I remember reading somewhere, that the DAO was basically hastly coded under pressure, without any QA or security audit, so that explains things
Umm they (TheDAO) were very loud about the fact that they had a security audit from a famous firm.
Critical Update on DAO Vulnerability
491–500 of 629 posts
Re: Critical Update on DAO Vulnerability
#492Article content: Posted by Vitalik Buterin on June 17th, 2016. An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times o…
Hang on. So because this one contract is poorly specified, they've decided to change the universe to prevent its existence? Wow. That's some fiat power right there.
It's worse because everyone considers Vitalik as some god of decentralization
Re: Critical Update on DAO Vulnerability
#493This is what concerns me about contract programming. With human contract law, if there's a minor typo or loophole, participants can generally see the spirit and intent, and at worst go to a judge who will usually enforce the intent. But with software contracts, only the characters matter and there's no intent anywhere: either you get paid or you don't. ETH is advising, "Contract authors should ... be very careful abo…
Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…
One solution would be for (some) individual contracts to be programmed to have "curators" with an expanded role. These curators would have dictatorial powers (via a supermajority vote of the curators) to nullify and replace the entire contract. However, they would promise to do this only in case of a genuine software bug, or if ordered to do so by a court with jurisdiction over them, not for any other reason. There would be many curators. Many of them would be professional curators, similar to professional accountants or trust executors, who work for huge firms which, like Big Four accounting firms, have a lot to lose if any of their members are caught misusing their power.
Re: Critical Update on DAO Vulnerability
#494Earlier quoted context omitted.
That depends on whether you think of a contract as an interface or as an implementation. A contract should present an interface that includes a declaration of its behavior. The declared behavior should be well defined, and if a bug in the implementation is discovered, the contract should be updatable to fix the bug. There could even be futures expressing the probability that a contract will be found to have a bug. Th…
> A contract should present an interface that includes a declaration of its behavior. The declared behavior should be well defined, and if a bug in the implementation is discovered, the contract should be updatable to fix the bug. The first part, a "declaration of...[future] behaviour," is basically a normal contract.
Indeed. However in a normal contract, the implementation is specified fairly loosely the laws (and enforcement mechanisms) can change drastically over the life of the contract.
There ought to be a way to have highly vetted primitives. In meatspace legalese, boilerplate words and phrases are the closest we get to this... once a contract (or open source license, etc.) has been through litigation, its vulnerabilities become better known.
If a dispute gets decided the "wrong" way because a few clarifying words were absent, the contract is modified and future deals use the new contract.
Re: Critical Update on DAO Vulnerability
#495Earlier quoted context omitted.
Commenting on your second thought: I hoped that people behind DAO (and Ethereum?) will stick to the terms they themselves proposed but it seems they will push hard for forking the chain (see: Ethereum blog).
Maybe someone can write an insurance contract that future DAO authors can hire, as an alternative to interventions. It would have to be bug free.
This is a smart response. The insurance company could also review the contract code in order to provide cover -- this would give investors extra confidence.
Re: Critical Update on DAO Vulnerability
#496Earlier quoted context omitted.
Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…
What's crazy to me about the whole thing isn't the bug in the DAO nor the fact that it's being taken advantage of. As you say, it's all very early stuff, and there's no surprise that it hasn't been fully worked out yet. What does surprise me is that people poured the equivalent of tens of millions of dollars into this new, unproven thing. To me, this says that while Ethereum itself may be technologically fine, the co…
There is a lot of speculative fervor going on. It's like any fad, except you can count the "value" generated by the waves of PR.
The underlying tech is clever though; the speculation is just a side-effect of cryptocurrency systems that they attract a lot of people who attempt to make a quick buck from during the rapid growth phase.
As others have pointed out, this is not a bad thing b/c speculation is one legitimate way that cryptocurrencies can bootstrap themselves, even if (over time) their strengths are not likely to result in more speculative behavior than is found in other established currencies.
Re: Critical Update on DAO Vulnerability
#497Earlier quoted context omitted.
Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…
This is fascinating. How do ancaps propose that DRO's will enforce their judgments? With violence? What's to stop the losing party from just gathering a bigger militia and shooting back to prevent collection?
The collection could be written as part of the smart contract that wants to use the service of the DRO (of course that part would have be be bug-free…).
Generally, I think ancaps would argue that violence wouldn't occur because it is too costly (as they do in the context of private defence agencies [1]).
Anyway, I believe this argument is flawed, in the sense that people have resorted to violence, despite the fact that it was nonsensical in economic terms (I'm looking for the quote of some prominent intellectual who argued around ~1914 that no big war could ever happen again, because it would be devastating in economic terms. He was proven both wrong and right in the sense that it indeed was devastating for the economy and that it occurred anyway as we know. If somebody knows the name of this gentleman please let me know).
Re: Critical Update on DAO Vulnerability
#498Earlier quoted context omitted.
Not a single TheDAO proposal has even been close to reaching a quorum [0] to pass a vote. How is this ratification supposed to happen? [0] https://dao.report/?sort=popular&keywords&status%5B0%5D=1&st...
So far there hasn't been a single serious proposal, so naturally nobody is voting.
That's not true.
Proposal #5 "Moratorium on proposals" only reached 8.86% of 20% quorum before voting ended.
Yet the moratorium is already in effect... as you can see there aren't any other real proposals out. Everyone is waiting to sort out these huge bugs in the framework.
https://www.reddit.com/r/ethereum/comments/4ns5nl/news_on_th...
Re: Critical Update on DAO Vulnerability
#499Well, that was kind of inevitable. Building a financial system out of pure code with no humans in the loop and no legal structure is building a self-distributing bug bounty piñata. It's decentralised, so there's nobody who can throw a breaker and shout "stop!"; cryptocurrency transactions are irreversible, so thefts are permanent; and it's somewhat anonymous, so thefts are hard to trace. It also demonstrates that bei…
Yes! Someone tried something new and difficult, and failed on their first try, therefore it must be impossible!
Re: Critical Update on DAO Vulnerability
#500Earlier quoted context omitted.
Keep in mind Ethereum is less than a year old, the DAO is even younger. It's still new, risky, and fraught with problems that need to be solved. If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state. In the future, as th…
What's crazy to me about the whole thing isn't the bug in the DAO nor the fact that it's being taken advantage of. As you say, it's all very early stuff, and there's no surprise that it hasn't been fully worked out yet. What does surprise me is that people poured the equivalent of tens of millions of dollars into this new, unproven thing. To me, this says that while Ethereum itself may be technologically fine, the co…
Tulips.