Chasing the DAO Attacker’s Wake – A second exploit • Hacker News Board

Re: Chasing the DAO Attacker’s Wake – A second exploit

#11

Post by [deleted] » Mon, Jun 20, 2016, 5:32 PM UTC

pjc50 wrote: post #9

Animats wrote: post #2

So one contract can call a function in another contract, in the middle of their transaction: if (_recipient.call.value(_amount)()) { // vulnerable That's inherently a scary feature, and it was exploited. Etherium's "Solidity" suffers from the desire to have it be a general-purpose computer. It should have been if-then rules, or a logic tree, or a decision logic table - a finite representation of business logic subjec…

The problem with a redesign is that the only way you're going to get a reliable design involves a lot of formal verification, which is a rare skill and time-consuming to perform. Whereas the cryptocurrency space is a startup environment: there's huge pressure to launch first so that you can get the money that people are begging to throw into untested speculative finance systems. And the refusal to countenance human c…

[deleted]

Re: Chasing the DAO Attacker’s Wake – A second exploit

#12

Post by mbrock » Tue, Jun 21, 2016, 3:51 PM UTC

I don't understand "you can't assume anything about the state of the contract." Surely the contract's state is only modified by the contract's own code, which means you can assume that the state is not altered arbitrarily but only according to the rules set up by the contract. Yes, you need to be careful about external calls that make altering calls to you.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#13

Post by refulgentis » Tue, Jun 21, 2016, 3:52 PM UTC

What if the DAO invested in short-selling Ethereum? 🤔🤑

Re: Chasing the DAO Attacker’s Wake – A second exploit

#14

Post by lostmsu » Tue, Jun 21, 2016, 3:53 PM UTC

Potential vector of attack to look for, not an exploit. Thus, flagged.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#15

Post by bouk » Tue, Jun 21, 2016, 3:54 PM UTC

Seems like this is what mutexes were invented for

Re: Chasing the DAO Attacker’s Wake – A second exploit

#16

Post by andrewfromx » Tue, Jun 21, 2016, 3:55 PM UTC

refulgentis wrote: post #13

What if the DAO invested in short-selling Ethereum? 🤔🤑

as long as eveyone agrees :)

Re: Chasing the DAO Attacker’s Wake – A second exploit

#17

Post by woah » Tue, Jun 21, 2016, 3:59 PM UTC

None of these "exploits" really sound much more dramatic than using a database without transactions

Re: Chasing the DAO Attacker’s Wake – A second exploit

#18

Post by heliumcraft » Tue, Jun 21, 2016, 4:00 PM UTC

"This impacts all contracts on Ethereum, not just the DAO. This is an issue with Ethereum’s JavaScript-like programming language (Solidity)."

No it doesn't, no it's not. It affects contracts that use this functionality with arbitrary untrusted contracts (which is a bad idea), and most contracts just don't use this functionality at all.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#19

Post by goldenkey » Tue, Jun 21, 2016, 4:01 PM UTC

lostmsu wrote: post #14

Potential vector of attack to look for, not an exploit. Thus, flagged.

I guess you own some Ethereum and have no shame.

Re: Chasing the DAO Attacker’s Wake – A second exploit

#20

Post by AJ007 » Tue, Jun 21, 2016, 4:01 PM UTC

Nearly a year ago I made the comment --

"Who are these people[1] and what credentials do they have to build and run a cryptocurrency platform?" [1] https://angel.co/ethereum-1

Today, not a single cryptographer, mathematician, or anyone with software security experience is listed on the Ethereum Foundation member list[2]. I am not attacking any individuals by themselves, but as a group this says a lot.

For the record, what I see listed online today is a: consultant, magazine founder, a programmer, and a lawyer. On the advisory board a sales person, a psychologist, a leveraged debt consultant. On the "special advisors" list, which I have no idea what this means, maybe someone who answered a phone call a few times, one person with a bunch of business credentials, something "fintech" related with little explanation, and a tech CEO.

Maybe the Ethereum Foundation doesn't need anyone with deep experience in cryptography and security?

[2] https://www.ethereum.org/foundation