Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#211

Post by Daishiman » Mon, May 17, 2021, 12:45 AM UTC

sva_ wrote: post #162

Daishiman wrote: post #151

Earlier quoted context omitted.

But the human world is not exact and full of context. Even mathematical.proofs exist within a context of an axiomatic system, known proofs, and various domain assumptions. I remember that in my computability theory class, defining the right proof was by far the most difficult task. And this was in very small, closed systems.

> But the human world is not exact and full of context. That is of course correct. However, it was my impression that the contract mentioned in the OP was completely on the blockchain, and therefore completely deterministic (no oracles or whatever.) Hence I figured it could've been proved with absolute rigor, in which case it should've been possible to formally prove the correctness. I'll be honest, I didn't look thr…

It's possible that maybe, just maybe, the interior world of some crypto scheme may have sufficient formal proofs.

It doesn't change the fact that the crypto system lives in a human world were law, politics and attacks can coerce you to do a lot of things and the formality of the system is just irrelevant.

Re: Missing line in a smart contract leads to $10M hack

#212

Post by chrisco255 » Mon, May 17, 2021, 12:48 AM UTC

mondoveneziano wrote: post #97

chrisco255 wrote: post #92

Earlier quoted context omitted.

While this startup smart contract got hacked, there are plenty of reputable products in the space that have never been hacked and have upwards of $80 billion locked up right now: https://defipulse.com/ The top projects: Aave, Compound, Uniswap, etc. have been audited several times over, publish their smart contract source code for further review, offer millions of dollars in bug bounties and inherently the locked val…

> You can also take out insurance for the biggest protocols for additional protection. Then what's the point? I can already take out insurance in the "traditional" banking system (e.g. every checking account has FDIC).

A number of points:

1) Decentralized finance is extensible, pluggable, open, auditable, and non-custodial. This means, when you want to integrate, say a popular crypto money market like Aave into your application, you don't need Aave's permission. You can just have your application interact with Aave's smart contract. (https://aave.com/) 2) When a smart contract is properly engineered, you retain full 24/7 access to your funds with 100% uptime guaranteed by the base chain that it sits on (Ethereum in most cases). You do not get Robinhood-like situations where all of a sudden they turn the buy button off on some stock like what happened two months ago. 3) Everyone has access to the same information. It's all on the public blockchain. There are no backroom deals, it's all in open-source code on the chain. It's all auditable. 4) The yields on so-called stablecoins (cryptos that are pegged to some traditional currency, like USD) are higher on DeFi. You can earn 7 or 8% or more on DeFi, because you are effectively acting as your own peer-to-peer bank and lending out your funds directly to a collateralized third party.(https://compound.finance/) 5) Decentralized finance has already introduced things like decentralized exchanges, which allow people to crowdsource liquidity. You can earn a yield for participating in a liquidity pool on Uniswap, for example (https://uniswap.org/) 6) There are additional exciting applications in this space, it's currently undergoing a Cambrian explosion of activity similar to the early internet. I cannot explain all of this in a short-form HN response, but there's real value there. Real innovation that will change finance forever. If you want to learn more, please check out:

1) https://newsletter.thedefiant.io/ 2) https://newsletter.banklesshq.com/

Re: Missing line in a smart contract leads to $10M hack

#213

Post by TimJRobinson » Mon, May 17, 2021, 1:00 AM UTC

secondcoming wrote: post #102

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

> Contacted Binance Authorities immediately to block the hacker(s) fund transfers I don't understand this part. I thought crypto was decentralised and so nobody controls anything. Yet, this suggests the opposite... some entitiy somewhere can shut you out on a whim.

This is on the Binance chain which is a fork of Ethereum that is partially centralized. A lot of crypto purists refuse to use it for this reason.

Re: Missing line in a smart contract leads to $10M hack

#214

Post by TimJRobinson » Mon, May 17, 2021, 1:11 AM UTC

sireat wrote: post #165

Looks like there are plenty of more DeFi hacks/internal fraud/incompetence https://www.rekt.news/leaderboard/ Setting aside the hacks, what good is DeFi anyhow for those outside crypto space? Seems DeFi currently serve two main functions. 1. Crypto backed loans - main purpose being crypto speculation / possibly some dubious tax benefits 2. Decentralized exchanges - nice for those into crypto but not for Joe Sixpack.

You could have said similar about the internet in 1990. It was an easily hackable network used only by geeks to share research papers and chat. Technologies start to help small niches and grow over time.

The DeFi space could eventually grow to replace any firm that acts as a middleman for digital trades: Robinhood, Wealth front etc.

Re: Missing line in a smart contract leads to $10M hack

#215

Post by rtpg » Mon, May 17, 2021, 1:18 AM UTC

adflux wrote: post #172

mondoveneziano wrote: post #161

Earlier quoted context omitted.

That's not enough, all parties would have to have 100% awareness and understanding of the smart contract, detail by detail. Real life contracts sometimes turn out to have non-enforceable clauses within our legal framework, or may be entirely invalid if, for example, signed under pressure or false pretense.

And a judge will decide whether the contract was signed under duress. Who will judge smart contracts?

A judge! A judge can just claim jursidiction!

Imagine if Goldman Sachs did this. A judge can say "look, you can follow our rules or we start seizing assets etc".

And when you're sitting around trying to be anonymous, well... you're doing everything on a public ledger, so now you're extremely restricted.

Hell, courts/legislative bodies could even go down the "force all miners within their jurisdiction to rollback an unwanted transaction". You think miners care enough to make a stand on this kind of stuff?

Unless you're going to like.... download your consciousness onto the blockchain you are still just as liable to being told by a court what to do as anything else.

Re: Missing line in a smart contract leads to $10M hack

#216

Post by o-__-o » Mon, May 17, 2021, 1:19 AM UTC

intricatedetail wrote: post #182

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

Why contracts don't have a test suite that verifies them?

They do, if you don’t have 100% code coverage then you get what you get

Re: Missing line in a smart contract leads to $10M hack

#217

Post by lmm » Mon, May 17, 2021, 1:21 AM UTC

jypepin wrote: post #134

jlarocco wrote: post #126

Earlier quoted context omitted.

I don't follow any of this too closely, but I thought the whole idea was to get rid of courts by using precisely codified contracts? What's the advantage if the result is the same system as before (lawsuits, courts, etc.) with added complexity of "smart contracts"?

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

So what's the difference between "hacking" and "following the contract"? The whole point of a smart contract is that the code is the contract.

Re: Missing line in a smart contract leads to $10M hack

#218

Post by naikrovek » Mon, May 17, 2021, 1:30 AM UTC

doopy1 wrote: post #205

naikrovek wrote: post #159

Earlier quoted context omitted.

The Internet was something new that provided new capabilities and new abilities to humanity with extremely high reliability, and at a scale that didn't exist prior to that. Cryptocurrency doesn't provide any new capabilities at all. Money and trading existed before. Price fluctuations existed before. Markets existed before. Buying and selling existed before. But now, because it's so new, and because it's not technica…

"Cryptocurrency doesn't provide any new capabilities at all." The new capability that cryptocurrency provides is that money is now "programmable" it's a fusion between money and software. Wether or not this is a benefit, is subjective, but IMO it's a humble beginning with epic potential.

A) Cryptocurrency is not money. It's not even a recognized currency. It's a virtual item. You can't hold it in your hand. When you spend it, it gets converted to the actual currency in your location and then THAT money is spent on the item you're buying. You don't buy anything with cryptocurrency, you only trade it for real money. Cryptocurrency is not money.

B) it's not programmable; it's an inert thing; proof of work or storage. Programs generate it according to rules that people set. (Real money is created according to rules that people set, as well, so it's "programmable" too, if you look at it in the same way.)

There is nothing new about cryptocurrency.

I could dump $1000 into bushels of corn and get the same exact effect. To grow corn you need to have space to grow it, fertile soil to grow it in, and you need to work, over time, to plant it, fertilize it, and to control pests and invasive weeds. At the end of the growing season, you harvest and you store the corn in a grain silo, and you wait for the price to go up to a point you're comfortable with before you sell it.

Same with wheat, soybeans, livestock, real-estate and so on. None of those things are currency, but at least they're tangible, and they can all be traded for money, just like cryptocurrency.

There is nothing new about cryptocurrency.

Re: Missing line in a smart contract leads to $10M hack

#219

Post by RhodoGSA » Mon, May 17, 2021, 1:34 AM UTC

yaitsyaboi wrote: post #46

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

tldr; there is. Also, Gavin wood the writer of the Solidity programming language left etheruem and founded polkadot, writting substrate and ink in the process.

Solidity is just a programming language to call functions and code on the blockchain. You can theoretically write it in any language but need to compile down to EVM at some point.

Solidity wasn't writting from the ground up to be safe and secure. There are a number of projects like vyper, which is a pythonesque language that compiles to the EVM. It's more centered around safety.

Re: Missing line in a smart contract leads to $10M hack

#220

Post by RhodoGSA » Mon, May 17, 2021, 1:37 AM UTC

lottin wrote: post #18

paulpauper wrote: post #5

Why do ransomware when you can just find exploit and get away without having tainted crypto and also make much more $ too. Defi is such a big gift to hackers. Probably $100 million stolen total in past 2 year. These protocols and contracts are so complicated that such hacks are inevitable and more to come.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

Not only unlawful, but unknowable. Monero and other privacy focused coins contain no heads of address names. Once it's in monero, you can create a new wallet and send it there and no one would ever be the wiser.