Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

41–50 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#41
post #29

Earlier quoted context omitted.

Let perfect not be the enemy of good. If you demanded that our currencies like dollars live up to your criteria, we would still be trading goods without currency.

Dollars don't purport to have a blockchain or immutable transactions. Ethereum does. Ethereum needs to live up to the standards it has set for itself.

That ship sailed a while ago. Ethereum has already used its market position to de facto interfere with the transactions they declare immutable on the project home page. [1]

[1] https://blog.ethereum.org/2016/06/17/critical-update-re-dao-...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#43
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

> Unmarked functions default to public in Solidity

What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#44
post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

Damn, you're right. And if people use smart contracts to do things that are technically allowed, but have unexpected downsides, we should have a review system in place where impartial third parties review the contract language. Two people should be assigned to speak for and against the unexpected behavior, and then maybe a panel of 12 regular citizens could render the actual verdict.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#45
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

> Unmarked functions default to public in Solidity

Facepalm

Wasn't this lesson learned long ago? C# defaults to private on unmarked members. Why would you ever want to default public?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#46
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#47
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Hmmm... That's similar to, but not covered by this submitted fix https://github.com/paritytech/parity/commit/e06a1e8dd9cfd8bf...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#48
post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

What is "unpredictable behavior"? Per ethereum, the code is the specified behavior. Would a contract with function "GiveMeAllYourMoney" be unpredictable behavior if it did what it said. What if instead it was named "Execute"? So now we have a contract whose "unpredictable behavior" depends on how you name functions and variables. However, that is something that cannot be checked by a computer, but would have to be human checked. "Unpredictable behavior" likely would ultimately have to be adjudicated by a court. In that case, what has the smart contract bought you?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#49
post #2

Let me guess... another hard fork to undo this.

I know this is a joke, but what would prevent the thief from attaching high transaction costs to the withdrawal of ETH from the target wallets? Say they place 50% of the value into the transaction costs - miners would assume a healthy profit off of the theft and it wouldn't be beneficial for them to rollback the chain.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#50
post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

In that future, ironically, Gold acquires even more value as a hedge
Post reply on HN