Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

491–500 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#491
post #484

Earlier quoted context omitted.

Isn't the team also working on a new language targeting the same VM? If so, they might be useful.

Can people outside of the Ethereum org implement their own languages that target that VM?

Yes. The VM has a public specification and you can implement your own compilers for it.

On the blockchain, the VM only cares about the bytecodes you submit, not the code itself.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#492

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Matt Levine has some thoughts [1] on that matter. [1] https://www.bloomberg.com/view/articles/2016-06-17/blockchai...

That's a good article, and the point about him reading a lot of DFW is hilarious and accurate.

But I think of this issue in slightly different terms that are more simple.

There's a ton of case law about what constitutes a contract that pretty much all countries have. Clearly understanding the contract you are getting into is a prerequisite for the contract being enforceable in most places.

The simple fact is that this is never going to hold up in court when people start suing.

No one gets into a contract with the understanding that they can be robbed, and that's just okay. No rational person would do that. And I think it's a fair case to say that no rational person did clearly understand the contract as presented and agree to it.

The courts are going to to shut this down, in my opinion.

You can't just write into a contract that you might get stolen from or murdered or whatever bad thing and then that bad thing is suddenly okay.

"Okay, this guy didn't read the fine print on that used car loan. Let's go rape his wife and kids now. He said it was okay!"

That's not how it works. Etherium deserves to get hammered for this.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#493
post #444

Earlier quoted context omitted.

But Bitcoin and Ethereum can do this too. In fact Ethereum already has done it (and is arguably designed to do it). Ethereum simply has to convince a majority of the participants to fix the bug and reset to a good hash (whereas bitcoin would need a majority of the mining power unless they went out of band and used old school politics/force/coercion).

They did this already? I'm guessing it happened in the dao accident? If so, this seems terrifying, what if I had accepted stolen ETH to sell physical goods?

It seems to match the real world in some ways; If I barter and end up accepting stolen physical goods, things can go rather badly for me.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#494

Earlier quoted context omitted.

What if the insurance doesn't pay out because it too is a flawed contract?

Various insurance contracts could be applied redundantly and/or recursively, and of course over time the real-world characteristics ought to become known and the price of insurance for well understood contracts should approach free.

There's a lot wrong with this argument. First of all, a primary concern when buying insurance is proof of the solvency of the insurer. That means the insurer has to hold the capital covering their outstanding risks. So any insurer that can prove solvency also has to sit on a ton of capital instead of using it productively, which means the minimal insurance cost of a contract is going to be value * (risk + r * time), where r is the expected rate of return on capital.

Adding on N redundant insurance contracts increases the total cost of insurance by N * value * r * time, assuming that the risk of insuring another insurance contract is extremely low. That number explodes extremely fast, and there's no obvious way to solve the problem apart from buying insurance without blockchain-based proof of solvency. But if you're doing that, why do it on the blockchain at all?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#495
This is the most useful explanation I've found about the vulnerability so far: https://blog.zeppelin.solutions/on-the-parity-wallet-multisi...

The explanation is a bit scary about what actually ended up in parity code:

The wallet contract forwards all unmatched function calls to the library using delegate call... This causes all public functions from the library to be callable by anyone, including initWallet, which can change the contract’s owners.

Edit: formatting

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#496
post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Your enumerated conditions apply to traditional legal contracts as well.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#497
post #333

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

I realize that was probably satire or sarcasm or both, but since I've seen people actually seriously take that position I'm going to go ahead and respond as if it was serious. How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only…

This comment? This is why I keep coming back to hn. A special interest in cotton.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#498
post #333

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

I realize that was probably satire or sarcasm or both, but since I've seen people actually seriously take that position I'm going to go ahead and respond as if it was serious. How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only…

Have you ever been to some old manor or library with hundreds of weathered ancient leather bound books...I always wonder about their contents... (usually they are under lock and key)...Cotton case law now seems a perfectly reasonable assumption.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#499

Earlier quoted context omitted.

We (tech geeks) tend to think of situations like this as analogous to code, where the local declaration supercedes the global one. We see a specific investment platform with specific terms and rules and our gut says those override more general ideas about how it should work because they're more immediate to the context. But civil society is the opposite: Contracts cannot violate the law; the law cannot violate the co…

There can be an immutable smart contract which is in compliance with the law (though you have to be more specific with which law, but for these purposes I know we mean US law). Point being, immutability is not sufficient to demonstrate that a contract is in conflict with the law.

But it's impossible to prove that a smart contract (or any contract, for that matter) is in compliance with the law until it goes in front of a judge and all possible appeals have been exhausted, and that's what matters here.
Post reply on HN