Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

111–120 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#111

Post by taspeotis »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Matt Levine has some thoughts [1] on that matter.

[1] https://www.bloomberg.com/view/articles/2016-06-17/blockchai...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#112

Post by grandalf »

anigbrowl wrote: post #72
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

What if the insurance doesn't pay out because it too is a flawed contract?

Various insurance contracts could be applied redundantly and/or recursively, and of course over time the real-world characteristics ought to become known and the price of insurance for well understood contracts should approach free.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#113

Post by finnh »

52-6F-62 wrote: post #58
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

This is somehow the top comment, but doesn't deal with the issue at hand. In fact it entirely ignores it. The theft wasn't due to an issue in the core protocol of Ethereum, it's due to faulty code in a single piece of software (as you can see throughout the rest of the thread). It's a matter of poor engineering practices, not a flaw in the fundamentals of the protocol. If an engineer designed a bridge, and it failed…

Well, the original comment that I excerpted from was discussing the flaw in the very idea of smart contracts superseding human-readable agreements (ie, "the code is the law, and anything we say about the code is just so much noise").

So, yes, in reposting I generalized from "smart contracts are a bad idea" to "Ethereum is a bad idea". Considering how essential the smart contract is to essence of Ethereum, I feel comfortable making that generalization.

Side note: "the essence of ethereum" would make a great subtitle for Drakkar Noir.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#114

Post by xadhominemx »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

it creates such a bad alternative to the current system it's certain not to come about.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#115

Post by pg_is_a_butt »

draw_down wrote: post #91
Deimorz wrote: post #54

Earlier quoted context omitted.

I don't follow Ethereum closely at all, but I don't really understand a few things about this: - Who's the "white hat group"? Why do people have confidence in it? - Why does everyone believe they'll give back $75M+? If they decided to just keep it, what could anyone do? - How will people even be able to claim ownership of the ETH in a way that's verifiable so they know they're giving it back to the right person?

The question makes sense, but really why do people have confidence in any of this, you know what I'm saying?

because it's hashed... so you can't hack it.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#116

Post by splintercell »

twblalock wrote: post #38
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Ethereum offers immutability, and blockchains can foster new kinds of trust, but trust still has to grow organically in the ecosystem. If you need a source of trust outside of the blockchain, why would you need the blockchain after such trust has been obtained?

It's about the structuring of the trust. I trust that someone from the hospital will triage me when I get to the emergency room, but that kind of trust is very different than if there is an online service which does remote triaging when I am on my way to the hospital.

When the proponents of this service are claiming that you don't have to trust the hospital that they would get someone to triage you, instead you can have your own assigned triage Nurse, you're claiming "But you still have to trust that this third party agency will have someone on the remote location to triage you, then what's the point of using this service?"

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#117

Post by fatbird »

omarchowdhury wrote: post #104
twblalock wrote: post #76

Earlier quoted context omitted.

I would add one more point: even if both participants in a contract fully understand and agree to the contract, the contract could still be thrown out under contract law for many reasons -- unconscionability, agreement to commit a crime, etc. If Ethereum becomes popular enough, one day the participants in an Ethereum contract are going to sue each other, and the judge is not going to be impressed by arguments that th…

If we enter a contract that we all know is intended to be immutable, why would a judge not enforce that? I can understand buried and obfuscated immutability clauses, but if the parties know exactly what they're getting into, the parameters of justice are contained.

the parameters of justice are contained

It just doesn't work like this.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#118

Post by root_axis »

Woofles wrote: post #63
joshschreuder wrote: post #52

Let's play hypotheticals. If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Also has the attacker broken a law by exploiting a bug in the contract?

IANAL but if someone leaves their front door open, it's still illegal to walk in and take their possessions. I would imagine this falls under a similar ruling.

I don't know if that analogy holds in the context of ethereum which is marketed as "code as law". I think it could be reasonably argued that this individual was fairly participating within the terms of the contract.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#119

Post by DennisP »

sidthekid wrote: post #51
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

About half my day job is auditing Solidity code for startups. And yes this should have been caught.
Post reply on HN