Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

31–40 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#31

Post by trakout »

samstave wrote: post #20

Forgive me for being harsh: Why is there no "pen-test" phase to any crytocurrency which hits the market. So, let me understand; you're ostensibly smart enough to (perhaps as a body of contributors, even) develop a cryptocurrency offering - yet youre also fucking stupid enough to not have same/wider network of ppl attempt to hack the fuck out of your plan? Does this already occur? or some savant comes and owns them? W…

Cryptocurrencies do go through pen tests. I think instances like these are a good analogy to how even multiple tests run by 3rd parties will only get you so far -- particularly when the "bounty" is potentially worth millions.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#33

Post by RexetBlell »

finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Can't you say the same thing about software that uses encryption in general? For example your browser, yet you still trust it. Also, what you said applies to critical software in airplanes, and cars like Tesla, yet you still somehow trust it without reading the code.

Maybe you should replace the word "Ethereum" with "sotware". "Software in general makes sense is all the following are true"

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#34

Post by dvcc »

earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Why would an unmarked function get the broadest possible scope in a language designed for contracts? I'm always surprised by the decisions made around Ethereum, and just how much value people have poured into it.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#36

Post by Scaevolus »

earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Good catch! It is indeed that the constructor could be called by anyone. Here's a couple txns showing it:

Calling initwallet: https://etherscan.io/tx/0xff261a49c61861884d0509dac46ed67577...

Executing: https://etherscan.io/tx/0x0e0d16475d2ac6a4802437a35a21776e5c...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#37

Post by sp332 »

samstave wrote: post #20

Forgive me for being harsh: Why is there no "pen-test" phase to any crytocurrency which hits the market. So, let me understand; you're ostensibly smart enough to (perhaps as a body of contributors, even) develop a cryptocurrency offering - yet youre also fucking stupid enough to not have same/wider network of ppl attempt to hack the fuck out of your plan? Does this already occur? or some savant comes and owns them? W…

*HIPAA.

I remember it as "hippo", or "H-I-P-P-Oh darn, I spelled it wrong again!"

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#38

Post by twblalock »

grandalf wrote: post #21
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Ethereum offers immutability, and blockchains can foster new kinds of trust, but trust still has to grow organically in the ecosystem.

If you need a source of trust outside of the blockchain, why would you need the blockchain after such trust has been obtained?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#39

Post by rboyd »

you can see that this is also effecting tokens. check the whitehat effort (Token Transfers / View Token Balances) on this wallet https://etherscan.io/address/0x1dba1131000664b884a1ba2384641....

$30M worth of BAT, $26M ICONOMI, $17M CFI, $1.4M EOS

historic episode here which is sure to spur many a conversation about what disclosure means in the blockchain era.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#40

Post by AlexandrB »

grandalf wrote: post #21
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

> Not really true. Nothing has to be perfect if there is insurance infrastructure.

Why not just use a traditional financial institution then? What's the benefit of the complexity of a blockchain if it's still unreliable without the added meatspace complexity of a bank?

Post reply on HN