Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#261

Post by astrange » Mon, May 17, 2021, 4:39 AM UTC

derefr wrote: post #202

astrange wrote: post #197

Earlier quoted context omitted.

Signing a paper contract doesn't mean you're bound to any bad thing that happens because of it for life. If a smart contract is so strict that eg it can be against public policy then it's not a real contract.

Note that in my above statement, the "network-consensus abstract machine" is the same kind of thing as "a judge": namely, both an arbitrator, and an official that declares certain clauses objectively void even if both parties like them. See also: the DAO hard-fork that created Ethereum Classic.

I mean, I agree with that, but I don't think having to restart the entire financial system or get 51% approval to edit any existing program is a good way to deal with problems like this.

Re: Missing line in a smart contract leads to $10M hack

#262

Post by anonytrary » Mon, May 17, 2021, 4:41 AM UTC

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

At least a smart contract can be unit tested thoroughly, whereas a 20 page legal document cannot be.

Re: Missing line in a smart contract leads to $10M hack

#263

Post by ddingus » Mon, May 17, 2021, 4:41 AM UTC

Two things bother me:

One is we put terms into contracts for when either party has to act in ways neither party may be happy about. This also helps to plan for risks.

Shit happens. That is what terms are for.

Missing a line = missing a term.

Where that happens, one can totally expect the other party to make good use of the terms as agreed.

Now comes the other major bother:

When employing written contracts, unless one is rolling their own, we have a body of law and language fairly well debugged and mutually understood.

Starting all that shit again as if code is law is going to be ultra painful! There was plenty of pain to establish the law we have today.

This all will be no different.

And still there will be law, so what is the point, unless the scope of terms is a subset of those allowed by law anyway?

Re: Missing line in a smart contract leads to $10M hack

#264

Post by moozilla » Mon, May 17, 2021, 4:52 AM UTC

twobuy wrote: post #188

coreyoconnor wrote: post #83

For fun I've been analyzing the contracts posted to r/CryptoMoonShots. Out of 20 posts 16 of them used the same contract; modulo names. This contract blocks everyone from removing funds but the owner. How? Is it some complex chunk of code that requires a delicate hack? No, not at all. There is literally a function with code, more or less, like: "If owner then OK here's all the funds". Anybody can check this in the co…

Typically the small amount of volume is by the contract owner attempting to pick up attention from momentum trading bots. This type of contract made a killing a few months ago. Basically miners trade by sandwiching orders in the mempool. You can search the 'salmonella' contract for more info.

https://github.com/Defi-Cartel/salmonella

Link for the lazy, super interesting read.

Re: Missing line in a smart contract leads to $10M hack

#265

Post by leifg » Mon, May 17, 2021, 5:04 AM UTC

Whenever I read guides on best practices for smart contracts there is always a line in there that says “consider all possible edge cases when developing…”

That sounds like smart advice but is also incredibly naive. If humans were able to foresee all possible inputs of any function we wouldn’t have spaceships exploding because of human errors.

I’m not sure how the smart contract dev community actually thinks of themselves but I personally don’t think I would ever be able to guarantee that my program works for all possible inputs (I’m a software engineer for more than 12 years).

So I am never surprised when a smart contract goes rogue and burns millions of dollars.

Re: Missing line in a smart contract leads to $10M hack

#266

Post by perryizgr8 » Mon, May 17, 2021, 5:09 AM UTC

So are they forking the chain again like they did the last time: https://www.coindesk.com/hard-fork-ethereum-dao

It was a similarly silly coding mistake the last time too.

Re: Missing line in a smart contract leads to $10M hack

#267

Post by lazide » Mon, May 17, 2021, 5:19 AM UTC

Daishiman wrote: post #130

lazide wrote: post #96

Earlier quoted context omitted.

If distributed and decentralized it also runs across a common issue with courts - the ‘make me’ problem. If someone buys product x from seller y, which is based on some decentralized ‘contract’ which is defacto enforced by every node of the network independently - and that product then produces a unjust outcome. You go to court, but what if Y is just a node on the network? And everyone involved is outside the courts…

If a US or EU court finds participants of said node criminally or financially liable and the political will exists (which will happen when someone important enough gets screwed over by a bad contract) they may be deported, face criminal prosecution, be banned from transacting with US financial entities, etc. Those things are not a small deal.

Lots of if’s and May’s there - and that’s true of a ton of things in crypto. It took nearly a decade before the SEC or IRS would even provide basic guidance on what the heck crypto even was in their eyes. Lots of deals gonna happen, lots of fortunes made and lost in that gap.

Re: Missing line in a smart contract leads to $10M hack

#268

Post by judge2020 » Mon, May 17, 2021, 5:22 AM UTC

missblit wrote: post #195

timoth3y wrote: post #146

Earlier quoted context omitted.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review. Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.

Re: Missing line in a smart contract leads to $10M hack

#269

Post by yborg » Mon, May 17, 2021, 5:33 AM UTC

ctur wrote: post #13

Someday some engineer working on these kinds of contracts will realize they can make a lot more money illegally by “accidentally” adding such bugs to the ecosystem then colluding with whoever exploits them. Actually it’s probably already happening.

Not sure I follow the 'illegal' part. Code is law here, right?

Re: Missing line in a smart contract leads to $10M hack

#270

Post by bryanrasmussen » Mon, May 17, 2021, 5:55 AM UTC

missblit wrote: post #195

timoth3y wrote: post #146

Earlier quoted context omitted.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review. Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

my reading of the code is law idea is that the code determines what is possible in the system, in this theory you can say that the law which code represents in more ironclad than most laws (at least common law) however this reading, which I thought was the default one, does not take into account bugs occurring in code or that people may not have thought rigorously enough to prevent people from doing not what the law intends but also what the code allows.