Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

131–140 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#131

Post by lazide »

Pulcinella wrote: post #122
lazide wrote: post #96

Earlier quoted context omitted.

If distributed and decentralized it also runs across a common issue with courts - the ‘make me’ problem. If someone buys product x from seller y, which is based on some decentralized ‘contract’ which is defacto enforced by every node of the network independently - and that product then produces a unjust outcome. You go to court, but what if Y is just a node on the network? And everyone involved is outside the courts…

I doubt the judge is going to care that the “contract” passed through a bunch of different peoples hands (nodes in a network). They could still fine the seller or order them to return the funds to X. If Y can’t be hauled into court because they are in another country or you just don’t know their identity, well that isn’t a problem specific to these “distributed smart contracts.”

It is actually a problem specific to these types of contracts. It is very difficult to nearly impossible for me to get money to a company somewhere right now in a way that doesn’t surface who they are and where they are at in some really obvious (and traceable) way - part of the US War on Terror is the anti money laundering, and know your customer rules and heavy handed enforcement of US financial control.

In this case, you send some ether somewhere.

Re: Missing line in a smart contract leads to $10M hack

#132

Post by xyzzy_plugh »

jlarocco wrote: post #126
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

I don't follow any of this too closely, but I thought the whole idea was to get rid of courts by using precisely codified contracts? What's the advantage if the result is the same system as before (lawsuits, courts, etc.) with added complexity of "smart contracts"?

How do you get rid of courts? Do you imagine an alternate reality where existing regulations do not and can not apply? Because I'd recommend continuing to imagine.

Re: Missing line in a smart contract leads to $10M hack

#133

Post by paulpauper »

jtsiskin wrote: post #85

The story doesn’t end there. After they converted to BTC at https://www.blockchain.com/btc/address/1Cm6WGvXQ9EgvvWX5dRsB... , where does the money go?

that is presumably to prevent the $ from ever being frozen. in some instances, devs will freeze defi tokens. very uncommon and controversial but it happened after kcuoin hack

Re: Missing line in a smart contract leads to $10M hack

#134

Post by jypepin »

jlarocco wrote: post #126
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

I don't follow any of this too closely, but I thought the whole idea was to get rid of courts by using precisely codified contracts? What's the advantage if the result is the same system as before (lawsuits, courts, etc.) with added complexity of "smart contracts"?

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

Re: Missing line in a smart contract leads to $10M hack

#135

Post by tylersmith »

secondcoming wrote: post #102
latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

> Contacted Binance Authorities immediately to block the hacker(s) fund transfers I don't understand this part. I thought crypto was decentralised and so nobody controls anything. Yet, this suggests the opposite... some entitiy somewhere can shut you out on a whim.

Nobody can force you to do business with them. Binance can't stop the transaction they can just not do business with that person.

Re: Missing line in a smart contract leads to $10M hack

#136

Post by pm90 »

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Code won't make the complexity go away but it can definitely inform humans of various little things that would be too tedious or expensive to do manually.

There's a reason we don't have lawyers review every ecommerce or in-store purchase that's made: the process of shopping has been standardized to such an extent that most parties (merchants and buyers) don't need to sign a bespoke agreement for every transaction.

If we can get more complex agreements automatically hammered out, it represents not just large cost savings, but potentially creating more business for smaller players easily.

Re: Missing line in a smart contract leads to $10M hack

#137

Post by 2OEH8eoCRo0 »

philangist wrote: post #127
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

All exploits are technically some version of “just doing what the code allows”, I don’t see how that would change whether or not a hack/theft actually occurred.

Reminds me of a Team Fortress 2 griefing video where they kept putting turrets underneath the map that couldn't be killed but could shoot players.

"If they didn't want you to do that then why did they put it in the game?"

Re: Missing line in a smart contract leads to $10M hack

#138

Post by paulpauper »

_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

Then they will never become mainstream

Re: Missing line in a smart contract leads to $10M hack

#139

Post by tylersmith »

paulpauper wrote: post #5

Why do ransomware when you can just find exploit and get away without having tainted crypto and also make much more $ too. Defi is such a big gift to hackers. Probably $100 million stolen total in past 2 year. These protocols and contracts are so complicated that such hacks are inevitable and more to come.

Because finding exploits is competitive. Many teams do both operations, exploit hunting and malware.
Post reply on HN