Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

71–80 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#71

Earlier quoted context omitted.

It's an exploit no matter how you look at it.

Would it be an exploit if I discover the math to move all bitcoin in existence to whatever address I want then do so?

Uh... yes? Are you seriously trying to imply that would be legal?

If someone ever cracks modern encryption, that doesn't mean they can do whatever they want with everyone's accounts everywhere. If you find an exploit and exploit it, that's illegal.

Re: The math prodigy whose hack upended DeFi won’t return funds

#72
post #65
post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

Respectfully disagree. I think I've seen several times the belief(from crypto supporters) that the code is the code is the code, and these are the rules that we play with.

The "laws of physics" analogy doesn't match up. I feel like it would be more appropriate in an anarchist society (physics are the only laws, thus everything that obeys physics is game).

This feels more like discovering an exploit in a video game. It's up to the devs to patch it, or tournaments to outlaw, but if you find something out, you can use it. We agree to play by the rules, but if someone comes up with something last minute, they can win.

Re: The math prodigy whose hack upended DeFi won’t return funds

#73
This is an outright copy of https://www.bloomberg.com/news/features/2022-05-19/crypto-pl....

e: missed at the end of the article:

> (Except for the headline, this story has not been edited by NDTV staff and is published from a syndicated feed.)

So perhaps this is reproduced under a legit syndication deal?

Re: The math prodigy whose hack upended DeFi won’t return funds

#74
post #55

> It would take weeks to figure out precisely what had happened, but it appeared that the platform had been fooled into severely undervaluing tokens that belonged to its users and selling them to the attacker at an extreme discount. Q: is the programming language these things are written in powerful enough and have sufficient data access for the developers to include sanity checks that would halt trading automaticall…

The language could represent that, but you pay per operation so checks tend to get thrown out the window.

Re: The math prodigy whose hack upended DeFi won’t return funds

#75

Earlier quoted context omitted.

There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…

One of the points of digital assets is that the code is the contract, so whatever the code says is what was agreed to. There can be no cheating (in theory) hence no need to resort to courts etc.

Which is why the big players the smart contract that was exploited in this article just accepted the loss and moved on? Oh wait, the two largest losers here BOTH went to court independently.

The cryotocurrency community supports the "code is law" talking point only until serious money is lost. Then they go the courts for redress under actual law, or they fork the blockchain.

Re: The math prodigy whose hack upended DeFi won’t return funds

#76
post #72
post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

Respectfully disagree. I think I've seen several times the belief(from crypto supporters) that the code is the code is the code, and these are the rules that we play with. The "laws of physics" analogy doesn't match up. I feel like it would be more appropriate in an anarchist society (physics are the only laws, thus everything that obeys physics is game). This feels more like discovering an exploit in a video game. I…

Many people in crypto want to not have to comply with "real world" laws right up until the point where it would be to their benefit to do so.

And if "smart contracts" depend on real law, then they're not really needed in many of the supposed use cases.

Re: The math prodigy whose hack upended DeFi won’t return funds

#77
post #65
post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

But that is the premise of smart contracts. Sure, it doesn't excuse you from the law if your contract is to pay someone to shoot someone, but it's supposed to be the final word on the actual financial transactions that happen within the contract.

Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm:

> Guaranteed Outcomes: Potentially the most attractive feature, smart contracts could offer a way to substantially reduce or completely eliminate the need for litigation and courts. This is because when parties commit to using self-executing contracts, they bind themselves to the rules and determinations of the underlying code, rather than exposing themselves to interpretations med by parties outside of the contractual relationship.

https://www.newburnlaw.com/benefits-of-smart-contracts

Re: The math prodigy whose hack upended DeFi won’t return funds

#78

For all the people shouting "Way to go!" and "The money is his!" I think you should remember he's currently a fugitive, and would need to spend the rest of his life living this way. If that's what it takes to live the "code is law" dream, count me out.

I like the very web3 middle ground where the attacker negotiates with the company and returns a part of the money, the rest being the lawful reward for reporting the vulnerability.

Re: The math prodigy whose hack upended DeFi won’t return funds

#79
post #18

What’d he do that was illegal? Seems like he didn’t cheat and insider trading laws don’t seem to apply. Oops crypto is a unregulated market.

FTA: > In their complaint, lawyers for Kellar and Day argued that two particular steps of the attack violated statutes against market manipulation and computer hacking. One was swapping almost all the UNI tokens out of the DEFI5 pool, the otherwise irrational trade that distorted the pricing such that Medjedovic could buy tokens out from under Indexed users, who were forced by the algorithm to sell. “The only purpose…

Their complaint hinges on an interpretation of what the correct level of abstraction for describing the transactions is. Their argument, "to mislead token holders to part with tokens on terms they never would have agreed to," is literally a counterfactual that presumes both fictional market conditions as well as intentions of anonymous owners.

The second argument is an analogy, "disable a security measure, like disabling the security system at a bank," and the limit expressed in the code was definitely an expressed preference by the contract author, but if they wanted it to be a legal contract subject to human interpretation, they would have specified this in English. Instead, they created a software tool, and they did not take into account how that tool might be used by the public.

The argument about this is whether code written for the express purpose of partipating in risky transactions can be imbued with any other coherent intention. The closest analogy would be that Medjedovic was at their gambling table and was counting cards, except there was no policy keeping him out of there, or against card counting.

Re: The math prodigy whose hack upended DeFi won’t return funds

#80

What is interesting to me is how it shines a light on the regulatory framework of the non-crypto economy. If you read up on edge cases, there is a lot of people deciding if something is "fair", and my notions of fair and a particular judges notions of fair are often at odds. To steal from Frank Zappa: Legal isn't the same as allowed, allowed isn't the same as fair, fair isn't the same as just, and just isn't music.

There are lots of stories lately about stolen NFTs. The podcast ReplyAll did an episode where they tracked down the current owner of a stolen NFT. He had sympathy for the original owner but he had no intention of turning it over. I don’t get why purchasing a stolen NFT is different than purchasing a stolen guitar from a pawn shop. Shouldn’t the previous owner be able to use the courts to demand the return of the item…

The whole point of an NFT is that the ownership is on the blockchain and guaranteed by said blockchain - if the courts can "force" return of the NFT than the NFT isn't actually synonymous with the ownership, and so then is kinda pointless.
Post reply on HN