Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

271–280 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#271

Post by bryanrasmussen »

crooked-v wrote: post #244
ArchD wrote: post #236

Earlier quoted context omitted.

The power of the court to 'right' the 'wrong' (e.g. by reversing transactions) is limited on a decentralized public blockchain governed by pure code that crosses national borders. This strengthens the position "the code is the law". On the other hand, this feature is a motivation for centralists to take issues with public decentralized blockchains.

Except it's not, really, because a judge who's unhappy at it isn't going to care about "the code is the law" talk. They're just going to tell people to fix it or else, and all being in another country usually means is that the asset seizures will take longer.

>because a judge who's unhappy at it isn't going to care about "the code is the law" talk.

in my experience if you ever tried to tell a judge the code is the law you will be in for a world of hurt. Hope they don't read about it elsewhere either.

on edit: obviously in agreement with parent, just noting that the very concept of the code is the law introduced to a judge is going to elicit some very negative reactions.

Re: Missing line in a smart contract leads to $10M hack

#273

Post by elcomet »

judge2020 wrote: post #268
missblit wrote: post #195

Earlier quoted context omitted.

It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review. Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.

They can order you to give back the money.

And like in real life, you can refuse to tell where the money is hidden.

Re: Missing line in a smart contract leads to $10M hack

#274

Post by _9omd »

mondoveneziano wrote: post #97
chrisco255 wrote: post #92

Earlier quoted context omitted.

While this startup smart contract got hacked, there are plenty of reputable products in the space that have never been hacked and have upwards of $80 billion locked up right now: https://defipulse.com/ The top projects: Aave, Compound, Uniswap, etc. have been audited several times over, publish their smart contract source code for further review, offer millions of dollars in bug bounties and inherently the locked val…

> You can also take out insurance for the biggest protocols for additional protection. Then what's the point? I can already take out insurance in the "traditional" banking system (e.g. every checking account has FDIC).

One thing that I think is really big in DeFi is the idea of permissionless composability. Let me give you an example. Say you want to start a traditional fintech company that aggregates many existing banks to provide the best interest rate to the user. So it would basically move your money around between banks depending on where the best rate is the current day. This is basically impossible to build, there is very little ability to integrate into various banks, and even if you can, you need permission to do so.

However, you can build this on DeFi today quite easily (see yearn for an example), and you don't need to ask anyone for permission, you just hook things together. The smart contracts can move money around within DeFi based on algorithms that will find the best rate of return on various collateral coins. This is why people are calling it money legos. It allows rapid innovation from the edges, instead of the center, which is insanely powerful. I hope this inspires you to do more research.

Re: Missing line in a smart contract leads to $10M hack

#275

Post by Scarblac »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

Future crypto courts? This whole crypto circus exists to solve the problem of having no central authority.

If you can use courts, you have no reason to use "smart" contracts.

Re: Missing line in a smart contract leads to $10M hack

#276

Post by samatman »

derefr wrote: post #179
timoth3y wrote: post #146

Earlier quoted context omitted.

> so where does one draw the line between theft and just doing what the code allows? This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration. Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

> Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs. In practice, if using a smart contract as a contract , the way you'd use a paper contract, then two parties would sit down and negotiate; draft the negotiated agreement into the form of a smart contract; and then agree (signatures, handshake, multi-sig deployment, whatever) that "what the smart contract doe…

There's a name for this, it's called a Ricardian contract.

https://en.wikipedia.org/wiki/Ricardian_contract

It's slightly different than what you describe, because the parallel contract is an actual contract: a written and binding agreement between multiple parties, which explicitly grants consent for some bit of software to govern a given business arrangement.

Most "smart contracts" aren't Ricardian contracts, though, they're just chunks of software running on a blockchain.

They probably should be though, because contract law applies to business whether a specific legal contract is drafted or not, and no, that implicit contract doesn't say "whatever the software does is fine".

Re: Missing line in a smart contract leads to $10M hack

#277

Post by davidwritesbugs »

andrewfromx wrote: post #103
hiq wrote: post #55

Many people are asking what happened, because the article does not go much into detail. The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091... After spending 2min on it and using this hint from the article: > The affected pool contract had an initialize() function that should have been activated after deployment. > The line: initialized = true; is missing from the f…

so where does one draw the line between theft and just doing what the code allows? I wonder in the future crypto courts is the defense, "your honor, the code allowed me to call initialize again, they specifically didn't set it to true." going to fly? Or will you have to prove that the 10 mil you now have was intended to be given to you and your "victim" isn't a victim at all.

ex-lawyer here.

Where big money is at stake most sensible judges will, or will /try/ to, look behind absolutist language in a contract (be it smart or not). Courts are very good at looking at contracts and asking what the parties intent was. They will ask things like "was it intended not to initialize this function?" They may then answer the question with, "No of course not, it was a bug. The person exploiting that bug knew that and cannot reap the benefit". Maybe, or maybe not: trying to guess what a judge will say is a mugs game, but my point is that saying it's a smart contract not operated humans renders it "Absolute Code-as-law" one can't interfere with is unlikely to fly.

Re: Missing line in a smart contract leads to $10M hack

#278

Post by arp242 »

Dayshine wrote: post #111
arp242 wrote: post #101

Earlier quoted context omitted.

> Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? And stuff like "I lost £95,000 in a bank scam after my solicitor's email was hacked".[1] She managed to recover £57k after , but still lost £35k, not an insubstantial amount! If anything, we need more protection against stuff like this. Sending money to the w…

This is before the recent change in bank transfers that requires account name to match account number right? My understanding was that change basically closes the majority of these scams (where the account details are substituted) as you would now need to create an account with a name you don't have ID for which is very very hard.

Yeah, you're correct.

As for how this actually pans out in practice: I don't know. I'd guess that having people also fill in a name isn't impossible either, although it certainly makes it a lot harder.

Re: Missing line in a smart contract leads to $10M hack

#279

Post by fogihujy »

crooked-v wrote: post #233
jollybean wrote: post #57

Earlier quoted context omitted.

It's worse than that. Contracts are not code. It's a complete misunderstanding to posit them as such. Contracts depend first and foremost upon the legal regime in which they are valid. Every jurisdiction has rules, precedence, language means specific things. There is quite a bit of variability in this stuff, which is why we have lawyers. And Judges. Putting a contract into a crypto ... is basically pointless. There's…

The most obvious example for 'contracts are not code': the most airtight contract in the world can get quickly voided in court if it turns out one of the parties was actually a minor at the time of signing, even if they hid that fact or didn't actually know it.

This. The foremost example being EULA's and warranties in countries where the law gives consumers far more rights than the copy/paste legalese texts that everyone accepts at installation/purchase.

Re: Missing line in a smart contract leads to $10M hack

#280

Post by sellyme »

drdrey wrote: post #221
sidlls wrote: post #125

Earlier quoted context omitted.

The legal system isn't a computer that implements the law strictly to the letter based on only factual information. There are "reasonable person" standards, allowance/tolerance for mistakes, etc. Relevant to this discussion is rules covering mistaken deposits to a bank account: recipients are obliged to return the assets, not shrug their shoulders and use the cash while they proclaim "Bank's fault; they're responsibl…

Actually didn’t a judge just rule Citibank wasn’t entitled to get its money back after a mistake like that? https://www.forbes.com/sites/jonathanponciano/2021/02/16/cit...

A very major part of that decision was because the payment was not reasonably assumed to be a mistake. Obviously that argument isn't going to work here.
Post reply on HN