Jack Kubinec

This is a segment from the Lightspeed newsletter. To read full editions, <a href="https://blockworks.co/newsletter/lightspeed" target="_blank" rel="noreferrer noopener">subscribe</a>.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



In mid-April, leaders in the Solana world took to X to post the same cryptic hash. Strings like this can conceal a message’s contents from the public, while still allowing anyone with the original data to verify its authenticity.



Some <a href="https://x.com/0x_Osprey/status/1912915445830848625">speculated</a> the hash was a method to coordinate Solana validators to patch a vulnerability in Solana’s code, and they turned out to be right: Shortcomings in the protocol’s confidential tokens product could have allowed a sophisticated attacker to mint unlimited new tokens, the Solana Foundation disclosed on Friday. The upgrade follows a similar vulnerability and patch situation that <a href="https://blockworks.co/news/lightspeed-newsletter-solana-outage-patch">went down in August</a>.



Solana’s token-2022 standard includes a feature named “confidential transfers” that allows addresses to transact on Solana without revealing the transfer amount. Confidential transfers are verified with a zero-knowledge proof. The bug was basically caused by some missing math that could have allowed someone who knew what they were doing to have invalid proofs be accepted by Solana’s zk program.



The bug being identified and then privately patched with the help of Solana validators provided some good engagement bait for Ethereum fans, but to be fair, I’m not sure what better option Solana had here. No user funds were lost, which is arguably the most crucial factor.



“Criticism of Solana&#8217;s zero-day bug fix makes me realize people have no idea how it would work on Ethereum,” Equilibrium investment partner Mika Honkasalo wrote on X. “TLDR; mostly the same process except feeling ‘holier’ to the ETH community.”



One person involved in Solana’s efforts to patch the bug said the process of privately patching a bug before publicly disclosing the vulnerability later on follows “established security protocols seen in other major blockchains and software projects.”



It’s also not like Solana validators are sharing war plans in a Signal chat. The Solana Foundation, Anza, and Jito contact validators through a patchwork of platforms and then share a hash as a kind of two-factor authentication to prove their outreach is legit, according to multiple people I spoke to involved with the response.&nbsp;



If you believe that Solana is the financial rails of the future, then that’s actually a pretty messy way to coordinate emergency software updates. Solana’s approach to this kind of thing is, arguably at least, a bit too decentralized.



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

Cybersecurity

Solana says zero-knowledge proofs were root of mid-April bug

Ben Strack

<div id="highlights-block_63061b30686cb" class="highlights">
 <ul>
 <li>Solana-powered Monaco Protocol aims to be an on-chain order book and matching engine that allows immediate wager settlements </li>
 <li>Monaco Protocol contributor BetDEX is fueled by last year&#8217;s $21 million seed round, led by Paradigm and FTX </li>
 </ul>
 
</div>



BetDEX, which says it&#8217;s the first decentralized sports betting protocol, is looking to double down on disrupting the legacy gambling industry, which the startup reckons is in desperate need of lower fees and better user experience.



Live on Solana’s developer testnet, <a href="http://monacoprotocol.xyz/" target="_blank" rel="noreferrer noopener">the Monaco Protocol</a> is set to function as a global clearinghouse for sports betting via a digital assets-based liquidity pool.



BetDEX, one of several key contributors to the protocol, is the first sports betting <a href="https://www.betdex.com/" target="_blank" rel="noreferrer noopener">application</a> built on top of it, the company said Wednesday. Hundreds have been lining up wagers on soccer as part of beta testing and more than 80,000 are on the waiting list, according to BetDEX.



Traditional sports betting, which BetDEX says was worth $250 billion in 2021, is plagued by poor user experience and high fees ranging from from 5% to 40%, CEO Varun Sudhakar told Blockworks. BetDEX fees will be no more than 1%, he added, declining to detail specifics.&nbsp;



Other problems include counterparty risk and corresponding withdrawal issues, such as delays in cashing out.



“We’re never going to be in control of any customer funds,” Sudhakar said. “Someone could come in through our exchange and place a wager. That wager’s going to sit on a smart contract and automatically get disbursed immediately upon settlement to the winner.”



While sports gambling on the blockchain is nothing new, the exchange is vying to gain licenses in various jurisdictions in coming months — Sudhakar declined to specify which — as well to actually go live on the Solana mainnet. In 2023, the Scotland-based company will look to add additional locales and sports.&nbsp;



BetDEX secured a $21 million seed <a href="https://www.businesswire.com/news/home/20211117005643/en/Former-FanDuel-Executives-Launch-BetDEX-the-World%E2%80%99s-First-Decentralized-Sports-Betting-Protocol-and-Secure-Largest-Ever-Seed-Round-by-a-UK-Startup" target="_blank" rel="noreferrer noopener">round</a> in November 2021, led by crypto investment firm Paradigm and exchange FTX.



FTX CEO Sam Bankman-Fried said at the time “it is mind-boggling that more sports wagering does not occur on exchanges.”



BetDEX was founded by one-time execs at FanDuel, an online sports gambling firm, including former CEO Nigel Eccles, BetDEX’s chairman. Sudhakar spent three years at FanDuel.



Principal software engineer Eoin Murphy was previously head of sportsbook technology at FanDuel. Other recent senior hires include product director Aidan Maughan and legal director Kevin Kreuser, who joined BetDEX from BoyleSports and Twilio, respectively.&nbsp;



Drawing a parallel between gambling and the airline industry, Sudhakar said there’s an abundance of players hawking the same core products at generally high prices — a confluence of factors the startup views as primed for disruption via digital assets.&nbsp;



“The key opportunity for sports betting from my perspective is a global clearinghouse to arise for sports betting that can drive fee compression across all of these different front-end operators across the world,” Sudhakar said. 



“This would really force them to compete upon product and user experience and not compete upon who can necessarily raise the most venture capital money and acquire the most customers.”



<hr class="wp-block-separator has-alpha-channel-opacity"/>



Get the news in your inbox. Explore Blockworks newsletters:



<ul class="wp-block-list">
<li><a href="https://blockworks.co/newsletter/thebreakdown">The Breakdown</a>: Decoding crypto and the markets. Daily.</li>



<li><a href="https://blockworks.co/newsletter/empire">Empire</a>: Crypto news and analysis to start your day.</li>



<li><a href="https://blockworks.co/newsletter/forwardguidance">Forward Guidance</a>: The intersection of crypto, macro and policy.</li>



<li><a href="https://blockworks.co/newsletter/0xresearch">0xResearch</a>: Alpha directly in your inbox.</li>



<li><a href="https://blockworks.co/newsletter/lightspeed">Lightspeed</a>: All things Solana.</li>



<li><a href="https://blockworks.co/newsletter/thedrop">The Drop</a>: Apps, games, memes and more.</li>



<li><a href="https://blockworks.co/newsletter/supplyshock">Supply Shock</a>: Bitcoin, bitcoin, bitcoin.</li>
</ul>

solana blockchain