I’ve Lost savings of my life sending erc20 on staking smart contract

[dawidkabani13]

I will payout 1000 LINK (13k $) for help in my problem.
I'm just recovering from a terrible loss, I'm a father and husband, and a few days ago I lost my life savings due to one small mistake and rush. I don't want to bother you with my problems, so I'll go to the details. I accidentally sent 4,000 LINK worth $ 50k to the Ghst Stacking smart contract that does not support the LINK cryptocurrency chain. Theoretically, the contract is immutable, and even its creator Nick Mudge admitted it. However, when I launched the rescue operation, good people came to me who said that there should be a chance to add a LINK sidechain to it, which would allow me to recover all my life savings. All information is contained on this website www.aavegotchi.com, while cale Aavegotchi agrees to cooperate if it turns out that it is possible to do so. Of course, it will cover the cost of your work, I think that it is enough money that "hangs" there that we will be able to agree. I got a link to you as a group that can do Magic. I am begging you for help. Dawid Kaczówka from Poland.
Tx: https://eth1.trezor.io/tx/0xd82fec2e5c2e37f82185307c8e74d9c3302f77c3fd85c2201876b403d55dbcef
https://etherscan.io/address/0x93ea6ec350ace7473f7694d43dec2726a515e31a#code
code.
https://etherscan.io/address/0x93eA6ec350Ace7473f7694D43dEC2726a515E31A#code
https://etherscan.io/address/0x4a271b59763d4d8a18ff55f1faa286de97317b15#code

[cameel]

I'm very sorry to hear about your loss. Unfortunately I don't think the funds are recoverable. There are two ways it could theoretically be done and both require functionality the contracts are missing.

First, the Chainlink contract could give you your tokens back if it was designed for such an eventuality. Etherscan does not show me the code of their token (just a summary of available ERC20 token functions), but I'm pretty sure that the contract is some version of this: https://github.com/smartcontractkit/LinkToken/tree/master/contracts/v0.6. It's a dead simple contract (as tokens tend to be) and it's designed to do just one thing: keep a big list of which address owns how much. In fact most of the implementation is the battle-tested standard OpenZeppelin ERC20 contract. Chainlink added a few functions to support ERC-677 but that does not change much. I can see no functions that would allow anyone but the owner to transfer funds. And the owner in this case is the Aavegotchi contract.

So the second option would be to make the Aavegotchi contract transfer funds back to you. And there's a ray of hope since the contract that owns the funds is a proxy (implemented as @mudgen's Diamond). If you could somehow get the proxy to register the transfer function of the Chainlink contract as a diamond facet, you (or anyone else) would then be able to call it via the proxy and move the funds as if you were the owner. Aavegotchi, as any diamond, has an admin interface for changing registered functions, called IDiamondCut. The thing is, that interface is disabled (commented-out so it can't really be enabled again). That's great for security of the contract but it's also bad news for you. You can't do it that way. You'd have to find and exploit a pretty serious security hole in Aavegotchi to make it possible and I know @mudgen ran a bug bounty on it so even if there were a hole, it would be unlikely to be an easy one to find.

I'm going to leave this open for a moment in case anyone else on the team wants to chime in but I don't want to get your hopes up. I wish you luck but I think that recovering it is pretty much impossible.

[cameel]

One more thing. If, against all odds, you do find a way to recover the funds by registering the transfer function with the proxy, please be wary of frontrunners. You might think that if you just quickly enable it and don't tell anyone, you'll be able to quickly transfer it back to your account and no one will have enough time to even notice. This logic does not work on the blockchain. From what I've heard, generalized frontrunners that watch every transaction and check if replacing your address with theirs will benefit them, are pretty widespread. As I said above, the transfer function would be available to anyone so a frontrunner could easily snatch the transaction from you. You can fool them by obfuscating the transaction (e.g. splitting it into two parts in a commit-reveal scheme) but you have to be smart about it.

[dawidkabani13]

Drogi Kamilu, Przepraszam ale nie wiedziałem że jesteście z Polski, bardzo dziekuje Ci za Twój czas. Niestety nie znam sie na tym od strony technicznej. Wiem tylko że Devsi smartkontraktu są w pełni otwarci na propozycje ktore mogłyby pomóc mi odzyskać środki, jeżeli jakimś cudem znajdziecie coś byłbym najszczęśliwszym człowiekiem na świecie - to oszczędności mojego życia, a na to wszystko złożył się jakiś niesamowity splot wydarzeń. Może jednak udałoby Ci się coś znaleść, chetnie zapłacę za Twoją pracę. Pozdrawiam Serdecznie, Dawid. W dniu wt., 15.12.2020 o 22:05 Kamil Śliwak <notifications@github.com> napisał(a):

…

One more thing. If, against all odds, you do find a way to recover the funds by registering the transfer function with the proxy, please be wary of frontrunners. You might think that if you just quickly enable it and don't tell anyone, you'll be able to quickly transfer it back to your account and no one will have enough time to even notice. This logic does not work on the blockchain. From what I've heard, generalized frontrunners that watch every transaction and check if replacing your address with theirs will benefit them, are pretty widespread. As I said above, the transfer function would be available to anyone so a frontrunner could easily snatch the transaction from you. You can fool them by obfuscating the transaction (e.g. splitting it into two parts in a commit-reveal scheme) but you have to be smart about it. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#10616 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASEI2NJFAF5NFUG3G7GNT3TSU7FQVANCNFSM4U4X3C4A> .

[dawidkabani13]

Dostalem jeszcze taką wiadomość: The verified source code for the LINK token contract is here: https://etherscan.io/address/0x514910771af9ca656af840dff83e8264ecf986ca#code W dniu wt., 15.12.2020 o 22:09 Dawid Kaczówka <dawidkaczowka@gmail.com> napisał(a):

…

Drogi Kamilu, Przepraszam ale nie wiedziałem że jesteście z Polski, bardzo dziekuje Ci za Twój czas. Niestety nie znam sie na tym od strony technicznej. Wiem tylko że Devsi smartkontraktu są w pełni otwarci na propozycje ktore mogłyby pomóc mi odzyskać środki, jeżeli jakimś cudem znajdziecie coś byłbym najszczęśliwszym człowiekiem na świecie - to oszczędności mojego życia, a na to wszystko złożył się jakiś niesamowity splot wydarzeń. Może jednak udałoby Ci się coś znaleść, chetnie zapłacę za Twoją pracę. Pozdrawiam Serdecznie, Dawid. W dniu wt., 15.12.2020 o 22:05 Kamil Śliwak ***@***.***> napisał(a): > One more thing. If, against all odds, you do find a way to recover the > funds by registering the transfer function with the proxy, please be wary > of frontrunners. You might think that if you just quickly enable it and > don't tell anyone, you'll be able to quickly transfer it back to your > account and no one will have enough time to even notice. This logic does > not work on the blockchain. From what I've heard, generalized frontrunners > that watch every transaction and check if replacing your address with > theirs will benefit them, are pretty widespread. As I said above, the > transfer function would be available to anyone so a frontrunner could > easily snatch the transaction from you. You can fool them by obfuscating > the transaction (e.g. splitting it into two parts in a commit-reveal > scheme) but you have to be smart about it. > > — > You are receiving this because you authored the thread. > Reply to this email directly, view it on GitHub > <#10616 (comment)>, > or unsubscribe > <https://github.com/notifications/unsubscribe-auth/ASEI2NJFAF5NFUG3G7GNT3TSU7FQVANCNFSM4U4X3C4A> > . >

[dawidkabani13]

He is correct about the diamond, but as he mentioned the IDiamondCut interface was not added to the diamond so it isn't possible to add new facets to the diamond. He is correct that we would have to exploit some security hole of which I know of none and doubt that there is any because I reviewed the contract and we had it audited by a security firm and held a bug bounty W dniu wt., 15.12.2020 o 22:11 Dawid Kaczówka <dawidkaczowka@gmail.com> napisał(a):

…

Dostalem jeszcze taką wiadomość: The verified source code for the LINK token contract is here: https://etherscan.io/address/0x514910771af9ca656af840dff83e8264ecf986ca#code W dniu wt., 15.12.2020 o 22:09 Dawid Kaczówka ***@***.***> napisał(a): > Drogi Kamilu, > Przepraszam ale nie wiedziałem że jesteście z Polski, bardzo dziekuje Ci > za Twój czas. Niestety nie znam sie na tym od strony technicznej. Wiem > tylko że Devsi smartkontraktu są w pełni otwarci na propozycje ktore > mogłyby pomóc mi odzyskać środki, jeżeli jakimś cudem znajdziecie coś > byłbym najszczęśliwszym człowiekiem na świecie - to oszczędności mojego > życia, a na to wszystko złożył się jakiś niesamowity splot wydarzeń. > Może jednak udałoby Ci się coś znaleść, chetnie zapłacę za Twoją pracę. > Pozdrawiam Serdecznie, Dawid. > > W dniu wt., 15.12.2020 o 22:05 Kamil Śliwak ***@***.***> > napisał(a): > >> One more thing. If, against all odds, you do find a way to recover the >> funds by registering the transfer function with the proxy, please be wary >> of frontrunners. You might think that if you just quickly enable it and >> don't tell anyone, you'll be able to quickly transfer it back to your >> account and no one will have enough time to even notice. This logic does >> not work on the blockchain. From what I've heard, generalized frontrunners >> that watch every transaction and check if replacing your address with >> theirs will benefit them, are pretty widespread. As I said above, the >> transfer function would be available to anyone so a frontrunner could >> easily snatch the transaction from you. You can fool them by obfuscating >> the transaction (e.g. splitting it into two parts in a commit-reveal >> scheme) but you have to be smart about it. >> >> — >> You are receiving this because you authored the thread. >> Reply to this email directly, view it on GitHub >> <#10616 (comment)>, >> or unsubscribe >> <https://github.com/notifications/unsubscribe-auth/ASEI2NJFAF5NFUG3G7GNT3TSU7FQVANCNFSM4U4X3C4A> >> . >> >

[mudgen]

I guess this is one benefit of upgradeable contracts. If the diamond had been upgradeable then the money could be returned. But since it is not upgradeable it looks like the LINK token is going to be stuck in the diamond forever.

Note: A diamond is an Ethereum contract that implements this contract standard EIP-2535 Diamond Standard.

Here are links to related source code in case anyone can find a way to return the funds:

• GHSTStakingDiamond Github: https://github.com/aavegotchi/ghst-staking
• LINK token contract: https://etherscan.io/address/0x514910771af9ca656af840dff83e8264ecf986ca#code
• GHSTStakingDiamond: https://etherscan.io/address/0x93eA6ec350Ace7473f7694D43dEC2726a515E31A#code
• StakingFacet: https://etherscan.io/address/0x4a271b59763d4d8a18ff55f1faa286de97317b15#code
• TicketsFacet deployed: https://etherscan.io/address/0xdf36944e720cf5af30a3c5d80d36db5fb71dde40#code
• DiamondLoupeFacet deployed: https://etherscan.io/address/0x47195a03fc3fc2881d084e8dc03bd19be8474e46#code
• OwnershipFacet deployed: https://etherscan.io/address/0x14ab595377e4fccca46062a9109ffac7fa4d3f18#code

Though it seems impossible, I don't like saying impossible or never.

[cameel]

Przepraszam ale nie wiedziałem że jesteście z Polski

Nie jesteśmy :) Tzn. tylko ja jestem a projekt jest międzynarodowy więc w bugtrackerze obowiązuje angielski. W razie czego możesz pisać po polsku na maila z mojego profilu.

Well, I can see it's very a big hit for you so I'll give it a try. I have enough work for the rest of the week but I can give it an hour or two on the weekend and see if there's anything I missed. But like I said, everything here seems very solid so really, please don't put too much hope in it as I'm pretty sure I won't find anything. GHST and Nick's contract were audited and the Link contract could hardly be simpler. From the link you gave me I see that it's an older version of the token (still running on Solidity 0.4.x) and maybe it is affected by some long patched security issue in the compiler but again, that's not something I would count on.

[mudgen]

@cameel Thank you for looking into this. If you need anything from me then let me know. I'm interested in helping in any way I can.

[cameel]

Sure. Thanks!

[JohnWinner]

Your biggest mistake was to put your life savings in cryptos. I hope you learned your lesson. Sorry for your loss.

[dawidkabani13]

Cryptocurrency in not a problem, I made mistake. W dniu śr., 16.12.2020 o 00:20 JohnWinner <notifications@github.com> napisał(a):

…

Your biggest mistake was to put your life savings in cryptos. I hope you learned your lesson. Sorry for your loss. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#10616 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASEI2NOJ3DCI7RHRKIGKY4TSU7VKPANCNFSM4U4X3C4A> .

[JohnWinner]

Cryptocurrency in not a problem, I made mistake.

You didn't learn. In what universe do you think a small mistake like that could crush your entire life? Not to mention all the hacks and scams threats. I am not sorry anymore for you, you seem irresponsible.

[dawidkabani13]

Sorry, You don’t even know me, Your post didnt helped ME in anything. Your first „sorry” and writting about lessons too. Im looking for people that can really try to help. W dniu śr., 16.12.2020 o 00:41 JohnWinner <notifications@github.com> napisał(a):

…

Cryptocurrency in not a problem, I made mistake. You didn't learn. In what universe do you think a small mistake like that could crush your entire life? Not to mention all the hacks and scams threats. I am not sorry anymore for you, you seem irresponsible. — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub <#10616 (comment)>, or unsubscribe <https://github.com/notifications/unsubscribe-auth/ASEI2NJICRCZQZTVG72FK3LSU7XZXANCNFSM4U4X3C4A> .

[nondev89]

As far as I can see @dawidkabani13, the contract has the ability to add different staking facets. Add me on discord: yegres #7183
With this custom facet we potentially can pull out the LINK. Now please message me and we will try to proceed with the contract owners

[rrjanbiah]

HN Thread: https://news.ycombinator.com/item?id=25443212