> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…
The math prodigy whose hack upended DeFi won’t return funds
51–60 of 409 posts
Re: The math prodigy whose hack upended DeFi won’t return funds
#52> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…
Re: The math prodigy whose hack upended DeFi won’t return funds
#53What is interesting to me is how it shines a light on the regulatory framework of the non-crypto economy. If you read up on edge cases, there is a lot of people deciding if something is "fair", and my notions of fair and a particular judges notions of fair are often at odds. To steal from Frank Zappa: Legal isn't the same as allowed, allowed isn't the same as fair, fair isn't the same as just, and just isn't music.
There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…
--
For the downvotes, I'll add some further explanation: you have access to the keys in order to perform a sale of "your" NFT, but no US court (I am unsure of other countries) has yet ruled in a case that clarifies whether a person actually owns an NFT. For example, they have not ever ruled against someone who has "stolen" an NFT. Therefore, there is no case law that says whether a person legally "owns" an NFT.
Don't just take my word for it:
> Ultimately, an NFT owner has access to the underlying asset, but they may lack exclusive access to or control of the asset, let alone ownership of the asset or any intellectual property (IP).
https://www.lawyer-monthly.com/2021/05/nfts-and-ip-law-who-o...
Re: The math prodigy whose hack upended DeFi won’t return funds
#54Earlier quoted context omitted.
There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…
One of the points of digital assets is that the code is the contract, so whatever the code says is what was agreed to. There can be no cheating (in theory) hence no need to resort to courts etc.
Re: The math prodigy whose hack upended DeFi won’t return funds
#55Q: is the programming language these things are written in powerful enough and have sufficient data access for the developers to include sanity checks that would halt trading automatically if something is happening too far out of the norm such as an unusually high volume of attempted night discount sales? Or maybe that would just block extreme discount sales if there have been too many of those recently?
Re: The math prodigy whose hack upended DeFi won’t return funds
#56> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…
It does? Maybe for the poor, but certainly not for the rich/corporations.[1]
[1] - https://www.imf.org/external/pubs/ft/fandd/2019/09/tackling-...
Re: The math prodigy whose hack upended DeFi won’t return funds
#57> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…
Re: The math prodigy whose hack upended DeFi won’t return funds
#58> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…
> And then if you like that state, you can then pay to send the working transaction to the mainnet to make that same state occur, in a sure bet. That often isn't true anymore, see https://ethereum.org/en/developers/docs/mev/
which means non-trading transactions would look so different that someone playing with higher gas wouldn't know what to replace in the bytecode within the 15 seconds between blocks
and the user also has the choice of sending directly to a miner just like the MEV people do, to skip the mempool
which is looks like he did (but not sure, just noticed his contract mentions MEV)
https://etherscan.io/tx/0x1710f8c91f03d43a51b94fb5db00305cdd...
Re: The math prodigy whose hack upended DeFi won’t return funds
#59Earlier quoted context omitted.
FTA: > In their complaint, lawyers for Kellar and Day argued that two particular steps of the attack violated statutes against market manipulation and computer hacking. One was swapping almost all the UNI tokens out of the DEFI5 pool, the otherwise irrational trade that distorted the pricing such that Medjedovic could buy tokens out from under Indexed users, who were forced by the algorithm to sell. “The only purpose…
If the law is held to have supremacy over “smart contracts” and implicit intent is held to be more important than explicit terms, than this undermines not just a major argument for smart contracts but a major argument as to why crypto as a whole is valuable. Enforcing a contract through a written contract & traditional finance vs a smart contract becomes a mere implementation detail since in either case somebody can…
Re: The math prodigy whose hack upended DeFi won’t return funds
#60In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculation, whereas a recent example where the contract was only checking the last several bytes of a destination address key would be a parsing exploit. Medjedovic's arbitrage as described appears to be a pure calculation advantage, and not exploiting a parsing error, and so this is very reasonably fair game.
He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts. When you exploit a buffer overflow, you are breaking through (sabotaging) a parser as a means to manipulate the raw memory and machine - whereas this arbitrage is closer to something that lies somewhere between clicking on a link someone provided but had some unspoken intention about you not using it, and a SQL injection or other evaluation error that yields an index. (edit: Actually, it's more like saying something really funny and unexpected on a platform that hasn't banned that kind of humor yet, and they're just mad about the consequences. we could even see a future where the distinction between a hack and arbitrage will be the complexity class of the algorithm and whether it represented a scheme that was Turing complete)
Unfortunately, in Canada they'll go after him just as a fugitive now, and there is no shortage of political actors who will want to make him the perfect example villain for their hysterical policy objectives. This is one of those increasingly classic situations where a really smart kid gets system-involved and can't comprehend how insane it is because the legal system and politics are not subject to mere reason. If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new.