Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

111–120 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#111

Post by Dayshine »

arp242 wrote: post #101
chriswait wrote: post #12

Earlier quoted context omitted.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

> Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? And stuff like "I lost £95,000 in a bank scam after my solicitor's email was hacked".[1] She managed to recover £57k after , but still lost £35k, not an insubstantial amount! If anything, we need more protection against stuff like this. Sending money to the w…

This is before the recent change in bank transfers that requires account name to match account number right?

My understanding was that change basically closes the majority of these scams (where the account details are substituted) as you would now need to create an account with a name you don't have ID for which is very very hard.

Re: Missing line in a smart contract leads to $10M hack

#112

Post by sva_ »

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> because nobody likes to lose their live savings because they missed a semicolon.

Yeah, but shouldn't it be possible that these things will be avoided by confirming the validity of the code with theorem provers such as Coq, Lean, or something similar, at some point in the not too distant future? That's what I've been wondering, without currently having any stakes in the game (and probably not until there's compelling mathematical proof of security)

Re: Missing line in a smart contract leads to $10M hack

#113

Post by ryanmarsh »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

Even as a crypto maximalist I believe code can create tyrannies of it's own kind. Take the example a story posted on HN some time ago of code Hertz wrote reporting cars not turned in as stolen and getting people (unfairly) arrested.

If I call my bank, they can fix a mistake, no matter how bad, because they own "truth".

I think what will end up happing is every contract will have the ability for some authorized key to make arbitrary movements of tokens amongst custodial accounts and nobody will build contracts where anything is moved out of custodial accounts until there's been multiple authorizations. Sort of how I transfer money into Gemini, I don't just trade from my personal checking account and they won't transfer to my checking without some authorizations. Look, I know I'm not being sophisticated here, I'm just saying, you need a way of un-fucking a fuckup and if someone can abscond with tokens easily because of a small logic flaw that doesn't work writ large.

Re: Missing line in a smart contract leads to $10M hack

#114

Post by ZephyrBlu »

naikrovek wrote: post #69
ZephyrBlu wrote: post #54

Earlier quoted context omitted.

It's a crypto news website. They're not going to link to basic crypto terms. Your whole comment sounds like confirmation bias to me. You don't like crypto, therefore all the new terms you've never heard of must be bad stuff, everyone is out to scam people and crypto isn't "on the level".

Maybe it is, I don't know. But I do know that I'm not ever even going to dip a toe into cryptocurrency because of the personalities of the people who are heavily pushing it. I am not talking about you. Everyone I know who is into this is very strongly into it, and they can never really explain why. Lots of non-specific sentiments emerge, and rather quickly, but no real this-changes-things-because-of-X details or expl…

Which personalities are you referring to?

I'm curious about what you've picked up as well. Like people not being able to explain why they're into it. Could you elaborate on those things a little bit?

Re: Missing line in a smart contract leads to $10M hack

#115

Post by Daishiman »

sva_ wrote: post #112
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> because nobody likes to lose their live savings because they missed a semicolon. Yeah, but shouldn't it be possible that these things will be avoided by confirming the validity of the code with theorem provers such as Coq, Lean, or something similar, at some point in the not too distant future? That's what I've been wondering, without currently having any stakes in the game (and probably not until there's compellin…

Theorem provers require code for defining what you want to prove and the method through which you reach said proof.

Proofs and theorems can have bugs.

Re: Missing line in a smart contract leads to $10M hack

#116

Post by paulpauper »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

if it went to court, i am guessing presuambly under a plea deal the hacker would be required give back all or most of the crpyto to rectify the 'mistake;' if not, it would prove intent to steal . For example, there is the 2005 Sammy MySpace XSS incident. Technically, his code was interpreted by Myspace as valid CSS/html, but was still guilty due to intent.

Re: Missing line in a smart contract leads to $10M hack

#117

Post by varjag »

ZephyrBlu wrote: post #107
unyttigfjelltol wrote: post #75

Earlier quoted context omitted.

Well ... first, what's described in the article isn't that smart. It's actually dumb. If we describe these code-as-law thingys as 'dumb contracts' it is crystal clear that 'YES' this is a dumb contract and any sane judge presented with one may well decide to give the participants exactly what they deserve, just like paper-based 'dumb contracts.' The key innovation here is that we've gone to the remedy residing in pro…

It's called a "smart contract" because it's programmable (Smart) and can be executed based on specific conditions (Contract). I've seen/read somewhere that Vitalik regrets naming them "smart contracts" though.

They are database triggers, but that's not enough grandeur for cryptoheads.

Re: Missing line in a smart contract leads to $10M hack

#118

Post by janoc »

sva_ wrote: post #112
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> because nobody likes to lose their live savings because they missed a semicolon. Yeah, but shouldn't it be possible that these things will be avoided by confirming the validity of the code with theorem provers such as Coq, Lean, or something similar, at some point in the not too distant future? That's what I've been wondering, without currently having any stakes in the game (and probably not until there's compellin…

That would cost an arm-and-leg, it would need to be done by someone who actually understands both the theory of proving algorithm corectness and the algo in question and systems like CoQ are from being able to prove large, complex systems.

All the while traditional "non-distributed" finance simply uses sound engineering practices, such as code reviews, audits and sign-offs at much smaller cost and without requiring specialized PhDs in multiple unrelated fields.

Re: Missing line in a smart contract leads to $10M hack

#119

Post by cosmodisk »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

It may depend on a legal system in a country but I think 'Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all' is more likely. For instance there were cases,where ATMs dispensed stupid amounts of money because of some error. People would normally be found guilty if they take the money that technically isn't theirs.

Re: Missing line in a smart contract leads to $10M hack

#120

Post by Daishiman »

ryanmarsh wrote: post #113
chriswait wrote: post #12

Earlier quoted context omitted.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

Even as a crypto maximalist I believe code can create tyrannies of it's own kind. Take the example a story posted on HN some time ago of code Hertz wrote reporting cars not turned in as stolen and getting people (unfairly) arrested. If I call my bank, they can fix a mistake, no matter how bad, because they own "truth". I think what will end up happing is every contract will have the ability for some authorized key to…

So then why even bother with DeFi when what you're doing is just relaying trust back to a centralised human party?

It's just regular finance with extra steps.

Post reply on HN