Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

191–200 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#191

Post by meowface »

f00zz wrote: post #173
ZephyrBlu wrote: post #121

Earlier quoted context omitted.

In what way is Solidity terribly designed?

Not an expert, but integer overflows getting silently truncated sounds pretty terrible. I understand there are safe arithmetic libraries, but overflow exceptions should have been built right into the VM

I agree. Thankfully, this was fixed in Solidity version 0.8 (released December 2020). Arithmetic operations now automatically revert on overflow/underflow, unless the programer explicitly wraps them in an "unchecked" block (sort of like how Rust supports "unsafe" blocks).

Re: Missing line in a smart contract leads to $10M hack

#192

Post by rawtxapp »

jypepin wrote: post #134
jlarocco wrote: post #126

Earlier quoted context omitted.

I don't follow any of this too closely, but I thought the whole idea was to get rid of courts by using precisely codified contracts? What's the advantage if the result is the same system as before (lawsuits, courts, etc.) with added complexity of "smart contracts"?

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

I think the way to look at is that, smart contracts are not behind the contracts/agreements, smart contracts are the contracts/agreements. Once you realize that, if a smart contract executed successfully then the operation was legitimate.

Of course, ethereum forked when a big hack happened, but it won't be forking for every hack, otherwise it's not really a reliable blockchain.

Re: Missing line in a smart contract leads to $10M hack

#193

Post by [deleted] »

aaronharnly wrote: post #185
mondoveneziano wrote: post #145

Earlier quoted context omitted.

I think the question is: Why then deal with all those inefficiencies and cost of distributed computation, mining, and broadcast transactions, if you need courts to override decisions anyway, and insurance to cover yourself when something goes wrong? You can already "automate" without smart contracts.

I share the general skepticism, but I am open to the idea that (much like other electronic commerce), the smart contracts might make 99% of transactions much more efficient; so the expensive manual interventions are only used on a small proportion. Of course, it is not necessarily obvious that blockchain-powered smart contracts are the only way — or the best way — to achieve that automation and efficiency!

[deleted]

Re: Missing line in a smart contract leads to $10M hack

#194

Post by kamyarg »

yaitsyaboi wrote: post #190
kamyarg wrote: post #76

Earlier quoted context omitted.

Not an expert in solidity but from my limited experience EVM and smart contracts have really different approach when it comes to computation. two things that come to my mind: - There is really no random() function due to need for determinism - Space vs. Time complexity is distorted, the gas you pay for instruction vs. byte is really different economics compared to AWS EC2 instance/hour etc.

Interesting, do you suggest any sources to read more about this?

Not sure about articles but I can recommend Crypto Kittens Tutorial[1].

It has been some time since I did it(Late 2018 I think), but was really informative to get the mindset and different constraints people deal with in smart contract world.

[1] https://www.cryptokitties.co/kitten-class/breeding/introduct...

Re: Missing line in a smart contract leads to $10M hack

#195

Post by missblit »

timoth3y wrote: post #146
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review.

Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

Re: Missing line in a smart contract leads to $10M hack

#196

Post by mondoveneziano »

aaronharnly wrote: post #185
mondoveneziano wrote: post #145

Earlier quoted context omitted.

I think the question is: Why then deal with all those inefficiencies and cost of distributed computation, mining, and broadcast transactions, if you need courts to override decisions anyway, and insurance to cover yourself when something goes wrong? You can already "automate" without smart contracts.

I share the general skepticism, but I am open to the idea that (much like other electronic commerce), the smart contracts might make 99% of transactions much more efficient; so the expensive manual interventions are only used on a small proportion. Of course, it is not necessarily obvious that blockchain-powered smart contracts are the only way — or the best way — to achieve that automation and efficiency!

> the smart contracts might make 99% of transactions much more efficient

The entire point of proof-of-work is that it is inefficient, by design. Efficiency is counteracted: Advances in technology that lead to more efficient mining techniques directly mean the difficulty for the next block being adjusted up.

Operating on traditional databases (where automation is regularly implemented, too) is orders of magnitude more efficient. Because like most other things other than proof-of-work, those processes directly benefit from getting more efficient.

Re: Missing line in a smart contract leads to $10M hack

#197

Post by astrange »

derefr wrote: post #179
timoth3y wrote: post #146

Earlier quoted context omitted.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

> Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs. In practice, if using a smart contract as a contract , the way you'd use a paper contract, then two parties would sit down and negotiate; draft the negotiated agreement into the form of a smart contract; and then agree (signatures, handshake, multi-sig deployment, whatever) that "what the smart contract doe…

Signing a paper contract doesn't mean you're bound to any bad thing that happens because of it for life. If a smart contract is so strict that eg it can be against public policy then it's not a real contract.

Re: Missing line in a smart contract leads to $10M hack

#198

Post by astrange »

sva_ wrote: post #124
Daishiman wrote: post #115

Earlier quoted context omitted.

Theorem provers require code for defining what you want to prove and the method through which you reach said proof. Proofs and theorems can have bugs.

But aren't proofs exact in what they state? So it wouldn't be the proof that would be faulty. It'd be the interpretation of what somebody thinks the proof means to them, and that'd be something you could entirely objectively reason/work on.

Proofs are programs and programs are proofs of themselves. The ways proofs might help you show that a program is "correct" (what you meant to say) are 1. the effect of writing it twice in different languages 2. that proofs may be more abstract and you can refine the program from them.

But a proof/formal methods can't actually prevent you from being wrong because you can be wrong at any meta level.

Re: Missing line in a smart contract leads to $10M hack

#199

Post by cblconfederate »

This is why Defi wins: people realize early that their contracts have to be space-proof and nuclear-proof, or else the punishment can be more than fatal. But the bigger win is there s no bailout or stimulus. Insurance is an additional level on top of the chain

Re: Missing line in a smart contract leads to $10M hack

#200

Post by astrange »

lazide wrote: post #99
unyttigfjelltol wrote: post #75

Earlier quoted context omitted.

Well ... first, what's described in the article isn't that smart. It's actually dumb. If we describe these code-as-law thingys as 'dumb contracts' it is crystal clear that 'YES' this is a dumb contract and any sane judge presented with one may well decide to give the participants exactly what they deserve, just like paper-based 'dumb contracts.' The key innovation here is that we've gone to the remedy residing in pro…

Looking at the various issues that have come up with these ‘smart contracts’ (aka the ethereum DAO issues up until now), I think anyone who wants to write one should be automatically excluded from being allowed to do so.

They should maybe be forced to learn what a dependent type system is so they can regret that their smart contracts are written in a language with no safety features.
Post reply on HN