Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bug which lost more than $600M in various cryptocurrencies a few hours ago

twitter.com

Post reply on HN
Print view View original

11–20 of 126 posts

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#11

Post by masa331 »

malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs.

There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt.

I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations which weren't planned. So i don't think there is a problem with these fixes

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#12

Post by lmm »

masa331 wrote: post #11
malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

> I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations which weren't planned. So i don't think there is a problem with these fixes

It's normal in most industries, but it also defeats the main selling point of crypto - "code is law" doesn't actually work, you always end up in a world of humans and politics.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#13

Post by throwaway6734 »

masa331 wrote: post #11
malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

Relying on an external authority to control the allocation of money seems to completely undermine the purpose of crypto.

What's to stop these actions being taken for reasons other than theft?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#14

Post by mrtksn »

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug.

I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled?

The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very well defined, so you want assets be stable.

Is there a company or cryptocurrencies focusing on solving the human part in the transactions? Huge part of the value with working in traditional systems is their resiliency against human errors. Sometimes mistakes happen(a faulty system, a design bug or straight out human error and people who are trying to take advantage of those), most of the time these are correctable.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#15

Post by trhway »

lordnacho wrote: post #4
irjustin wrote: post #2

Can someone help ELI5 please? [EDIT] Okay not 5... maybe like 25 but not in crypto tech.

My quick reading of it: there's this chain of chains that tries to make it possible to interoperate the various blockchains. The way they do it is they have a gatekeeper on each chain that locks up funds on one chain and releases them on another. Someone found a way to replace this gatekeeper with their own version, leading to havoc. The technical details are fascinating and super complex. And IME comically badly doc…

>Someone found a way to replace this gatekeeper with their own version

The gatekeeper function was "protected" by hash of its name and parameter types and this is the $600M quote:

"You don't need to find a full hash collision, you're only checking the first four bytes. "

And it is all in the environment where mountains of hardware with highly optimized software are combined in huge networks with the only purpose of calculating few basic types of hashes :)

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#16

Post by moss2 »

masa331 wrote: post #11
malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

When was the last time banking software got hacked?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#17

Post by masa331 »

throwaway6734 wrote: post #13
masa331 wrote: post #11

Earlier quoted context omitted.

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

Relying on an external authority to control the allocation of money seems to completely undermine the purpose of crypto. What's to stop these actions being taken for reasons other than theft?

You always need to rely on some external authority. You can't crypto/decentralize everything.

And relying on external authorities is a good thing actually. Because it's way way more effective than software solutions. Now of course the external authority can compromise sometimes but for this we also already have solutions for like thousands of years - diversification. If people just would learn not to put all their eggs into pne basket and expect eventual compromise that wouldn't be a problem. I think some 101 finances and practical real world problem solutions classes or something like this would get us way further than decentralisig everything with software

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#20

Post by londons_explore »

"Check the first 4 bytes of" should be banned in crypto code.

Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all.

Why would you ever check 4 bytes?

To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

Post reply on HN