Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#31

Post by ethanbond » Sun, May 16, 2021, 8:25 PM UTC

hhvn wrote: post #26

lottin wrote: post #18

Earlier quoted context omitted.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

You could argue all hacking is just doing something that is (accidentally) allowed by the target system.

Not really, because the entire premise of smart contracts is that the code IS the only representation of the contract. In normal software systems there’s an intent and then an implementation. There’s no explicit guarantee they are identical, which is exactly why there are subsystems to allow e.g. refunds or transaction invalidations.

Re: Missing line in a smart contract leads to $10M hack

#32

Post by JadeNB » Sun, May 16, 2021, 8:26 PM UTC

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> 'decentralized finance' will reinvent everything it tried to get rid off

Matt Levine wrote about exactly this in a recent Money Stuff column: https://www.bloomberg.com/news/newsletters/2021-05-11/money-... . First paragraph:

> A model that I often use for cryptocurrency is that it is rediscovering traditional finance: In its early days, crypto was a brand-new financial system, unsullied by the old evils of central banking, leverage, regulation, etc.; eventually people realized that some of those things were good, and started reinventing them. One way to reinvent finance is for idealistic crypto technologists to invent banking, leverage, regulation, etc., from first principles, with cursory or no knowledge of how the traditional financial system addressed these issues or why it rejected other solutions. You would expect this to lead to flawed but interesting results, whole new ways of doing things that might blow up horribly but that might instead point the way to a better future.

Re: Missing line in a smart contract leads to $10M hack

#33

Post by tankenmate » Sun, May 16, 2021, 8:26 PM UTC

_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

Crypto pen testers will become a thing; plenty of central banks are making noises about starting blockchains.

Re: Missing line in a smart contract leads to $10M hack

#34

Post by hn_throwaway_99 » Sun, May 16, 2021, 8:26 PM UTC

lottin wrote: post #18

paulpauper wrote: post #5

Why do ransomware when you can just find exploit and get away without having tainted crypto and also make much more $ too. Defi is such a big gift to hackers. Probably $100 million stolen total in past 2 year. These protocols and contracts are so complicated that such hacks are inevitable and more to come.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

Yeah, that's my question with all this. I mean, ransomware is obviously illegal. Finding vulnerabilities in smart contracts - well, "the code is the contract", so the hacker is just executing the code as it was published.

I mean, the whole reason Ethereum Classic exists is because a subset of Ether folks felt that restoring the funds in the original DAO hack was contrary to the whole "the code is the contract" ethos.

Re: Missing line in a smart contract leads to $10M hack

#35

Post by ethanbond » Sun, May 16, 2021, 8:27 PM UTC

_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

Maybe we could create a system to adjudicate such failures? ;)

Re: Missing line in a smart contract leads to $10M hack

#36

Post by bombcar » Sun, May 16, 2021, 8:27 PM UTC

ctur wrote: post #13

Someday some engineer working on these kinds of contracts will realize they can make a lot more money illegally by “accidentally” adding such bugs to the ecosystem then colluding with whoever exploits them. Actually it’s probably already happening.

There’s been at least one smart contract with a “typo” of zero for O that allowed an “exit event”.

Re: Missing line in a smart contract leads to $10M hack

#37

Post by BoiledCabbage » Sun, May 16, 2021, 8:28 PM UTC

tshaddox wrote: post #15

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

The thing is, that's what a lot of smart contract proponents are pushing for. That the legal system has no say over contracts, so the outcome would stand. Or effectively bake into operating these contracts that the legal system isn't a reprieve against anything.

Re: Missing line in a smart contract leads to $10M hack

#38

Post by lottin » Sun, May 16, 2021, 8:31 PM UTC

vladimirralev wrote: post #21

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

There is place for both systems. Most crypto people have made peace with the fact that they can lose it all. People overestimate conventional finance. Conventional finance is incredibly flimsy if you dig into it. Leveraged beyond repair, ductaping one unprecedented monetary experiment after another. No conventional currency has preserved substantial purchasing power over a span of say 100 years maximum. The mathemati…

I think you're confusing "money" with "finance". Finance is about lending resources to carry out projects, whereas money is a means of exchanging things.

Re: Missing line in a smart contract leads to $10M hack

#39

Post by Consultant32452 » Sun, May 16, 2021, 8:31 PM UTC

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Companies have canned contracts, like when you buy a house your mortgage company just plugs in a few variables and voila, contact. Commonly used smart contracts will converge in a similar way before they make it into common usage.

Re: Missing line in a smart contract leads to $10M hack

#40

Post by Arnavion » Sun, May 16, 2021, 8:36 PM UTC

naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.)

This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because you expect the reader to know English. In the same way it's perfectly fine to write an article with a target audience that understands the concepts being discussed. Not everything needs to be written for a general audience; this website is exclusively about cryptocurrency, and particularly dense with jargon and slang at that.