Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#281

Post by alkonaut » Mon, May 17, 2021, 7:25 AM UTC

duxup wrote: post #27

Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

First thing I do when changing or creating a thing. Try to figure out WHY things are the way they are and run through some scenarios. It's not a bullet proof system, I don't always do it well... but it can help having to re-invent some of the more obvious aspects of the wheel. The whole blockchain ecosystem seems like a long drawn out lesson as to why at least some systems we have are kinda big, bulky, involve a lot…

> First thing I do when changing or creating a thing. Try to figure out WHY things are the way they are and run through some scenarios.

As a developer I often stumble across code and systems that are superficially idiotic. I just think "Why isn't this doing X instead?".

Here there are two approaches 1) blindly change the thing to make it better 2) Try to understand why it is wrong, and what led to the legacy design.

The sensible thing might be 2, but its also soul-crushingly boring. So I obviously always do 1. After ripping out some code and replacing it with shiny new code, you invariably find the edge cases that led to the legacy design.

They will show up as bugs, or edge cases missing. After a while, you will have iterated so that your solution might look something like the original (hopefully slightly better) but the important thing is you now have a system you understand fundamentally. You basically traded a few regressions for fundamental understanding of a system

Re: Missing line in a smart contract leads to $10M hack

#282

Post by thaumasiotes » Mon, May 17, 2021, 7:26 AM UTC

elcomet wrote: post #273

judge2020 wrote: post #268

Earlier quoted context omitted.

Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.

They can order you to give back the money. And like in real life, you can refuse to tell where the money is hidden.

Also like in real life, you might have spent the money.

Re: Missing line in a smart contract leads to $10M hack

#283

Post by benplumley » Mon, May 17, 2021, 8:08 AM UTC

IncRnd wrote: post #183

meowkit wrote: post #123

Earlier quoted context omitted.

In the future I think smart contracts will be standardized - these kinds of things won’t happen unless you’re trying something new. If that’s the case there will probably be services/testnets to properly vet it before launching on a mainnet.

> these kinds of things won’t happen unless you’re trying something new. Unfortunately, that's probably not going to be what occurs. Even today, there are constantly bugs discovered and fixed, some critical, that have been latent in systems for decades - as in since the last century. The recent FragAttacks against WiFi systems come to mind.

A bug-free version of ProfitSharingRewardPool is much more plausible than a bug-free version of WiFi, or SSL, because the former is less than 1000 lines of code and apparently had an unintended $10M bug bounty.

Re: Missing line in a smart contract leads to $10M hack

#284

Post by lordnacho » Mon, May 17, 2021, 8:11 AM UTC

hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

IIRC the DAO "hack" was also caused by an init that could be called twice. Kinda interesting how this could happen again. I haven't looked at the smart contract as I'm on a phone but it's imagine you'd at the very least put a comment explaining what the purpose of stopping the reinit was.

Re: Missing line in a smart contract leads to $10M hack

#285

Post by thatjamesdude » Mon, May 17, 2021, 8:14 AM UTC

timoth3y wrote: post #146

andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

>The theory is that the code is the law. There is no theft.

What rubbish. You cannot claim "the computer let me do it" and expect to be let off for that. That's an extreme absurdity and is absolutely not how the law works.

Contrary to what a lot of people seem to think: Crypto is not "outside" the law in any way. It is a token of value (like FIAT currency) and there are plenty of laws that cover use cases from capital gains taxes to money laundering to, you guessed it, theft.

Re: Missing line in a smart contract leads to $10M hack

#286

Post by thatjamesdude » Mon, May 17, 2021, 8:16 AM UTC

judge2020 wrote: post #268

missblit wrote: post #195

Earlier quoted context omitted.

It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review. Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.

Comments like this make me think we software engineers live in a different world.

>unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions

You think so, do you? "The law is the because that's what the law says it is". It might not be possible now (and I'm not sure I believe that, you can garnish foreign wages) but it will be if the need arises.

"But the code" yeah, no, that's a silly argument that only applies to cyberspace and not the physical world you occupy

Re: Missing line in a smart contract leads to $10M hack

#287

Post by TeMPOraL » Mon, May 17, 2021, 8:46 AM UTC

anoncake wrote: post #222

andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

The "point" of smart contracts is that the code is the contract. The "victim" voluntarily gave that money away.

> The "victim" voluntarily gave that money away.

This explanation, much like its sibling "voluntary transaction" defense of market failures and economic coercion, sounds to me like a bully who hits their victim with their own arm, and then exclaims, "stop punching yourself!".

Re: Missing line in a smart contract leads to $10M hack

#288

Post by hypertele-Xii » Mon, May 17, 2021, 8:50 AM UTC

timoth3y wrote: post #146

andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

A smart contract is only as smart as the programmers writing it.

Re: Missing line in a smart contract leads to $10M hack

#289

Post by anoncake » Mon, May 17, 2021, 9:05 AM UTC

TeMPOraL wrote: post #287

anoncake wrote: post #222

Earlier quoted context omitted.

The "point" of smart contracts is that the code is the contract. The "victim" voluntarily gave that money away.

> The "victim" voluntarily gave that money away. This explanation, much like its sibling "voluntary transaction" defense of market failures and economic coercion, sounds to me like a bully who hits their victim with their own arm, and then exclaims, "stop punching yourself!".

If the person who lost the money had to use smart contracts, you've got a point. If they used them because they thought they were a good idea, I hope they learned their lesson.

Re: Missing line in a smart contract leads to $10M hack

#290

Post by rorykoehler » Mon, May 17, 2021, 9:12 AM UTC

timoth3y wrote: post #146

andrewfromx wrote: post #103

Earlier quoted context omitted.

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

The code is the spec. Any other documentation is a compression of the spec.