Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

medium.freecodecamp.org

Post reply on HN
Print view View original

111–120 of 440 posts

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#111

Post by jacquesm »

wildmusings wrote: post #107
jacquesm wrote: post #101

Earlier quoted context omitted.

You really just simply do not get it. Just like the law can not define Pi to be 3 the law should not be able to influence the outcome of a smart contract if smart contracts work at all because that is how it is intended to work, smart contracts are supposed to be the entirety of the agreement, no outside interpretation should make a difference nor could it make a difference. This is where the Ethereum crowd has - in…

I do get it. I just don't think that's realistic. What smart contracts should be according to you is mostly irrelevant to how the law will treat them.

You still don't get it. The law will not have anything to say about smart contracts because the law will not be able to enforce a contract one way or another depending on some judge but it will simply execute and that's the end of that.

This so that some guy in China or India and some guy in the United States can agree on terms without having to haggle over whose legal jurisdiction will kick in if and when there is a dispute about the contract.

Until we get a world government and until judges are able to order millions of nodes all over the world to do a hard fork there is no way around a smart contract environment that actually works. But we don't have that at the present, Ethereum as far as I'm concerned was DOA because of DAO.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#112

Post by wildmusings »

jacquesm wrote: post #111
wildmusings wrote: post #107

Earlier quoted context omitted.

I do get it. I just don't think that's realistic. What smart contracts should be according to you is mostly irrelevant to how the law will treat them.

You still don't get it. The law will not have anything to say about smart contracts because the law will not be able to enforce a contract one way or another depending on some judge but it will simply execute and that's the end of that . This so that some guy in China or India and some guy in the United States can agree on terms without having to haggle over whose legal jurisdiction will kick in if and when there is…

However a smart contract between you and me may execute, a court can still order me to give you money, or order me to enter into a different smart contract. And if I don't comply, they will eventually hold me in contempt and at some point seize my property by force and throw me in jail if I resist.

The authority of the state ultimately rests on its ability to resort to violence to enforce its will. No smart contract can change that.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#113

Post by brongondwana »

owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

Your logic doesn't add up. Attackers are only willing spend $90k if there's a 90 percent chance they can exploit a bug in the contract to extract the entire $100k value.

Clearly if TWO hackers both spend $90k and only one extracts the value, the other one has lost their entire $90k - unless there's a way to be sure you are the one who will win that, your expected return on the $90k is only $50k if there are two parties trying to hack the contract.

The interesting bit is yes - the immediate loss. But a loss of unmarked cash is similarly instant.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#114

Post by [deleted] »

jacquesm wrote: post #99
wildmusings wrote: post #69

Earlier quoted context omitted.

That's a fascinating point. Can any lawyers comment on how the law might see this?

The whole point of smart contracts is that lawyers' (and judges) opinions are not relevant. As soon as you need them and they have some power to make the thing go one way or the other the whole smart contract concept has failed.

[deleted]

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#115

Post by seanwilson »

Hmm, so don't most courts consider the spirit of a law/contract as opposed to the exact wording to get around people finding obscure loopholes in the phrasing? That's one area a computer is not going to be forgiving about.

Obviously in this case, reassigning the wallet owner is completely against the spirit of the smart contract. What solutions are there to this? All I can think of is for contract coders to use a language that allows contract constraints to be specified more easily (e.g. "owners cannot be reassigned") and have it verified by the language. Maybe this is a good application of formally verified code but the language being used doesn't seem built with that in mind.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#116

Post by jlebar »

"It’s going to take a lot of work to develop the training and discipline to treat smart contracts the way that banks treat their ATM software."

https://web.archive.org/web/20160406115607/https://www.bloom...

ATMs are not secure because of their software. They are secure despite their software.

Maybe eth will reach the point where the police will come after people who try heists like this. That seems much harder than coming after someone who stole $30m from a series of ATMs, though.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#117

Post by JetSpiegel »

tlrobinson wrote: post #59
owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

Is formal verification of contracts feasible? Is anyone working on it? Also, here's a possibly crazy idea: could one create bug bounties for algorithms (or even arbitrary software) on the Ethereum blockchain by writing the algorithm into a contract such that if you somehow break it you receive the bounty? An example of this would be the massive implicit bounty currently placed on the crypto algorithms (SHA256, ECDSA/…

There's already an implicit bug bounty. Whoever found this bug got a bounty of millions. Much better than the presence that tech companies pay.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#118

Post by vimota »

owenversteeg wrote: post #52

I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…

I mostly see your point, except your argument seems to be missing the important fact that the payoff for the hackers is not guaranteed. To say someone is willing to spend up to 90% of the potential payoff without a guarantee that they will be paid out is missing a fundamental aspect of the economic equation here.

The scenario you gave should be fairly similar to any application outside of Ethereum that deals with money ie. a banking app, except for the fact that, like you mentioned, you can't prosecute someone.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#119

Post by jacquesm »

wildmusings wrote: post #112
jacquesm wrote: post #111

Earlier quoted context omitted.

You still don't get it. The law will not have anything to say about smart contracts because the law will not be able to enforce a contract one way or another depending on some judge but it will simply execute and that's the end of that . This so that some guy in China or India and some guy in the United States can agree on terms without having to haggle over whose legal jurisdiction will kick in if and when there is…

However a smart contract between you and me may execute, a court can still order me to give you money, or order me to enter into a different smart contract. And if I don't comply, they will eventually hold me in contempt and at some point seize my property by force and throw me in jail if I resist. The authority of the state ultimately rests on its ability to resort to violence to enforce its will. No smart contract…

> However a smart contract between you or me may execute, a court can still order me to give you money,

Just like that judge that ordered the DAO hack to be reversed?

> or order me to enter into a different smart contract.

No, a judge will never order anybody to enter into a different smart contract just like they don't order people into regular contracts today.

> And if I don't comply, they will eventually hold me in contempt and at some point seize my property by force and throw me in jail if I resist.

Judges have a lot of power, but they can't enforce their views on people not in their jurisdiction without the cooperation of judges and governments in other countries. This is one of the major drivers behind the development of smart contracts. I think that for those situations where 'dumb' contracts suffice they will continue to be used and the courts will continue to have their power. But precisely for those situations where the courts do not have such power smart contracts are a potential solution.

> The authority of the state ultimately rests on its exclusive right to resort to violence to enforce its will. No smart contract can change that.

The world is larger than just your own country.

Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum

#120

Post by gjjrfcbugxbhf »

jacquesm wrote: post #111
wildmusings wrote: post #107

Earlier quoted context omitted.

I do get it. I just don't think that's realistic. What smart contracts should be according to you is mostly irrelevant to how the law will treat them.

You still don't get it. The law will not have anything to say about smart contracts because the law will not be able to enforce a contract one way or another depending on some judge but it will simply execute and that's the end of that . This so that some guy in China or India and some guy in the United States can agree on terms without having to haggle over whose legal jurisdiction will kick in if and when there is…

If you try to argue this to a judge you will most likely end up doing some time for contempt of court.

I am not a lawyer and not your lawyer.

Post reply on HN