Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

251–260 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#251
"In their complaint, lawyers for Kellar and Day argued that two particular steps of the attack violated statutes against market manipulation and computer hacking."

So now they want crypto to be treated as regulated securities, but let me guess, only when it benefits them...

Re: The math prodigy whose hack upended DeFi won’t return funds

#252
post #18

What’d he do that was illegal? Seems like he didn’t cheat and insider trading laws don’t seem to apply. Oops crypto is a unregulated market.

FTA: > In their complaint, lawyers for Kellar and Day argued that two particular steps of the attack violated statutes against market manipulation and computer hacking. One was swapping almost all the UNI tokens out of the DEFI5 pool, the otherwise irrational trade that distorted the pricing such that Medjedovic could buy tokens out from under Indexed users, who were forced by the algorithm to sell. “The only purpose…

So for the first claim, they are arguing that forcing a leveraged short squeeze is market manipulation? There seems to be lots of straightforward counterexamples that it's not - that's an extremely common tactic the big guys use to squash little guys in the regulated markets. The little guys "would never have agreed to part with those securities on those terms" and the squeeze is often deliberate, transient, and leveraged.

Re: The math prodigy whose hack upended DeFi won’t return funds

#253

> Medjedovic added that he'd taken on “substantial risk” in pursuing this strategy. If he'd failed he would have lost “a pretty large chunk of my portfolio.” (The 3 ETH he stood to lose in fees was worth about $11,000 at the time.) This is misleading, either intentionally or due to Medjedovic's incompetence. You can fork the current head of the mainnet blockchain to localhost and try infinite permutations for free to…

I took "fail" to mean someone seeing his transaction in the mempool and frontrunning him, exploiting the flaw for themselves before he could. AKA Ethereum's "Dark Forest." Not that the transaction would fail as in a bug or something. I'm sure he knows how to simulate transactions locally if he could figure all this out.

Re: The math prodigy whose hack upended DeFi won’t return funds

#254
post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

>In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law I think some confusion arises because that "smart contracts" only make sense if code really is law, in the sense that any transaction executed by the contract -- even unexpected, surprising transactions -- is considered to be fully consented to by all parties interacting with the contract. I agree t…

> Why not just use regular contracts?

It's just code, so the same reason we use APIs rather than doing everything by lawyers.

Re: The math prodigy whose hack upended DeFi won’t return funds

#256

-- EDIT -- i found the address and i take everything back and declare the opposite, that address is not random at all. -- original post -- > The Ethereum address used for the attack included the number ... shorthand for ... So Bloomberg thinks people choose the numbers in their wallet addresses and are responsible for any perceived numerological meaning. Are they for real? Sure the guy could have sat there recreating…

I’ll give the full quote: > The Ethereum address Medjedovic used for the attack included the number “1488”—shorthand for a neo-Nazi slogan—and he’d written the N-word into the code itself, 16 times. A Twitter user called him the “Dylan [sic] Roof of Balancer Pools,” a reference to the mass shooter who killed nine Black people at a church in Charleston, S.C., in 2015. Medjedovic liked the tweet. Here’s another: > Medj…

Parents, don't rush your kids.

Re: The math prodigy whose hack upended DeFi won’t return funds

#257
post #98
post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

I think the problem is, if you put a sign saying "Feel free to break in, I dare you, if you manage to get in the house then you're free to take anything you want!" then you can't later complain when someone does exactly that. (Well, maybe you can still complain, IANAL, but it gets a lot murkier.)

That might be useful in a civil case, but I don't see how it would apply to a criminal case. "If you do X, it is not considered fraud" isn't going to legally bind the criminal justice system in any way.

Re: The math prodigy whose hack upended DeFi won’t return funds

#258
post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

This is a thing that confused me about smart contracts. I don't see how they can exist without a judicial system. They do seem to have some uses under that framework. Like the system is auditable so you can prove if someone cheated and changed a contract out from under you (and you lost your copy), but that's only a minor improvement on the current system. The US has a lot of legal policy that is based on spirit of t…

> I don't see how they can exist without a judicial system.

Smart contracts don't have to exist outside the judicial system. Smart contracts are simply a way to automate transactions in a way that's efficient, transparent, and credibly neutral. Yes, we may still have to invoke courts for the 0.01% of transactions that are clear exploits. But the other 99.99% of the time, it's a much more efficient system than using written contracts to handle normal, everyday outcomes.

Even without blockchains or smart contracts, we already have automated systems that execute transactions based on algorithmic rules. If you blatantly exploit a vulnerability in those systems, then courts will generally punish you. That doesn't mean that automated systems are pointless, because 99.9% of the transactions aren't exploits. That's still a huge win, because it means we don't have to have our lawyers email redlines back and forth every time we want to trade an S&P index futures contract. (Near) fully automated transactions are 1) orders of magnitude more efficient, 2) expose general purpose composability where one automated system can be predictably inter-connected with another.

When you put an automated transaction system on-chain, you drastically increase the advantages of both, because you're embedded in an open application network with credible neutrality. A smart contract exchange like Uniswap can process about the same amount of volume as a centralized exchange like Coinbase, but the difference is that Uniswap only needs about 50 employees, whereas Coinbase needs 5000. That's primarily because Coinbase runs inside a silo'd network. That entails replicating many functions like user account management, that aren't necessary for an application like Uniswap that piggybacks off the credible neutrality of a decentralized consensus layer like Ethereum.

Re: The math prodigy whose hack upended DeFi won’t return funds

#259

Earlier quoted context omitted.

This is a thing that confused me about smart contracts. I don't see how they can exist without a judicial system. They do seem to have some uses under that framework. Like the system is auditable so you can prove if someone cheated and changed a contract out from under you (and you lost your copy), but that's only a minor improvement on the current system. The US has a lot of legal policy that is based on spirit of t…

The legal system has failure modes that are just as easily exploitable, but humans can intervene and reverse the failure, make people whole, etc. The problem with smart contracts isn't that there are bugs, but that buggy results are final with little to no recourse, by design, unless you get everyone to agree to hard fork the chain (rolling the "bad" transactions back and eplacing the buggy contract) and/or the imple…

AFAIK the legal system still applies to crypto; the recourse when somebody hacks your smart contract is the same as when somebody defrauds you; you sue. Except with smart contracts you have more traceability as to what happened.

And you don't need to make the smart contract explicitly subordinate to the law, they are as a matter of fact, because everything de facto is. This idea that code is law and crypto exists in a vacuum is complete delirium (although a popular one and sign that the scene has a lot of room to mature)

Re: The math prodigy whose hack upended DeFi won’t return funds

#260
post #98
post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

I think the problem is, if you put a sign saying "Feel free to break in, I dare you, if you manage to get in the house then you're free to take anything you want!" then you can't later complain when someone does exactly that. (Well, maybe you can still complain, IANAL, but it gets a lot murkier.)

This comes down to the intent, doesn't it? It would be different if you had no sign but on the door that opened if someone pushed it because it was badly designed.

People on HN argue this with openly accessible APIs fairly regularly "ah but the machine let me do it, they must be OK with it" and I think that goes down badly in court.

Post reply on HN