Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

11–20 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#11

Post by qeternity »

shoto_io wrote: post #4
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

I think you have point. And, a key advantage I can imagine is that "checklists" could be implemented into code over time and that is potentially superior to natural language. I am not a crypto expert though.

If it were this easy, software would not have bugs.

Re: Missing line in a smart contract leads to $10M hack

#12

Post by chriswait »

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency.

I haven't written a lot of decentralised code in production, but I get the impression there is generally more to consider, and a fun new class of failure modes to worry about.

Re: Missing line in a smart contract leads to $10M hack

#14

Post by terenia »

shoto_io wrote: post #4
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

I think you have point. And, a key advantage I can imagine is that "checklists" could be implemented into code over time and that is potentially superior to natural language. I am not a crypto expert though.

Stark reminder on the importance of quality control and checking the work twice. I think people sometimes become complacent with work completed in the virtual environment vs the physical world.

Re: Missing line in a smart contract leads to $10M hack

#15

Post by tshaddox »

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly according to its technical specifications and therefore the outcome stands.”

Re: Missing line in a smart contract leads to $10M hack

#16

Post by paulpauper »

barbegal wrote: post #9

This also shows how little security probing is performed on cryptocurrencies and smart contracts. It took over a month and a huge bounty to find the bug in this contract. The likelihood of finding bugs in other currencies and contracts is extremely high despite millions of dollars of value relying on it. Most cryptocurrencies and smart contracts are copy and paste with little analysis of the underlying code. To the c…

even pro coders get hacked and make mistakes. normally, mistakes are inevitable and survivable, but crypto makes the stakes so much higher.

Re: Missing line in a smart contract leads to $10M hack

#17

Post by shoto_io »

terenia wrote: post #14
shoto_io wrote: post #4

Earlier quoted context omitted.

I think you have point. And, a key advantage I can imagine is that "checklists" could be implemented into code over time and that is potentially superior to natural language. I am not a crypto expert though.

Stark reminder on the importance of quality control and checking the work twice. I think people sometimes become complacent with work completed in the virtual environment vs the physical world.

yes. Reminds me of something a friend said a while ago: "You know how I became a great coder after 3 years? By being a bad coder for 3 years."

Re: Missing line in a smart contract leads to $10M hack

#18

Post by lottin »

paulpauper wrote: post #5

Why do ransomware when you can just find exploit and get away without having tainted crypto and also make much more $ too. Defi is such a big gift to hackers. Probably $100 million stolen total in past 2 year. These protocols and contracts are so complicated that such hacks are inevitable and more to come.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

Re: Missing line in a smart contract leads to $10M hack

#19

Post by naikrovek »

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.)

So this is apparently about some stock market for cryptocurrencies, looks like? I think so.

The first few paragraphs of the analysis of the post-mortem contain so many new terms that I am never likely to trust anyone that pushes any type of cryptocurrency, ever. This is pretty clearly "The New Scam" type that is fashionable. People are regularly getting busted for the old fashioned pyramid scheme, so I guess something else needed to be invented.

This stuff is unregulated, prices are easily swayed by a few famous individuals or sometimes a lot of unknown people, en masse, and you can earn and lose real money by trading the stuff. Hard pass. This article just reinforces to me that my decision about that is correct.

I do not like telling people that their interests are bad, because I'm sure in some ways blockchain stuff is at least semi-useful. I mean there are other ways to provably make ledgers read-only, but whatever. I'm not trying to stir anyone up, is what I'm trying to say. Cryptocurrency is just so clearly not "on the level" in my eyes. Sorry. :(

Re: Missing line in a smart contract leads to $10M hack

#20

Post by arilotter »

tshaddox wrote: post #15
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

It's not necessarily true that a smart contract is controlled or operated by an individual or corporation. Once deployed, many have no provisions for administration or ownership tools. If you're using one of these contracts and there's a bug, suing the creator would be like suing someone because they put a random legal contract template online & you didn't proofread it well enough.
Post reply on HN