🔷 Waves Tech - a powerful blockchain-agnostic ecosystem

[Mallyx]

An emergency switch yes, but a full control is not good.

An example of emergency switch that doesn't allow the admins to steal the users funds and reduce hacking damages:

1. You have an emergency function that freeze everything: deposits, withdrawals, interests, etc... It give times to the admins to find the issue.
2. If the issue can't be fixed for some reasons, the 2nd emergency function auto-transfer every single funds to an other already specified dApp address.
3. On that "emergency" dApp address, a simple script allow the users to redeem their funds with the tokens they got by lending, providing liquitidy, etc.... Nobody else can withdraw, including the admin team.

Want to see how look such script ?
I took 5min to write it. It's an incomplete script, it's only to show how easy that can be done.

Code:

# Function to freeze
@Callable(i)
func emergencyFreeze(enable: Boolean) = {
  if(this != i.caller) then {
    throw("Access denied")
  } else {
    [BooleanEntry("freeze", enable)]
  }
}

# Place it on each callable function. If frozen just reject the request
func isFrozen() = {
  match getBoolean(this, "freeze") {
    case a: Boolean => a
    case _ => false
  }
}

# Emergency transfer function
@Callable(i)
func emergencyTransfer() = {
  if(this != i.caller) then {
    throw("Access denied")
  } else {
    let receivingAddr = "AddrThatIsAlreadyKnown"
    [ScriptTransfer(...)]
  }
}

A little effort in scripting could prevent:
- Admins to run away with the funds
- Stops an ongoing hack.
- Allow user to redeem remaining funds.
- Prevent $5 wrench attacks (if the attacker get the admins private key, he only have to power to freeze and auto transfer, but not the power to withdraw the funds for self)

Don't trust. Verify.

[Waves.support]

Swop.fi users are likely to wonder what risks they are facing and how serious those risks are. Although risks linked to Swop.fi are considered low, this video will help you better understand our service.



We've also published the text version of this video on our blog.

[JohnSilver]

An emergency switch yes, but a full control is not good.

... and too many power for "this" (owner of the dApp private key) at your example.

[Mallyx]

An emergency switch yes, but a full control is not good.

... and too many power for "this" (owner of the dApp private key) at your example.

You restrict the private key "power" in the @Verifier function.
Not saying SWOP is a dishonest project, but just exposing the risks and ideas of how it can be mitigated


edit: https://medium.com/swop-fi/what-risks-are-involved-in-using-swop-fi-373260884696
Nice timing lol !
They just forgot to mention the risk I found  

[unheiliger]

An emergency switch yes, but a full control is not good.

An example of emergency switch that doesn't allow the admins to steal the users funds and reduce hacking damages:

1. You have an emergency function that freeze everything: deposits, withdrawals, interests, etc... It give times to the admins to find the issue.
2. If the issue can't be fixed for some reasons, the 2nd emergency function auto-transfer every single funds to an other already specified dApp address.
3. On that "emergency" dApp address, a simple script allow the users to redeem their funds with the tokens they got by lending, providing liquitidy, etc.... Nobody else can withdraw, including the admin team.

Want to see how look such script ?
I took 5min to write it. It's an incomplete script, it's only to show how easy that can be done.

Code:

# Function to freeze
@Callable(i)
func emergencyFreeze(enable: Boolean) = {
  if(this != i.caller) then {
    throw("Access denied")
  } else {
    [BooleanEntry("freeze", enable)]
  }
}

# Place it on each callable function. If frozen just reject the request
func isFrozen() = {
  match getBoolean(this, "freeze") {
    case a: Boolean => a
    case _ => false
  }
}

# Emergency transfer function
@Callable(i)
func emergencyTransfer() = {
  if(this != i.caller) then {
    throw("Access denied")
  } else {
    let receivingAddr = "AddrThatIsAlreadyKnown"
    [ScriptTransfer(...)]
  }
}

A little effort in scripting could prevent:
- Admins to run away with the funds
- Stops an ongoing hack.
- Allow user to redeem remaining funds.
- Prevent $5 wrench attacks (if the attacker get the admins private key, he only have to power to freeze and auto transfer, but not the power to withdraw the funds for self)

Don't trust. Verify.

You are perfectly right, It would be nice if somebody from the team could answer those really legit concerns about the code.

Perhaps you could also write an issue into the github code. It might be that some of the developers would be more sensitive to that point.

[Waves.support]

5,000 NSBT has been distributed in an airdrop among $WAVES holders on Binance. Check your wallets and see more details about the distribution in the Apply for joining the stream official announcement.

[Waves.support]

An update on the DeFi vs. CeFi AMA session! We have another speaker! John Nahas, Senior Director of Business Development at Ava Labs, will join a discussion with Waves speakers.

📺 Tune in on March 17, 2pm CET!

[nick2050]

Hi Waves Community. PLEASE HELP.
I invested about 5.3 in Waves ICO and recently I really think i didn’t receive the correct amount and maybe some of my BTC transactions wasn’t confirmed. I tried to contact Waves support but no luck.
So I did invest 5.3 BTC in Waves ICO and I received about 15,689 Waves coins. Can somebody please tell me if I got the correct amount or not? I also participated in the rewards campaigns and there were some rewards for early investment but I’m not worried about that cuz I can calculate those. I appreciate if someone can help me. Thann you 

[estenity]

waves has recently lost momentum, even with a rather stable usd price.

now 82th on coingecko..

[Waves.support]

Our live stream on CeFi vs. DeFi with Waves experts + a speaker from Ava Labs has started. Tune in here and have fun! 🙃

[Waves.support]

The airdrop of 5,000 NSBT on Bithumb is now completed, and token withdrawals are already open! Check more details in the official announcement.

[Waves.support]

Swop.fi team has launched a governance feature! With your staked $SWOP on the service, you can now vote for pool weights = influence liquidity providers' $SWOP income. Find out more about the voting process

The results of the first voting will be applied on Monday, March 22, at ~11:00 Moscow time (8:00 UTC).

[hopenotlate]

Swop.fi team has launched a governance feature! With your staked $SWOP on the service, you can now vote for pool weights = influence liquidity providers' $SWOP income. Find out more about the voting process

The results of the first voting will be applied on Monday, March 22, at ~11:00 Moscow time (8:00 UTC).

I have been told swop.fi is a separate project from waves one but still I can see you are advertising it here in  waves official announcement thread : may you please confirm if someone from the main board of waves is involved in swop.fi project?

By any chance is sasha in control of one ( or more) of these three private keys ?

My main issue it the current SWOP.FI stuff.

I hardly believe that the Waves team is promoting a potential scam.

Look at all the contracts source (taken from https://github.com/swopfi/swopfi-smart-contracts):

Code:

@Verifier(tx)
func verify() = match tx {
    case _ => {
        let adminPubKey1Signed = if sigVerify(tx.bodyBytes, tx.proofs[0], adminPubKey1) then 1 else 0
        let adminPubKey2Signed = if sigVerify(tx.bodyBytes, tx.proofs[1], adminPubKey2) then 1 else 0
        let adminPubKey3Signed = if sigVerify(tx.bodyBytes, tx.proofs[2], adminPubKey3) then 1 else 0
        adminPubKey1Signed + adminPubKey2Signed + adminPubKey3Signed >= 2
    }
}

The Verifier function allow by a multisig to withdraw and control the funds (it also allow to update the dApp script).
It mean that if 2 peoples on 3 decide to run away with all the fund: the dApp will allow it.
We don't even know if their is 3 peoples or just 1...

The dApp point is to decentralize stuff the prevent trusting a third party.
In that case the third party has all the right (dApp update + funds control), so you must trust it.
-snip-

[somebody else]

waves has recently lost momentum, even with a rather stable usd price.

now 82th on coingecko..

Don't worry, that is natural result when devs are playing with high interest rates and promotion of it. Many times seen at many PoS coins.

Advice to devs, REMOVE HIGH INTEREST RATES if you want going up at marketcap list.

[jerry0]

Did waves.exchange wallet make a change again in the layout/how you log in?


I haven't logged into my waves.exchange account in a long time.  When i used to log in, i had to type in my password when accessing the waves.exchange wallet.  Back then i used waves lite wallet and the waves wallet and then it was the waves.exchange.



Right now, i see option is log in by


Email
ledger
software - log in via seed, private key or keystore file (not recommended)




Since i never connected my waves wallet with my nano ledger s, i assume i can't do that now.  So i have to use either email or software right?  And software is my seed?  Which would you recommend?



Also, why does waves keep changing all these things?  Back then the waves lite was with the google chrome store... then it changed to Waves New Dex.... then the waves.exchange.


So what do you recommend to log in with it?  Email or seed?  I previously had to type in my seed a while back when i used the waves new dex and then the waves.exchange so i assume do that?  But that mean everytime after this, i need to type my waves seed every single time?  So there is no more accessing waves account by password?  I don't understand this.

Waves.support, can you answer this?  Right now when i open the waves exchange program, it give me three options either


Email
Ledger
Software



When I click on email, it ask me to create an account.  So i type in an email and password.  But once i do that, i would have to confirm the link in the email?  But once i do that and log in with my password, would i have access to my waves exchange account?  Or i still need to type in my waves seed?  Again i have my waves seed with me. 


Or do i just click on software instead?  I don't have the waves installed on my nano ledger s.  But this is the same waves exchange program i been using on my computer ever since i downloaded it a while back when i had to use it after waves new dex no longer worked.


I did recall when the waves lite client no longer worked... i had to use the waves new dex and enter my waves seed to get into my account.  Then put in a password to log in each time.


But once the waves new dex was no more and we had to use the waves exchange, i had to type in my waves password again to access it.  Then put in a password to log in each time. 


So which of these three methods do i choose?  If i type in my seed, does that mean i need to type my seed every single time to access my waves wallet?  If so, i dont like that.  I would prefer to be typing a password each time.  But why does it ask to create an email to connect my account?  With waves lite client and waves new dew and waves exchange before this change, it never ask to link an email.


Can you or anyone else explain this?  Haven't logged into my waves exchange wallet in a long time since i saw this new log in.

Waves.support, can you answer this?  I still have not tried to log into my waves exchange wallet for a long time.


Do i just type in my seed to log in? 


So once i do this, every other time i log in... i either do that... or register an email and password with it so everytime i log into waves.exchange, it would be my username and password?

[MarquiseMuseum]

Working with Solidity devs since yesterday for Interchain swapping Waves/M2 -> Opensea/ERC20 Wrapped ERC1155 NFT

https://bitcointalk.org/index.php?topic=2970288.msg56556856#msg56556856

So M2 on waves will still have a use case but market cap will be limited to $200k because there is alot more collectors on Eth network for NFT than on waves. So M2 owners still get a share of the updated version and will be able to participate in trading of this OG 2017 ERC20 mint which is examined for appraisal by Swedish auction house Bukowskis.

Waves m2 is trading 1/40th below deal value so anyone can profit from this swap opportunity:

https://waves.exchange/trading/spot/BS1KFNR8zrXKBEWdUUvpaP6G57Hic3aESkwK7qQKdLpB_WAVES

https://www.coinlore.com/coin/marquise-museum/historical-data

1m M2 can still be used to redeem Giclées from the Cryptobook value $300. This deal was open since september 2019 but no investor used it yet. In this case, M2 is also trading 1/40th below value. If you collect all Giclées from the book, it can be minted and delivered to you, so this is like a subscription model because the completed book cost $50k. There is additional minting cost because it's handbound and contains 100g gold.

The reason for this x40 price premium is that value is locked into asset and not USDT.

I hope this will satisfy M2 traders, as you get x40 paper profit on your stacks when swapping.

I am willing to wrap M2 into SignArt NFT if they offer good promotion deal as this is OG NFT. I dont want to publish anything more on waves if it will simply vanish into the shadows like M2. Opensea already offered code auditing and promotion on their platform which is global 4000 Alexa rank. My goal is to cash in on this project, Cryptopunks market cap is $500m, launched 120 days before Marquise $Museum. There is only a handful 2017 NFTs and they will probably be priceless long term similar to pioneering works of Cubism, Surrealism, Pop Art. But it is no guarantee, please invest with caution.

[Waves.support]

Did waves.exchange wallet make a change again in the layout/how you log in?


I haven't logged into my waves.exchange account in a long time.  When i used to log in, i had to type in my password when accessing the waves.exchange wallet.  Back then i used waves lite wallet and the waves wallet and then it was the waves.exchange.



Right now, i see option is log in by


Email
ledger
software - log in via seed, private key or keystore file (not recommended)




Since i never connected my waves wallet with my nano ledger s, i assume i can't do that now.  So i have to use either email or software right?  And software is my seed?  Which would you recommend?



Also, why does waves keep changing all these things?  Back then the waves lite was with the google chrome store... then it changed to Waves New Dex.... then the waves.exchange.


So what do you recommend to log in with it?  Email or seed?  I previously had to type in my seed a while back when i used the waves new dex and then the waves.exchange so i assume do that?  But that mean everytime after this, i need to type my waves seed every single time?  So there is no more accessing waves account by password?  I don't understand this.

Waves.support, can you answer this?  Right now when i open the waves exchange program, it give me three options either


Email
Ledger
Software



When I click on email, it ask me to create an account.  So i type in an email and password.  But once i do that, i would have to confirm the link in the email?  But once i do that and log in with my password, would i have access to my waves exchange account?  Or i still need to type in my waves seed?  Again i have my waves seed with me. 


Or do i just click on software instead?  I don't have the waves installed on my nano ledger s.  But this is the same waves exchange program i been using on my computer ever since i downloaded it a while back when i had to use it after waves new dex no longer worked.


I did recall when the waves lite client no longer worked... i had to use the waves new dex and enter my waves seed to get into my account.  Then put in a password to log in each time.


But once the waves new dex was no more and we had to use the waves exchange, i had to type in my waves password again to access it.  Then put in a password to log in each time. 


So which of these three methods do i choose?  If i type in my seed, does that mean i need to type my seed every single time to access my waves wallet?  If so, i dont like that.  I would prefer to be typing a password each time.  But why does it ask to create an email to connect my account?  With waves lite client and waves new dew and waves exchange before this change, it never ask to link an email.


Can you or anyone else explain this?  Haven't logged into my waves exchange wallet in a long time since i saw this new log in.

Waves.support, can you answer this?  I still have not tried to log into my waves exchange wallet for a long time.


Do i just type in my seed to log in? 


So once i do this, every other time i log in... i either do that... or register an email and password with it so everytime i log into waves.exchange, it would be my username and password?

Hello! Did you ask Waves.Exchanges support on this issue? The support chat is available on the website.

[Waves.support]

💰 A 5,000 NSBT has been allocated in an airdrop to WAVES holders on OKEx. Make sure you redeem your bonus before May 22, 2021! See more details in the announcement.

[nightandday]

Check out that waves market movement 

[hopenotlate]

Check out that waves market movement 

Just speculation or is there any particular rerason/news for this spike?
Out of top 100 coins for market capitalization I see, beside waves, only few coins are recording a double digits 24h increase like theta, theta fuel, ascend (Bitmax oken) dent asnd a coupple of other : is there any correlation or what?