Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

161–170 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#161

Post by mondoveneziano »

timoth3y wrote: post #146
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

That's not enough, all parties would have to have 100% awareness and understanding of the smart contract, detail by detail.

Real life contracts sometimes turn out to have non-enforceable clauses within our legal framework, or may be entirely invalid if, for example, signed under pressure or false pretense.

Re: Missing line in a smart contract leads to $10M hack

#162

Post by sva_ »

Daishiman wrote: post #151
sva_ wrote: post #124

Earlier quoted context omitted.

But aren't proofs exact in what they state? So it wouldn't be the proof that would be faulty. It'd be the interpretation of what somebody thinks the proof means to them, and that'd be something you could entirely objectively reason/work on.

But the human world is not exact and full of context. Even mathematical.proofs exist within a context of an axiomatic system, known proofs, and various domain assumptions. I remember that in my computability theory class, defining the right proof was by far the most difficult task. And this was in very small, closed systems.

> But the human world is not exact and full of context.

That is of course correct. However, it was my impression that the contract mentioned in the OP was completely on the blockchain, and therefore completely deterministic (no oracles or whatever.) Hence I figured it could've been proved with absolute rigor, in which case it should've been possible to formally prove the correctness. I'll be honest, I didn't look through the contract in detail now, so I might be wrong.

Re: Missing line in a smart contract leads to $10M hack

#164

Post by the_local_host »

sva_ wrote: post #112
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

> because nobody likes to lose their live savings because they missed a semicolon. Yeah, but shouldn't it be possible that these things will be avoided by confirming the validity of the code with theorem provers such as Coq, Lean, or something similar, at some point in the not too distant future? That's what I've been wondering, without currently having any stakes in the game (and probably not until there's compellin…

> ...shouldn't it be possible that these things will be avoided by confirming the validity of the code...

It would be better to build in a margin of tolerance for correcting mistakes, but that's contrary to the rigid determinism that smart contracts and cryptocurrencies, for some reason, strive for.

Re: Missing line in a smart contract leads to $10M hack

#165

Post by sireat »

Looks like there are plenty of more DeFi hacks/internal fraud/incompetence https://www.rekt.news/leaderboard/

Setting aside the hacks, what good is DeFi anyhow for those outside crypto space?

Seems DeFi currently serve two main functions.

1. Crypto backed loans - main purpose being crypto speculation / possibly some dubious tax benefits

2. Decentralized exchanges - nice for those into crypto but not for Joe Sixpack.

Re: Missing line in a smart contract leads to $10M hack

#166

Post by PeterisP »

lazide wrote: post #96
jollybean wrote: post #58

Earlier quoted context omitted.

"That the legal system has no say over contracts, " An agreement is an agreement subject to laws and jurisdiction. There's no avoiding that. It will be interesting to see how this plays out in the courts.

If distributed and decentralized it also runs across a common issue with courts - the ‘make me’ problem. If someone buys product x from seller y, which is based on some decentralized ‘contract’ which is defacto enforced by every node of the network independently - and that product then produces a unjust outcome. You go to court, but what if Y is just a node on the network? And everyone involved is outside the courts…

If the seller Y is identifiable but simply abroad, then there are various cross-country agreements that would allow to use the legal process in their country to collect money from them in various ways, especially if there's a lot of money at stake - like the $10M discussed in the article.

If the seller is unidentified, then it is possible to get a judgement and work on identifying them. If it's not just a civil dispute but felony fraud, then law enforcement might identify them some years later, it happens.

Of course, if everyone involved is properly anonymous then it's very, very hard to enforce anything, and takes enough effort and money so that it's not worth the hassle for small amounts, so for that there's simply some 'caveat emptor' in dealing with foreign anonymnous sellers. If you defraud $10 off of someone across the ocean, you are likely to get away with this. But for large cases of fraud? Everyone makes mistakes now and them that may allow them to get identified, and such fraud can be prosecuted many years later.

Re: Missing line in a smart contract leads to $10M hack

#168

Post by nkrisc »

philangist wrote: post #127
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

All exploits are technically some version of “just doing what the code allows”, I don’t see how that would change whether or not a hack/theft actually occurred.

Seems like these smart contacts should include written contracts as well to outline what the code is intended to do, if you can’t rely on the code.

Re: Missing line in a smart contract leads to $10M hack

#169

Post by lottin »

tshaddox wrote: post #147
lottin wrote: post #110

Earlier quoted context omitted.

A "smart contract" is a computer program that manipulates balances on a ledger. There is no way you can use that to hire someone to perform a job because this isn't something that can be expressed in terms of balances. You would need an actual contract to do that. Also the parties that interact with the so-called smart contract have no agreement between them. What could they possibly have a dispute over?

Yes, a smart contract is not a legally-binding agreement, although it could be a component of a legally-binding agreement. That’s my point. The smart contract in my hypothetical scenario might be something like a transaction with 3 parties: you (the customer), the construction company, and a third-party verification service, that executes your payment to the construction company when any 2 of the parties agree to exe…

But for this arrangement to work the customer, the construction party and the third-party need to enter into an agreement, i.e. a traditional contract. A traditional contract is legally binding, so of course the courts would treat it as legally binding. The smart contract may be part of the agreement but a smart contract by itself is not an agreement and something cannot be a legally-binding agreement if it isn't an agreement to begin with.

Re: Missing line in a smart contract leads to $10M hack

#170

Post by lottin »

PeterisP wrote: post #158
ethanbond wrote: post #31

Earlier quoted context omitted.

Not really, because the entire premise of smart contracts is that the code IS the only representation of the contract. In normal software systems there’s an intent and then an implementation. There’s no explicit guarantee they are identical, which is exactly why there are subsystems to allow e.g. refunds or transaction invalidations.

That premise is clear, proponents of smart contracts would like it to become true, but as of now that premise is simply not true anywhere in the world. There may be obvious practical difficulties in identifying the counterparty and enforcing a judgement in them, but if that becomes possible (and if $10m is at stake, perhaps it might become possible, bounties, etc) then the argument that "code is the only representati…

But code is the only representation, like it or not. The smart contract is code and nothing else.
Post reply on HN