-------

------- 
Author: Adam Lee 
Asia News Desk

A security hole was discovered in Facebook's soon-to-launch cryptocurrency, the 'Libra'.

The vulnerability was discovered by OpenZeppelin, a firm that has conducted security audits for many of the major players in the cryptocurrency industry including Coinbase, the Ethereum Foundation, Brave, Bitgo, Shapeshift and more.
The exploit allowed for text that appeared to be harmless inline comments, to be executed as code. The firm provided some examples of how a bad actor could use this vulnerability, including:

• A faucet that mints assets (Libra Coins or any other asset on the Libra network) in exchange for a fee can deploy a malicious module that takes a fee but never actually provide the possibility of minting such asset to the user.
• A wallet that claims to keep deposits frozen and release them after a period of time may actually never release such funds.
• A payment splitter module that appears to divide some asset and forward it to multiple parties may actually never send the corresponding part to some of them.
• A module that takes sensitive data and applies some kind of cryptographic operation to obscure it (e.g. hashing or encrypting operations) may actually never apply such operation.

But this is hardly a complete list, when discussing a security hole that allows for someone to execute code, the possibilities are endless - it all depends on how creative, or malicious, the person writing that code is.

What's normal here, and what isn't...

Discovery of security holes while a project is in the development phase is beyond common - it's standard.

The only thing we found surprising - the large gap of time between when OpenZeppelin said they informed Facebook on Aug 6th, and the date Facebook had finally fixed the code, Sept 4th.

Even odder, changes were made to this section of code during this time, but those changes left the security hole open for another 3 weeks.

Facebook says security a top priority...

Speaking to one of my contacts inside Facebook, they said Libra "has and will continue to go through some of the most intense security auditing/testing imaginable" adding "we're letting a lot of hackers take a stab at Libra, and it won't be launched without consensus among the developers that it's fully secure, and ready for the masses".

In all fairness, while I can't say i'm convinced Facebook entering the crypto space is a good thing - it is good they're letting outsiders put Libra's security through rigorous testing.

Nothing is more dangerous than a group of developers so sure their code is flawless, they don't see the need to test that claim before releasing it to the public. That's how insecure software ends up opening security hole on thousands, or millions of computers.

-------
Author: Ross Davis
E-Mail: Ross@GlobalCryptoPress.com Twitter:@RossFM
San Francisco News Desk

Everything is going to be just fine...

Over the last 24hrs, I've seen way too many people making way too much out of this.  We need to talk.

Here at the Gloabl Crypto Press Association, we've been on top of this story from day one.

Actually... before day one, seriously.

Being based in Silicon Valley, just among our own staff there's people who worked for/with Facebook in various capacities. In my case, I was born and raised here, and if you're from my generation you're going to have friends from high school or college who ended up at Facebook.

That creates an atmosphere where if Facebook (or Zuckerberg specifically) mentions blockchain or cryptocurrency, somebody is going to bring it up to someone here.

For us, it started with Zuckerberg's sister entering the cryptocurrency industry last year - now you have to wonder if perhaps this is who first planted the idea in Mark's mind.

Then, Mark Zuckerberg mentioned blockchain himself. This was at the peak of Facebook being under fire for privacy issues, I admit we didn't take it seriously and thought he was just using the buzzword.

The big story then came in April of this year, we published "Facebook's Secret Plan For Crypto" and actually pretty much had the whole story then, saying to expect a stable coin with lots of corporate partners.

With a couple insignificant updates since then, I think we remained fair, and when appropriate, critical of Facebook's plans as we learned more and reported on it.

Now, finally, after all those articles where we had to use phrases like 'according to sources...' and 'there's a rumor that...' Facebook made it official with a post from Zuckerberg.

While those deeper in the crypto world have been following the story for awhile, there was still a fairly intense reaction today in every online crypto community I checked - Twitter, Reddit, Telegram and Discord, and of course Facebook itself - a good number of angry people convinced this is going to ruin crypto for all of us.

So let's address some of the main concerns we've seen so far.

Adoption VS Usage...

Yes, Facebook's coin is likely going to kick off and almost immediately see heavy usage.

This is because Facebook, with it's partners will be inserting themselves into transactions, presenting the option to them - this is not adoption.

In tech 'adoption' means people looking for a solution feel they have discovered the best one. But Facebook is going to be saying "use our coin" to people who were never asking 'which cryptocurrency should I use?'

They'll provide some incentives to do so, so people will.  This is still just usage, not adoption - and with usage there's no loyalty.

The effect that will have...

With Facebook providing incentives for people to use Libra, people will take that big first step of making their first ever transaction using cryptocurrency.

Once they do, human nature kicks in.  Suddenly people who have heard about Bitcoin, or other cryptocurrencies, see them as a lot less intimidating.

Unfortunately for Facebook... they're Facebook...

I believe they can convince someone to try cryptocurrency, I don't think they can convince someone to trust them.

"This is great, I should find an alternative that isn't from Facebook" is going to be a common response.  There's just no way around it.

Regardless of what Facebook promises, people have concerns in the back of their mind any time Facebook is involved.

Many who try and like Libra will go looking for a Facebook-free alternative.

There won't be a cult following for this coin...

Look at the communities behind the top coins.  Each have people who hate it, like it, love it, and LIVE FOR IT.   Sometimes they even go to war with each other.

I don't see Libra having anything except people who hate it, and like it.

Let's be honest, the excitement of owning a stablecoin is greatly limited...

The excitement that comes with price volatility is what sucked us in and got us hooked, and typically a cult following is made up of people who love a coin that made them a nice profit.

During days of heavy market activity, up or down, how often do you check prices?  All of this is gone with a stablecoin.

The retailers...

This one is huge, because with the help of the credit card companies involved in to Libra, they will be recruiting lots of retailers to accept their first cryptocurrency.

Retailers that may have been 20 years away from accepting cryptocurrency will hear that Visa and Mastercard are involved, and it's a way to bring in revenue - and that's all they need to say 'yes' at a time they would say no to someone offering them a way to accept Bitcoin or other top coins.

Now, the retailer is in a very different position, because 'you should add Bitcoin to the types of cryptocurreny you accept' is a totally different pitch, and now a much smaller step for them to take.

So, relax...

There's countless ways Facebook's cryptocurrency can serve as a pathway, leading people and businesses in to the general cryptocurrency market and economy. While at the same time, limited in the influence it has over what we've built so far.

In other words, I think this is a one way street - and it's sending people in our direction.

-------
Author: Ross Davis
E-Mail: Ross@GlobalCryptoPress.com Twitter:@RossFM
San Francisco News Desk