Things like this are why I think Tezos, when/if it comes out, has a bright future. I want a formal proof for any contract I use with real-money.
153k Ether Stolen in Parity Multi-Sig Attack
281–290 of 754 posts
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#282Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control
Poking around in that project, I don't see any specific tests of the Wallet contract... would be interested to see what UTs/STs were included if anyone knows where they are -- or was it just manually tested on the testnet? It seems that a basic set of UTs for this contract should have caught this issue. It's not even in the category of weird timing attacks or complicated internal states allowing unexpected state tran…
As I said here last week "Also the lead developer is some kid who believes very much in moving fast and breaking things. This philosophy may work for a social network site but not for other people's money."
This philosophy permeates the community of Etherum development.
Bitcoin disabled most of the smart contracts op codes for a very good reason.
I wouldn't recommend putting anything of value into an Etherum smart contract and find a project with more responsible developers who take a more "wait and see" approach.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#283Earlier quoted context omitted.
You compared it to Mt Gox, which is where the confusion is coming from. With an online service like Mt Gox you don't have control of the coins at all. I have no issue using an open source implementation of something. You haven't explained why that's an issue.
Whether it's an online service or a local wallet with an embedded buggy smart contract, your coins are just as gone. If you're perfectly happy to use it, you're perfectly happy to lose everything. How many millions need to be lost before this lesson is learned?
Again, you haven't made any case for not using open source third party software. The other other example you've come up with was a close source proprietary internet service.
Very few people, for instance, use the official Bitcoin Core wallet.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#284Earlier quoted context omitted.
I think a big part of the complaint is about the implicit assumption that because people are smart, and have experience with cryptography, they necessarily have the experience to design a sane and safe programming language given their goals. They did put themselves way out there, and that takes ambition, but also hubris. I wish they were able to figure out which one was driving them at certain points a bit better, as…
Actually, I think Solidity being designed to turn bad node.js coders into bad smart contract coders was key to Ethereum's success. I've written a book on this (hit upload five minutes ago! release Monday!) which hammers on this point (and all the stuff surrounding this issue). I think Solidity is actually designed with worse is better in mind, because Ethereum is the first smart contract platform that anyone actually…
That may be, but if so, it might be worse. What's worse, not getting a lot of uptake for this idea that's been hard going for others, or getting the uptake because of trade-offs you made that make it a ticking time-bomb that may damage the reputation of the idea for years to come and set it back?
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#285Earlier quoted context omitted.
"It's all there black and white, clear as crystal. [...] You get nothing. You lose. Good day, sir."
You skipped the juiciest part of one of my favorite scenes of that movie. [scared the bejeezus out of me when I was little, I didn't realise for some time it was pure satire and no adult would be expected to understand him]. So I feel obligated to post the full bit (from wikiquote) >Wonka: [angrily] Wrong, sir! Wrong! Under section 37B of the contract signed by him, it states quite clearly that all offers shall becom…
>[scared the bejeezus out of me when I was little, I didn't realise for some time it was pure satire and no adult would be expected to understand him].
Yeah, as a kid, I too thought Wonka was serious. It took viewing it as a much older person to see the satire there.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#286Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control
Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.
Read the Solidity documentation on visibility [1]. Public, private, internal, external, that really seem to mix overlapping concerns. In the visibility documentation, it explains that the default is public.
Then, in another section of the documentation, when talking about function types [2], not specifying internal or external defaults visibility to internal.
It doesn't seem like the simplest or most consistent way to express these concepts, and certainly not the safest way.
[1] http://solidity.readthedocs.io/en/develop/contracts.html#vis... [2] http://solidity.readthedocs.io/en/develop/types.html#functio...
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#287No rollback this time. The chain with this hack must have the longer Proof-Of-Vitalik.
https://twitter.com/VitalikButerin/status/887782650026631168
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#288Earlier quoted context omitted.
You compared it to Mt Gox, which is where the confusion is coming from. With an online service like Mt Gox you don't have control of the coins at all. I have no issue using an open source implementation of something. You haven't explained why that's an issue.
Whether it's an online service or a local wallet with an embedded buggy smart contract, your coins are just as gone. If you're perfectly happy to use it, you're perfectly happy to lose everything. How many millions need to be lost before this lesson is learned?
Are you saying everyone needs to write their wallet from scratch?
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#289Earlier quoted context omitted.
I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"
Except for that DAO of last summer, in that case the law changed...
Hold on to your hats boys, we might be getting another hard fork!
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#290Time for another hard fork!