Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

61–70 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#61

Post by ZephyrBlu »

duxup wrote: post #27
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

First thing I do when changing or creating a thing. Try to figure out WHY things are the way they are and run through some scenarios. It's not a bullet proof system, I don't always do it well... but it can help having to re-invent some of the more obvious aspects of the wheel. The whole blockchain ecosystem seems like a long drawn out lesson as to why at least some systems we have are kinda big, bulky, involve a lot…

This reminds me of Chesterton's Fence: https://fs.blog/2020/03/chestertons-fence/.

Re: Missing line in a smart contract leads to $10M hack

#62

Post by coryrc »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

No, because I expect it to implode well before "all" gets replaced!

Re: Missing line in a smart contract leads to $10M hack

#63

Post by wyager »

naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

> prices are easily swayed by a few famous individuals or sometimes a lot of unknown people, en masse, and you can earn and lose real money by trading the stuff

Totally, this Gamestop stock market stuff is crazy. Oh, you were talking about cryptocurrencies?

Re: Missing line in a smart contract leads to $10M hack

#64

Post by saurik »

alextheparrot wrote: post #51
Arnavion wrote: post #40

Earlier quoted context omitted.

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

This is actually a bit amusing, because one of my favorite reading features on iPad is being able to click and hold on an arbitrary word to look it up. Sure, the UI/UX of a traditional link isn't desirable, but I do want every word to be linkable to the dictionary.

Sounds great as a feature of your client, not of every single site.

Re: Missing line in a smart contract leads to $10M hack

#65

Post by [deleted] »

dnautics wrote: post #45
chriswait wrote: post #12

Earlier quoted context omitted.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

How would exactly the same argument not be applicable to any sort of public code repo?

[deleted]

Re: Missing line in a smart contract leads to $10M hack

#66

Post by CuriousCosmic »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

I think the big issue is using tools without verification infrastructure. Of course there are specification level bugs to deal with but hacks seem to be oh so often the simple "I forgot to initialise a variable" kind of attacks.

I think we really need to be splitting up code for smart contracts into 3 classes:

- Low Complexity, Automated Assurance: Non-turing complete DSLs that allow you to fully reason about their behaviour and catch bugs in a near completely automated manner. The only one of these that I know of at the moment is Marlowe however I'd love to know if more existed. This class should be easily accessible by finance people and should be near impossible to get wrong.

- Medium Complexity, Semi-automated Assurance: These are tools that are expressive and more code than contract however they may or may not be turing complete. These can catch a wide number of bug classes but may need manual intervention (annotations or proofs) to cover the last mile.

- High Complexity, Manual Assurance: The are tools that give you the full power of a turing complete language and all the landmines that come with them. I personally believe any smart contract written with one of these tools should not be used in production unless it is accompanied with a formal specification and an end to end set of proofs verifying correctness.

At least with this model you can judge the risk factor by how complex your application is. 90% of smart contracts probably fall into the first class and another 9% probably fall into the second. There really is no reason to be using a tool without any reasonable amount of assurances provided unless your project is extraordinarily complex (and even then it'd probably cost a fortune to run on a network) and even then there's no reason for these smart contracts to exist without any proofs backing them.

Re: Missing line in a smart contract leads to $10M hack

#67

Post by ZephyrBlu »

JadeNB wrote: post #32
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> 'decentralized finance' will reinvent everything it tried to get rid off Matt Levine wrote about exactly this in a recent Money Stuff column: https://www.bloomberg.com/news/newsletters/2021-05-11/money-... . First paragraph: > A model that I often use for cryptocurrency is that it is rediscovering traditional finance: In its early days, crypto was a brand-new financial system, unsullied by the old evils of central…

I find the fact that crypto is re-inventing finance from first principles to be really interesting.

As he says, "You would expect this to lead to flawed but interesting results, whole new ways of doing things that might blow up horribly but that might instead point the way to a better future".

Re: Missing line in a smart contract leads to $10M hack

#68

Post by duxup »

ZephyrBlu wrote: post #61
duxup wrote: post #27

Earlier quoted context omitted.

First thing I do when changing or creating a thing. Try to figure out WHY things are the way they are and run through some scenarios. It's not a bullet proof system, I don't always do it well... but it can help having to re-invent some of the more obvious aspects of the wheel. The whole blockchain ecosystem seems like a long drawn out lesson as to why at least some systems we have are kinda big, bulky, involve a lot…

This reminds me of Chesterton's Fence: https://fs.blog/2020/03/chestertons-fence/ .

TY

I hadn't read this before, but it is worded way better than I did.

Re: Missing line in a smart contract leads to $10M hack

#69

Post by naikrovek »

ZephyrBlu wrote: post #54
naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

It's a crypto news website. They're not going to link to basic crypto terms. Your whole comment sounds like confirmation bias to me. You don't like crypto, therefore all the new terms you've never heard of must be bad stuff, everyone is out to scam people and crypto isn't "on the level".

Maybe it is, I don't know. But I do know that I'm not ever even going to dip a toe into cryptocurrency because of the personalities of the people who are heavily pushing it. I am not talking about you.

Everyone I know who is into this is very strongly into it, and they can never really explain why. Lots of non-specific sentiments emerge, and rather quickly, but no real this-changes-things-because-of-X details or explanation about anything. It's the same pattern I've seen from people who believe in psychic readings and Tarot cards, except those two groups can get very specific, it's just about imaginary things.

Age is a superpower. I have a few decades behind me. You see patterns in behavior, because people are not snowflakes, and incoming generations make the same mistakes the outgoing generations have made, and must learn the same lessons previous generations have learned. This generation is trying the things that the other generations already tried, etc. Some things change, but the fundamental things people try to do with their lives, those don't really change much generation to generation.

Experience is a good teacher. Now, maybe I'm wrong about cryptocurrency, I'll gladly admit that. And I would counter by saying that "I'm seeing the same broad strokes I've seen previously, with different names."

Re: Missing line in a smart contract leads to $10M hack

#70

Post by riffraff »

tshaddox wrote: post #48
lottin wrote: post #30

Earlier quoted context omitted.

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Yes, and if you use a smart contract to hire someone to build a deck on your house, I suspect any resulting legal disputes would be treated by the courts the same as if you had used a traditional contract.

The problem is that smart contracts do not come with the same capability to take your counterpart to a tribunal: you might not even know who your counterpart is, im which country they live or if there are multiple ones. Who are you gonna sue?
Post reply on HN