Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Poly Network hacker returns $258M after stealing $600M

forbes.com

Post reply on HN
Print view View original

261–270 of 303 posts

Re: Poly Network hacker returns $258M after stealing $600M

#261

Post by spyder »

blowfish721 wrote: post #112
namdnay wrote: post #75

Earlier quoted context omitted.

> You have to be an absolute tool to use the poly network for anything serious ever again agreed > A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it I kind of disagree in philosophy here. If there's a bug in a bank API that lets me transfer funds to my account, I'm still "hacking", even if I'm doing exactly what the API lets me do…

Isn’t that the point though, when you access a bank api you have signed a contract in order to access it that states what is allowed and what’s not, the api code is not the contract but a way to access what you are allowed. With smart contracts the code is that contract so if the code allows it then it should be allowed.

You don't have to sign a contract to find vulnerabilities in an API. The thing that you have to obey is the law. Just because we call it smart contracts it isn't above the laws.

Re: Poly Network hacker returns $258M after stealing $600M

#263

Post by tablespoon »

mlazos wrote: post #35
hamburgerwah wrote: post #16

I haven't seen any evidence there was in fact a hack at all. A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it. If bad contract writers get to cry "hack" and beg for their money back there is no point to digital contracts at all. If someone had physically or electronically broken into systems and illicitly copied private keys that…

It’s so funny to me when everyone touts crypto + smart contracts as revolutionary™ then when you follow a system implemented with them to its logical conclusions you have analogs to everything that already exists. Lawyers to audit the contracts for bugs (and yes there can be bugs in a formally verified spec as well), courts to arbitrate disagreements, and an authority to enforce rules when someone finds a security ho…

> It’s so funny to me when everyone touts crypto + smart contracts as revolutionary™ then when you follow a system implemented with them to its logical conclusions you have analogs to everything that already exists. Lawyers to audit the contracts for bugs (and yes there can be bugs in a formally verified spec as well), courts to arbitrate disagreements, and an authority to enforce rules when someone finds a security hole.

Tech people tend to think of technology as computerized things, but all those things you listed are also technologies that solve real problems that people encountered in the past.

IMHO, crypto is like a new car with the revolutionary new feature of not having seat belt technology. Maybe the inventor has some dumb idiosyncratic or ideological hatred of seat belts, and maybe some people buy into it... Then the new cars get popular, people start crashing them in numbers, and we realize, "hey maybe seat-belts weren't so dumb after all."

Of course, when that happens someone in that community will call it a seat-strap and claim it's a revolutionary new invention.

Re: Poly Network hacker returns $258M after stealing $600M

#264

Post by jshen »

JohnJamesRambo wrote: post #193
wesleywt wrote: post #96

Earlier quoted context omitted.

Can someone explain to me why HN is so anti-crypto?

Most HN users are wealthy devs or they want to be wealthy devs or startup founders. They have no need for crypto and it threatens where their money is stored- equities and the traditional banking system. The “hackers” traded their soul for money. It’s really no different than a wealthy old man hating crypto. He has no need for it, he doesn’t want others to use it to get past him. He sees no problem with the current w…

Anyone that thinks that crypto is somehow going to help fix inequality is delusional. If crypto isn’t a complete dud, which I think is likely, it will increase inequality.

Re: Poly Network hacker returns $258M after stealing $600M

#265

Post by bryondowd »

songeater wrote: post #224
panarky wrote: post #213

Earlier quoted context omitted.

In 2011 a new Bitcoin exchange called Bitcoinica launched. I deposited 100 BTC to test it out. First thing I did was to try to withdraw negative 100 BTC. It sent me 100 BTC, but instead of a zero balance in the exchange, it said I now had 200 BTC. So then I withdrew a negative 200 BTC, and it sent me 200 BTC and increased my exchange balance to 400 BTC. I contacted the owner and returned the funds and he sent me a 10…

$4 million bug bounty! Eclipses anything here... https://www.pcmag.com/news/7-huge-bug-bounty-payouts

In 2011, so the value of BTC at the time was between $1 and $32.

Re: Poly Network hacker returns $258M after stealing $600M

#266

Post by Kevin_S »

ALittleLight wrote: post #48
rebuilder wrote: post #29

Earlier quoted context omitted.

I have to agree. I was going to counterargue that technically all hacking is executing permissible actions in the sense that the system you're hacking into ends up allowing you to do what you want. That leads to why we have laws around unauthorized access etc., and that leads to digital contracts that need to be interpreted by a human with some ability to enforce their interpretation. So yes. As the main point of dig…

I've wondered about things like this with video games. I played RuneScape a while back and one of the things my brother and I would do is lure unsuspecting players into the wilderness to kill them and take their stuff. That stuff, RuneScape gold, weapons, and armor, has some real world value. We took it from other people, often by lying to them (e.g. "follow me into the wilderness, I'll show you something cool"). Cou…

So I scammed at the duel arena for a few years. Made quite a lot of gp, then RWT it all.

I know what we did constituted a violation of terms of service, and we were subject to bans at any time. However, I was reasonably confident there was little Jagex could do to pursue legal action against us. Generally, we were relatively small fish compared to things like the Mod Jed scandal.

I am not sure the courts would find this to be in any way illegal. But I find it very interesting.

Re: Poly Network hacker returns $258M after stealing $600M

#267

Post by smorgusofborg »

leetcrew wrote: post #231
panarky wrote: post #213

Earlier quoted context omitted.

In 2011 a new Bitcoin exchange called Bitcoinica launched. I deposited 100 BTC to test it out. First thing I did was to try to withdraw negative 100 BTC. It sent me 100 BTC, but instead of a zero balance in the exchange, it said I now had 200 BTC. So then I withdrew a negative 200 BTC, and it sent me 200 BTC and increased my exchange balance to 400 BTC. I contacted the owner and returned the funds and he sent me a 10…

I dunno whether it would be considered hacking, fraud, or plain old theft, but if you hadn't returned the BTC, this would be a clear example of exploiting a bug for financial gain. if nothing else, the operator should have some legal recourse to get their money back. if it can be shown that you did it deliberately, I don't think it would be unreasonable to consider it a criminal offense. of course, this is not quite…

Yes, but the point of a digital contract is that everything doesn't hinge on proof of a meeting of the minds. If lawyers and the digital contract can now be so far apart that one says you get the money and the other says you get jail time that isn't an improvement over local law.

They need to go back and wrap all this stuff in actual legal boiler plate to have a meeting of the minds limiting what any individual digital contract can mean, if anything, rather than pretending this is orthogonal when it clearly is not.

Re: Poly Network hacker returns $258M after stealing $600M

#268

Post by baobabKoodaa »

spywaregorilla wrote: post #174
baobabKoodaa wrote: post #159

Earlier quoted context omitted.

This is a disingenuous argument not written in good faith. You know very well that the contract writers did not intend for this to happen, and yet you are pretending otherwise just to make a provocative argument.

If you go bowling, and remove the gutter rails, you have to accept that you can now throw a gutter ball.

Yes, but if you try to aim for the bowling pins, and you miss, don't make a disingenuous claim that you intended to miss in the first place.

Re: Poly Network hacker returns $258M after stealing $600M

#269

Post by joe_the_user »

spullara wrote: post #256
hamburgerwah wrote: post #16

I haven't seen any evidence there was in fact a hack at all. A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it. If bad contract writers get to cry "hack" and beg for their money back there is no point to digital contracts at all. If someone had physically or electronically broken into systems and illicitly copied private keys that…

If you find a software bug in an ATM that gives you all the money from the machine it absolutely would be considered theft. A bad lock on a door (or even no lock) doesn't give you the right to steal things behind that door. IMHO this is how the law would look at it and not care a wit about whether or not there was a flaw in the software. IANAL but have seen this kind of argument play out ever since computer bugs were…

The thing about that is smart contracts are intended to not operate this way. The aim of a smart contract is that whatever happens is the ultimate rule - the contract enforces itself.

Such an intention doesn't cause laws and courts to stop existing or make things so courts won't interpret certain actions as theft. But it complicates things.

Re: Poly Network hacker returns $258M after stealing $600M

#270

Post by bryondowd »

Retric wrote: post #232
kaibee wrote: post #228

Earlier quoted context omitted.

> SpaceX didn’t start from scratch. The goal for Falcon 1 was to be as conventional a design as possible and save money via vertical integration. This is still starting from scratch. The design may be conventional, but you're benefiting from a modern approach to processes and design from the beginning.

This is one of those differences between engineering and software. For physical projects how much something is starting from scratch is kind of arbitrary. Knowing for example the ideal nose cone shapes and tradeoffs is a huge advantage. I mean this is the best way possible, the Falcon 1 didn’t reinvent the wheel. They basically said what’s the simplest useful rocket for getting stuff to orbit copying as much of the d…

You could make the same argument for software. Where do you draw the line "starting from scratch" in software? Does incorporating third party libraries make it not from scratch? What about the standard library of your language of choice? What about using the abstraction of a high level language in general vs a low level language, or straight machine code? For that matter, is it from scratch if you didn't design the logic gates on the chip itself? Or perhaps even come up with the concept of logic gates from electrical and material science principals.. etc..

I'd say that if you are gluing together a bunch of known-good components into a specific configuration that isn't a full copy of something else, you're building from scratch.

Post reply on HN