Critical Update on DAO Vulnerability • Hacker News Board

Re: Critical Update on DAO Vulnerability

#371

Post by cmdrfred » Fri, Jun 17, 2016, 2:33 PM UTC

quirkot wrote: post #333

cmdrfred wrote: post #281

Earlier quoted context omitted.

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

I actually found a typo of a 100x magnitude in a Washington, D.C. law about ten years ago. Submitted it, and it was administratively adjusted. No need to even take it back for another vote. I believe is happens with much greater frequency than anyone outside the business of maintaining legal documents imagines. [even had a typo in the first publish of this comment!]

> administratively adjusted

That sounds like a terrible amount of power to give someone without a vote.

Re: Critical Update on DAO Vulnerability

#372

Post by barisser » Fri, Jun 17, 2016, 2:35 PM UTC

What concerns me is that they want to do a soft-fork to handle just this case. One shouldn't fiddle with the protocol every time something like this happens.

Re: Critical Update on DAO Vulnerability

#373

Post by clarkmoody » Fri, Jun 17, 2016, 2:36 PM UTC

zepolud wrote: post #209

"They say 'there are no atheists in foxholes.' Perhaps, then, there are also no libertarians in crises." [1] [1] https://www.hks.harvard.edu/fs/jfrankel/CatoRespCrisesJun07+...

My knee-jerk reaction is to say the libertarians rarely have power during crises anyway, and democracy insures that those who "do nothing" lose their power in the face of interventionist opponents come election time.

Not that they were libertarians, but the presidents during the 1920-21 Depression[1] acted slowly, and the economy bounced back incredibly quickly. From the article: However, by the time Harding had called his conference, the country's economy had already shown signs of rebound, and by 1922 was starting the economic boom of the 1920s[13] and merely allowed for President Harding to claim success.

[1] https://en.wikipedia.org/wiki/Depression_of_1920%E2%80%9321

Re: Critical Update on DAO Vulnerability

#374

Post by nsajko » Fri, Jun 17, 2016, 2:37 PM UTC

kauffj wrote: post #335

nsajko wrote: post #317

Earlier quoted context omitted.

Why are prediction markets a huge boon for the world? Isn't that just a fancy term for betting anyway?

They provide a far more accurate insight into the likelihood of events than any other alternative. You can think of it as betting if you like, but it's betting with lots of positive externalities. Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insi…

This is OT now, but in addition to the corruptive effects of traders influencing results they are betting on mentioned by mootothemax, another possible negative externality is the conservative effect the prediction market would have on the traders. Eg. if you got a whole population to bet on the market, suddenly it is in the interest of the majority to uphold past predictions, thus making society resistant to change.

Re: Critical Update on DAO Vulnerability

#375

Post by jobigoud » Fri, Jun 17, 2016, 2:39 PM UTC

Zelmor wrote: post #338

mbrock wrote: post #215

Earlier quoted context omitted.

Ethereum is a P2P accounting system, like Bitcoin, but allowing users to upload automatic contracts that decide autonomously what to do with the tokens they possess. For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency). "The DAO" is such a contract but with more complex logic that amounts to a kind…

Now there are a couple things I still do not understand. 1. How do I exchange this cryptocurrency for something that I can go and buy a sandwich with at the Deli? 2. Why is there a need for this instead of using traditional methods with contracts, banks, etc? Money as is, is a collective illusion we all subscribe to anyway, and these things aren't any more different from that. What is the purpose of this cryptocurren…

It allows a person to enter a contract without requiring her to trust the other party.

Re: Critical Update on DAO Vulnerability

#376

Post by aw3c2 » Fri, Jun 17, 2016, 2:40 PM UTC

makomk wrote: post #348

rlpb wrote: post #100

Earlier quoted context omitted.

If there is consensus that this is a problem and shouldn't be allowed, then there presumably is also consensus for even a hard fork if necessary. As an outside observer, I don't see why this is a demonstration that the decentralised system can be manipulated, is not fault tolerant, or censored. Since if this is a problem and will be fixed, it will presumably be by consensus. We already know that with consensus the en…

slock.it are now implying that opponents of the proposed hardfork are probably the thief and asking people to contact them with information about the identity of anyone who organizes opposition to it: https://twitter.com/christopherhesh/status/74379447973649612... It's going to be a very interesting kind of "consensus", that's for sure.

Ah, vigilantism. How incredibly fitting into the whole cryptocurrency ghetto. So very unprofessional.

Re: Critical Update on DAO Vulnerability

#377

Post by grandalf » Fri, Jun 17, 2016, 2:43 PM UTC

infodroid wrote: post #266

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

> But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract.

This is really too bad. The best outcome would be for the community to learn from this and build tools and practices that make new contracts significantly more reliable.

Smart contract design practices will have to undergo the same kind of gradual hardening that web servers have over the past 20 years. Let's hope it happens a bit quicker.

Re: Critical Update on DAO Vulnerability

#378

Post by 6502nerdface » Fri, Jun 17, 2016, 2:43 PM UTC

sznurek wrote: post #251

cpa wrote: post #233

Earlier quoted context omitted.

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do. People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but…

The 'Terms' section on DAO website states: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Doesn't it state that, by definition, that…

> The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code.

Nice. So if the community ultimately succeeds in preventing the "attacker" from withdrawing his funds, which he acquired in perfect accordance with the DAO code, which is the entirety of the agreement, could he publicly bring suit for violation of contract?

Re: Critical Update on DAO Vulnerability

#379

Post by grandalf » Fri, Jun 17, 2016, 2:44 PM UTC

wslh wrote: post #255

imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

I see a different problem here: Ethereum and the DAO were not in a mature state to handle this amount of money. For example, there is a limited support for upgrading contracts in Ethereum and the DAO was not reviewed enough to handle hundreds of million dollars. Also, there are methods to make the software ultra secure using formal models.

Formal verification is the right approach. Do you know of any specifics for this goal that exist for ETH now?

Re: Critical Update on DAO Vulnerability

#380

Post by developer2 » Fri, Jun 17, 2016, 2:47 PM UTC

mbrock wrote: post #347

Zelmor wrote: post #338

Earlier quoted context omitted.

Now there are a couple things I still do not understand. 1. How do I exchange this cryptocurrency for something that I can go and buy a sandwich with at the Deli? 2. Why is there a need for this instead of using traditional methods with contracts, banks, etc? Money as is, is a collective illusion we all subscribe to anyway, and these things aren't any more different from that. What is the purpose of this cryptocurren…

1. You just make an agreement with someone who would like to buy your tokens for some national currency. If you ever played an MMORPG or Diablo 2 or something, you know that "imaginary" digital items can be traded for "real" money. There are many exchanges where you can do this conveniently. 2. For one example, consider how tedious it is to open a new bank account; with cryptocurrency, you just make a new keypair. Sm…

>> consider how tedious it is to open a new bank account

You make it sound like a person needs to open a separate bank account for every transaction, which is clearly not how people manage their finances.

I'm in the same eli5 boat. I can't fathom why anybody would put real cash into such a system. It comes across as "because I'm rich as fuck and can gamble away my money on a stupid tech system that is not realistically viable". Just... why would anyone use this? It makes no sense, unless this just offers a way to attempt to hide one's identity while participating in illegal ventures.

I know a lot of tech nerds. Not one of them would ever join a system like this. I just don't get who is voluntarily subjecting themselves to this insanity. Can someone out there who has actually used Ethereum explain why they've done so? I would really appreciate some kind of insight into this whole concept, as I just don't understand.