Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

41–50 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#41

Post by CuriousCosmic »

naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

Basically what this (and DeFi in general) is is a decentralised lending platform and "liquidity farm".

The lending part is relatively self-evident. You can pool funds together and the contract automatically issues loans when requested provided the user has X amount of collateral. Most "DeFi" lending basically acts like a margin for margin trading at the moment.

The liquidity farming however is a bit more practical. It's creating pools of liquidity for decentralised exchanges and various "cross-network" smart contracts to temporarily source coins out of.

There's a lot of dogfooding going on but the general system behind it is useful. It's just overly simplistic and the code lacks pretty much any scrutiny in a lot of these cases.

Re: Missing line in a smart contract leads to $10M hack

#42

Post by s5300 »

Oh, Value DeFi is just a long-haul grifting scam in general lmao. Wasn't a "missing" line, "dev" team just set it up lol.

I have a boatload of screenshots sent from one of their team members I'd been talking with for a few months that was internally profiting off the grift but then went rogue.

Shame this story is getting attention, especially on HN. YFV aka Value DeFi is just a long-haul rugpull/scam lol.

Re: Missing line in a smart contract leads to $10M hack

#44

Post by s5300 »

ctur wrote: post #13

Someday some engineer working on these kinds of contracts will realize they can make a lot more money illegally by “accidentally” adding such bugs to the ecosystem then colluding with whoever exploits them. Actually it’s probably already happening.

Yeah, this is the case for this specific contract. Could dump a large amount of proof but don't exactly need too much attention brought my way.

Re: Missing line in a smart contract leads to $10M hack

#45

Post by dnautics »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

How would exactly the same argument not be applicable to any sort of public code repo?

Re: Missing line in a smart contract leads to $10M hack

#46

Post by yaitsyaboi »

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

Re: Missing line in a smart contract leads to $10M hack

#47

Post by tshaddox »

BoiledCabbage wrote: post #37
tshaddox wrote: post #15

Earlier quoted context omitted.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

The thing is, that's what a lot of smart contract proponents are pushing for. That the legal system has no say over contracts, so the outcome would stand. Or effectively bake into operating these contracts that the legal system isn't a reprieve against anything.

They might be pushing for it, but I just don’t think it’s going to happen, at least for transactions where it’s feasible to sue in court. The courts already deal with traditional contracts and, from what I can tell, they tend to look more at what a reasonable person would expect the outcome of a contract to be than the literal text of the contract.

Re: Missing line in a smart contract leads to $10M hack

#48

Post by tshaddox »

lottin wrote: post #30
tshaddox wrote: post #15

Earlier quoted context omitted.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Yes, and if you use a smart contract to hire someone to build a deck on your house, I suspect any resulting legal disputes would be treated by the courts the same as if you had used a traditional contract.

Re: Missing line in a smart contract leads to $10M hack

#49

Post by vladimirralev »

paulpauper wrote: post #22
vladimirralev wrote: post #21

Earlier quoted context omitted.

There is place for both systems. Most crypto people have made peace with the fact that they can lose it all. People overestimate conventional finance. Conventional finance is incredibly flimsy if you dig into it. Leveraged beyond repair, ductaping one unprecedented monetary experiment after another. No conventional currency has preserved substantial purchasing power over a span of say 100 years maximum. The mathemati…

conventional finance has ways of insuring money and getting back stolen funds. it also is more idiot proof. nothing like that exists with cryto. crypto way less forgiving of errors..

Not quite accurate. The insurance you are talking about is for the custodial services of financial institutions. You can get custodial service for crypto with insurance too (https://custody.coinbase.com/faq). Outside of your narrowly worded agreement you don't have anything except perhaps the justice system which rarely works out in these cases. $20B were stollen in phone scams alone in the US last year, not recovered or insured, outside the insurance terms.

Re: Missing line in a smart contract leads to $10M hack

#50

Post by yojo »

geocrasher wrote: post #25

Can somebody explain to a non-coder who doesn't have anything to do with cryptocurrency what happened here? I find the article itself to be unreadable.

As I understand it: Value DeFi is a company that provides infrastructure for some kind of lending. Money (in this case cryptocurrency) is locked up in a “smart contract” that acts as a sort of bank account. If all is working correctly, the owner of that money can dispense it to borrowers by sending specially crafted and authenticated messages.

In this case it looks like the way it was supposed to work is: create the contract, send an “initialize” message to declare yourself the owner, then fund it and otherwise control the money. The intent was that “initialize” could only ever happen once, so the owner could not change.

In practice, there was a bug where someone could initialize again, thereby declaring themself the owner of the contract and funds. Someone did this to a contract funded got with $10M, then promptly sent it all to their own account.

Post reply on HN