Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

51–60 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#51

> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…

Not quite a sure bet. It depends on your magic TX getting picked up from the mempool by the winning node.

Re: The math prodigy whose hack upended DeFi won’t return funds

#52

> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…

If anyone could perfectly predict what was going to happen in the next state then those with this ability would only ever make money and never lose it. Yet this can't happen. In the real world there are sniper bots and all sorts of other things that another agent could do in parallel with your own script, which would lead the outcome to be uncertain.

Re: The math prodigy whose hack upended DeFi won’t return funds

#53

What is interesting to me is how it shines a light on the regulatory framework of the non-crypto economy. If you read up on edge cases, there is a lot of people deciding if something is "fair", and my notions of fair and a particular judges notions of fair are often at odds. To steal from Frank Zappa: Legal isn't the same as allowed, allowed isn't the same as fair, fair isn't the same as just, and just isn't music.

There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…

The courts haven't even determined whether anyone even "owns" an NFT, so no.

--

For the downvotes, I'll add some further explanation: you have access to the keys in order to perform a sale of "your" NFT, but no US court (I am unsure of other countries) has yet ruled in a case that clarifies whether a person actually owns an NFT. For example, they have not ever ruled against someone who has "stolen" an NFT. Therefore, there is no case law that says whether a person legally "owns" an NFT.

Don't just take my word for it:

> Ultimately, an NFT owner has access to the underlying asset, but they may lack exclusive access to or control of the asset, let alone ownership of the asset or any intellectual property (IP).

https://www.lawyer-monthly.com/2021/05/nfts-and-ip-law-who-o...

Re: The math prodigy whose hack upended DeFi won’t return funds

#54

Earlier quoted context omitted.

There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…

One of the points of digital assets is that the code is the contract, so whatever the code says is what was agreed to. There can be no cheating (in theory) hence no need to resort to courts etc.

When two or more parties sign a contract, it doesn’t necessarily mean that all the terms in that contract are enforceable.

Re: The math prodigy whose hack upended DeFi won’t return funds

#55
> It would take weeks to figure out precisely what had happened, but it appeared that the platform had been fooled into severely undervaluing tokens that belonged to its users and selling them to the attacker at an extreme discount.

Q: is the programming language these things are written in powerful enough and have sufficient data access for the developers to include sanity checks that would halt trading automatically if something is happening too far out of the norm such as an unusually high volume of attempted night discount sales? Or maybe that would just block extreme discount sales if there have been too many of those recently?

Re: The math prodigy whose hack upended DeFi won’t return funds

#56
post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

> That is, modern finance and the law also attempt to deal with intent.

It does? Maybe for the poor, but certainly not for the rich/corporations.[1]

[1] - https://www.imf.org/external/pubs/ft/fandd/2019/09/tackling-...

Re: The math prodigy whose hack upended DeFi won’t return funds

#57
post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

"Code is law" is a dream that is not actualized. It's not actually law, it's just code. I'm pretty sure law enforcement will gladly prosecute for a lot of these "hacks".

Re: The math prodigy whose hack upended DeFi won’t return funds

#58
post #48

> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…

> And then if you like that state, you can then pay to send the working transaction to the mainnet to make that same state occur, in a sure bet. That often isn't true anymore, see https://ethereum.org/en/developers/docs/mev/

> but they wouldn't necessarily know what to look for or change if its a distinct kind of transaction

which means non-trading transactions would look so different that someone playing with higher gas wouldn't know what to replace in the bytecode within the 15 seconds between blocks

and the user also has the choice of sending directly to a miner just like the MEV people do, to skip the mempool

which is looks like he did (but not sure, just noticed his contract mentions MEV)

https://etherscan.io/tx/0x1710f8c91f03d43a51b94fb5db00305cdd...

Re: The math prodigy whose hack upended DeFi won’t return funds

#59
post #18

Earlier quoted context omitted.

FTA: > In their complaint, lawyers for Kellar and Day argued that two particular steps of the attack violated statutes against market manipulation and computer hacking. One was swapping almost all the UNI tokens out of the DEFI5 pool, the otherwise irrational trade that distorted the pricing such that Medjedovic could buy tokens out from under Indexed users, who were forced by the algorithm to sell. “The only purpose…

If the law is held to have supremacy over “smart contracts” and implicit intent is held to be more important than explicit terms, than this undermines not just a major argument for smart contracts but a major argument as to why crypto as a whole is valuable. Enforcing a contract through a written contract & traditional finance vs a smart contract becomes a mere implementation detail since in either case somebody can…

Yes, that's exactly the problem with smart contracts and why people are interested in resolving the case.

Re: The math prodigy whose hack upended DeFi won’t return funds

#60
This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or targets infrastructure to Medjedovic.

In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculation, whereas a recent example where the contract was only checking the last several bytes of a destination address key would be a parsing exploit. Medjedovic's arbitrage as described appears to be a pure calculation advantage, and not exploiting a parsing error, and so this is very reasonably fair game.

He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts. When you exploit a buffer overflow, you are breaking through (sabotaging) a parser as a means to manipulate the raw memory and machine - whereas this arbitrage is closer to something that lies somewhere between clicking on a link someone provided but had some unspoken intention about you not using it, and a SQL injection or other evaluation error that yields an index. (edit: Actually, it's more like saying something really funny and unexpected on a platform that hasn't banned that kind of humor yet, and they're just mad about the consequences. we could even see a future where the distinction between a hack and arbitrage will be the complexity class of the algorithm and whether it represented a scheme that was Turing complete)

Unfortunately, in Canada they'll go after him just as a fugitive now, and there is no shortage of political actors who will want to make him the perfect example villain for their hysterical policy objectives. This is one of those increasingly classic situations where a really smart kid gets system-involved and can't comprehend how insane it is because the legal system and politics are not subject to mere reason. If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new.

Post reply on HN