Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

241–250 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#241

Post by sum627u »

shpx wrote: post #191
oh_sigh wrote: post #150

Earlier quoted context omitted.

Odds etherium does another hard fork to fix this bug?

The DAO held nearly 14% of all ethereum in existence, 153,000ETH is less than .2%. 153,000 / 93,405,120[0] = 0.001638025838 [0] https://etherscan.io/stat/supply

And there's more Ethereum now. The DAO was a ~$50 million fraud. This was a ~$30 million fraud. Obviously this is totally different and there's nothing we can do about it and it's just fine. People should have known better than to use parity with this bug in it.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#242

Post by jeffwass »

justinjlynn wrote: post #55
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

"It's all there black and white, clear as crystal. [...] You get nothing. You lose. Good day, sir."

You skipped the juiciest part of one of my favorite scenes of that movie. [scared the bejeezus out of me when I was little, I didn't realise for some time it was pure satire and no adult would be expected to understand him].

So I feel obligated to post the full bit (from wikiquote)

>Wonka: [angrily] Wrong, sir! Wrong! Under section 37B of the contract signed by him, it states quite clearly that all offers shall become null and void if - and you can read it for yourself in this photostatic copy - "I, the undersigned, shall forfeit all rights, privileges, and licenses herein and herein contained," et cetera, et cetera... "Fax mentis, incendium gloria cultum," et cetera, et cetera... Memo bis punitor delicatum! It's all there! Black and white, clear as crystal! You stole Fizzy-Lifting Drinks! You bumped into the ceiling, which now has to be washed and sterilized, so you get... NOTHING!!! You lose! GOOD DAY, SIR! [returns to work]

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#243

Post by tehlike »

sidthekid wrote: post #51
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

code reviews are prone to human errors, even if you have the best engineers.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#244

Post by eropple »

wheelerwj wrote: post #212
TylerE wrote: post #140

Earlier quoted context omitted.

Because the cryptocurrency space attracts only the brightest minds .

i know that you're not really serious when you generalize against all of us crypto simpletons, but anytime theres a stupid amount of money on the table people are bound to rush to pick it up. and that means mistakes. the work being done on public blockchains is unlike anything else done before. You don't have he luxury of keeping your db behind a vpn running on a vm platform secured and maintained by the worlds large…

One of the more important skills in this craft is the combination of intuition and knowledge to know when you don't know something well enough to achieve the goal. The difference between "ambition" and "hubris" is small but critical.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#245

Post by sillysaurus3 »

ChrisClark wrote: post #236
sillysaurus3 wrote: post #194

Earlier quoted context omitted.

The real lesson is: don't store your coins on a third party anything . This was a third-party wallet. Everyone used it because everyone else used it. Exactly like Mt Gox. There was no reason to store coins on Mt Gox, just like there was no reason to use this wallet. A moment's reflection would have prevented this foolish decision.

This wasn't a third party wallet actually. It is the local Parity wallet and node. What this was, was a bug in the multisig contract that Parity would give you to deploy. So it is a contract you personally deploy onto the ethereum network and then interact with. You do own it, you own the private keys for the address, etc. But the bug allowed any other address to add themselves as owners and withdraw from it. Luckily…

https://github.com/paritytech/parity

About Parity

Parity's goal is to be the fastest, lightest, and most secure Ethereum client. We are developing Parity using the sophisticated and cutting-edge Rust programming language. Parity is licensed under the GPLv3, and can be used for all your Ethereum needs.

Parity comes with a built-in wallet.

How is this not a third-party wallet? They say right on the page that they're trying to be the best implementation of Ethereum. That means they're not the core implementation, right?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#246

Post by sillysaurus3 »

DenisM wrote: post #233
sillysaurus3 wrote: post #209

Earlier quoted context omitted.

You're saying you could declare "I now have $30 million in assets" on your IRS forms and it wouldn't trip any alarms? I mean, I don't personally know which alarms would be tripped, or what effect that would have. But that just seems so unlikely. It'd be fascinating if this were true, though, so any info would be appreciated. Re: coinbase, it'd be foolish to use them because they have a history of disabling accounts f…

Tax forms don't have a place to declare assets, iirc, only income.

Right, so I guess I was asking: If you cash out everything as quickly as possible, no one from the government will ask where your millions came from?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#247

Post by grandalf »

_wp3r wrote: post #229
grandalf wrote: post #181

Earlier quoted context omitted.

> Which would make such contracts significantly more expensive than regular contracts that are reversible by trusted intermediaries and legal authorities. You assert this but don't offer proof. The cost of fraud is baked into all areas of our economic system to the point where it's very difficult to establish how much it is costing society. Arguably the massive innovations in counterfeiting prevention in the past dec…

Parent is referring to the transaction mechanism of the CC providers, not consumer credit. Fraud is a function of humans not the currency. The reason large systems to protect from fraud are baked in, is because there are a lot of humans that commit fraud. The blockchain would only provide a well documented account of the fraud, with no tooling to remove the assets from the fraudster. Chargebacks are a blessing when y…

> Chargebacks are a blessing when you need them and a curse when you receive them, but something that the economy has deemed a necessary evil mostly because there are a lot of fraudsters in the world

This is an excellent point, and I think it's an example of how an institutional mechanism evolved to help address fraud.

There's absolutely no reason to think chargebacks would not come to exist if commerce were dominated by ETH or BTC transactions.

The difference is that the infrastructure to do chargebacks, merchant account underwriting, etc., can be built very easily with relatively few lines of code.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#248

Post by koolba »

elviejo wrote: post #186
dvcc wrote: post #34

Earlier quoted context omitted.

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

For the same reason every variable in JavaScript is global by default... I.e. I don't have a clue how that could seem like a good idea.

That's not how JavaScript works. Variable declarations are hoisted to the start of the enclosing function scope and only undeclared variables are global by default.

But yes it seems pretty asinine to use global by default for (not so) smart contracts.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#249

Post by twblalock »

calafrax wrote: post #197
twblalock wrote: post #76

Earlier quoted context omitted.

I would add one more point: even if both participants in a contract fully understand and agree to the contract, the contract could still be thrown out under contract law for many reasons -- unconscionability, agreement to commit a crime, etc. If Ethereum becomes popular enough, one day the participants in an Ethereum contract are going to sue each other, and the judge is not going to be impressed by arguments that th…

Right. Ethereum is just a medium for recording a contractual agreement. Using ethereum should not make contracts any more enforceable in the eyes of the law. In many cases I would assume the opposite will occur: plaintiffs will claim that there was no contract formation because because the technical mumbo-jumbo of computer code is incomprehensible to a layman. I suspect that courts will react quite favorably to this…

I'm just amazed that people want to cut the courts out of jurisdiction over contracts. The courts are a legal recourse if you get screwed.

Why give up those rights and let a computer program (or rather, it's creators) dictate that you're screwed if you make a mistake? I mean, contract law exists because that kind of strict arrangement proved unsatisfactory in real life in the past.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#250

Post by Cthulhu_ »

mechnesium wrote: post #214
sidthekid wrote: post #51

Earlier quoted context omitted.

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

Precisely. Code reviews and software quality assurance aren't just corporate redtape, they can save your rear.

Especially for this; it should be enterprise, bank-tier code, covered by as much red tape as possible.

The problem with cryptocurrency is that they try to be better than the system, but have to relearn all the lessons the hard way. It probably won't take too long before all of it becomes exactly like what banks are now - heavily regulated, etc.

Post reply on HN