Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

181–190 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#181

Post by grandalf »

abalone wrote: post #139
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Users of the contract should pay an insurance fee Which would make such contracts significantly more expensive than regular contracts that are reversible by trusted intermediaries and legal authorities. Paying out insurance claims is much more expensive than simply reversing a transaction. This is part of the reason Bitcoin never took off as an alternative to credit cards. Consumer protections are much more expensi…

> Which would make such contracts significantly more expensive than regular contracts that are reversible by trusted intermediaries and legal authorities.

You assert this but don't offer proof. The cost of fraud is baked into all areas of our economic system to the point where it's very difficult to establish how much it is costing society. Arguably the massive innovations in counterfeiting prevention in the past decades indicate that counterfeiting is a major problem. Money laundering and tax evasion are the other big crimes that impose significant social cost which public blockchain systems solve beautifully.

The larger a percentage of the economy that is transacted via a public blockchain, the less opportunity for all sorts of crime. The existence of the "trusted intermediaries and legal authorities" as well as the elaborate enforcement mechanisms that accompany them, are themselves a cost.

> This is part of the reason Bitcoin never took off as an alternative to credit cards

This does not make sense as Bitcoin is not a mechanism for extending consumer credit.

> Consumer protections are much more expensive to wrap around immutable transactions

Protections against what? Confusing interest rate terms or cards sold to college students? Bankruptcy or minimum payment rules? All these sorts of things would apply equally to a credit card denominated in BTC so I'm not sure what you mean.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#182

Post by dragonwriter »

pdkl95 wrote: post #170
grandalf wrote: post #93

Earlier quoted context omitted.

> do things that are technically allowed, but have unexpected downsides Unexpected downsides for whom? Smart contracts cease to be smart if we have to rely not on the VM but on a small group of human overlords. If a smart contract exists and you don't know clearly how many times it has been used and what percentage of the parties who used it are pleased with its functioning, you really should not use it unless you fe…

> personally reviewing the code. With the insane decision to use a Turing-complete language, the contract's behavior undecidable . You don't even know if the contract will halt . Limited "gas" (execution time) isn't the solution, because the lesson of the Halting Problem isn't that a program might not terminate. Even if the program halts within a finite time (or "gas"), the behavior of the program on the current inpu…

> With the insane decision to use a Turing-complete language, the contract's behavior undecidable.

OTOH, if the language isn't Turing-complete, there will almost certainly be things you'll want a contract to do that it can't. You can have generality or decidability, but not both.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#183

Post by flamedoge »

finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

not even banks can give you guarantee of safely holding money with impeccable degree of certainty. Uncertainty cannot be avoided.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#184

Post by STRiDEX »

sillysaurus3 wrote: post #154
vkou wrote: post #80

Earlier quoted context omitted.

> If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Exchange to BTC, mix it, exchange to USD. > Also has the attacker broken a law by exploiting a bug in the contract? There are no laws. Only contracts.

This won't work in the US. It's very hard to get USD out of Bitcoin. And then the IRS will want to know where you are suddenly getting a huge amount of money from. You could use localbitcoins to offload one coin at a time on an as-needed basis. That'd be pretty sweet, and the IRS won't be able to know anything strange is happening if you avoid depositing your USD into a bank. But paying rent in all-cash is rather ske…

If you buy all your food, drinks, and lunch in cash for life. That's pretty good savings.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#185

Post by aresant »

From the post mortem (1) -=>

- A hacker managed to exploit a ICO multisig wallet vulnerability and drain 44,055 ETH - $9,119,385 at present.

- A white hat showed up and "saved" 377,000 ETH - $78,039,000 !!! - by draining other accounts.

I get the "see cryptos are too insecure / it's a pyramid / it's a bubble / ICOs are scams / etc" arguments.

But holy shit turning a world currency into the wild west - for better or worse - is going to be disruptive, period.

That $10m out the window is like a Series A for a nefarious hacker with deep crypto skills, what does this success embolden or create?

I can only imagine the debacles that we have to look forward to, and I say that in full support of and as a long term believer in both blockchain and cryptocurrencies.

(1) https://press.swarm.city/parity-multisig-wallet-exploit-hits...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#186

Post by elviejo »

dvcc wrote: post #34
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

For the same reason every variable in JavaScript is global by default... I.e. I don't have a clue how that could seem like a good idea.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#187

Post by [deleted] »

dvcc wrote: post #34
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

[deleted]

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#188

Post by [deleted] »

0x0 wrote: post #108
Woofles wrote: post #63

Earlier quoted context omitted.

IANAL but if someone leaves their front door open, it's still illegal to walk in and take their possessions. I would imagine this falls under a similar ruling.

In most cases yes, but isn't ethereum all about "the code _is_ the contract"? If you as the owner of a house put an ad in the paper saying "if you can manage to enter my house feel free to take whatever you want", should you complain if someone did exactly that?

[deleted]

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#189

Post by finnh »

flamedoge wrote: post #183
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

not even banks can give you guarantee of safely holding money with impeccable degree of certainty. Uncertainty cannot be avoided.

Slow down! Let's just aim for reducing uncertainty.

Let's say we have an uncertainty scale scored 1-100. If 100 is "money in a bank" and 1 is "money that's already been set aflame, but there's a cup of water nearby", I'd put Ethereum in the low single digits =)

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#190

Post by urda »

codewiz wrote: post #180
urda wrote: post #141

Earlier quoted context omitted.

... because it breaks the basic fundamentals of a block chain. A block chain is supposed to fight against roll backs not support them . Sure, the core team / devs are using the rollback for good. But will that always be the same in the future? It's an avenue for abuse and one of the primary reasons ether isn't going to take off.

The point is, if the core team made a change that's widely unpopular, clients would just refuse to upgrade to that version. Discontent users simply switch to a different branch maintained by different developers. If there's enough consensus, people will call it "real" blockchain and the other one will be left behind with few users and hence no meaningful way to spend the balances.

The last thing you want with any currency is two different sides arguing what the real "truth" is.

The moment that happens, the currency loses any influential power.

Post reply on HN