Missing line in a smart contract leads to $10M hack • Hacker News Board

Re: Missing line in a smart contract leads to $10M hack

#311

Post by withinboredom » Mon, May 17, 2021, 12:55 PM UTC

derefr wrote: post #252

crooked-v wrote: post #247

Earlier quoted context omitted.

> A judge can't tell a distributed network that has equal presence in countries with mutually-antagonistic economies what to do. They can at most ban the network's nodes from being operated in their country — but people in that country can still continue to use the network through a VPN. The distributed network is to some degree a red herring here: in most cases, an unhappy judge would be issuing orders compelling be…

> in most cases, an unhappy judge would be issuing orders compelling behaviors from specific people I'm presuming here that the unhappy judge is on the other end , is the thing. There's no judge local to the person “in the wrong” who actually has cause to go after them. Only the judge in the other country does. If I'm in Iraq and you're in Brazil, and I rip you off, and you have no idea who I am because I'm just some…

> If you rear-end someone, you don't owe that person money.

You are in for a world of hurt... that's not how this works. At all. https://en.wikipedia.org/wiki/Tort

Re: Missing line in a smart contract leads to $10M hack

#312

Post by judge2020 » Mon, May 17, 2021, 2:09 PM UTC

thatjamesdude wrote: post #286

judge2020 wrote: post #268

Earlier quoted context omitted.

Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.

Comments like this make me think we software engineers live in a different world. >unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions You think so, do you? "The law is the because that's what the law says it is". It might not be possible now (and I'm not sure I believe that, you can garnish foreign wages) but it will be…

It's 'legally' possible in that the court can say that you have to pay back some amount of crypto or some amount of USD, but with crypto it's not something that they can enforce in reality if the debtor doesn't cooperate. I'm saying the court can't force incoming transactions to be 60/40 split with 40% going to a different party, and the anonymity part of crypto means you can create a new wallet whenever you want to get paid without the court even knowing that you are receiving crypto as payment.

Re: Missing line in a smart contract leads to $10M hack

#313

Post by DennisP » Mon, May 17, 2021, 2:21 PM UTC

janoc wrote: post #118

sva_ wrote: post #112

Earlier quoted context omitted.

> because nobody likes to lose their live savings because they missed a semicolon. Yeah, but shouldn't it be possible that these things will be avoided by confirming the validity of the code with theorem provers such as Coq, Lean, or something similar, at some point in the not too distant future? That's what I've been wondering, without currently having any stakes in the game (and probably not until there's compellin…

That would cost an arm-and-leg, it would need to be done by someone who actually understands both the theory of proving algorithm corectness and the algo in question and systems like CoQ are from being able to prove large, complex systems. All the while traditional "non-distributed" finance simply uses sound engineering practices, such as code reviews, audits and sign-offs at much smaller cost and without requiring s…

Smart contracts are not large, complex systems, and formal proofs have already been used for them. There's not much code to verify and bugs are very expensive, so the economics easily justify doing it.

Re: Missing line in a smart contract leads to $10M hack

#314

Post by ryanmarsh » Mon, May 17, 2021, 2:57 PM UTC

Daishiman wrote: post #120

ryanmarsh wrote: post #113

Earlier quoted context omitted.

Even as a crypto maximalist I believe code can create tyrannies of it's own kind. Take the example a story posted on HN some time ago of code Hertz wrote reporting cars not turned in as stolen and getting people (unfairly) arrested. If I call my bank, they can fix a mistake, no matter how bad, because they own "truth". I think what will end up happing is every contract will have the ability for some authorized key to…

So then why even bother with DeFi when what you're doing is just relaying trust back to a centralised human party? It's just regular finance with extra steps.

With DeFi you can side step the non-essential bits of centralization and delay in finance and investing. There's quite a bit of unnecessary complexity and opaqueness in finance and investing today, which only serve to protect monopoly and hegemony.

Re: Missing line in a smart contract leads to $10M hack

#315

Post by ryanmarsh » Mon, May 17, 2021, 2:58 PM UTC

Daishiman wrote: post #257

intotheabyss wrote: post #250

Earlier quoted context omitted.

Except it's not at all. You can take synthetic TSLA shares and deposit those as collateral to mint stablecoins as a loan. Where else can you do that from your web browser at 10am on a Sunday and confirmed in 30 seconds?

Clearly the demand for this isn't exactly as important as anyone claims given the abject failure of the microloans industry to pan out. The problem with loans generally isn't that you can have one at 10Am on a Sunday morning.

I've always thought the retail lending side of DeFi was silly. The risk is too high. Screenshot this, mortgage backed securities will be the first major success of blockchain debt based products.

Re: Missing line in a smart contract leads to $10M hack

#316

Post by withinboredom » Mon, May 17, 2021, 5:21 PM UTC

logicalmonster wrote: post #208

sidlls wrote: post #125

Earlier quoted context omitted.

The legal system isn't a computer that implements the law strictly to the letter based on only factual information. There are "reasonable person" standards, allowance/tolerance for mistakes, etc. Relevant to this discussion is rules covering mistaken deposits to a bank account: recipients are obliged to return the assets, not shrug their shoulders and use the cash while they proclaim "Bank's fault; they're responsibl…

Nobody can predict the future of how business will get done years down the road, but I think Smart Contracts can potentially utilize both Oracles (systems like Chainlink) to provide objective data about the world for triggering Smart Contract logic, and Arbitration systems (something along the lines of Kleros) for humans to make subjective judgements about human concepts like "reasonableness" in contracts. A very con…

But if a bug allows you to delete the contract. It’s useless. In the real world, a contract exists unless all parties agrees it doesn’t. A “loophole” won’t cause money to be removed from escrow unilaterally.

Re: Missing line in a smart contract leads to $10M hack

#317

Post by withinboredom » Mon, May 17, 2021, 5:23 PM UTC

solveit wrote: post #240

crooked-v wrote: post #239

Earlier quoted context omitted.

At that point, why have the smart contract? If you want 'automation', just get a trustworthy third party to execute the financials for you , as is already done with (for example) most real estate contracts.

> trustworthy third party Merits aside, sidestepping the need for this is the whole point of blockchain.

Apparently you can’t even trust the um, paper, it’s written on

Re: Missing line in a smart contract leads to $10M hack

#318

Post by withinboredom » Mon, May 17, 2021, 5:26 PM UTC

rawtxapp wrote: post #192

jypepin wrote: post #134

Earlier quoted context omitted.

I think smart contracts are meant to automate the work behind contracts/agreements, but if someone hacks you, well, they did something illegal and you can sue?

I think the way to look at is that, smart contracts are not behind the contracts/agreements, smart contracts are the contracts/agreements. Once you realize that, if a smart contract executed successfully then the operation was legitimate. Of course, ethereum forked when a big hack happened, but it won't be forking for every hack, otherwise it's not really a reliable blockchain.

Judging from the amount of contract disputes in the court system, I would expect it to be forked pretty regularly

Re: Missing line in a smart contract leads to $10M hack

#319

Post by TheCoelacanth » Mon, May 17, 2021, 6:00 PM UTC

PeterisP wrote: post #181

hn_throwaway_99 wrote: post #174

Earlier quoted context omitted.

I mean, at its heart then you are really arguing than smart contracts shouldn't exist in the first place (I don't really disagree). The entire reason that smart contracts exist is to get rid of the need for any trusted third party intermediary because (as proponents argue) all of the logic for the contract is completely embedded in the code. If it then becomes necessary to say "The code is the contract, unless there'…

I'm not necessarily arguing that smart contracts shouldn't exist in the first place - perhaps they have a valid future role in effectively and cheaply adjudicating small claims where currently it might not be worth to enforce a contract due to the effort and costs of the legal process; something vaguely like what arbitration was intended to be. This use case would IMHO have a quite large market, and it would be perfe…

The premise that you can opt out of the laws in the jurisdiction that you're operating in seems faulty.

Smart contracts can let you enforce things that aren't enforceable otherwise, but they aren't going to let you avoid having things enforced through other means.

Re: Missing line in a smart contract leads to $10M hack

#320

Post by sneak » Mon, May 17, 2021, 6:11 PM UTC

coreyoconnor wrote: post #83

For fun I've been analyzing the contracts posted to r/CryptoMoonShots. Out of 20 posts 16 of them used the same contract; modulo names. This contract blocks everyone from removing funds but the owner. How? Is it some complex chunk of code that requires a delicate hack? No, not at all. There is literally a function with code, more or less, like: "If owner then OK here's all the funds". Anybody can check this in the co…

Then it moves the security breach incentive to compromising the owner's keys, which is also usually pretty straightforward.