Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

181–190 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#181

Post by PeterisP »

hn_throwaway_99 wrote: post #174
PeterisP wrote: post #160

Earlier quoted context omitted.

Ignoring contract law (which would not blindly accept "the code is the contract", and people's ethos does not allow them to arbitrarily decide how contracts shall work in the country where they live), the fact that some action was explicitly written in a contract that was properly signed by everyone does not necessarily mean that the action was lawful. For example, if you intentionally misrepresent what the contract…

I mean, at its heart then you are really arguing than smart contracts shouldn't exist in the first place (I don't really disagree). The entire reason that smart contracts exist is to get rid of the need for any trusted third party intermediary because (as proponents argue) all of the logic for the contract is completely embedded in the code. If it then becomes necessary to say "The code is the contract, unless there'…

I'm not necessarily arguing that smart contracts shouldn't exist in the first place - perhaps they have a valid future role in effectively and cheaply adjudicating small claims where currently it might not be worth to enforce a contract due to the effort and costs of the legal process; something vaguely like what arbitration was intended to be.

This use case would IMHO have a quite large market, and it would be perfectly compatible with those smart contracts having a proper (non-code) appeals process explicitly designed in the system - the benefit would be that the third party (arbiters, or state, or whatever) is not used in most cases, because that would be costly.

Re: Missing line in a smart contract leads to $10M hack

#182

Post by intricatedetail »

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

Why contracts don't have a test suite that verifies them?

Re: Missing line in a smart contract leads to $10M hack

#183

Post by IncRnd »

meowkit wrote: post #123
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

In the future I think smart contracts will be standardized - these kinds of things won’t happen unless you’re trying something new. If that’s the case there will probably be services/testnets to properly vet it before launching on a mainnet.

> these kinds of things won’t happen unless you’re trying something new.

Unfortunately, that's probably not going to be what occurs. Even today, there are constantly bugs discovered and fixed, some critical, that have been latent in systems for decades - as in since the last century.

The recent FragAttacks against WiFi systems come to mind.

Re: Missing line in a smart contract leads to $10M hack

#185

Post by aaronharnly »

mondoveneziano wrote: post #145
jypepin wrote: post #134

Earlier quoted context omitted.

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

I think the question is: Why then deal with all those inefficiencies and cost of distributed computation, mining, and broadcast transactions, if you need courts to override decisions anyway, and insurance to cover yourself when something goes wrong? You can already "automate" without smart contracts.

I share the general skepticism, but I am open to the idea that (much like other electronic commerce), the smart contracts might make 99% of transactions much more efficient; so the expensive manual interventions are only used on a small proportion.

Of course, it is not necessarily obvious that blockchain-powered smart contracts are the only way — or the best way — to achieve that automation and efficiency!

Re: Missing line in a smart contract leads to $10M hack

#186

Post by ryanmentor »

adflux wrote: post #172
mondoveneziano wrote: post #161

Earlier quoted context omitted.

That's not enough, all parties would have to have 100% awareness and understanding of the smart contract, detail by detail. Real life contracts sometimes turn out to have non-enforceable clauses within our legal framework, or may be entirely invalid if, for example, signed under pressure or false pretense.

And a judge will decide whether the contract was signed under duress. Who will judge smart contracts?

Kleros Digital Courts, if their story holds through.

Re: Missing line in a smart contract leads to $10M hack

#187

Post by hn_throwaway_99 »

PeterisP wrote: post #181
hn_throwaway_99 wrote: post #174

Earlier quoted context omitted.

I mean, at its heart then you are really arguing than smart contracts shouldn't exist in the first place (I don't really disagree). The entire reason that smart contracts exist is to get rid of the need for any trusted third party intermediary because (as proponents argue) all of the logic for the contract is completely embedded in the code. If it then becomes necessary to say "The code is the contract, unless there'…

I'm not necessarily arguing that smart contracts shouldn't exist in the first place - perhaps they have a valid future role in effectively and cheaply adjudicating small claims where currently it might not be worth to enforce a contract due to the effort and costs of the legal process; something vaguely like what arbitration was intended to be. This use case would IMHO have a quite large market, and it would be perfe…

Again, though, in that case, as with many use cases where people like to yell "blockchain!!", just use some code running on top of a database.

Blockchain adds a ton of cost and complexity precisely because it is completely "autonomous" with no enhanced trust relationship for anyone. The second you have some people with an enhanced trust relationship, then the whole reason for using blockchain falls apart.

Re: Missing line in a smart contract leads to $10M hack

#188

Post by twobuy »

coreyoconnor wrote: post #83

For fun I've been analyzing the contracts posted to r/CryptoMoonShots. Out of 20 posts 16 of them used the same contract; modulo names. This contract blocks everyone from removing funds but the owner. How? Is it some complex chunk of code that requires a delicate hack? No, not at all. There is literally a function with code, more or less, like: "If owner then OK here's all the funds". Anybody can check this in the co…

Typically the small amount of volume is by the contract owner attempting to pick up attention from momentum trading bots.

This type of contract made a killing a few months ago. Basically miners trade by sandwiching orders in the mempool. You can search the 'salmonella' contract for more info.

Re: Missing line in a smart contract leads to $10M hack

#189

Post by meowface »

quadcore wrote: post #180

There might be something deeply interesting in that news actually. 'initialised = true' is obviously a bad pattern, now people cant argue about it anymore. Why is it bad? Obviously, if you forgot the line then... BOOM. So instead I check whatever main variable the initialisation initialised before the initialisation starts - even when it looks a bit awkward cause it does sometimes. Also, the whole concept of initiali…

>So instead I check whatever main variable the initialisation initialised before the initialisation starts - even when it looks a bit awkward cause it does sometimes. Also, the whole concept of initialisation is a bad pattern. You dont want to have an initialisation whenever you can avoid it, you want to perform the whole calculation every time. 'initialisation' implies a state machine. You dont want state machines, you want stateless machines, as much as possible. So yeah, 'initialisation' is a good optimisation some of the time and most of it a bad compulsive-caching habit.

One issue is that every operation in Ethereum smart contracts costs some gas, with differing gas costs for different kinds of operations. I'm not sure to what degree it applies in this case, if at all, but anything you can do to reduce the number of operations (and minimize costly operations) helps reduce gas costs.

Re: Missing line in a smart contract leads to $10M hack

#190

Post by yaitsyaboi »

kamyarg wrote: post #76
yaitsyaboi wrote: post #46

Earlier quoted context omitted.

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

Not an expert in solidity but from my limited experience EVM and smart contracts have really different approach when it comes to computation. two things that come to my mind: - There is really no random() function due to need for determinism - Space vs. Time complexity is distorted, the gas you pay for instruction vs. byte is really different economics compared to AWS EC2 instance/hour etc.

Interesting, do you suggest any sources to read more about this?
Post reply on HN