Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

101–110 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#101

Post by arp242 »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

> Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this?

And stuff like "I lost £95,000 in a bank scam after my solicitor's email was hacked".[1] She managed to recover £57k after , but still lost £35k, not an insubstantial amount!

If anything, we need more protection against stuff like this. Sending money to the wrong account because your solicitor's email account was compromised is something that can happen to anyone, especially if it's someone you've been in regular contact with.

It seems the systems for dealing with fraud in the current banking system is already inadequate (although there is now a new "voluntary code" according to the article, no idea how well this works in practice), and for crypto it's woefully so.

[1]: https://www.theguardian.com/money/2020/feb/29/bank-scam-soli...

Re: Missing line in a smart contract leads to $10M hack

#102

Post by secondcoming »

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

> Contacted Binance Authorities immediately to block the hacker(s) fund transfers

I don't understand this part. I thought crypto was decentralised and so nobody controls anything. Yet, this suggests the opposite... some entitiy somewhere can shut you out on a whim.

Re: Missing line in a smart contract leads to $10M hack

#103

Post by andrewfromx »

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

Re: Missing line in a smart contract leads to $10M hack

#104

Post by doopy1 »

naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

I know this won't change your mind, but the reason you are seeing new terms is, because you're seeing the birth of new protocols. Pictures yourself in the early days of the internet and you want to learn about http and/or javascript (for example) - you would be overwhelmed with new terminology to concepts that didn't exist before like gui based web browsing. Crypto/Defi are this in many ways. Does that make it not a scam? Maybe, maybe not, but don't let the new terminology startle you.

Re: Missing line in a smart contract leads to $10M hack

#105

Post by tylersmith »

lottin wrote: post #30
tshaddox wrote: post #15

Earlier quoted context omitted.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

People get so hung up on the word contract. Might as well spend time arguing that rodents make for bad I/O peripherals.

Re: Missing line in a smart contract leads to $10M hack

#107

Post by ZephyrBlu »

unyttigfjelltol wrote: post #75
lottin wrote: post #30

Earlier quoted context omitted.

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Well ... first, what's described in the article isn't that smart. It's actually dumb. If we describe these code-as-law thingys as 'dumb contracts' it is crystal clear that 'YES' this is a dumb contract and any sane judge presented with one may well decide to give the participants exactly what they deserve, just like paper-based 'dumb contracts.' The key innovation here is that we've gone to the remedy residing in pro…

It's called a "smart contract" because it's programmable (Smart) and can be executed based on specific conditions (Contract).

I've seen/read somewhere that Vitalik regrets naming them "smart contracts" though.

Re: Missing line in a smart contract leads to $10M hack

#109

Post by kevindong »

tshaddox wrote: post #15
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

Then what's the point of smart contracts? If you always must have some form of repudiation/reversal mechanism, you might as well go with the traditional contracts.

You could argue there will be lowered costs in the happy path where nothing goes wrong, but I'm not sure that's valid since the underlying software still needs to written/supported by someone.

Re: Missing line in a smart contract leads to $10M hack

#110

Post by lottin »

tshaddox wrote: post #48
lottin wrote: post #30

Earlier quoted context omitted.

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Yes, and if you use a smart contract to hire someone to build a deck on your house, I suspect any resulting legal disputes would be treated by the courts the same as if you had used a traditional contract.

A "smart contract" is a computer program that manipulates balances on a ledger. There is no way you can use that to hire someone to perform a job because this isn't something that can be expressed in terms of balances. You would need an actual contract to do that. Also the parties that interact with the so-called smart contract have no agreement between them. What could they possibly have a dispute over?
Post reply on HN