Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

91–100 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#91
post #60

Earlier quoted context omitted.

This is actually a bit amusing, because one of my favorite reading features on iPad is being able to click and hold on an arbitrary word to look it up. Sure, the UI/UX of a traditional link isn't desirable, but I do want every word to be linkable to the dictionary.

On the Mac too, you can just "force press" the touchpad on any word and a definition comes up. As a non-native English speaker, I use it quite a lot.

or highlight and ctrl+cmd+d :)

Re: Missing line in a smart contract leads to $10M hack

#92

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

While this startup smart contract got hacked, there are plenty of reputable products in the space that have never been hacked and have upwards of $80 billion locked up right now: https://defipulse.com/

The top projects: Aave, Compound, Uniswap, etc. have been audited several times over, publish their smart contract source code for further review, offer millions of dollars in bug bounties and inherently the locked value acts as a giant bug bounty. I feel comfortable with these projects that have been around for several years now. But it is an open ecosystem and not all projects are created equal. You can also take out insurance for the biggest protocols for additional protection.

Re: Missing line in a smart contract leads to $10M hack

#93

Earlier quoted context omitted.

It's a crypto news website. They're not going to link to basic crypto terms. Your whole comment sounds like confirmation bias to me. You don't like crypto, therefore all the new terms you've never heard of must be bad stuff, everyone is out to scam people and crypto isn't "on the level".

Maybe it is, I don't know. But I do know that I'm not ever even going to dip a toe into cryptocurrency because of the personalities of the people who are heavily pushing it. I am not talking about you. Everyone I know who is into this is very strongly into it, and they can never really explain why. Lots of non-specific sentiments emerge, and rather quickly, but no real this-changes-things-because-of-X details or expl…

I’m not sure it’s been done before though. This crowd seems hell bent on replacing basic trust and civility with algorithms. As if if we could just eliminate morality the world would be better.

From what I know this has mostly been described in dystopian sci-fi before, not really tried in earnest.

Re: Missing line in a smart contract leads to $10M hack

#94

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

What's the benefit? These are all human errors, easily reproducible in any language.

Re: Missing line in a smart contract leads to $10M hack

#95

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

It's a poor speaker who blames the audience for not understanding.

Re: Missing line in a smart contract leads to $10M hack

#96

Earlier quoted context omitted.

The thing is, that's what a lot of smart contract proponents are pushing for. That the legal system has no say over contracts, so the outcome would stand. Or effectively bake into operating these contracts that the legal system isn't a reprieve against anything.

"That the legal system has no say over contracts, " An agreement is an agreement subject to laws and jurisdiction. There's no avoiding that. It will be interesting to see how this plays out in the courts.

If distributed and decentralized it also runs across a common issue with courts - the ‘make me’ problem.

If someone buys product x from seller y, which is based on some decentralized ‘contract’ which is defacto enforced by every node of the network independently - and that product then produces a unjust outcome.

You go to court, but what if Y is just a node on the network? And everyone involved is outside the courts jurisdiction? what can an adverse court judgement actually accomplish? It can’t roll back the network activity to fix the smart contract without everyone’s consent - and that seems unlikely. It can declare product X illegal or fine seller Y - but if they have no way to enforce it, what’s the point?

Re: Missing line in a smart contract leads to $10M hack

#97

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

While this startup smart contract got hacked, there are plenty of reputable products in the space that have never been hacked and have upwards of $80 billion locked up right now: https://defipulse.com/ The top projects: Aave, Compound, Uniswap, etc. have been audited several times over, publish their smart contract source code for further review, offer millions of dollars in bug bounties and inherently the locked val…

> You can also take out insurance for the biggest protocols for additional protection.

Then what's the point? I can already take out insurance in the "traditional" banking system (e.g. every checking account has FDIC).

Re: Missing line in a smart contract leads to $10M hack

#98
post #13

Someday some engineer working on these kinds of contracts will realize they can make a lot more money illegally by “accidentally” adding such bugs to the ecosystem then colluding with whoever exploits them. Actually it’s probably already happening.

As with the rest of the industry, mostly the solution here is just better vetting and static checking etc.

Re: Missing line in a smart contract leads to $10M hack

#99
post #30

Earlier quoted context omitted.

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Well ... first, what's described in the article isn't that smart. It's actually dumb. If we describe these code-as-law thingys as 'dumb contracts' it is crystal clear that 'YES' this is a dumb contract and any sane judge presented with one may well decide to give the participants exactly what they deserve, just like paper-based 'dumb contracts.' The key innovation here is that we've gone to the remedy residing in pro…

Looking at the various issues that have come up with these ‘smart contracts’ (aka the ethereum DAO issues up until now), I think anyone who wants to write one should be automatically excluded from being allowed to do so.

Re: Missing line in a smart contract leads to $10M hack

#100
post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> will reinvent everything it tried to get rid off

I started to have this feel already. DeFi projects creates projects that create projects .. it's gonna be a potential spaghetti bowl of intermediate layers. Either the mass is gonna make it survive on the side or it's gonna fade off xml style.

Post reply on HN