Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

231–240 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#231

Post by stjohnswarts »

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

So I wonder if someone watches the block chains for these kinds of bugs then swoop in when it happens.

Re: Missing line in a smart contract leads to $10M hack

#232

Post by stjohnswarts »

rtpg wrote: post #215
adflux wrote: post #172

Earlier quoted context omitted.

And a judge will decide whether the contract was signed under duress. Who will judge smart contracts?

A judge! A judge can just claim jursidiction! Imagine if Goldman Sachs did this. A judge can say "look, you can follow our rules or we start seizing assets etc". And when you're sitting around trying to be anonymous, well... you're doing everything on a public ledger, so now you're extremely restricted. Hell, courts/legislative bodies could even go down the "force all miners within their jurisdiction to rollback an u…

Well if you don't know who the person who got the money is then there's not much a judge can do.

Re: Missing line in a smart contract leads to $10M hack

#233

Post by crooked-v »

jollybean wrote: post #57
chriswait wrote: post #12

Earlier quoted context omitted.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

It's worse than that. Contracts are not code. It's a complete misunderstanding to posit them as such. Contracts depend first and foremost upon the legal regime in which they are valid. Every jurisdiction has rules, precedence, language means specific things. There is quite a bit of variability in this stuff, which is why we have lawyers. And Judges. Putting a contract into a crypto ... is basically pointless. There's…

The most obvious example for 'contracts are not code': the most airtight contract in the world can get quickly voided in court if it turns out one of the parties was actually a minor at the time of signing, even if they hid that fact or didn't actually know it.

Re: Missing line in a smart contract leads to $10M hack

#234

Post by NateEag »

o-__-o wrote: post #216
intricatedetail wrote: post #182

Earlier quoted context omitted.

Why contracts don't have a test suite that verifies them?

They do, if you don’t have 100% code coverage then you get what you get

100% code coverage isn't even close to a guarantee of correctness.

Re: Missing line in a smart contract leads to $10M hack

#235

Post by crooked-v »

stjohnswarts wrote: post #232
rtpg wrote: post #215

Earlier quoted context omitted.

A judge! A judge can just claim jursidiction! Imagine if Goldman Sachs did this. A judge can say "look, you can follow our rules or we start seizing assets etc". And when you're sitting around trying to be anonymous, well... you're doing everything on a public ledger, so now you're extremely restricted. Hell, courts/legislative bodies could even go down the "force all miners within their jurisdiction to rollback an u…

Well if you don't know who the person who got the money is then there's not much a judge can do.

Judges have tremendous amounts of discretionary power when carrying out the law, and a good judge certainly isn't going to just give up because the identity of one party isn't immediately known. The example already given of ordering that the transaction be reversed on the network (even if that involves compelling uninvolved people to cooperate with the process) is entirely plausible.

Re: Missing line in a smart contract leads to $10M hack

#236

Post by ArchD »

timoth3y wrote: post #146
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

The power of the court to 'right' the 'wrong' (e.g. by reversing transactions) is limited on a decentralized public blockchain governed by pure code that crosses national borders. This strengthens the position "the code is the law".

On the other hand, this feature is a motivation for centralists to take issues with public decentralized blockchains.

Re: Missing line in a smart contract leads to $10M hack

#237

Post by crooked-v »

rawtxapp wrote: post #192
jypepin wrote: post #134

Earlier quoted context omitted.

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

I think the way to look at is that, smart contracts are not behind the contracts/agreements, smart contracts are the contracts/agreements. Once you realize that, if a smart contract executed successfully then the operation was legitimate. Of course, ethereum forked when a big hack happened, but it won't be forking for every hack, otherwise it's not really a reliable blockchain.

A smart contract can't actually be the contract (and may end up not even vaguely correspond to the resulting situation in the real world) because the legal system alters or voids contracts all the time. A judge who decides that your smart contract has an unconscionable clause isn't going to care about what you say about immutable code - he's going to tell you to fix it in the real world or else.

Re: Missing line in a smart contract leads to $10M hack

#238

Post by arilotter »

crooked-v wrote: post #235
stjohnswarts wrote: post #232

Earlier quoted context omitted.

Well if you don't know who the person who got the money is then there's not much a judge can do.

Judges have tremendous amounts of discretionary power when carrying out the law, and a good judge certainly isn't going to just give up because the identity of one party isn't immediately known. The example already given of ordering that the transaction be reversed on the network (even if that involves compelling uninvolved people to cooperate with the process) is entirely plausible.

Are judges going to manage to identify and compel enough miners (or devs, i guess, assuming the miners adopt the compelled transaction revert version) to have enough hash power to win a fork?

Re: Missing line in a smart contract leads to $10M hack

#239

Post by crooked-v »

nkrisc wrote: post #168
philangist wrote: post #127

Earlier quoted context omitted.

All exploits are technically some version of “just doing what the code allows”, I don’t see how that would change whether or not a hack/theft actually occurred.

Seems like these smart contacts should include written contracts as well to outline what the code is intended to do, if you can’t rely on the code.

At that point, why have the smart contract? If you want 'automation', just get a trustworthy third party to execute the financials for you , as is already done with (for example) most real estate contracts.

Re: Missing line in a smart contract leads to $10M hack

#240

Post by solveit »

crooked-v wrote: post #239
nkrisc wrote: post #168

Earlier quoted context omitted.

Seems like these smart contacts should include written contracts as well to outline what the code is intended to do, if you can’t rely on the code.

At that point, why have the smart contract? If you want 'automation', just get a trustworthy third party to execute the financials for you , as is already done with (for example) most real estate contracts.

> trustworthy third party

Merits aside, sidestepping the need for this is the whole point of blockchain.

Post reply on HN