Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

221–230 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#221

Post by drdrey »

sidlls wrote: post #125
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

The legal system isn't a computer that implements the law strictly to the letter based on only factual information. There are "reasonable person" standards, allowance/tolerance for mistakes, etc. Relevant to this discussion is rules covering mistaken deposits to a bank account: recipients are obliged to return the assets, not shrug their shoulders and use the cash while they proclaim "Bank's fault; they're responsibl…

Actually didn’t a judge just rule Citibank wasn’t entitled to get its money back after a mistake like that?

https://www.forbes.com/sites/jonathanponciano/2021/02/16/cit...

Re: Missing line in a smart contract leads to $10M hack

#222

Post by anoncake »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

The "point" of smart contracts is that the code is the contract. The "victim" voluntarily gave that money away.

Re: Missing line in a smart contract leads to $10M hack

#223

Post by sio8ohPi »

drdrey wrote: post #221
sidlls wrote: post #125

Earlier quoted context omitted.

The legal system isn't a computer that implements the law strictly to the letter based on only factual information. There are "reasonable person" standards, allowance/tolerance for mistakes, etc. Relevant to this discussion is rules covering mistaken deposits to a bank account: recipients are obliged to return the assets, not shrug their shoulders and use the cash while they proclaim "Bank's fault; they're responsibl…

Actually didn’t a judge just rule Citibank wasn’t entitled to get its money back after a mistake like that? https://www.forbes.com/sites/jonathanponciano/2021/02/16/cit...

Citi accidentally paid back lenders, rather than accidentally sending money to some unrelated party. This doesn't seem relevant.

Re: Missing line in a smart contract leads to $10M hack

#224

Post by crooked-v »

derefr wrote: post #202
astrange wrote: post #197

Earlier quoted context omitted.

Signing a paper contract doesn't mean you're bound to any bad thing that happens because of it for life. If a smart contract is so strict that eg it can be against public policy then it's not a real contract.

Note that in my above statement, the "network-consensus abstract machine" is the same kind of thing as "a judge": namely, both an arbitrator, and an official that declares certain clauses objectively void even if both parties like them. See also: the DAO hard-fork that created Ethereum Classic.

Except it's not the same kind of thing, because an actual judge has legal power. Your abstract machine is going to be sidelined pretty quickly if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect.

Re: Missing line in a smart contract leads to $10M hack

#225

Post by crooked-v »

lmm wrote: post #217
jypepin wrote: post #134

Earlier quoted context omitted.

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

So what's the difference between "hacking" and "following the contract"? The whole point of a smart contract is that the code is the contract.

Except it can't be, because the legal system can and regularly does adjust or override the terms of contracts for a variety of reasons.

Re: Missing line in a smart contract leads to $10M hack

#226

Post by drdrey »

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

Can the deployment and the initialization happen in the same transaction? Or would it be in principle possible for a 3rd party to swoop in and initialize it ?

Re: Missing line in a smart contract leads to $10M hack

#228

Post by vmception »

tylersmith wrote: post #135
secondcoming wrote: post #102

Earlier quoted context omitted.

> Contacted Binance Authorities immediately to block the hacker(s) fund transfers I don't understand this part. I thought crypto was decentralised and so nobody controls anything. Yet, this suggests the opposite... some entitiy somewhere can shut you out on a whim.

Nobody can force you to do business with them. Binance can't stop the transaction they can just not do business with that person.

lol wrong. The validators can coordinate to make a transaction invalid on that blockchain. They wont though because of theyll lose a lot of confidence in their network, and users can exit their funds across the bridge very quickly.

Re: Missing line in a smart contract leads to $10M hack

#229

Post by crooked-v »

anoncake wrote: post #222
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

The "point" of smart contracts is that the code is the contract. The "victim" voluntarily gave that money away.

That only holds right up until a judge disagrees and orders the transfer reversed.

Re: Missing line in a smart contract leads to $10M hack

#230

Post by vmception »

secondcoming wrote: post #102
latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

> Contacted Binance Authorities immediately to block the hacker(s) fund transfers I don't understand this part. I thought crypto was decentralised and so nobody controls anything. Yet, this suggests the opposite... some entitiy somewhere can shut you out on a whim.

That blockchain is controlled by 21 validators of which Binance itself is many.

They wont and dont block the transaction though. The bridges to other blockchains are very fast, and hacker would be prudent to move their funds immediately to a blockchain with greater security.

Post reply on HN