Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

331–340 of 629 posts

Re: Critical Update on DAO Vulnerability

#331

Post by bernardlunn »

heliumcraft wrote: post #304
infodroid wrote: post #266

Earlier quoted context omitted.

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

IMO smart contracts are more about decentralized "serverless" services than they are about law contracts. Personally I hate the term "smart contracts" because of the confusion they create on what they actually are.

I prefer robo contracts. Implies cheap and no humans (with pros and cons of all robo services). Code is only as smart as the humans who program it.

Re: Critical Update on DAO Vulnerability

#332

Post by kefka »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

Precisely, because this company is at the root of Ethereum. They can do these kinds of tomfoolery, and anyone who uses and trusts Ethereum is to blame for not doing their homework.

Re: Critical Update on DAO Vulnerability

#333

Post by quirkot »

cmdrfred wrote: post #281
drinchev wrote: post #260

Earlier quoted context omitted.

Indeed, but you have bug-safety law around the world which incorporates something like : "If there is a typo, error, fraud, crime etc. a contract is considered invalid or the part of the contract that is flawed" With software bugs you have something similar : > NO WARRANTY. THE SOFTWARE IS PROVIDED TO YOU “AS IS” AND “WITH ALL FAULTS.”

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

I actually found a typo of a 100x magnitude in a Washington, D.C. law about ten years ago. Submitted it, and it was administratively adjusted. No need to even take it back for another vote. I believe is happens with much greater frequency than anyone outside the business of maintaining legal documents imagines.

[even had a typo in the first publish of this comment!]

Re: Critical Update on DAO Vulnerability

#334

Post by jcfrei »

sznurek wrote: post #251
cpa wrote: post #233

Earlier quoted context omitted.

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do. People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but…

The 'Terms' section on DAO website states: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Doesn't it state that, by definition, that…

Well, apparently it isn't.

Re: Critical Update on DAO Vulnerability

#335

Post by kauffj »

nsajko wrote: post #317
kauffj wrote: post #242

Earlier quoted context omitted.

100% agreed and anyone who expects these types of smart contracts to replace typical contracts is overlooking this. The real void smart contracts fill is the type of contracts that cannot be trusted to be enforced by the current court systems. For example, consider prediction markets. Just about any economist or rational person will tell you these are a huge boon to the world, but the CFTC shut down InTrade just a fe…

Why are prediction markets a huge boon for the world? Isn't that just a fancy term for betting anyway?

They provide a far more accurate insight into the likelihood of events than any other alternative. You can think of it as betting if you like, but it's betting with lots of positive externalities.

Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insight.

It's wisdom of crowds + skin in the game.

Re: Critical Update on DAO Vulnerability

#336

Post by EthanHeilman »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

>But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract.

It is the beginning of a precedent but precedent is fairly weak because Ethereum in its early stages and very experimental (many hard forks are in Ethereum future). Bitcoin rolled back the blockchain at one point as well but it wouldn't happen today.

>So what now are the benefits of Ethereum smart contracts over the traditional legal system?

My view is that smart contracts can most useful for low value contracts that you would never want to take to court. No judge wants to listen to two people arguing over 18 dollars.

Re: Critical Update on DAO Vulnerability

#337

Post by DasIch »

cpa wrote: post #233
sznurek wrote: post #195

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"? I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition. Isn't…

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do. People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but…

What you call an informal contract could also be seen as an incorrect interpretation of a contract.

If you're not willing to call that simply an incorrect interpretation, you end up with two systems - software and people that push the blockchain forward - that interpret contracts differently. You also give precedence to the latter, which will lose the ability to effectively enforce its interpretation the more distributed the system becomes.

Ultimately you have to choose between having one true interpretation of contracts defined by software or being unable to enforce contracts as interpreted by a non-deterministic system.

Choose the latter and not just is there no advantage over real world systems, it's worse at enforcement.

Re: Critical Update on DAO Vulnerability

#338

Post by Zelmor »

mbrock wrote: post #215
spdionis wrote: post #193

Can someone eli5 what DAO and ethereum are?

Ethereum is a P2P accounting system, like Bitcoin, but allowing users to upload automatic contracts that decide autonomously what to do with the tokens they possess. For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency). "The DAO" is such a contract but with more complex logic that amounts to a kind…

Now there are a couple things I still do not understand.

1. How do I exchange this cryptocurrency for something that I can go and buy a sandwich with at the Deli?

2. Why is there a need for this instead of using traditional methods with contracts, banks, etc? Money as is, is a collective illusion we all subscribe to anyway, and these things aren't any more different from that. What is the purpose of this cryptocurrency?

3. Who on earth are putting all these millions of dollars into these systems and how?

Re: Critical Update on DAO Vulnerability

#339

Post by cplease »

Oh, nobody saw that coming. Completely unforeseeable.

What other mature, ready-for-primetime autonomous altcoin networks can I dump my savings into for no apparent reason?

Edit: "DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH."

No they shouldn't. They should running screaming for the exit doors. Less than two months after the launch of this mysterious "DAO" with an entirely bogus value proposition, 1/3 of the money put in, worth presently some $39 million USD in real money, has been confirmed stolen.

Post reply on HN