Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Deleting $300M by messing around with Ethereum contracts

hackernoon.com

Post reply on HN
Print view View original

21–30 of 45 posts

Re: Deleting $300M by messing around with Ethereum contracts

#21

Post by TeeWEE »

mannykannot wrote: post #18
TeeWEE wrote: post #6

The author mentions that turing complete contracts will have bugs in them eventually. While currently that happens, we do have formal verification methods in computer science. And thats exactly what people are trying to apply on Ethereum: Formally verified smart contracts. https://blog.ethereum.org/2016/06/19/thinking-smart-contract...

Formal methods have been under development for decades, yet their penetration into software development is miniscule. Hardly any professional developers know how to use them. Turning Ethereum and its contracts into a formally verified system would be the largest adoption of formal methods by several orders of magnitude. Ironically, the article you link to does not support your post: it also stresses the difficulties…

Yeah true, it is used in some industries such as the space and flight industries, where you want to be sure your code is correct.

However it comes with a range of problems, and often its not worth going into the effort of formally verifying a contract. But with ether, the costs quickly outweigh the ptential losses.

I don't know if it will work, in theory it can, i just wanted to be possitive: I see a light at the end of the tunnel.

Re: Deleting $300M by messing around with Ethereum contracts

#22

Post by rrobukef »

mannykannot wrote: post #19
rrobukef wrote: post #17

Earlier quoted context omitted.

It is just moving the goalposts. The formally verified contract is only as good as the assertions proven. Look at WPA2, it was formally verified against 'most' attacks.

Just to be clear, this is an argument that even formal methods might not be sufficient to secure Ethereum (and certainly not if applied piecemeal), not an argument that it can be secured by other means.

Yes, i think a lot of the stupid bugs would be avoided. I don't think this was a stupid enough bug that formal methods would always catch.

Re: Deleting $300M by messing around with Ethereum contracts

#23

Post by thisisit »

oelmekki wrote: post #14

The thing is, the kind of developers it takes to implement smart contracts correctly is probably exceptionally rare, if they even actually exist. I don't think it's impossible, but it's clearly in conflict with the "release early, release often" culture. If anything, developing smart contracts is more like building software for NASA crafts : you have to get it right before the launch. And even regarding the NASA, I g…

It's not the release culture that is at fault here. It takes age for a language to mature. Relying millions of dollars on an untested language is grounds for trouble.

Re: Deleting $300M by messing around with Ethereum contracts

#24

Post by thisisit »

It just goes to show why developing a mature language is a difficult task. There are situations that were never thought of or some really unintended consequences.

Additionally, for the love of god, why are people experimenting on the main-net? My understanding was Ethereum has a test-net to try and experiment/learn smart contract coding. Is that too different from the main-net to learn stuff?

Re: Deleting $300M by messing around with Ethereum contracts

#25

Post by bpicolo »

thisisit wrote: post #24

It just goes to show why developing a mature language is a difficult task. There are situations that were never thought of or some really unintended consequences. Additionally, for the love of god, why are people experimenting on the main-net? My understanding was Ethereum has a test-net to try and experiment/learn smart contract coding. Is that too different from the main-net to learn stuff?

He was experimenting with productionized main net code.

Re: Deleting $300M by messing around with Ethereum contracts

#26

Post by [deleted] »

dagw wrote: post #16
kbart wrote: post #15

Earlier quoted context omitted.

Yet this system is not bulletproof either: 0. http://www.telegraph.co.uk/news/uknews/crime/11414191/Hacker... 1. https://en.wikipedia.org/wiki/Bangladesh_Bank_robbery

Of course no system is completely bulletproof against a determined attacker. There are however a few differences. First of all what these people did is obviously illegal and people go to jail for doing that sort of thing. As it stands there is no legal consensus on whether exploiting a bug in a smart contract is illegal or not. Secondly and more importantly, the fail-safes built into the system largely work. In the B…

[deleted]

Re: Deleting $300M by messing around with Ethereum contracts

#27

Post by libeclipse »

kbart wrote: post #12
libeclipse wrote: post #4

This is really funny, and hopefully this time people will realise the danger of using programmer-written contracts to manage millions of dollars . If someone can accidentally delete that volume of your money, it's not that someone's fault, it's your fault.

Bank accounts, wire transfers that move trillions are also written by programmers, so should we stay to cash economy only? The problem is immaturity of crypto currency/contract market as it's still in its infancy. I'm optimistic about crypto economy future as most of current problems could be fixed (or at least alleviated) by standards, regulations and discipline.

My bank account isn't managed by some sketchy Solidity contract.

Re: Deleting $300M by messing around with Ethereum contracts

#28

Post by thisisit »

bpicolo wrote: post #25
thisisit wrote: post #24

It just goes to show why developing a mature language is a difficult task. There are situations that were never thought of or some really unintended consequences. Additionally, for the love of god, why are people experimenting on the main-net? My understanding was Ethereum has a test-net to try and experiment/learn smart contract coding. Is that too different from the main-net to learn stuff?

He was experimenting with productionized main net code.

You lost me half way there. Experiment and production don't go together. Still what is a productionized main net code? Please elaborate.

Though looking at the screenshots, specially in the third one, he claims to be learning. He was experimenting sending kill() and destroy() to contracts on main net.

Re: Deleting $300M by messing around with Ethereum contracts

#29

Post by bpicolo »

thisisit wrote: post #28
bpicolo wrote: post #25

Earlier quoted context omitted.

He was experimenting with productionized main net code.

You lost me half way there. Experiment and production don't go together. Still what is a productionized main net code? Please elaborate. Though looking at the screenshots, specially in the third one, he claims to be learning. He was experimenting sending kill() and destroy() to contracts on main net.

I can clarify. My point is that the code on the ethereum main net is immutable and permanent. If it wasn't this guy, it would have been someone else, either malicious or not.

If you deploy code to the ethereum main net, it is vulnerable to the world. The issue isn't that the guy was toying with main net contracts, the issue was that the contract was busted, and there was this room for problems.

Ethereum has been extraordinarily prone to these sorts of errors so far (see the DAO). As of now, the foundation is unstable and the stakes are high.

Re: Deleting $300M by messing around with Ethereum contracts

#30

Post by kjrose_pr »

beaconstudios wrote: post #10
mosselman wrote: post #9

I just hope that poor guy can still sleep instead of lying awake at night, listening for the soft tapping of the assassins' padded steps on his bedroom floor. I can imagine someone out there is pretty unhappy with him.

on the bright side, that someone won't have any money left to pay assassins.

Ouch.

As well, if they do have any money, he just needs to delete it.

Post reply on HN