Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

101–110 of 629 posts

Re: Critical Update on DAO Vulnerability

#101

Post by mpeg »

infodroid wrote: post #77
joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

Vitalik Buterin, the co-founder and Chief Scientist of Ethereum, just called for a DAO and ETH trading halt at all Ethereum exchanges: https://www.reddit.com/r/ethereum/comments/4oif2x/dao_attack...

Apparently all that talk of decentralisation goes out the window when you're losing money. Ha

Re: Critical Update on DAO Vulnerability

#102

Post by makomk »

ThomasRooney wrote: post #60
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

- I don't think there's any definitive details yet, but it could be an instance of this attack [1]. The code behind the DAO is available here [2]. Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open. - Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inve…

This is astonishing. The company behind the DAO knew that the bug in question affected withdrawals from the DAO rewards balance and wrote a blog post saying this isn't an issue because it's empty, but either didn't bother checking whether withdrawals of of people's original capital through the splitDAO mechanism (which is possible) had the same bug, or did and pretended it didn't exist and everyone's funds were fine.

Re: Critical Update on DAO Vulnerability

#103

Post by tomp »

jabgrabdthrow wrote: post #52
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times. It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder…

> if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept.

I guess if Ethereum makes a hard fork, that will damage it much more - basically, it makes the "smart" contracts unenforcable.

Re: Critical Update on DAO Vulnerability

#104

Post by nneonneo »

ThomasRooney wrote: post #60
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

- I don't think there's any definitive details yet, but it could be an instance of this attack [1]. The code behind the DAO is available here [2]. Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open. - Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inve…

Ah, I see: the money isn't missing, it's just gone to an unknown party (the hacker) - so we're practically watching a bank heist in progress, where the "good guys" are trying to slow down the robber's getaway vehicle (by flooding the transaction network).

I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546dfe434669c6..., I can see that most of the transactions are internal, with the API reporting monotonically increasing call-depth values. It seems like there are three recursive calls involved here: one call in the DAO, a second call to transfer money to the attacker, and a third "dummy" call which appears to transfer nothing (but presumably kicks off the next recursion into the DAO).

The scary thing, to me, is that someone else could figure out the bug right now and start exploiting it - presumably, all the relevant code is open source.

Re: Critical Update on DAO Vulnerability

#105

Post by pjc50 »

lazaroclapp wrote: post #71
OscarCunningham wrote: post #54

Earlier quoted context omitted.

Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it

I think they could also be shorting ETH, in dollars/euros/rubles/yuans, in which case destroying the currency would be excellent business for them, even if they can't extract what they stole.

Shorting small illiquid markets is very difficult and prone to blowing up in your face. The most recent famous example of this is Porsche/VW: http://www.economist.com/node/12523898

Re: Critical Update on DAO Vulnerability

#106

Post by benbou09 »

OscarCunningham wrote: post #54
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it

Can't they just take control of TheDAO, and then steal all its Ether?

Re: Critical Update on DAO Vulnerability

#107

Post by ottodev »

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

If there is network consensus to do the rollback, then the blockchain stays decentralised.

Re: Critical Update on DAO Vulnerability

#108

Post by ottodev »

joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

If there is network consensus to do the rollback, then the blockchain stays decentralised.

Re: Critical Update on DAO Vulnerability

#110

Post by anc84 »

pmorici wrote: post #57
anc84 wrote: post #33

Earlier quoted context omitted.

No money is going to evaporate. First of all, the value just changes hands and second of all, there is no money involved, just toy bits.

well the market price of ETH went from $22 earlier today to as low as $15 in the last 30 minutes so I would say a lot of value has evaporated even if the eth itself hasn't.

I would not consider fraud schemes valuable.
Post reply on HN