Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

241–250 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#241

Post by solveit »

fpig wrote: post #201
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

I think that's the wrong question. If a court can decide (and enforce) what a smart contract "really means", then smart contracts don't really bring much to the table. It doesn't matter what the court would actually decide. The main thing smart contracts bring to the table is a mechanism of enforcing contracts without government involvement or control. The contract gets enforced, period. The parties can be anonymous,…

Automation is valuable in itself. Imagine a system of thousands of smart contracts interacting with each other millions of times a second. No court system is (currently) equipped to deal with that except in the most superficial way.

Re: Missing line in a smart contract leads to $10M hack

#242

Post by derefr »

crooked-v wrote: post #224
derefr wrote: post #202

Earlier quoted context omitted.

Note that in my above statement, the "network-consensus abstract machine" is the same kind of thing as "a judge": namely, both an arbitrator, and an official that declares certain clauses objectively void even if both parties like them. See also: the DAO hard-fork that created Ethereum Classic.

Except it's not the same kind of thing, because an actual judge has legal power. Your abstract machine is going to be sidelined pretty quickly if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect.

I meant that the abstract machine's behavior is dictated by the legislation of the "society" of node operators, in the same way that the judge's behavior is dictated by the legislation of the society you live in. They're both appointed arbiters. And they've both got the responsibility of enforcing, among other things, certain 'inalienable rights' — i.e. making certain contracts (or certain legal motions based on the wording of a contract) invalid, if they would be greatly damaging to one party in a way deemed unacceptable to "society."

> if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect

A judge can't tell a distributed network that has equal presence in countries with mutually-antagonistic economies what to do. They can at most ban the network's nodes from being operated in their country — but people in that country can still continue to use the network through a VPN.

Think of it like offshore gambling, except that it's 'offshore' respective to every country on Earth, and there's nowhere a sufficiently-motivated Navy can send a bunch of boats to shoot at it, either.

Much of the economic value of blockchains comes from the fact that they allow private citizens of countries that have no trade/treaty compatibility (e.g. countries actively at war with one-another), to have a basis for trust allowing them to enter into contracts with one-another. The basis for this trust is the virtual 'overlay' legal framework of "whatever the software the majority of node operators decide to install says, goes."

Of course, if you and I are both in America, and we enter into a smart-contract contract, then we're also entering into a civil legal contract evidenced by that smart contract (just like we're entering into a legal contract if we make a verbal "handshake agreement.")

But if we have a compatible legal framework to operate in, that grants our contract as valid†, then why would we even need a blockchain?

† (A common reason to not grant a civil contract as valid: because it's a contract for purchase of illegal goods. In such cases, you don't have a compatible legal framework to operate in, even if you're operating in the same country.)

Re: Missing line in a smart contract leads to $10M hack

#243

Post by [deleted] »

derefr wrote: post #202
astrange wrote: post #197

Earlier quoted context omitted.

Signing a paper contract doesn't mean you're bound to any bad thing that happens because of it for life. If a smart contract is so strict that eg it can be against public policy then it's not a real contract.

Note that in my above statement, the "network-consensus abstract machine" is the same kind of thing as "a judge": namely, both an arbitrator, and an official that declares certain clauses objectively void even if both parties like them. See also: the DAO hard-fork that created Ethereum Classic.

[deleted]

Re: Missing line in a smart contract leads to $10M hack

#244

Post by crooked-v »

ArchD wrote: post #236
timoth3y wrote: post #146

Earlier quoted context omitted.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

The power of the court to 'right' the 'wrong' (e.g. by reversing transactions) is limited on a decentralized public blockchain governed by pure code that crosses national borders. This strengthens the position "the code is the law". On the other hand, this feature is a motivation for centralists to take issues with public decentralized blockchains.

Except it's not, really, because a judge who's unhappy at it isn't going to care about "the code is the law" talk. They're just going to tell people to fix it or else, and all being in another country usually means is that the asset seizures will take longer.

Re: Missing line in a smart contract leads to $10M hack

#245

Post by chrisco255 »

_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

There's a lot of forks of existing code out there. Some of the people using the existing forked code don't understand how it really works, because they didn't write it and didn't bother to study it in detail. This is especially common on the Binance Smart Chain, which itself is a fork of Ethereum. The pitfalls will continue to happen, because it is a completely open system. The best, most audited and long-lived projects will rise to the top over time. But there will be a long tail of total flops or projects that get exploited in some way along the way. It is the Wild West, but you should understand that if you put your money into a smart contract, you are risking those funds. It's a powerful abstract, but with great power comes great responsibility. Do due diligence, don't invest a lot into new projects, have more faith in the ones that have held up over the long haul, and buy insurance when you can.

Re: Missing line in a smart contract leads to $10M hack

#246

Post by bouncycastle »

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

Reminds me of the 2nd "Parity wallet hack", where they forgotten to initialize the contract, despite extensive audits after a previews hack.

That one lost around $154 million USD at the time. The hacker didn't get anything though, the funds became permanently trapped.

Imagine having a bad day at work? https://hackernoon.com/parity-wallet-hack-2-electric-boogalo...

Re: Missing line in a smart contract leads to $10M hack

#247

Post by crooked-v »

derefr wrote: post #242
crooked-v wrote: post #224

Earlier quoted context omitted.

Except it's not the same kind of thing, because an actual judge has legal power. Your abstract machine is going to be sidelined pretty quickly if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect.

I meant that the abstract machine's behavior is dictated by the legislation of the "society" of node operators, in the same way that the judge's behavior is dictated by the legislation of the society you live in. They're both appointed arbiters. And they've both got the responsibility of enforcing, among other things, certain 'inalienable rights' — i.e. making certain contracts (or certain legal motions based on the…

> A judge can't tell a distributed network that has equal presence in countries with mutually-antagonistic economies what to do. They can at most ban the network's nodes from being operated in their country — but people in that country can still continue to use the network through a VPN.

The distributed network is to some degree a red herring here: in most cases, an unhappy judge would be issuing orders compelling behaviors from specific people (e.g. "you're going to send that $10M back to the person who had it"), and if that contradicts the code, too bad - do it some other way.

> Think of it like offshore gambling, except that it's 'offshore' respective to every country on Earth

Except it's not: if you're in Iraq and I'm in Brazil and we enter into a contract (as would be legally understood in either or both countries), we are now in a contract under the jurisdictions of both countries.

Even being literally "offshore" doesn't really matter: almost every country will claim jurisdiction over its own citizens if they're not already under the jurisdiction of some other nation (by way of being on a ship registered under that nation's flag). You can't actually escape the law just by going out into the middle of the ocean.

Re: Missing line in a smart contract leads to $10M hack

#248

Post by fake-name »

timoth3y wrote: post #146
andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

> Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

In other words, it doesn't work.

Re: Missing line in a smart contract leads to $10M hack

#249

Post by bouncycastle »

cryptica wrote: post #176

I never understood the point of smart contracts. Why not just launch a new blockchain or decentralized application by forking code and launching nodes? That way you don't need to pay Ethereum fees and you get a lot more flexibility - Also, your project will not be constrained by Ethereum's scalability limits and you won't have to pay fees to subsidize the popularity of other projects which are running on the same pla…

Because contracts can call other contracts in the same transaction if they are on the same chain. This is what is known as "composition", and it's very handy for building powerful apps on existing proven primitives (such as aggregators, decentralized exchanges, lending protocols). Also, once you launch a contract on Ethereum, it's accessible to millions who already have an Ethereum wallet with ETH loaded. On-boarding to a new chain would be more of an uphill battle.

If you're worried about tx fees, there are already plenty of L2 solutions available and more coming online soon!

Re: Missing line in a smart contract leads to $10M hack

#250

Post by intotheabyss »

Daishiman wrote: post #120
ryanmarsh wrote: post #113

Earlier quoted context omitted.

Even as a crypto maximalist I believe code can create tyrannies of it's own kind. Take the example a story posted on HN some time ago of code Hertz wrote reporting cars not turned in as stolen and getting people (unfairly) arrested. If I call my bank, they can fix a mistake, no matter how bad, because they own "truth". I think what will end up happing is every contract will have the ability for some authorized key to…

So then why even bother with DeFi when what you're doing is just relaying trust back to a centralised human party? It's just regular finance with extra steps.

Except it's not at all. You can take synthetic TSLA shares and deposit those as collateral to mint stablecoins as a loan. Where else can you do that from your web browser at 10am on a Sunday and confirmed in 30 seconds?
Post reply on HN