Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

Post reply on HN
Print view View original

231–240 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#231

Post by charcircuit »

motohagiography wrote: post #60

This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or targets infrastructure to Medjedovic. In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculatio…

>He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts

The same description can be said for using XSS to steal someone's cookies. XSS doesn't escape the JavaScript virtual machine similar to how you aren't escaping Ethereum's virtual machine. Technically the code allows you to inject arbitrary JavaScript, but that behaviour wasn't intend to be possible by the designers of the site.

Re: The math prodigy whose hack upended DeFi won’t return funds

#232

Post by glerk »

stickfigure wrote: post #223
er4hn wrote: post #198

Earlier quoted context omitted.

Let's say that I place a vending machine in a public space, such as a street or a park. The public is able to interact with it by inserting FIAT coins to purchase DRNK. Someone clever figures out a way to interact with the vending machine to extract DRNK at less than it's intended FIAT price. Two questions at this point: (a) Is this a theft from the person who placed the vending machine? Why or why not? (b) How is th…

I'll try to steelman the code-is-law argument (not really sure how I feel about it myself): In the case of the smart contract, you don't own the vending machine. It doesn't have an owner, it just "is". If it did have an owner, that person is probably violating all sorts of securities laws in countless jurisdictions. That's at least part of the point of all this smart contract stuff. To make the analogy a little more…

> If did have an owner, that person is probably violating all sorts of securities laws in countless jurisdictions.

That's probably what upsets me most about this story. These developers want to have it both ways: it is decentralized finance and nobody owns the contract as long as we are making money, but we want all the laws and regulations of traditional finance to protect us if things don't go our way.

I am saying this as someone who is pro-crypto. There are trade-offs to this technology. We need to pick a lane be prepared to deal with the consequences.

Re: The math prodigy whose hack upended DeFi won’t return funds

#233

Post by verdverm »

thrwy_918 wrote: post #193
Ajedi32 wrote: post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

>In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law I think some confusion arises because that "smart contracts" only make sense if code really is law, in the sense that any transaction executed by the contract -- even unexpected, surprising transactions -- is considered to be fully consented to by all parties interacting with the contract. I agree t…

Most people will be coerced into returning funds if the alternative is hard jail time

Smart contract is really the misnomer. In reality, they are automations of contractual obligations and cannot automate complete contract clauses.

Re: The math prodigy whose hack upended DeFi won’t return funds

#234

Post by s1artibartfast »

er4hn wrote: post #198
glerk wrote: post #132

Earlier quoted context omitted.

A smart contract deployed on a public permissionless blockchain is not owned by anyone. Only the contract's logic determines how one can interact with it. This is a fact. It doesn't matter who can make the best argument in court. A good enough lawyer can convince a stupid enough jury of pretty much anything.

Let's say that I place a vending machine in a public space, such as a street or a park. The public is able to interact with it by inserting FIAT coins to purchase DRNK. Someone clever figures out a way to interact with the vending machine to extract DRNK at less than it's intended FIAT price. Two questions at this point: (a) Is this a theft from the person who placed the vending machine? Why or why not? (b) How is th…

Imagine in your example the vending machine has a variable pricing and lowers its price if nobody purchases soda. Is it theft to wait longer than the designers thought people would wait and purchase the DRNK at price lower than the machine owner thought they would.

I think a better example is a claw gambling machine. You pay Fiat for a chance to grab fiat out of a pool.

If you come up with a strategy whereby you can grab more or all of the Fiat in a way that the game/machine designer and other players did not anticipate, is that theft?

Alternatively, people are playing a modified version of Poker with rules they don't understand, and someone understands the rules better and gets their money, is that a crime?

Re: The math prodigy whose hack upended DeFi won’t return funds

#235

Post by majormajor »

mbreese wrote: post #228
LeifCarrotson wrote: post #205

Earlier quoted context omitted.

I think a lot of the appeal of crypto/smart contracts is that they are final with little to no recourse, humans can't intervene and exploit failure modes which individuals using the so-called contracts can't defend against. Corporations and wealthy individuals with influence in the writing of this legal system, with massive amounts of financial resources, with negligible moral agency, and with limited criminal liabil…

I want to know what kind of contracts people entered into before this where they thought they were being abused by a big corporation? This seems like a noble endeavor, but not an entirely practical one. Both sides of a transaction have to agree to these smart contracts, so where is this an advantage (outside of internal crypto trading)?

A bunch of those many-to-one individual:corporation contracts (like phone service) are in such imbalanced markets that you'd have to overcome the power balance problem in order to get the other party to adopt the "smart" contract.

But if you can overcome the power balance problem, you can just fix the contracts directly anyway without them being smart?

Re: The math prodigy whose hack upended DeFi won’t return funds

#236

Post by majormajor »

sushid wrote: post #154
SamBam wrote: post #77

Earlier quoted context omitted.

But that is the premise of smart contracts. Sure, it doesn't excuse you from the law if your contract is to pay someone to shoot someone, but it's supposed to be the final word on the actual financial transactions that happen within the contract. Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm: > Guaranteed Outcomes: Potentially the…

Smart contracts allow for guaranteed outcomes. Some commentary added by a random law firm does not mean that guaranteed outcomes == no need for litigation and courts. Just think of non-smart contract parallels. If a bank had an ATM, the premise is that this ATM will execute a series of commands and allow you to withdraw/deposit/transfer funds. If a nefarious back actor found a series of user input that allowed them t…

In a world where you're falling back to the legal system, why do I care if your buggy ATM is powered by a "smart contract" or by "regular" code? Why even do you care?

(There have been exploits in both ATMs and smart contracts, after all.)

Re: The math prodigy whose hack upended DeFi won’t return funds

#237

Post by majormajor »

Ajedi32 wrote: post #90
daveed wrote: post #72

Earlier quoted context omitted.

Respectfully disagree. I think I've seen several times the belief(from crypto supporters) that the code is the code is the code, and these are the rules that we play with. The "laws of physics" analogy doesn't match up. I feel like it would be more appropriate in an anarchist society (physics are the only laws, thus everything that obeys physics is game). This feels more like discovering an exploit in a video game. I…

That's not how the law works though, at least not in any country I know of. If you exploit flaws in computer code to steal something of real-world value, that's a crime. We're all bound to the laws of physics, just as in the world of smart contracts all are bound to the laws of code. But none of that changes the existence of the laws of men.

If you do a promotion for giving away free food, and your smart contract accidentally allows someone to get a free sandwich every minute instead of once a day, is it so obvious that someone using your promotion more than once a day is "stealing"?

Ever use a different email address to sign up for a different free trial, say? Let alone people sharing Netflix accounts... where do you draw the line around "stealing" here?

Re: The math prodigy whose hack upended DeFi won’t return funds

#238

Post by silentsea90 »

knorker wrote: post #126
silentsea90 wrote: post #78

Earlier quoted context omitted.

I like the very web3 middle ground where the attacker negotiates with the company and returns a part of the money, the rest being the lawful reward for reporting the vulnerability.

Do you mean "like" as in you're amused by it's absolute absurdity, or that you think this is a good standard practice?

Sorry, I should make it clear - it is very very absurd. Can't edit comments after some time sadly.

Re: The math prodigy whose hack upended DeFi won’t return funds

#239

Post by Veserv »

sushid wrote: post #154
SamBam wrote: post #77

Earlier quoted context omitted.

But that is the premise of smart contracts. Sure, it doesn't excuse you from the law if your contract is to pay someone to shoot someone, but it's supposed to be the final word on the actual financial transactions that happen within the contract. Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm: > Guaranteed Outcomes: Potentially the…

Smart contracts allow for guaranteed outcomes. Some commentary added by a random law firm does not mean that guaranteed outcomes == no need for litigation and courts. Just think of non-smart contract parallels. If a bank had an ATM, the premise is that this ATM will execute a series of commands and allow you to withdraw/deposit/transfer funds. If a nefarious back actor found a series of user input that allowed them t…

The difference is that the ATM provider did not explicitly promise that the “code is law” which directly implies that they want to and aggressively argue that they are waiving their legal recourse as long as they were valid user inputs.

In contrast, basically nobody outside of the blockchain space would waive their legal recourse in such a manner and thus would have legal recourse if the intent of their system was bypassed.

To go on to then argue that a legal system should not allow one to waive those rights as it would be idiotic to do so is a perfectly valid legal/moral/justice position, but also directly contradicts basically the entire purported value proposition of everything in the blockchain space whose primary “positive” differentiating factor is that “code is law” and they have waived those rights. To not allow them to do so basically invalidates their entire purpose.

Essentially, either let people bind themselves to “code is law” and suffer the consequence of their choice, or ban it at which point you lose decentralized trust and censorship-resistance making them no different than traditional implementations except that they are slower with higher operational costs.

Re: The math prodigy whose hack upended DeFi won’t return funds

#240

Post by young_unixer »

godelski wrote: post #173
SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

This is a thing that confused me about smart contracts. I don't see how they can exist without a judicial system. They do seem to have some uses under that framework. Like the system is auditable so you can prove if someone cheated and changed a contract out from under you (and you lost your copy), but that's only a minor improvement on the current system. The US has a lot of legal policy that is based on spirit of t…

> The US has a lot of legal policy that is based on spirit of the law

Yes, but that's a wrong and unfair way to define and apply laws.

> humans are imperfect

Smart contracts and "code is the law" mantra don't contradict this. You're imperfect and you commit a mistake, you lose. You find a mistake in someone else's code, you win.

This is much better than the current legal system where we are all collectively forced to adapt to, or even pay for, someone else's mistakes.

Post reply on HN