Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

441–450 of 629 posts

Re: Critical Update on DAO Vulnerability

#441

Post by sctb »

nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

We merged the earlier thread which linked to the transaction list (https://news.ycombinator.com/item?id=11921216) with this one, which has more context.

Re: Critical Update on DAO Vulnerability

#442

Post by kauffj »

qwtel wrote: post #412
kauffj wrote: post #242

Earlier quoted context omitted.

100% agreed and anyone who expects these types of smart contracts to replace typical contracts is overlooking this. The real void smart contracts fill is the type of contracts that cannot be trusted to be enforced by the current court systems. For example, consider prediction markets. Just about any economist or rational person will tell you these are a huge boon to the world, but the CFTC shut down InTrade just a fe…

> Just about any economist or rational person will tell you these are a huge boon to the world True, but I think said people still haven't taken the whole Taleb idea to heart. I'm pretty sure there are certain domains where the wisdom of the crowd is no wiser then a chimp throwing darts. As an extreme example, assume you ran a prediction market that predicted the value of the s&p500 x days from now. Would you expect…

> As an extreme example, assume you ran a prediction market that predicted the value of the s&p500 x days from now. Would you expect to make money based on these predictions?

The S&P already is a prediction market for the future value of the S&P. So no, there would be no additional information here.

I agree that wisdom of crowds does not always work, but remember that this is not just wisdom of crowds, it's wisdom of crowds PLUS skin-in-the-game.

All of the things in quadrant 4 are difficult to predict. I would trust the predictions of people who have put money where there mouth is far more than the predictions of those who haven't, and I think Taleb would too.

Re: Critical Update on DAO Vulnerability

#443

Post by fudged71 »

infodroid wrote: post #318
wslh wrote: post #255

Earlier quoted context omitted.

I see a different problem here: Ethereum and the DAO were not in a mature state to handle this amount of money. For example, there is a limited support for upgrading contracts in Ethereum and the DAO was not reviewed enough to handle hundreds of million dollars. Also, there are methods to make the software ultra secure using formal models.

I always wondered why there was such a rush to launch the DAO. As opposed to what Ethereum itself did: develop a proof of concept for over a year, then release a beta version and provide bounties for security bugs, all the while collaborating with testers and security researchers to stress the software.

TheDAO effectively turned into a massive bug bounty, a pot up for grabs.

Re: Critical Update on DAO Vulnerability

#444

Post by Mahn »

a2800276 wrote: post #95
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

> - At a high level, what does this attack actually consist of? At a high level, The Dao is like Pokemon. Casual observation suggests that it may be a more or less consistent world internally and that a lot of people are very excited about it. A few of those people even claim to fully understand how it works. But there's a lot of fat guys with acne blindly spending on Pokemon cards thinking it's a wise investment. Un…

Funny, but to be fair this doesn't apply to Ethereum only, the vast majority of discussions here on HN would look like this to a person not interested in programming or tech.

And that's fine, nothing wrong with having a hobby and being passionate about it. Not everything needs to have an impact in the grand scheme of things.

Re: Critical Update on DAO Vulnerability

#445

Post by Joeri »

infodroid wrote: post #266
imglorp wrote: post #214

This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…

Unlike traditional contracts, the idea was that smart contracts were going to eliminate the need for enforcement or dispute resolution. So that law is enshrined in code. But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract. So what now are the benefits of Ethereum smart contracts over the traditional legal system? The way…

If anyone can intervene, intervention will happen, even if it takes a new law to make it so.

The only way to eliminate the human interpretation factor is to eliminate the possibility for human interpretation. This is effectively impossible in a pre-singularity world, so there can be no such thing as a contract enshrined in code which is binding.

Re: Critical Update on DAO Vulnerability

#446

Post by infodroid »

DennisP wrote: post #401
infodroid wrote: post #369

Earlier quoted context omitted.

Even if we agree that Ethereum is still in its early stages we have to ask whether this response is setting a good or bad precedent going forward. Will the project leadership offer a soft- and/or hard-fork every time a poorly-implemented smart contract is exploited in a manner that is not intended by the contract creators? If every smart contract is going to be "guaranteed" in this way, then this introduces significa…

In this particular case the contract holds 15% of all ether. The fork won't be enacted unless a majority of the community agrees to run its code. That's not likely to happen except in extreme cases, like this one.

I don't think such a scenario is entirely neutral.

Because it implies that some contracts will have a greater probability of being "bailed out" if they are backed by more ether.

It may turn out to be a bad thing because it will establish the idea that not all Ethereum contracts are created equal.

And this can lead the system to be more centralized.

Re: Critical Update on DAO Vulnerability

#447

Post by peterbonney »

Interesting side point to this: some people wondered why DAO units immediately traded at a discount and many thought it presented an "arbitrage" opportunity, but this hack illustrates why it was always rational that the DAO should trade at less than the redemption value. The value of DAO units is capped on the upside, but not on the downside, and this hack is one way (of many) that downside risk could manifest itself.

Re: Critical Update on DAO Vulnerability

#448

Post by JumpCrisscross »

grandalf wrote: post #387
JulianMorrison wrote: post #359

Earlier quoted context omitted.

Core problem: If contracts can be upgraded while in use, everything reduces to a game of Nomic.

That depends on whether you think of a contract as an interface or as an implementation. A contract should present an interface that includes a declaration of its behavior. The declared behavior should be well defined, and if a bug in the implementation is discovered, the contract should be updatable to fix the bug. There could even be futures expressing the probability that a contract will be found to have a bug. Th…

> A contract should present an interface that includes a declaration of its behavior. The declared behavior should be well defined, and if a bug in the implementation is discovered, the contract should be updatable to fix the bug.

The first part, a "declaration of...[future] behaviour," is basically a normal contract.

Re: Critical Update on DAO Vulnerability

#449

Post by JoshTriplett »

quirkot wrote: post #333
cmdrfred wrote: post #281

Earlier quoted context omitted.

Who decides what a typo is? "Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though." Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.

I actually found a typo of a 100x magnitude in a Washington, D.C. law about ten years ago. Submitted it, and it was administratively adjusted. No need to even take it back for another vote. I believe is happens with much greater frequency than anyone outside the business of maintaining legal documents imagines. [even had a typo in the first publish of this comment!]

Sounds like a story worth telling; details?

Re: Critical Update on DAO Vulnerability

#450

Post by codingmyway »

xg15 wrote: post #406
codingmyway wrote: post #315

Earlier quoted context omitted.

At this stage yes. That's why I don't hold ether as being solid enough yet to be a store of value, aside from the fact that it's being inflated at ~25% pa. Needs to go through these teething problems now while that is still the case.

Why would that be different at later stages? Bitcoin grew more centralized with time, not decentralized: The miners with the most powerful equipment also have the most ability to become even more powerful. Why is that different for Ethereum?

It's not that it's centralised, it's that the cost of the precedent set by a fork and rollback doesn't mean it is seen as a terminal failure.
Post reply on HN