Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The math prodigy whose hack upended DeFi won’t return funds

bloomberg.com

Post reply on HN
Print view View original

321–330 of 409 posts

Re: The math prodigy whose hack upended DeFi won’t return funds

#321

Post by shrimp_emoji »

sushid wrote: post #316
majormajor wrote: post #236

Earlier quoted context omitted.

In a world where you're falling back to the legal system, why do I care if your buggy ATM is powered by a "smart contract" or by "regular" code? Why even do you care? (There have been exploits in both ATMs and smart contracts, after all.)

I primarily care because I think there's money to be made. But I also think the shift directionally makes sense. Traditional finance (really most transactions for that matter) have moved towards fewer middlemen dependent, more democratized forms of transactions (e.g. wealthy folks can call their traders to buy/sells stock -> open to middle class -> no need to call traders -> no fee no minimum online trading). To me,…

>I primarily care because I think there's money to be made.

Crypto /thread

Re: The math prodigy whose hack upended DeFi won’t return funds

#322

Post by charcircuit »

motohagiography wrote: post #301
charcircuit wrote: post #231

Earlier quoted context omitted.

>He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts The same description can be said for using XSS to steal someone's cookies. XSS doesn't escape the JavaScript virtual machine similar to how you aren't escaping Ethereum's virtual machine. Technically the code allows you to inject arbitrary JavaScript, but that behaviour wasn't intend to be possible by the design…

Your level of abstraction as an end-to-end operation I would agree with and it's a better example than mine, but the theft metaphor is not accurate because he literally paid the market price for every single step along the way in mining fees and transaction costs. For every token purchase and exchange, there was another person on the other side of that trade. The argument I'm using is that the casino didn't shuffle t…

I didn't intend to make a theft metaphor. I think a big factor on why this wasn't fair game is when he abused the bug to send tokens manually instead of interfacing with the smart contract which caused it to allow him to withdraw tokens worth ~366 times what he sent. Using a bug to bypass a restriction seems sketchy.

Re: The math prodigy whose hack upended DeFi won’t return funds

#323

Post by DangitBobby »

silverlake wrote: post #153
SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

Citibank mistakenly sent $900M to a bunch of hedge funds. Many refused to return it. Citi lost the court case. https://www.cnn.com/2021/02/16/business/citibank-revlon-laws...

I agree that this case was obviously ruled on incorrectly. The institutions broke the law (stole) by not returning the money, and the judge wanted to give a hot take instead of a legitimate ruling. Not allowing someone to retrieve money or property which was clearly given to you by mistake is theft. The end.

Re: The math prodigy whose hack upended DeFi won’t return funds

#324

Post by [deleted] »

why_only_15 wrote: post #278
rootusrootus wrote: post #264

Earlier quoted context omitted.

> If a consenting adult wants to deposit their money into a system that they have full visibility into, why should we stop them? We already do exactly that, e.g. Accredited Investor.

Yes but should we do it? Those rules prevent most people from e.g. investing into startups.

[deleted]

Re: The math prodigy whose hack upended DeFi won’t return funds

#325

Post by coffeedan »

fvdessen wrote: post #259
webmaven wrote: post #186

Earlier quoted context omitted.

The legal system has failure modes that are just as easily exploitable, but humans can intervene and reverse the failure, make people whole, etc. The problem with smart contracts isn't that there are bugs, but that buggy results are final with little to no recourse, by design, unless you get everyone to agree to hard fork the chain (rolling the "bad" transactions back and eplacing the buggy contract) and/or the imple…

AFAIK the legal system still applies to crypto; the recourse when somebody hacks your smart contract is the same as when somebody defrauds you; you sue. Except with smart contracts you have more traceability as to what happened. And you don't need to make the smart contract explicitly subordinate to the law, they are as a matter of fact, because everything de facto is. This idea that code is law and crypto exists in…

I mean, anyone can sue for anything, but if you're suing for this, good luck: a) finding a judge/jury that understands it, and b) collecting

Re: The math prodigy whose hack upended DeFi won’t return funds

#326

Post by prvc »

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

He contravened their "intent" to make more (fiat) money through speculation, simply put. If they actually wanted to promote decentralization and openness, they would not be undermining trust in it and impeding its adoption by invoking the legal system at this stage. All they gain from suing over this is making things hard for the kid who did the trade, and a remote possibility of "recovering" some of their previous valuations in fiat.

Re: The math prodigy whose hack upended DeFi won’t return funds

#327

Post by QuantumGood »

glerk wrote: post #232
stickfigure wrote: post #223

Earlier quoted context omitted.

I'll try to steelman the code-is-law argument (not really sure how I feel about it myself): In the case of the smart contract, you don't own the vending machine. It doesn't have an owner, it just "is". If it did have an owner, that person is probably violating all sorts of securities laws in countless jurisdictions. That's at least part of the point of all this smart contract stuff. To make the analogy a little more…

> If did have an owner, that person is probably violating all sorts of securities laws in countless jurisdictions. That's probably what upsets me most about this story. These developers want to have it both ways: it is decentralized finance and nobody owns the contract as long as we are making money, but we want all the laws and regulations of traditional finance to protect us if things don't go our way. I am saying…

The "laws and regulations of traditional finance" also protect them if things "go their way". They're not trying to "have it both ways", the law protects everyone in all scenarios.

Re: The math prodigy whose hack upended DeFi won’t return funds

#328

Post by SamBam »

sushid wrote: post #110
SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

I never hear "code is law" from defi protocols, their ToS, or really from anyone. It's only the detractors of Web3 who tout this false logic of "code is law" so I guess you're screwed. Examples of code NOT being the law: Some defi protocols have made those affected by a hack/loophole whole again with their own funds. Some defi protocols explicitly exclude certain jurisdictions like the US from accessing their protoco…

> Examples of code NOT being the law: Some defi protocols have made those affected by a hack/loophole whole again with their own funds.

That's a terrible example. If the code really weren't law, they'd reverse the transaction, or force the hacker to give back the money, like a court could.

Since the code is law they're stuck, and so just hand the victim some money out of their own pockets, to try and eliminate bad press and keep people's trust.

Re: The math prodigy whose hack upended DeFi won’t return funds

#329

Post by zarzavat »

fvdessen wrote: post #259
webmaven wrote: post #186

Earlier quoted context omitted.

The legal system has failure modes that are just as easily exploitable, but humans can intervene and reverse the failure, make people whole, etc. The problem with smart contracts isn't that there are bugs, but that buggy results are final with little to no recourse, by design, unless you get everyone to agree to hard fork the chain (rolling the "bad" transactions back and eplacing the buggy contract) and/or the imple…

AFAIK the legal system still applies to crypto; the recourse when somebody hacks your smart contract is the same as when somebody defrauds you; you sue. Except with smart contracts you have more traceability as to what happened. And you don't need to make the smart contract explicitly subordinate to the law, they are as a matter of fact, because everything de facto is. This idea that code is law and crypto exists in…

The legal contract of the EVM is “you are allowed to execute any computationally legal sequence of instructions on the EVM”. At least that’s how it has always been presented.

People who post smart contract code on the EVM are equal users of a shared computation infrastructure. If they want to put legal terms on who can use their smart contract and what for, they should need to make their own blockchain platform, because they certainly don’t own Ethereum.

The law already regulates mistakes in traditional markets. If you accidentally sell your shares for a fraction of what they are worth, you cannot go to a judge and ask them to return the “stolen” shares. When you subject yourself to a mechanistic market system, the predictable operation of the system is more important than any participant’s bad fortunes.

Re: The math prodigy whose hack upended DeFi won’t return funds

#330

Post by DangitBobby »

Dylan16807 wrote: post #222
albertgoeswoof wrote: post #176

Earlier quoted context omitted.

But the NFT was actually stolen, she was phished for her seed phrase, and the criminal moved ownership of the nft to their wallet, and then sold that to the person who was interviewed on the podcast. It’s no different to a thief stealing your bike then selling it to someone else on a street corner. Just because that person is the current owner and thinks they legitimately purchased it doesn’t make it rightfully their…

An NFT exists purely in the realm of thought, and the owner is whoever knows the password. Therefore phishing the seed phrase is not "actually stealing" it within the rules of NFT. And outside the rules of NFT it's just a receipt; it's worthless. It's taking a picture of a picture of a bike, not stealing it.

That doesn't make sense. An NFT exists purely in the realm of reality. It has a real (non-fungible!) representation as 1s and 0s and it's etched into "the blockchain". That's just as "real" as the atoms that makeup a bicycle. Arguably, much less valuable, but still real. At the end of the day, the NFT is represented by atoms as well.

If you steal my bike, that's theft. If you steal my DVD collection, that's theft. If you steal my steam account, that's theft. If you steal my NFT, that's theft.

Post reply on HN