The math prodigy whose hack upended DeFi won’t return funds • Hacker News Board

Re: The math prodigy whose hack upended DeFi won’t return funds

#371

Post by otterley » Tue, May 24, 2022, 1:06 PM UTC

faeriechangling wrote: post #275

xur17 wrote: post #196

Earlier quoted context omitted.

> If the law is held to have supremacy over “smart contracts” and implicit intent is held to be more important than explicit terms, than this undermines not just a major argument for smart contracts but a major argument as to why crypto as a whole is valuable. No, it really doesn't. There are 2 questions that you are conflating here: 1. Can the courts force a user to return funds made via a valid smart contract trans…

>2. Can the courts force a blockchain to reverse a transaction that was made. The courts already can't necessarily force a transaction to be reversed as it is. The money can be gone long before they get involved. >To me there is a large difference between a system (like credit card settlement) that can have transactions revoked easily after settlement, and one that can only be revoked by another separate transaction…

Courts will try to figure out a way to make a plaintiff whole even if the transaction can’t technically be reversed.

Re: The math prodigy whose hack upended DeFi won’t return funds

#372

Post by postalrat » Tue, May 24, 2022, 1:53 PM UTC

grumple wrote: post #202

postalrat wrote: post #88

Earlier quoted context omitted.

What doesn't owning bitcoin really mean? If I had the math to generate keys why wouldn't I also be considered an owner?

If you copy my signature does that mean you can sign my checks?

In the case of bitcoin I wouldn't be copying keys. The key I generate will almost certainly be different than all the other known keys.

Re: The math prodigy whose hack upended DeFi won’t return funds

#373

Post by vageli » Tue, May 24, 2022, 2:11 PM UTC

zarzavat wrote: post #329

fvdessen wrote: post #259

Earlier quoted context omitted.

AFAIK the legal system still applies to crypto; the recourse when somebody hacks your smart contract is the same as when somebody defrauds you; you sue. Except with smart contracts you have more traceability as to what happened. And you don't need to make the smart contract explicitly subordinate to the law, they are as a matter of fact, because everything de facto is. This idea that code is law and crypto exists in…

The legal contract of the EVM is “you are allowed to execute any computationally legal sequence of instructions on the EVM”. At least that’s how it has always been presented. People who post smart contract code on the EVM are equal users of a shared computation infrastructure. If they want to put legal terms on who can use their smart contract and what for, they should need to make their own blockchain platform, beca…

> The legal contract of the EVM is “you are allowed to execute any computationally legal sequence of instructions on the EVM”.

Where is this contract? I've never seen it. The rest of your argument is based on this premise. The "legal contract" of a computer program is the same, yet we have laws on what you can and can't do to other people's computer programs.

> The law already regulates mistakes in traditional markets. If you accidentally sell your shares for a fraction of what they are worth, you cannot go to a judge and ask them to return the “stolen” shares.

Someone taking all the money from a smart contract you gave money to is not like your fictional example of a person selling their shares for the wrong value.

Re: The math prodigy whose hack upended DeFi won’t return funds

#374

Post by vageli » Tue, May 24, 2022, 2:14 PM UTC

chii wrote: post #352

ekidd wrote: post #312

Earlier quoted context omitted.

> Those who find themselves on the other side of this power disparity would often prefer to risk a potentially buggy but inviolate contract than one which they expect to be abused against them. There is no way that AT&T, Comcast or Bank of America will ever agree to a smart contract written by an ordinary customer. As always, the companies will write their own contracts, and customers will either accept them, or leav…

so what happens if the company's smart contract has a bug in it, and the customer takes advantage of it? In an analogous situation, if a shop mis-labels the price of an item (let's say, they forgot a zero or two for a $1000 item), the customer theoretically has the legal basis to purchase it at the labeled price. How is this scenario any different to a block chain contract with a bug?

If a site has prices stored on the frontend and a user edits the price to make it lower, do you think the user has a legal basis to receive the item at their new specified price? I don't think many jurisdictions would say they do.

Further, in many places your example itself falls apart.

https://smallbusiness.chron.com/company-advertising-price-wr... https://www.findlaw.com/smallbusiness/business-contracts-for...

Re: The math prodigy whose hack upended DeFi won’t return funds

#375

Post by jdmichal » Tue, May 24, 2022, 2:35 PM UTC

cogman10 wrote: post #285

jdmichal wrote: post #265

Earlier quoted context omitted.

And what if the vending machine measures coins by weight, and you so happen to have a "coin" that is just a properly-weighted blank. You're still interacting with the vending machine as technically intended . But by not inserting the correct amount of money, you are not interacting with it as intended by the creators. The smart contract implements a technical intent, just like the vending machine. But that technical…

That'd make sense IF this attack was one that was along the lines of "Hey, I did an injection attack on the contract which caused it to do something bad". However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code. The technical and explici…

The article makes it very clear where things were exploited. Especially the circumnavigation of the new token limit seems pretty relevant to the discussion of whether this was playing within the intent.

If he’d wanted, Medjedovic could now have traded $3,200 worth of Sushi for DEFI5 tokens worth $1,172,000. And had he simply done that, Indexed would have been fine. The protocol places limits on the amount of a new token that users can swap into the pool, so he would have been able to extract only about 1.5% of the pool’s value—which, given transaction fees, wouldn’t have been profitable for him.

Instead, Medjedovic’s script took out another flash loan consisting of $2.4 million worth of Sushi tokens. And rather than swapping them into the pool, it gifted them to it—a seemingly irrational move that Indexed’s algorithm wasn’t designed to handle. The “donation” overwhelmed the pool and circumvented its usual trade limit for new tokens. This allowed Medjedovic’s program to freely trade overvalued Sushi for undervalued DEFI5 tokens, then cash those out for the pool’s underlying assets, pay back the loans, and keep the rest, now worth $11.9 million. The attack on the CC10 pool brought the total haul to $16 million.

Re: The math prodigy whose hack upended DeFi won’t return funds

#376

Post by grumple » Tue, May 24, 2022, 2:37 PM UTC

t0mas88 wrote: post #368

grumple wrote: post #202

Earlier quoted context omitted.

If you copy my signature does that mean you can sign my checks?

No, but that's not the same. Signatures and checks are covered by terms & conditions (and law) that you must follow. A better anology is if you figure out a mathematical advantage within the rules of a casino game, are you allowed to win? I believe you are, as long as it's within the rules of the game. And the casinos are smart enough to create rules against any lasting mathematical advantage.

I know how to pick locks. The locks are designed to open when pins are raised by a certain amount. Doesn't mean I have a right to anything I can unlock.

The intention of the system is to work to as security. Just because you find a way around the security doesn't mean that you are now immune to the law regarding ownership. When SHAX gets cracked, that doesn't give the person figuring it out a right to transfer all the money out of your bank account just because they figured out the math.

Re: The math prodigy whose hack upended DeFi won’t return funds

#377

Post by DannyBee » Tue, May 24, 2022, 2:38 PM UTC

notahacker wrote: post #366

DannyBee wrote: post #355

Earlier quoted context omitted.

I will admit have avoided trying to follow the entire rabbit hole of details on this case. So feel free to point out where i've missed some facts. From what i've seen I doubt it would be considered theft for the simple reason that the tokens that were bought/sold didn't belong to anyone else in particular who you could say it was appropriated from. He also paid for all of it, and paid the fair value at the time. In f…

According to the linked article, he contributed code to the exploited contract (and was even paid for it!). That sounds like a trust relationship, and layers of obfuscation around swaps and "paying fair price" arent going to change the fact the intended net effect of the trades was that all the value in the contract was transferred to him. Big difference between a trading bot doing dumb stuff and trading bots using e…

Yeah, maybe embezzlement then, but still not theft. Depends on what the exact relationship was - most companies go to amazing legal lengths to ensure that they disclaim any relationship between themselves and their contractors. Which is not going to cut in their favor.

There have also been plenty of instances of folks much closer to having relationships + knowledge and not being found to be illegal (though rarely there has been civil liability). IE financial advisors exploiting inside knowledge of their clients portfolios + what their companies are up to to make trades that advantage their companies at the expense of their clients.

As for the rest - the intended net effect of almost all trades in finance is to cleverly transfer the value of everything you can to yourself ;). The only question is whether he had a relationship that makes that illegal or not.

Re: The math prodigy whose hack upended DeFi won’t return funds

#378

Post by nybble41 » Tue, May 24, 2022, 7:09 PM UTC

vageli wrote: post #374

chii wrote: post #352

Earlier quoted context omitted.

so what happens if the company's smart contract has a bug in it, and the customer takes advantage of it? In an analogous situation, if a shop mis-labels the price of an item (let's say, they forgot a zero or two for a $1000 item), the customer theoretically has the legal basis to purchase it at the labeled price. How is this scenario any different to a block chain contract with a bug?

If a site has prices stored on the frontend and a user edits the price to make it lower, do you think the user has a legal basis to receive the item at their new specified price? I don't think many jurisdictions would say they do. Further, in many places your example itself falls apart. https://smallbusiness.chron.com/company-advertising-price-wr... https://www.findlaw.com/smallbusiness/business-contracts-for...

> If a site has prices stored on the frontend and a user edits the price to make it lower, do you think the user has a legal basis to receive the item at their new specified price?

There was a case like that in the early days of online shopping, which was actually decided in favor of the customer. The prices of items in the shopping cart were stored in form fields, and the customer edited them before placing the order. The court considered that a counter-offer which was accepted by the store. (It probably wouldn't go that way today; for one thing online stores have gotten smarter about trusting data from the client.)

That's a bit different from simply editing the client-side view and never informing the merchant about the change, of course.

Re: The math prodigy whose hack upended DeFi won’t return funds

#379

Post by Dylan16807 » Tue, May 24, 2022, 9:45 PM UTC

albertgoeswoof wrote: post #365

Dylan16807 wrote: post #360

Earlier quoted context omitted.

Neither of those build up a system where immutable transactions are the absolute arbiter of ownership. If they did, then the same would apply.

Ok so if I hacked into your computer and stole your private keys, I get to keep all your Bitcoin? Even if you know it was me and have irrefutable evidence? Even if I admit to it? You wouldn’t consider asking the courts to use real force to get it back?

Bitcoins aren't specifically designed the way I described. It's reasonable to invoke normal contracts and courts with bitcoin.

This is a situation specific to NFTs and people that are going super hard on smart contracts.

And even if I was a true believer in NFTs, yeah I'd probably ask the courts to do that, but doing so would be a betrayal of my beliefs and evidence that the foundation of NFTs is very shaky. The idea that I would do something hypocritical in such a hypothetical situation doesn't change the argument I made in my previous post.

Re: The math prodigy whose hack upended DeFi won’t return funds

#380

Post by Dylan16807 » Tue, May 24, 2022, 9:47 PM UTC

criddell wrote: post #370

Dylan16807 wrote: post #360

Earlier quoted context omitted.

Neither of those build up a system where immutable transactions are the absolute arbiter of ownership. If they did, then the same would apply.

Ownership is a legal concept and the blockchain says nothing about that. It merely records transactions and says nothing about the right to do those things. For example, if the court orders you to turn over your Bitcoin holdings to creditors in a bankruptcy proceeding and instead you transfer them elsewhere, you are probably going to jail. When you transferred them, the coins were in your possession, but you weren't…

Correct, blockchain itself doesn't mess with ownership.

But NFTs and certain smart contracts are meticulously designing a custom form of ownership for themselves. That's what changes things. And this would be true even if they didn't use blockchains!

If you throw out all that custom ownership logic, you lose the core of what makes an NFT an NFT. Now it's just a few dozen bytes that anyone can mimic.