Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

231–240 of 629 posts

Re: Critical Update on DAO Vulnerability

#231

Post by mcherm »

joosters wrote: post #169
curiousgal wrote: post #135

Earlier quoted context omitted.

The announcement didn't come out of the blue. Exchanges don't want stolen funds to go through them so it is also in their interest to halt trading.

...but they didn't halt trading until they were asked to, so clearly it wasn't totally in their interests? Exchanges are in a difficult position once the 'head' of ethereum tells them to stop. It's a sign that the blockchain might be forked, so any further trades they make might be undone - they simply have little choice but to stop after being told to do so.

> but they didn't halt trading until they were asked to, so clearly it wasn't totally in their interests?

Not at all. This is a classic "coordination problem". It is advantageous for many participants in the overall system to take an action, but only if the other participants are ALSO taking the action. In such a case, a widely followed and popular leader is one possible coordinating mechanism. And it does not give that popular leader the ability to do ANYTHING, only things that actually ARE popular but require coordination.

Re: Critical Update on DAO Vulnerability

#232

Post by joosters »

johncolanduoni wrote: post #197
Tinyyy wrote: post #188

> (The soft fork) will later be followed up by a hard fork which will give token holders the ability to recover their ether. Does this mean that transactions are going to be rolled back? If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?

Remember that when they say it's a suggestion, it's truly a suggestion. If a majority of the miners refuse to accept the update, then what anyone at the Ethereum foundation wants them to do is irrelevant. There is definitely a lot of social pressure to consider here, but there is still no central switch. I'm generally not a huge fan of cryptocurrency (as currencies that is, I love the tech), but I fail to understand…

Rubbish, this is as centralised as you can get. Of course it will go through, because the alternative will cause forks and chaos. Miners have little to no choice but accept this decision from on high.

Re: Critical Update on DAO Vulnerability

#233

Post by cpa »

sznurek wrote: post #195

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do.

People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but it turns out that the implementation is not correct w.r.t the informal specification. That's called a software bug and abusing a bug to your own profit makes you an attacker in my book, just as much that using a flash 0-day to drop a rootkit makes you an attacker.

People should have been more careful, but hey, I'm not sure I would have.

Re: Critical Update on DAO Vulnerability

#234

Post by joosters »

Tinyyy wrote: post #201
jpereira wrote: post #192

Earlier quoted context omitted.

I don't think they're going to roll back transactions but rather build in the functionality to "give token holders the ability to recover their ether".

And how are they going to do that?

By changing the rules and bailing out a 'too big to fail' entity.

At least this way, with no full-scale rollback, other people's transactions won't be affected.

Re: Critical Update on DAO Vulnerability

#235

Post by malka »

joosters wrote: post #222
sznurek wrote: post #220

Earlier quoted context omitted.

I am not sure. I believe that in many cases similar activity would illegal or at least forbidden by Terms and Conditions. I the DAO case I am not aware of any regulations or laws that the "attacker" has broken.

The DAO's 'terms and conditions' were the contract code itself. During the crowd sale, it was often said that 'investors' need to look at the code because that is the only binding agreement. I guess it turns out that's a lie too.

Could the attacker then attack DAO for breach of contract ? That would be the ultimate plot twist.

Re: Critical Update on DAO Vulnerability

#236

Post by runn1ng »

justusw wrote: post #203
tomp wrote: post #191

Congratulations! A month after the first real test of the "distributed", "safe" cryptocurrency featuring "enforcable" contracts, it turns out it's none of this.

I share your bitterness. The meaning of the word "safe" seems to vary from person to person. The ETH and contract devs think safe means having a static PL to capture contracts. But in reality it is safe as in, whoever exploited the vulnerability now has a "safe" source of income in a few weeks. Perhaps it is a lesson better learnt now than later when the stakes are even higher.

Well, she doesn't, they will block the attacker outright by a centralized decree. What's the better proof that decentralized solutions work than blacklisting accounts and making ad-hoc forks for each attack.

Re: Critical Update on DAO Vulnerability

#238

Post by wolfgke »

infodroid wrote: post #127
icebraining wrote: post #114

Earlier quoted context omitted.

Actually, I'd say the fact that he has to publicly ask for exchanges to stop the trades, and can't simply press a button or send out an order, shows the decentralization. Decentralization doesn't prevent coordination.

I think you're missing the point. The fact that one man can bring the whole of Ethereum trading to a halt with an announcement really demonstrates just how much power he has. So it doesn't matter that he doesn't have a physical kill switch if the end result is the same.

> I think you're missing the point. The fact that one man can bring the whole of Ethereum trading to a halt with an announcement really demonstrates just how much power he has.

The reason for this is that ethereum exchanges are not decentralized and the "program" that the owners of the exchanges execute on their brains partly allows "dynamic mental code update" by Vitalik Buterin.

Re: Critical Update on DAO Vulnerability

#240

Post by Chris2048 »

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

> participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent

Stuff like patent-trolling (and patents) suggest to me the law isn't so consistently trustworthy as you suggest.

Post reply on HN