Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

Post reply on HN
Print view View original

241–250 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#241

Post by silentsea90 »

silentsea90 wrote: post #78
TameAntelope wrote: post #64

For all the people shouting "Way to go!" and "The money is his!" I think you should remember he's currently a fugitive, and would need to spend the rest of his life living this way. If that's what it takes to live the "code is law" dream, count me out.

I like the very web3 middle ground where the attacker negotiates with the company and returns a part of the money, the rest being the lawful reward for reporting the vulnerability.

To make my stance very clear - this is an absurd and hilarious practice and feels similar to ransom, with the hacked entity putting "white hat hackery" on the table as an option to get some of their money back.

Re: The math prodigy whose hack upended DeFi won’t return funds

#242

Post by mikkergp »

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

This is a twitter thread apparently from the lawyers hired by Indexed "I want to explain to you why what you did was illegal and wrong":

https://twitter.com/ohaiom/status/1451142195369725957

Re: The math prodigy whose hack upended DeFi won’t return funds

#243

Post by jrm4 »

I'll keep saying it -- a "smart contract" is nothing nothing nothing at all like a real contract, it's a stupid little piece of vending machine code that just operates. If we're going to argue the ridiculously dumb idea that smart contracts are, in fact, legal contracts -- congrats to the kid because he is 100% entitled to that money.

Re: The math prodigy whose hack upended DeFi won’t return funds

#244

Post by eftychis »

Good luck to the judge. Commodities laws still apply so this will be interesting to follow.

They had to sue or they would be sued themselves (which they might regardless), but there is no law restricting you actually from inflating the market value of an item (or a security). Their advantage is that he doesn't have a lawyer (or claims to) -- which is a stupid move; and that they froze his gains (another stupid move). If a hack is actually involved under Canadian law we shall see but a civil lawsuit is not unlikely to dictate that.

He misled their market maker, not the holders. Of course without reading the case one can not say anything and has an incomplete view, but they are trying to shift blame here.

There is precedent of course, when Oil futures went negative and in the end brokers paid the difference -- as their software wouldn't allow people to trade non-negative ranges.

tl;dr: I think they are still on the hook for the lost funds back in the E.U./U.K.

Re: The math prodigy whose hack upended DeFi won’t return funds

#245

Post by retrac »

moneywoes wrote: post #194
paulpauper wrote: post #39

Yeah, the attacker resides in Canada, so even if found guilty he's looking at easy jail time at the worst. All he has to do is wait a few years and the $ is his. not like in the US in which feds hand out decade+ sentences like candy on Halloween.

Can’t he be extradited

Maybe. That actually raises some interesting questions, come to think.

A key factor in an offence is the location of the offence, which usually determines jurisdiction and the relevant laws.

In the classic example of hacking an American bank from Canada, the offence occurs on the American bank's servers in the United States. That's relatively clean and simple, legally.

With an Ethereum smart contract ... I'm not even sure where to begin. Where does the offence even occur, legally speaking? What aspect of fraud by a non-American, against an American resident by executing an adverse smart contract, occurs under the jurisdiction of the United States, if any?

Re: The math prodigy whose hack upended DeFi won’t return funds

#246

Post by Graziano_M »

anonu wrote: post #214

Are there any good resources someone can point to on getting into the code and mechanics of this? The article was a nice read, but probably distills the real stuff behind some journalistic simplification.

ethernauts is particularly good intro that has you work through a lot of the common security issues.

Re: The math prodigy whose hack upended DeFi won’t return funds

#247

Post by s1artibartfast »

glerk wrote: post #141
woojoo666 wrote: post #131

Earlier quoted context omitted.

By that token, wouldn't rugpulls be legal too?

Probably? A priori there is nothing wrong with someone who owns a large amount of a certain asset transferring it into a liquidity pool in exchange for a different asset. It gets more murky if a founder explicitly lies to investors in order to get them to buy their token. Fraudulent misrepresentation is problematic in most jurisdictions, but this has nothing to do with the mechanics of the "rugpull" itself.

rugpulls are different because crypto developers lie and deceive investors in their disclosure.

A better example would be 3rd parties pumping and dumping a crypto asset. Should this be illegal?

Re: The math prodigy whose hack upended DeFi won’t return funds

#248

Post by jallen_dot_dev »

SamBam wrote: post #77
Ajedi32 wrote: post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

But that is the premise of smart contracts. Sure, it doesn't excuse you from the law if your contract is to pay someone to shoot someone, but it's supposed to be the final word on the actual financial transactions that happen within the contract. Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm: > Guaranteed Outcomes: Potentially the…

> it's supposed to be the final word on the actual financial transactions that happen within the contract.

The court doesn't care how crypto idealists think the world should work.

Re: The math prodigy whose hack upended DeFi won’t return funds

#249

Post by arcticbull »

cinntaile wrote: post #226
chx wrote: post #208

Earlier quoted context omitted.

There was a wonderful summary of what smart contracts are. https://twitter.com/qrs/status/1395784294451265536 > Smart contracts should be considered self-funded bug-bounty platforms.

Mark the "should". It's just an opinion, not a fact.

More like a piñata full of money sitting next to a whole pile of sticks.

Re: The math prodigy whose hack upended DeFi won’t return funds

#250

Post by mikkergp »

majormajor wrote: post #237
Ajedi32 wrote: post #90

Earlier quoted context omitted.

That's not how the law works though, at least not in any country I know of. If you exploit flaws in computer code to steal something of real-world value, that's a crime. We're all bound to the laws of physics, just as in the world of smart contracts all are bound to the laws of code. But none of that changes the existence of the laws of men.

If you do a promotion for giving away free food, and your smart contract accidentally allows someone to get a free sandwich every minute instead of once a day, is it so obvious that someone using your promotion more than once a day is "stealing"? Ever use a different email address to sign up for a different free trial, say? Let alone people sharing Netflix accounts... where do you draw the line around "stealing" here…

> is it so obvious that someone using your promotion more than once a day is "stealing"?

Yes. This is very obviously stealing, particularly if the promotion said it was for use once a day.

Edit: Also, sharing your netflix password may also very well be illegal: https://www.lawjournalnewsletters.com/sites/lawjournalnewsle...

Post reply on HN