Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

Post reply on HN
Print view View original

131–140 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#131

Post by learc83 »

Fej wrote: post #64
gciruelos wrote: post #24

Nothing was stolen. All I see is a programmer abiding by the contracts.

If a smart contract is also a binding, legal contract, then normal contract law applies - and intent matters here in the real world. Therefore, it's theft. I am most certainly not a lawyer.

Most likely true. But if intent matters and the smart contract isn't actually the final arbitar, then smart contracts are fatally flawed.

Unless courts recognize the ability to sign away your rights through some kind of disclaimer that makes the smart contract the equivalent of binding arbitration.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#132

Post by wildmusings »

learc83 wrote: post #124
wildmusings wrote: post #112

Earlier quoted context omitted.

However a smart contract between you and me may execute, a court can still order me to give you money, or order me to enter into a different smart contract. And if I don't comply, they will eventually hold me in contempt and at some point seize my property by force and throw me in jail if I resist. The authority of the state ultimately rests on its ability to resort to violence to enforce its will. No smart contract…

Assuming you live in a certain subset of countries, sure that could happen (take a look at what happens when an American sues a Chinese citizen). But it defeats the purpose of a smart contract. If everyone agrees that smart contracts will pay out when they are fufilled. But only if they are fufilled in the specific way each party believes they should be (as opposed to what the code actually says)--then there is no po…

The problem is that, for better or for worse, people do not have full freedom of contract by law. There are volumes upon volumes of laws and regulations limiting the kind of financial contracts, for example, that you are allowed to enter into. Every bank has a massive compliance department dedicated to making sure that they abide by those rules.

You can't just ignore these rules by making a system that executes contracts automatically. The judge will simply order you to make the other party whole. Then, if the law allows it, he might hit you with a massive fine for breaking the rules.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#133

Post by GrumpyNl »

The keep telling me Crypto's are safe.Everybody controls them. I haven't heard of any banks that have been robbed several times this year from these amounts of money. Sounds like me that crypto coins are the easiest hackable sources right now.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#134

Post by learc83 »

wildmusings wrote: post #132
learc83 wrote: post #124

Earlier quoted context omitted.

Assuming you live in a certain subset of countries, sure that could happen (take a look at what happens when an American sues a Chinese citizen). But it defeats the purpose of a smart contract. If everyone agrees that smart contracts will pay out when they are fufilled. But only if they are fufilled in the specific way each party believes they should be (as opposed to what the code actually says)--then there is no po…

The problem is that, for better or for worse, people do not have full freedom of contract by law. There are volumes upon volumes of laws and regulations limiting the kind of financial contracts, for example, that you are allowed to enter into. Every bank has a massive compliance department dedicated to making sure that they abide by those rules. You can't just ignore these rules by making a system that executes contr…

That's what I meant when I said courts might chose to ignore the disclaimer.

It is possible you could eventually be able to sign something making the smart contract a form of binding arbitration.

But you're correct, courts law enforcement isn't going to let you enter into illegal contracts just because it's a smart contract.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#135

Post by XorNot »

vimota wrote: post #118
owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

I mostly see your point, except your argument seems to be missing the important fact that the payoff for the hackers is not guaranteed. To say someone is willing to spend up to 90% of the potential payoff without a guarantee that they will be paid out is missing a fundamental aspect of the economic equation here. The scenario you gave should be fairly similar to any application outside of Ethereum that deals with mon…

Except it's made up numbers, and the the valuation's are actually much lower - the cost to find an exploit is not a linear investment of time and money, but a parallel one. Thousands of potential hackers are targeting you, and only have to succeed once to bankrupt you (the payoff is also non-linear - any given exploit probably works more then once).

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#136

Post by SingletonIface »

shadowmint wrote: post #42

This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…

The page you linked mentioned "SafeMath". Is this that?

https://github.com/nemequ/portable-snippets/blob/master/safe...

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#137

Post by TeMPOraL »

jacquesm wrote: post #119
wildmusings wrote: post #112

Earlier quoted context omitted.

However a smart contract between you and me may execute, a court can still order me to give you money, or order me to enter into a different smart contract. And if I don't comply, they will eventually hold me in contempt and at some point seize my property by force and throw me in jail if I resist. The authority of the state ultimately rests on its ability to resort to violence to enforce its will. No smart contract…

> However a smart contract between you or me may execute, a court can still order me to give you money, Just like that judge that ordered the DAO hack to be reversed? > or order me to enter into a different smart contract. No, a judge will never order anybody to enter into a different smart contract just like they don't order people into regular contracts today. > And if I don't comply, they will eventually hold me i…

Correct me if I'm wrong, but I think it's also worth pointing out that from the point of view of judges, people losing money on ETH are really losing abstract Internet points. Even if it all happened in the same jurisdiction, would a judge be willing to consider that a theft has happened?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#138

Post by lordnacho »

brongondwana wrote: post #113
owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

Your logic doesn't add up. Attackers are only willing spend $90k if there's a 90 percent chance they can exploit a bug in the contract to extract the entire $100k value. Clearly if TWO hackers both spend $90k and only one extracts the value, the other one has lost their entire $90k - unless there's a way to be sure you are the one who will win that, your expected return on the $90k is only $50k if there are two parti…

> But a loss of unmarked cash is similarly instant.

True, there isn't a global list of where every bank note is.

I've already lost a tiny amount of BTC just by testing a bit with short keys. Can you imagine what the world would be like if every time you left your wallet for 10 seconds, it vanished?

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#139

Post by jacquesm »

TeMPOraL wrote: post #137
jacquesm wrote: post #119

Earlier quoted context omitted.

> However a smart contract between you or me may execute, a court can still order me to give you money, Just like that judge that ordered the DAO hack to be reversed? > or order me to enter into a different smart contract. No, a judge will never order anybody to enter into a different smart contract just like they don't order people into regular contracts today. > And if I don't comply, they will eventually hold me i…

Correct me if I'm wrong, but I think it's also worth pointing out that from the point of view of judges, people losing money on ETH are really losing abstract Internet points. Even if it all happened in the same jurisdiction, would a judge be willing to consider that a theft has happened?

I don't think that's the material issue, but it is definitely possible that a judge would consider the matter too abstract to make a ruling over. But as a plaintiff or a defendant in such a case I really would not want to base my case on that.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#140

Post by kierenj »

Animats wrote: post #46
dsacco wrote: post #11

Earlier quoted context omitted.

> Isn't "unbreakable" a bit of a dirty word in the security community "Dirty" is one way to put it, yes. I'd personally use something like "false god" or "blasphemy" :). "Unbreakable" is a naive way of describing cryptographic algorithms, because it preempts conversations about intractability assertions or complexity analysis...modern cryptography accepts as a premise that "unbreakable" is not a reasonable goal, whic…

Those are not sufficient conditions for a one-time pad. The entire pad, not just some "seed" has to be random. The pad cannot ever be reused even with a different plaintext. Breaking a one-time pad that's been used twice is not very hard. It's equivalent to recovering two texts which have been XORed together, which is not hard for English. One time pad systems are used regularly for high-security embassy-to-State Dep…

I don't understand how this is practical. If you have a highly secure mechanism for distributing the ultimate secret - one-time-pads - why not just distribute the messages in this way?

Is it just the fact that it would take two trips for the courier? Or that someone would need to intercept both communications (pad, ciphertext)?

Post reply on HN