The math prodigy whose hack upended DeFi won’t return funds • Hacker News Board

Re: The math prodigy whose hack upended DeFi won’t return funds

#301

Post by motohagiography » Mon, May 23, 2022, 11:29 PM UTC

charcircuit wrote: post #231

motohagiography wrote: post #60

This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or targets infrastructure to Medjedovic. In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculatio…

>He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts The same description can be said for using XSS to steal someone's cookies. XSS doesn't escape the JavaScript virtual machine similar to how you aren't escaping Ethereum's virtual machine. Technically the code allows you to inject arbitrary JavaScript, but that behaviour wasn't intend to be possible by the design…

Your level of abstraction as an end-to-end operation I would agree with and it's a better example than mine, but the theft metaphor is not accurate because he literally paid the market price for every single step along the way in mining fees and transaction costs. For every token purchase and exchange, there was another person on the other side of that trade.

The argument I'm using is that the casino didn't shuffle their deck and a player calculated an advantage. He didn't have hidden cards, a secret view of anyone elses. I'd like to verify that aspect of the strategy though as it's potentially a powerful heuristic.

Re: The math prodigy whose hack upended DeFi won’t return funds

#302

Post by theelous3 » Mon, May 23, 2022, 11:29 PM UTC

ummonk wrote: post #298

LeifCarrotson wrote: post #205

Earlier quoted context omitted.

I think a lot of the appeal of crypto/smart contracts is that they are final with little to no recourse, humans can't intervene and exploit failure modes which individuals using the so-called contracts can't defend against. Corporations and wealthy individuals with influence in the writing of this legal system, with massive amounts of financial resources, with negligible moral agency, and with limited criminal liabil…

That's ridiculous. If we're talking power disparities and differences in resources, corporations could just code up standard smart contracts with loopholes in them that allows the corporations to steal from their customers. It's not like customers have the resources to carefully audit the smart contract and make sure there aren't any backdoors that the corporation has written in to exploit.

This is a significantly more ridiculous premise than the one you're calling ridiculous.

Re: The math prodigy whose hack upended DeFi won’t return funds

#303

Post by ummonk » Mon, May 23, 2022, 11:32 PM UTC

marcosdumay wrote: post #146

twox2 wrote: post #57

Earlier quoted context omitted.

"Code is law" is a dream that is not actualized. It's not actually law, it's just code. I'm pretty sure law enforcement will gladly prosecute for a lot of these "hacks".

If you widely publicize that "code is law", and get customers due to that promise, things are not that black on white.

Can you point to a single instance where Indexed Finance advertised "code is law"?

Re: The math prodigy whose hack upended DeFi won’t return funds

#304

Post by ummonk » Mon, May 23, 2022, 11:36 PM UTC

silverlake wrote: post #153

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

Citibank mistakenly sent $900M to a bunch of hedge funds. Many refused to return it. Citi lost the court case. https://www.cnn.com/2021/02/16/business/citibank-revlon-laws...

A single judge ruled against Citi. It's under appeal.

Re: The math prodigy whose hack upended DeFi won’t return funds

#305

Post by ummonk » Mon, May 23, 2022, 11:37 PM UTC

hartator wrote: post #160

blakesterz wrote: post #2

This was an interesting read. The case is now in limbo until authorities can locate Medjedovic or he decides to appear. “I did not steal anyone's private keys. I interacted with the smart contract according to its very own publicly available rules. The people who lost internet tokens in this trade were other people seeking to use the smart contract to their own advantage and taking on risky trading positions that the…

> I did not steal anyone's private keys. I interacted with the smart contract according to its very own publicly available rules. Yes, it's a little disingenuous to claim "code is law" until it doesn't suit you anymore.

Where did Indexed Finance claim "code is law"?

Re: The math prodigy whose hack upended DeFi won’t return funds

#306

Post by woojoo666 » Mon, May 23, 2022, 11:41 PM UTC

ummonk wrote: post #298

LeifCarrotson wrote: post #205

Earlier quoted context omitted.

I think a lot of the appeal of crypto/smart contracts is that they are final with little to no recourse, humans can't intervene and exploit failure modes which individuals using the so-called contracts can't defend against. Corporations and wealthy individuals with influence in the writing of this legal system, with massive amounts of financial resources, with negligible moral agency, and with limited criminal liabil…

That's ridiculous. If we're talking power disparities and differences in resources, corporations could just code up standard smart contracts with loopholes in them that allows the corporations to steal from their customers. It's not like customers have the resources to carefully audit the smart contract and make sure there aren't any backdoors that the corporation has written in to exploit.

That's like saying corporations can release complex open source code with backdoors in it and the userbase won't notice. Are there any big instances of this happening?

Re: The math prodigy whose hack upended DeFi won’t return funds

#307

Post by ummonk » Mon, May 23, 2022, 11:41 PM UTC

motohagiography wrote: post #60

This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or targets infrastructure to Medjedovic. In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculatio…

He isn't only accused of fraud. He's also accused of market manipulation, and the trick he used here is practically a textbook example of market manipulation.

Re: The math prodigy whose hack upended DeFi won’t return funds

#308

Post by simonh » Mon, May 23, 2022, 11:43 PM UTC

theelous3 wrote: post #302

ummonk wrote: post #298

Earlier quoted context omitted.

That's ridiculous. If we're talking power disparities and differences in resources, corporations could just code up standard smart contracts with loopholes in them that allows the corporations to steal from their customers. It's not like customers have the resources to carefully audit the smart contract and make sure there aren't any backdoors that the corporation has written in to exploit.

This is a significantly more ridiculous premise than the one you're calling ridiculous.

During the financial crisis Goldmans traded against the trades of their customers, who were making trades Goldmans had recommended they make. They made a few hundred million on it. Goldmans that is, not their customers.

Re: The math prodigy whose hack upended DeFi won’t return funds

#309

Post by ummonk » Mon, May 23, 2022, 11:44 PM UTC

shadowgovt wrote: post #128

DangitBobby wrote: post #30

Earlier quoted context omitted.

If I write code that can be exploited with a buffer overflow and you exploit it, who is the law going to punish more harshly?

But the entire raison d'etre of most of crypto is to get out from under the thumb of existing national and legal entanglements. So the question becomes "Who's law?"

That's not the position taken by Indexed Finance's creators:

"When Kellar and his co-founders created Indexed, they imagined it as a step forward for DeFi, or decentralized finance, a blockchain-based movement that purports to offer a more automated, less intermediated version of borrowing and lending, asset trading, and portfolio management. Some proponents take a utilitarian view of DeFi, considering it an improved version of traditional finance, with its fee-taking middlemen and sluggish human decision-making. Others are more libertarian, seeing DeFi as an escape from the existing system, a way of circumventing the rules and restrictions imposed by governments or corporations. Then there are the skeptics, who think it’s all a grift.

Kellar, who describes himself as “very progressive,” fits squarely into the utilitarian camp."

Re: The math prodigy whose hack upended DeFi won’t return funds

#310

Post by sushid » Mon, May 23, 2022, 11:46 PM UTC

Veserv wrote: post #239

sushid wrote: post #154

Earlier quoted context omitted.

Smart contracts allow for guaranteed outcomes. Some commentary added by a random law firm does not mean that guaranteed outcomes == no need for litigation and courts. Just think of non-smart contract parallels. If a bank had an ATM, the premise is that this ATM will execute a series of commands and allow you to withdraw/deposit/transfer funds. If a nefarious back actor found a series of user input that allowed them t…

The difference is that the ATM provider did not explicitly promise that the “code is law” which directly implies that they want to and aggressively argue that they are waiving their legal recourse as long as they were valid user inputs. In contrast, basically nobody outside of the blockchain space would waive their legal recourse in such a manner and thus would have legal recourse if the intent of their system was by…

Where and when did the defi protocol in question explicitly state "code is law"? No one is waiving legal recourse when they're using Web3. I'm not a lawyer but I'd be very surprised if one could even "waive legal recourse" just because it's blockchain all the way down vs mySQL.

I believe you're making this claim because _some_ crypto proponents believe "code is law" and because your personal logical framing is that web3 has no value add outside of being able to operate without legal recourse thus it must operate without legal recourse.

First, even if web3 had no useful value add, it doesn't mean it ought not exist. I can create a SaaS company that does exactly the same thing another company does just with my own logo and API documentation. Does non-uniqueness invalidate my company's existence? What if I forked an open source SQL database and slapped my name on the repo? Have you heard about something called substitute goods? I don't see why Pepsi can't exist in a world where only Coke is the norm.

Second, web3/blockchain/defi does have benefits outside of traditional web2/finance. The ability to not require depositing your funds into an account to transact on a protocol, for instance, is a clear value add. The ability to buy/sell NFTs without a middleman (if they choose to eschew a middleman) is a novel and potentially valuable value add as well. There are countless other applications of web3 that I won't delve into but these concepts can and should operate within bounds of legal recourse.