Earlier quoted context omitted.
This is comedy gold.
Not everyone uses (I'm assuming) Twitter
Yeah, should it be PM? They are on IRC, after all.
Critical Update on DAO Vulnerability
121–130 of 629 posts
Re: Critical Update on DAO Vulnerability
#122The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…
It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times. It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder…
I find it truly amazing that a project with hundreds of millions of dollars at stake could have such a simple bug. After they discovered the first bug, it seems like they should have sat down to carefully audit all other places where that could happen - because it seems like the attackers certainly did!
From reading the article on Smart Contract security (https://blog.ethereum.org/2016/06/10/smart-contract-security...), I get the feeling that the programming model might be somewhat to blame. The "obvious" ways of implementing something are subtly broken, in ways that are very difficult to anticipate without a very deep understanding of the protocol. The programming model demands that the program be capable of calling functions that are not under the programmer's control, and which can do nearly anything. This is very, very difficult to get right, and very easy to screw up, as anyone who has tried to write a sandbox environment can attest to.
Re: Critical Update on DAO Vulnerability
#123Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…
And if it can't be stopped, the argument about decentralized apps being "unstoppable" won't be that appealing anymore after all :)
It's sad, being able to write blockchain apps like with ethereum and lisk is cool tech, but we'll have to deal with the idea that once is out, it's out. Programming NASA style.
Re: Critical Update on DAO Vulnerability
#124Isn't it race condition?
Re: Critical Update on DAO Vulnerability
#125Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…
Vitalik Buterin, the co-founder and Chief Scientist of Ethereum, just called for a DAO and ETH trading halt at all Ethereum exchanges: https://www.reddit.com/r/ethereum/comments/4oif2x/dao_attack...
[deleted]
Re: Critical Update on DAO Vulnerability
#126So the attacker can buy very cheap eth/dao right now, then somehow stop/reverse the attack/send money back/claim it was white hacking and effectively launder all the money he gained legitimately.
Re: Critical Update on DAO Vulnerability
#127Earlier quoted context omitted.
Apparently all that talk of decentralisation goes out the window when you're losing money. Ha
Actually, I'd say the fact that he has to publicly ask for exchanges to stop the trades, and can't simply press a button or send out an order, shows the decentralization. Decentralization doesn't prevent coordination.
I think you're missing the point. The fact that one man can bring the whole of Ethereum trading to a halt with an announcement really demonstrates just how much power he has. So it doesn't matter that he doesn't have a physical kill switch if the end result is the same.
Re: Critical Update on DAO Vulnerability
#128Earlier quoted context omitted.
Can't they just take control of TheDAO, and then steal all its Ether?
And drop its value to nothing, why do that?
The purpose of a hack (or any crime) is not to extract the maximum possible value, but to extract the maximum value and get away with it. Cashing out quickly and disappearing is part of the escape strategy. They probably won't care if it destroys the currency.
Re: Critical Update on DAO Vulnerability
#129This pretty directly contradicts a lot of the hype around Ethereum. Yes, bad contract code is bad, but a lot of money is about to evaporate. If it isn't easy to write secure contracts then there is a serious deployment problem.
No money is going to evaporate. First of all, the value just changes hands and second of all, there is no money involved, just toy bits.
Exactly, its just toy bits..
But we live in a reality so upside down, that we value toy bits and numbers on paper more than the real things :)
Re: Critical Update on DAO Vulnerability
#130Market is reacting to it https://www.coingecko.com/en/price_charts/ethereum/usd
Ethereum down from $21 to $15 in minutes