Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bug which lost more than $600M in various cryptocurrencies a few hours ago

twitter.com

Post reply on HN
Print view View original

21–30 of 126 posts

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#21

Post by hoseja »

masa331 wrote: post #11
malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

Sounds to me like there's a decentralized, trustless incentive to make sure your software is secure. Yelping NO FAIR! and central-bank-style rolling back the oopsie does not seem very radical and libertarian and crypto.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#22

Post by lucozade »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

> why would you be so afraid that the transaction would be cancelled?

The transaction will likely be for goods, services and/or money. If one or more parties don't provide said goods, services or money then the other parties may well want the transaction cancelled. That's different from them all being willing to transact in the first place.

That's not a justification for irreveribility. The opposite in fact. But if you were planning on screwing your customer, say, the irreversibility is a bonus.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#23

Post by 55555 »

There's a serious fundamental problem with DeFi that can't be solved with blockchains.

Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this.

One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a) patch the vulnerability, which will get him a pat on the back, or (b) convince himself he didn't notice anything, quit his job, wait a month, go to a coffee shop with a hoodie on, boot into whonix, connect to the internet with a 4g dongle, run a few lines of code, and get $600 million dollars.

Most people would choose (a)! And law enforcement is a thing! But a lot of people will choose (b), and if they do a merely decent job they will get away with it, and 600 million dollars is stolen®.

Actually, it's worse than that, because unlike normal banks, the code used by these digital banks is open source, and anyone in the world can go bug hunting.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#24

Post by et2o »

londons_explore wrote: post #20

"Check the first 4 bytes of" should be banned in crypto code. Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all. Why would you ever check 4 bytes? To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#25

Post by masa331 »

lmm wrote: post #12
masa331 wrote: post #11

Earlier quoted context omitted.

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

> I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations which weren't planned. So i don't think there is a problem with these fixes It's normal in most industries, but it also defeats the main selling point of crypto - "code is law" doesn't actually work, you always end up in a world of humans and politics.

Yes i agree and i don't think there is actually a problem with that. We are humans and we should be able to solve problems like this. I try to view it just as another way of bug fixing technique. Sometimes you can just explain that you messed up and others will understand

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#27

Post by crypt1d »

55555 wrote: post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#28

Post by ed_elliott_asc »

masa331 wrote: post #11
malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

“You can’t really write software without bugs” - which is why crypto will never be for me

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#29

Post by zimbatm »

malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

I bet that we will see insurance companies emerge in the market. Contracts will send a portion of the transaction to an insurance company. The insurance company would mandate "layers" to validate the contract. Users can then claim damages if there was a bug in the contract.

Once all this is done, the transaction fees will be equal or higher than traditional banking systems :-p

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#30

Post by paulgb »

MauranKilom wrote: post #18

Very ironic (or topical?) for a crypto exploit to boil down to finding a hash collision.

“Find a hash matching these digits” is roughly Bitcoin’s proof of work system. Maybe another way of looking at this is that these weren’t hackers, they were just miners who found a more lucrative coin to mine.
Post reply on HN