Live data from Hacker News

Ethereum Contracts Are Going to Be Candy for Hackers

vessenes.com

31–40 of 85 posts

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#31
post #24

ICYMI: Bitcoin will gain Turing-completeness via a merge-mined sidechain called Rootstock ( http://www.rootstock.io/ ), that also offers a transaction throughput boost (300TPS right off the bat). I highly recommend their whitepaper as it's also a great overview of the Blockchain ecosystem as a whole.

From reading their site, it sounds like you expose yourself to massive counterparty risk using this, as a "federation" is holding your bitcoins.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#32
post #17

Earlier quoted context omitted.

First, let me acknowledge that this is a fair question. A bit cynical, perhaps, but fair. To answer it, no, not like this. Contract law has a lot of humans in it. You are certainly able to sign some contracts with combinations of clauses that can get you, and I've read horror stories at the mega-corp levels about contract clauses interacting unexpectedly and screwing some party or other. But even in those cases, the…

I'd love to hear more about those horror stories you mention.

Me too. I can't remember enough about what they were to pull up details, though.

I remember it was some combination of contractual obligations to supply a certain product at a certain price, obligations to supply a certain number of them, a clause that changed the price if a certain number of them were bought, that sort of thing. You can do things like create contracts where you can buy enough of the items to trigger the lower price then force the company to take back the ones you paid the higher price for, or if you can screw with the price of some component that is necessary for the production of the thing make it so it costs the producer more to make than you're going to pay, stuff like that. Legal shenanigans? Absolutely. But considered to be normal stuff at the higher levels of the game.

Hopefully someone can come up with some better examples. But I'll at least make a peace offering with this: http://thedailywtf.com/articles/Special-Delivery

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#33
The author talks about a mechanism for replacing parts of a script (e.g. maintaining it in production in spite of the 'forever' longevity of a contract). The Truffle Ethereum development framework has such a proposal in the works -- a simple 'migration' mechanism that will allow in-place upgrades of running contracts:

https://github.com/ConsenSys/truffle/issues/138

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#34
post #17

Earlier quoted context omitted.

First, let me acknowledge that this is a fair question. A bit cynical, perhaps, but fair. To answer it, no, not like this. Contract law has a lot of humans in it. You are certainly able to sign some contracts with combinations of clauses that can get you, and I've read horror stories at the mega-corp levels about contract clauses interacting unexpectedly and screwing some party or other. But even in those cases, the…

I'd love to hear more about those horror stories you mention.

"The dispute between Rogers Communications of Toronto, Canada’s largest cable television provider, and a telephone company in Atlantic Canada, Bell Aliant, is over the phone company’s attempt to cancel a contract governing Rogers’ use of telephone poles. But the argument turns on a single comma in the 14-page contract. The answer is worth 1 million Canadian dollars ($888,000).

Citing the “rules of punctuation,” Canada’s telecommunications regulator recently ruled that the comma allowed Bell Aliant to end its five-year agreement with Rogers at any time with notice."

Read more: http://www.nytimes.com/2006/10/25/business/worldbusiness/25c...

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#35

Earlier quoted context omitted.

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...

Linus doesn't view security bugs as a special category of bugs. So he doesn't prioritize them they way most infosec people would like them to. The lack of a strong security advocate in their leadership is largely the reason why Linux isn't the best example.

The other big reason being that it's a giant blob of C and a large attack surface.

All of these factors could be easily avoided or simply don't exist for an Ethereum contract developer.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#36
post #12

Don't these contracts existing in a market? If one contract is flawed won't customers flock to another competing one? This would create an incentive for quality control. Or is the proposed problem that these flaws are unavoidable or too costly to prevent? I could see the high-investment cost being a deterrent for developers to adopt the platform. In general the contract code should be as simple as possible and memory…

How would the average Ethereum speculator know that the contract is flawed? Given the limited success of other, much easier-to-use blockchain technologies I'm skeptical that Ethereum can reach critical mass if every participant must learn the Solidity language and conduct a complete code review of any contracts they call. It seems to me that the Ethereum marketplace has to be married to some kind of source of trust, even one as simple as an upvote/downvote system.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#37
If Ethereum or something like it were to succeed, it would end up taking the form of low-level plumbing for financial products or other stuff which will simply say: "built on the Ethereum trustless/blockchain system". And as others here point out, there would be an ecosystem with companies which would audit and rate smart contracts for trustworthiness by an end-user. That in itself might end up being another application of Ethereum. Again, emphasis on the aforementioned if.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#38
post #17

Earlier quoted context omitted.

First, let me acknowledge that this is a fair question. A bit cynical, perhaps, but fair. To answer it, no, not like this. Contract law has a lot of humans in it. You are certainly able to sign some contracts with combinations of clauses that can get you, and I've read horror stories at the mega-corp levels about contract clauses interacting unexpectedly and screwing some party or other. But even in those cases, the…

But the issue with humans is also interpretation. If a contract or set of clauses is detrimental to a specific party, because if the complexity of the structure of a contract, not the language used - then surely this is easier to spot and fix with software heuristics, rather than deciphering humalanguage

The issue with contracts isn't interpretation. The legal system evolved and develop procedures in how those contracts are executed. It is done through a form consensus building between two parties and the jurisprudence. There is procedural component of that involves human judgment and also provides avenues of appeal. The human element also serves as a sanity check within the legal system: intent and the consequences of a clauses matters more than what is stated. Ethereum, right now has none of this. The execution of the contracts are blind. Also, if software can be any indication of things, complex software with a lot of interacting parts tend to be very complex, and with no human in the process, with no consensus amongst those involved, what is being executed by those clauses and the intentions of those clauses can be worlds apart. I think in the realm of software, when this happens, people label this disconnect as a bug...

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#39

Earlier quoted context omitted.

But the issue with humans is also interpretation. If a contract or set of clauses is detrimental to a specific party, because if the complexity of the structure of a contract, not the language used - then surely this is easier to spot and fix with software heuristics, rather than deciphering humalanguage

The issue with contracts isn't interpretation. The legal system evolved and develop procedures in how those contracts are executed. It is done through a form consensus building between two parties and the jurisprudence. There is procedural component of that involves human judgment and also provides avenues of appeal. The human element also serves as a sanity check within the legal system: intent and the consequences…

Humans can't write bullet-proof contracts OR bullet-proof software.

Combining the two and suggesting that the result will somehow magically be more secure and less hackable - in any sense - is nonsense.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#40

Earlier quoted context omitted.

I'd love to hear more about those horror stories you mention.

"The dispute between Rogers Communications of Toronto, Canada’s largest cable television provider, and a telephone company in Atlantic Canada, Bell Aliant, is over the phone company’s attempt to cancel a contract governing Rogers’ use of telephone poles. But the argument turns on a single comma in the 14-page contract. The answer is worth 1 million Canadian dollars ($888,000). Citing the “rules of punctuation,” Canad…

quote from the linked nytimes article " The dispute is over this sentence: “This agreement shall be effective from the date it is made and shall continue in force for a period of five (5) years from the date it is made, and thereafter for successive five (5) year terms, unless and until terminated by one year prior notice in writing by either party.”

The regulator concluded that the second comma meant that the part of the sentence describing the one-year notice for cancellation applied to both the five-year term as well as its renewal. Therefore, the regulator found, the phone company could escape the contract after as little as one year. "

Post reply on HN