Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The bug which lost more than $600M in various cryptocurrencies a few hours ago

twitter.com

Post reply on HN
Print view View original

31–40 of 126 posts

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#31

Post by ed_elliott_asc »

et2o wrote: post #24
londons_explore wrote: post #20

"Check the first 4 bytes of" should be banned in crypto code. Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all. Why would you ever check 4 bytes? To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.

Checking whole hash was probably too slow, you can imagine they put in a check for first four bytes, if that matched then check the whole hash - probably merge conflict and lost the second bit - doesn’t seem too far fetched!

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#32

Post by lawn »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

> A legitimate trade always occurs between willing partners

Charge back fraud (also called friendly fraud) is a big problem in commerce, where the buyer will buy something, receive it and then cancel the payment. The merchant will often have to swallow the cost.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#33

Post by imtringued »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

One thing I don't understand is this. The vast majority of people will use credit cards (or equivalent) to purchase things. If I wanted to pay with Bitcoin I would get a crypto credit card.

Payment processing just isn't the same thing as a currency. It's like expecting the dollar bill to do payment processing. Is lightning network supposed to be that fancy decentralized payment processing platform that is going to kill credit cards or will people stick with visa and mastercard?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#34

Post by colechristensen »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

The end question is "why bother" with cryptocurrencies if you have a central authority that handles transaction disputes.

It makes sense if you have a small group of trusted entities that want to have a ledger between themselves (like inter-bank ledgers for various purposes) but if you have somebody in the middle handling disputes... don't you just have paypal? Then cryptocurrency is just an extra complicated step that doesn't really matter.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#35

Post by uncomputation »

crypt1d wrote: post #27
55555 wrote: post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

It’s very hard to take this claim seriously in this thread, which details a huge (and somewhat obvious) security vulnerability in a currency worth at least $600m (an amount anyone would assume is “first-tier”).

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#36

Post by Taek »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

The appeal for irreversibility is the complete removal of counterparty risk. It's a sharp edge and you need to be structured/careful, but for certain types of transactions, the cost of being careful is 100x cheaper than the cost of finding and using a trustworthy counterparty.

A strong example of where the irreversibility of crypto is very useful is in the online sale of expensive electronic goods. Especially for things like speakers, TVs, and projectors, fraud rates are extremely high and boutique shops struggle to effectively support online customers, because such a large percentage of their sales get chargebacks after they've shipped the goods.

If you accept crypto, you have a 100% guarantee that when the money has hit your wallet, the money is good and will stay in your wallet. You don't need to deal with an anti-fraud firm, you don't need to check whether this person is trying to have the goods shipped to a sketchy country, and you don't need to fear that your $6,000 item is going to sail away from you without payment.

Yes, this means that the consumer has to fully trust the merchant, but in the case of online sales, the merchant is the known quantity with a reputation. Every consumer is a random, unknown person to the merchant and so it's much harder (and therefore more expensive) for the merchant to establish trustworthyness.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#37

Post by thrwawy4345784 »

et2o wrote: post #24
londons_explore wrote: post #20

"Check the first 4 bytes of" should be banned in crypto code. Either I want something to match, in which case check it all, or I don't care if it matches, in which case don't check at all. Why would you ever check 4 bytes? To me it smells like a way to prevent fuzzers stumbling on a deliberate loophole.

This is perhaps the most confusing element of it all, to me. I can hardly imagine a legitimate reason to do this. Defeats entirely the purpose of a hash.

Maybe somebody thought of short sha-1 id's of git: https://git-scm.com/book/en/v2/Git-Tools-Revision-Selection With that only 4 chars is enough to identify a commit :-)

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#38

Post by yunohn »

crypt1d wrote: post #27
55555 wrote: post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

A lot of these contracts, and especially those owned by first-tier cryptocurrency companies, are reviewed by 3rd party auditors. Of course that doesn't completely remove the risk, but certainly at least ensures that no obvious bugs are missed.

Do you have some sources for this claim? Or just a belief?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#39

Post by astoor »

mrtksn wrote: post #14

Cryptocurrencies are fascinating but the irreversibility is not a feature but a bug. I don't get the appeal for irreversibility. A legitimate trade always occurs between willing partners, why would you be so afraid that the transaction would be cancelled? The only legitimate use that comes to my mind are complex financial instruments where things mostly happens with an assumption that the underlaying assets are very…

> irreversibility is not a feature but a bug

Completely true. Irreversibility and lack of consumer protections might just about fly for small transactions with pocket change which people on both sides of the transaction don't mind losing, but isn't going to be acceptable to most people for larger transactions. If I'm buying a house, for example, I don't want the risk of it being stolen because of an unfixable bug in a smart contract, or sold to the wrong person by an irreversible mistake entering the address. Scaling up further, if you look at the back office for any investment bank, a big chunk of people power is spend on trade reconciliation and essentially fixing human errors - this is a good thing for both parties making such transactions.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#40

Post by Taek »

malthaus wrote: post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

At least up to this point, the amount of growth in the industry from moving fast and having buggy software (as opposed to moving slow and having fully verified software) has more than made up for all the hacks. For every $600 million dollar hack, there's been $6 billion dollars in gains from growth in the industry. Moving slower means fewer hacks, but it also means lower growth, and the growth is the more important multiple right now.

As the growth slows down there will be an increased focus on best practices for smart contracts, on auditing, and on formal verification. There are also a lot of startups that are looking into insurance for smart contracts and crypto balances in general.

In general, the best experts in the space could probably write smart contracts with >100x fewer bugs than your typical smart contract. Especially with something as complex as the EVM it's difficult to assert that any piece of software is truly bug-free, but there are a lot of steps that can be taken to make them significantly more rare. It's just that these mitigating steps are more expensive than the growth at this time.

Post reply on HN