Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

231–240 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#231

Post by blueprint »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Well, you know, except for the whole "we, the central governors, will hard-fork if we get scared that there's an existential threat to the blockchain" thing.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#232

Post by quickthrower »

dom96 wrote: post #202
tinco wrote: post #169

Earlier quoted context omitted.

It was designed to be like Javascript. Of all languages...

Wouldn't it make more sense to design it like Haskell? or something even more strict? A little bit of extra work seems like a small price to pay to prevent millions being stolen from your wallet because of a silly mistake like this...

In Haskell everything is public by default unless you specify exports for the module.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#233

Post by DenisM »

sillysaurus3 wrote: post #209
true_religion wrote: post #171

Earlier quoted context omitted.

Why is it very hard? Can't one simply use Coinbase? > And then the IRS will want to know where you are suddenly getting a huge amount of money from. In my experience, the IRS is largely unconcerned with where you are getting money from. They just want you to declare it, and pay taxes on it. If you treat Bitcoin as ordinary income and pay taxes on it at the highest available rate, the IRS will largely be satisfied. If…

You're saying you could declare "I now have $30 million in assets" on your IRS forms and it wouldn't trip any alarms? I mean, I don't personally know which alarms would be tripped, or what effect that would have. But that just seems so unlikely. It'd be fascinating if this were true, though, so any info would be appreciated. Re: coinbase, it'd be foolish to use them because they have a history of disabling accounts f…

Tax forms don't have a place to declare assets, iirc, only income.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#235

Post by kbenson »

wheelerwj wrote: post #212
TylerE wrote: post #140

Earlier quoted context omitted.

Because the cryptocurrency space attracts only the brightest minds .

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

I think a big part of the complaint is about the implicit assumption that because people are smart, and have experience with cryptography, they necessarily have the experience to design a sane and safe programming language given their goals.

They did put themselves way out there, and that takes ambition, but also hubris. I wish they were able to figure out which one was driving them at certain points a bit better, as while some of these problems are because they are doing new and interesting things, some are old as dirt for computing, and there's little defense.

If some company tried to tout a new language with all the pitfalls of C, but none of the benefits of being really inter-operable and known the same way, I'd like to think we could recognize that as having some very bad design choices given what we've learned from C, and at little benefit other than being different. Ignoring decades of research and experience on the topic through ignorance is not laudable, even if you've put yourself out there. I can't help but feel we have a similar scenario going on here.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#236

Post by ChrisClark »

sillysaurus3 wrote: post #194
aresant wrote: post #185

From the post mortem (1) -=> - A hacker managed to exploit a ICO multisig wallet vulnerability and drain 44,055 ETH - $9,119,385 at present. - A white hat showed up and "saved" 377,000 ETH - $78,039,000 !!! - by draining other accounts. I get the "see cryptos are too insecure / it's a pyramid / it's a bubble / ICOs are scams / etc" arguments. But holy shit turning a world currency into the wild west - for better or w…

The real lesson is: don't store your coins on a third party anything . This was a third-party wallet. Everyone used it because everyone else used it. Exactly like Mt Gox. There was no reason to store coins on Mt Gox, just like there was no reason to use this wallet. A moment's reflection would have prevented this foolish decision.

This wasn't a third party wallet actually. It is the local Parity wallet and node. What this was, was a bug in the multisig contract that Parity would give you to deploy. So it is a contract you personally deploy onto the ethereum network and then interact with. You do own it, you own the private keys for the address, etc.

But the bug allowed any other address to add themselves as owners and withdraw from it.

Luckily not many people used it and the white hat was able to claim all the rest before anyone else.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#237

Post by zdkl »

grandalf wrote: post #107
Pulcinella wrote: post #84

Earlier quoted context omitted.

This is the central, glaring flaw in cryptocurrencies to me. Transferring "value" for goods and services is really more of a social problem than a scientific/engineering one. Money is a social technology that solves a social problem. Cryptocurrency is a engineering technology in search of a problem to solve.

> Transferring "value" for goods and services is really more of a social problem than a scientific/engineering one Do you mean on the margin where there is debate about the contract or whether the goods/services were rendered adequately? Cryptocurrencies don't attempt to solve this problem at all, they simply allow for efficient moving of currency between parties without the need for meatspace regulation/trust to do…

Shame on whoever considers himself familiar with cryptocurrencies that downvoted this. This is a well worded argument for an opinion that one may or may not share, but whatever one's position about the "true believers" of smart contracts the parents points are valid, on topic and sensible.

Btc isn't here to pay your coffee or your salary, it's here as a fallback if you really need to get out of traditional finance. Same with ETH. You're not supposed to switch all your banking, notarial or legal affairs to the platform but it's there for cases where traditional contract law isn't desirable.

Now why so many people ascribed additional meaning or value to these platforms is the really interesting part. In a way, it's good these hacks happen as a reminder that this is what you signed up for. It's the wild west and you don't have a court or government watching your back. That's a (the) feature.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#238

Post by lomnakkus »

dvcc wrote: post #34
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

It's a good indicator that these people may be experts in one area, but not necessarily in others.

Language design is actually notoriously difficult in general[1], but if you're doing language design for a security-critical language[2]... well, that requires actual mechanized proof, IMO. Not just proof of "design", but proof of the implementation. Anything else is a huge gamble. (And I'm sure there are some 'investors'/gamblers who made off very well.)

[1] Beyond surface-level, obviously.

[2] We're talking about 0.0001% of the general population here.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#239

Post by sdenton4 »

justinjlynn wrote: post #55
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

"It's all there black and white, clear as crystal. [...] You get nothing. You lose. Good day, sir."

Furthermore, I suggest you do what your parents did, and get a job, sir! The bums lost, Lebowski!

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#240

Post by empath75 »

joshschreuder wrote: post #52

Let's play hypotheticals. If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Also has the attacker broken a law by exploiting a bug in the contract?

You move to somewhere in the third world with lax banking regulations.
Post reply on HN