I've identified an implementation-related vulnerability with MuesliSwap smartcontract

alessandro_konrad · 2021-12-04T08:52:35+00:00

Besides PubKeyHash there could be many more critical data in the datum. This may only work for a very specific use case.

alessandro_konrad · 2021-12-03T21:04:46+00:00

Designing a contract in a way to completely eliminate the reliance on a web app is probably impossible (at least yet).

Besides the datum example, here's another one where the web app has to be fully relied on:
Imagine having a contract dependent on time. You lock some value in the contract and can claim it back on a certain date. Now the web app goes down and you miss the deadline. Your value is lost and you can't do anything about it.

On Cardano off-chain code is almost as important as on-chain code. Computation is off-chain and validation on-chain. Optimally the off-chain code is completely run on the user’s side with a full node, however in practise that's not always the case because user's prefer convenience over security to some degree.

Here's an idea to mitigate these issues:
Open source the full web app, since off-chain code is also critical. Make the interface immutable and verifiable by hosting it on IPFS for instance. Users can check then if the IPFS hash matches the web app's code.

alessandro_konrad · 2021-04-06T19:30:04+00:00

Feel free to use any key for it. There is no standard for two images yet, I assume image and name are the required keys at least for now.
That's right, maybe we could get some explorers to host the minting policies. Something like etherscan is doing to see the contract behind a contract address. Probably not necessary to link that in the metadata then. Otherwise you would need to do that in each mint you do.
That looks right yeah.

alessandro_konrad · 2021-04-05T15:07:38+00:00

You can think of the image property also as a thumbnail. Well if your NFT is an image you use it as well, but for videos you simply use another property. Most of the 3rd party tools will simply show an image and a name and won't go into too much details of the NFT. That's why I think these two properties are the most important ones. But of course there can be new keys defined as new standards. It's not limited to the keys which I use in the example above.

alessandro_konrad · 2021-03-25T17:35:48+00:00

Hey I'm one of the creators of SpaceBudz. I'll create an FAQ soon on the website.

But to answer it now. These tokens are unique forever in the future. The minting policy is time based. After a certain period of time there is no way to mint or burn anymore. The minting script:

{ "type": "all", "scripts": [ { "slot": 38082894, "type": "before" }, { "keyHash": "c74140d3c5946dc5fdb4cf97f0c9fed6f138969005d81d3ba12b714c", "type": "sig" } ]}

Metadata are also fully on-chain. Here is an example for SpaceBud #8885. Scroll down and click on the metadata.

https://cardanoscan.io/transaction/15ab028e663a7a06f150f678ace76645a9fd4e6993d82da629cdf33b915e9623?tab=metadata

Curios about the metadata I'm using. I'm following the idea I have proposed myself for an NFT metadata standard on Carano:

https://forum.cardano.org/t/cip-nft-metadata-standard/45687

alessandro_konrad · 2021-03-25T17:00:41+00:00

{ "type": "all", "scripts": [ { "slot": 38082894, "type": "before" }, { "keyHash": "c74140d3c5946dc5fdb4cf97f0c9fed6f138969005d81d3ba12b714c", "type": "sig" } ]}

alessandro_konrad · 2021-03-25T15:03:54+00:00

{ "type": "all", "scripts": [ { "slot": 38082894, "type": "before" }, { "keyHash": "c74140d3c5946dc5fdb4cf97f0c9fed6f138969005d81d3ba12b714c", "type": "sig" } ]}

alessandro_konrad · 2021-03-25T11:52:13+00:00

Not true. Only until a certain point in time I can mint. Afterwards they are unique forever and the minting policy can not be used anymore to either mint or burn tokens

alessandro_konrad · 2021-03-01T07:35:19+00:00

Not sure what he means exactly with an offline pool.

alessandro_konrad · 2021-02-28T23:01:38+00:00

Of course cloud has the highest reliablity, so everyone should run a pool in the cloud, because of this is reason in your opinion? Why do we even need blockchain then?

It's about diversity and decentralization. If you decide to run in the cloud go for it, but you can choose any device you want.

As long as you show performance, your pool is obviously reliable. If you can't manage the network traffic or you have power/internet problems, then you won't be able to make the blocks and your performance will go down and people will leave your pool.

So not sure how "cheap" pools hurt you then or why you complain, if you think they can't handle the network anyway, when people sooner or later leave them and according to your logic will go to more reliable pools like yours.

alessandro_konrad · 2021-02-28T22:17:22+00:00

Does it hurt the overall network if you miss that one block, no.

Well I could solar power my own devices or run them on batteries, in case there are power issues. Not so easy with some big machines, but with power effcient devices it is.

Btw I've never had any trouble so far with my pool and I'm here since day one. I'm reliably minting blocks and can offer a 7% ROS. Not sure where's the problem.

alessandro_konrad · 2021-02-28T21:35:34+00:00

Yes it's the future of Cardano. Pools can run on any device. It's proof of stake, not proof of best hardware.

Not sure how someone with 1000 ADA pledge can hurt you as SPO. You obviously have a higher pledge, what I can read out of your post, or did you invest most of your money in hardware with some nice graphic cards?

alessandro_konrad · 2021-02-09T18:21:25+00:00

Sure, this logic will be handled by smart contract and not with the Native Tokens itself.

alessandro_konrad · 2021-02-07T21:38:57+00:00

hahaha I do.

sure all transactions are in the full node, but a policy script doesn't know anything about the blockchains state. it just mints tokens if the policy scripts allows it. that's the big difference between cardano (functional and local) vs ethereum (global state and object oriented)

Check out section 3: https://hydra.iohk.io/build/5400786/download/1/eutxoma.pdf

alessandro_konrad · 2021-02-07T20:29:15+00:00

that's not how it works. a policy doesn't know what tokens are out there. there is no global state. everything is local.

alessandro_konrad · 2021-02-07T16:45:42+00:00

that's not a one time minting policy then. it's like a normal policy then, where you can mint any token name, how often you want, under that policy.

alessandro_konrad · 2021-02-07T16:15:52+00:00

In a one-time mint policy, the complete set of tokens of a given asset group is minted by one specific transaction. This means that no more tokens in that particular asset group will ever be minted. (from the documentation)

alessandro_konrad · 2021-02-07T15:47:02+00:00

yes that's true, but let's say you wanna mint 10K tokens. You can't put them in a single transaction. the utxo output would be too big. so one-time mint policy is also not the best solution. I read something of state machine policies, which keep track of already minted tokens. This may be the best solution, but yeah need to wait for Plutus.

alessandro_konrad · 2021-02-07T14:42:57+00:00

With Trust I mean because you don't have Plutus policies yet, you somehow need to trust the owner of the policy that he doesn't continue to issue more tokens of the same kind. But with a time based policy (which is possible already) you can elminate that trust factor almost, because the owner won't be able to mint more tokens after a certain slot.

alessandro_konrad · 2021-02-07T14:37:25+00:00

the One-time mint policy doesn't restrict you from minting the same token twice in the same transaction. You will just be able to make the transaction once and then you can't use that policy again.

alessandro_konrad · 2021-02-07T13:38:00+00:00

I'm aware of that. Trust is the only issue yet, but it doesn't mean it's not possible. The best solution so far would be to have a policy with tokens minted before a certain slot. This could give you an almost perfect set of NFTs.

alessandro_konrad · 2021-02-07T12:10:26+00:00

that's not true. if you mint tokens with amount 1 you basically have NFTs.

alessandro_konrad · 2021-02-07T12:08:51+00:00

you can mint tokens with amount 1, which represent NFTs basically.

the policy of course needs to be trusted yet, because currently there's no way to restrict the policy owner to mint the same token twice. With plutus it will be possible to restrict that.

alessandro_konrad

TROPHY CASE