Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

141–150 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#141

Post by dragonwriter »

philangist wrote: post #127
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

All exploits are technically some version of “just doing what the code allows”, I don’t see how that would change whether or not a hack/theft actually occurred.

One view of smart contracts is that the code defines the intent/agreement, so if the code allows it, the it is, ipso facto, not theft.

Of course,

Re: Missing line in a smart contract leads to $10M hack

#143

Post by paulpauper »

ctur wrote: post #13

Someday some engineer working on these kinds of contracts will realize they can make a lot more money illegally by “accidentally” adding such bugs to the ecosystem then colluding with whoever exploits them. Actually it’s probably already happening.

Makes you wonder how many incidents are inside jobs. Probably more than one would assume.

Re: Missing line in a smart contract leads to $10M hack

#144

Post by reilly3000 »

This makes me think that the next generation may have a new profession of hybrid lawyer-programmers that are engaged to ensure the validity of smart contracts, both negotiating and formally verifying these boilerplate transaction machines. While this was clearly a technical oversight, there are also legal frameworks and traditions that need to be programmed into future contracts. That along with insurance, escrow, title, and other professions will need to evolve with web 3 paradigms.

Re: Missing line in a smart contract leads to $10M hack

#145

Post by mondoveneziano »

jypepin wrote: post #134
jlarocco wrote: post #126

Earlier quoted context omitted.

I don't follow any of this too closely, but I thought the whole idea was to get rid of courts by using precisely codified contracts? What's the advantage if the result is the same system as before (lawsuits, courts, etc.) with added complexity of "smart contracts"?

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

I think the question is: Why then deal with all those inefficiencies and cost of distributed computation, mining, and broadcast transactions, if you need courts to override decisions anyway, and insurance to cover yourself when something goes wrong? You can already "automate" without smart contracts.

Re: Missing line in a smart contract leads to $10M hack

#146

Post by timoth3y »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows?

This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration.

Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

Re: Missing line in a smart contract leads to $10M hack

#147

Post by tshaddox »

lottin wrote: post #110
tshaddox wrote: post #48

Earlier quoted context omitted.

Yes, and if you use a smart contract to hire someone to build a deck on your house, I suspect any resulting legal disputes would be treated by the courts the same as if you had used a traditional contract.

A "smart contract" is a computer program that manipulates balances on a ledger. There is no way you can use that to hire someone to perform a job because this isn't something that can be expressed in terms of balances. You would need an actual contract to do that. Also the parties that interact with the so-called smart contract have no agreement between them. What could they possibly have a dispute over?

Yes, a smart contract is not a legally-binding agreement, although it could be a component of a legally-binding agreement. That’s my point.

The smart contract in my hypothetical scenario might be something like a transaction with 3 parties: you (the customer), the construction company, and a third-party verification service, that executes your payment to the construction company when any 2 of the parties agree to execute. This theoretically prevents the possibility of any 1 party defecting and running away with a monetary benefit (including the third party verification service, which couldn’t run away with the cash like a traditional escrow service hypothetically could).

But my point is that even in this case, if the construction company and third-party verification service colluded to run away with the money without completing the work, you would still sue one or both of them, and my prediction is that the courts would treat this essentially identically to a scenario using traditional contracts.

Re: Missing line in a smart contract leads to $10M hack

#148

Post by jazzyjackson »

koolba wrote: post #43

Serious question for people familiar with this space. Would you encourage an ambitious expert programmer with a substantial finance background to avoid this space entirely, or enter it as a creator, a contractor, or black hat?

Well at least take a look around and see if it's interesting to you. I've been enjoying a playlist of blockchain lectures by Gary Gensler, current chair of the SEC. Lecture 6 is smart contracts with Lawrence Lessig guest speaking. [0]/[1]

I've been avoiding smart contracts since hearing about hacks like these (similar to the Multisig Parity Bug years ago, neglected to initialize, let someone else become the owner and kill the contract) - but I've been educating myself the past week and find that there are really cool things that can be done, maybe cooler a year or 15 in the future when ETH finally gets its fees under control.

As a programmer, you'd probably be interested to see the ethereum virtual machine's "assembly" language [2], I'm pretty impressed with how little code underlies all these ERC20 tokens.

[0] https://ocw.mit.edu/courses/sloan-school-of-management/15-s1...

[1] https://www.youtube.com/watch?v=EH6vE97qIP4&list=PLUl4u3cNGP...

[2] https://docs.soliditylang.org/en/v0.8.4/yul.html

Re: Missing line in a smart contract leads to $10M hack

#149

Post by tylersmith »

charonn0 wrote: post #95
Arnavion wrote: post #40

Earlier quoted context omitted.

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

It's a poor speaker who blames the audience for not understanding.

Not every random reader of an article is in its intended audience. The audience the speaker is writing for understands the article fine.

Re: Missing line in a smart contract leads to $10M hack

#150

Post by ZephyrBlu »

CuriousCosmic wrote: post #73
_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

There are better tools for this, they just aren't in common use unfortunately. Had this been written in Glow, both this bug and the bug that followed where another 7M was stolen would have been compile errors. This is just the consequence of people developing code in languages that provide little to no protection against their various footguns. At the very least we should expect to see some additional tool on top of…

How would those bugs have been compile errors in Glow? I'm unfamiliar with it, but that sounds interesting.
Post reply on HN