Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#81

Post by koolba » Sun, May 16, 2021, 9:13 PM UTC

hiq wrote: post #71

koolba wrote: post #43

Serious question for people familiar with this space. Would you encourage an ambitious expert programmer with a substantial finance background to avoid this space entirely, or enter it as a creator, a contractor, or black hat?

What's your goal? I don't think committing crimes as an expert programmer is a rational choice with most utility functions. Do you really want to make 10x or 100x as much in exchange of your peace of mind? Given that you're probably a top earner already? And that's already taking it from a purely selfish point of view.

I’m wondering which would be the most lucrative one, five, or ten years out.

Plus the legal status of interacting with a smart contract per its “code is law” API has not been tested. Have you broken any law or even civil contract?

Re: Missing line in a smart contract leads to $10M hack

#82

Post by exdsq » Sun, May 16, 2021, 9:13 PM UTC

Interesting to see that those with audits are still vulnerable. I question the quality of companies like Certik which basically just run a home-brewed static analysis tool and charge a crap ton.

Re: Missing line in a smart contract leads to $10M hack

#83

Post by coreyoconnor » Sun, May 16, 2021, 9:14 PM UTC

For fun I've been analyzing the contracts posted to r/CryptoMoonShots. Out of 20 posts 16 of them used the same contract; modulo names. This contract blocks everyone from removing funds but the owner.

How? Is it some complex chunk of code that requires a delicate hack?

No, not at all. There is literally a function with code, more or less, like: "If owner then OK here's all the funds". Anybody can check this in the contract. Yet people are dumping funds into these contracts. Even tho these contracts tend to only attract a few thousand dollars each. Well, costs next to nothing to create and spam.

A more detailed analysis of a similar contract to the one I've seen: https://cryptot3ddybear.gitlab.io/blog/posts/scam-explained-...

Re: Missing line in a smart contract leads to $10M hack

#84

Post by KETpXDDzR » Sun, May 16, 2021, 9:15 PM UTC

I see a market for static code analyzers for smart contracts. And virus scanners!

Re: Missing line in a smart contract leads to $10M hack

#85

Post by jtsiskin » Sun, May 16, 2021, 9:16 PM UTC

The story doesn’t end there. After they converted to BTC at https://www.blockchain.com/btc/address/1Cm6WGvXQ9EgvvWX5dRsB..., where does the money go?

Re: Missing line in a smart contract leads to $10M hack

#86

Post by splintercell » Sun, May 16, 2021, 9:18 PM UTC

yaitsyaboi wrote: post #46

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

Solidity is a DSL. DSLs have their purposes and this happened to be a correct purpose. It just also happens to be that Solidity is a terribly designed language.

Re: Missing line in a smart contract leads to $10M hack

#87

Post by dj_mc_merlin » Sun, May 16, 2021, 9:19 PM UTC

Is it weird that this kind of excites me? It's like in that videogame Uplink, where you would hack into a bank and redirect cash to yourself. Except in real life. A new wild west?

Re: Missing line in a smart contract leads to $10M hack

#88

Post by shiado » Sun, May 16, 2021, 9:19 PM UTC

There's no such thing as hacking a smart contract. The code is the law.

Re: Missing line in a smart contract leads to $10M hack

#89

Post by cfcosta » Sun, May 16, 2021, 9:20 PM UTC

chriswait wrote: post #12

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

I'd say this is a problem of a really new tech, with the advanced attack vectors and methodologies we have nowadays.

Thankfully, other cryptos (such as Cardano) are building their smart contract platform with correctness/security in mind (compiler checks and so on), so we might see less problems like this.

Re: Missing line in a smart contract leads to $10M hack

#90

Post by splintercell » Sun, May 16, 2021, 9:21 PM UTC

hn_throwaway_99 wrote: post #34

lottin wrote: post #18

Earlier quoted context omitted.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

Yeah, that's my question with all this. I mean, ransomware is obviously illegal. Finding vulnerabilities in smart contracts - well, "the code is the contract", so the hacker is just executing the code as it was published. I mean, the whole reason Ethereum Classic exists is because a subset of Ether folks felt that restoring the funds in the original DAO hack was contrary to the whole "the code is the contract" ethos.

If Code is law then hard fork is also law. Otherwise those Ethereum classic people are saying that code is law but only the DSL of Solidity. Outside updatable Ethereum engine code is not law.