Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

51–60 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#51

Post by sidthekid »

earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

Seems like something a code review would have caught. Then again, code reviews and other slow processes are probably not the par for startups.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#53

Post by olegkikin »

lettergram wrote: post #13
niahmiah wrote: post #2

Let me guess... another hard fork to undo this.

Hard fork can't even undo this, from my understanding.

I'm pretty sure a hard fork can undo anything on the block chain. You can start over from the block before the hack. There's probably a cleaner solution than that though.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#54

Post by Deimorz »

sna1l wrote: post #27

https://etherscan.io/address/0x1dba1131000664b884a1ba2384641... -- white hat group exploited the vuln and are holding people's crypto for them.

I don't follow Ethereum closely at all, but I don't really understand a few things about this:

- Who's the "white hat group"? Why do people have confidence in it?

- Why does everyone believe they'll give back $75M+? If they decided to just keep it, what could anyone do?

- How will people even be able to claim ownership of the ETH in a way that's verifiable so they know they're giving it back to the right person?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#55

Post by justinjlynn »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

"It's all there black and white, clear as crystal. [...] You get nothing. You lose. Good day, sir."

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#56

Post by vesinisa »

grandalf wrote: post #21
finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

Seems like a chicken and egg problem. The crypto currency space is currently so fraught with fraud and crime that I assume no sensible insurer would touch it with a long stick. Insurers need a boatload of seed capital and - if they would be to act as expert intermediaries as you suggest - must invest lots and lots of R&D to due diligence. But as long as ETH mostly remains a get rich quick scheme for computer criminals, any such insurer party would only stand to loose all seed capital they invested.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#58

Post by 52-6F-62 »

finnh wrote: post #11

I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…

This is somehow the top comment, but doesn't deal with the issue at hand. In fact it entirely ignores it.

The theft wasn't due to an issue in the core protocol of Ethereum, it's due to faulty code in a single piece of software (as you can see throughout the rest of the thread).

It's a matter of poor engineering practices, not a flaw in the fundamentals of the protocol.

If an engineer designed a bridge, and it failed due to a flaw in the design -- say the math on a strut's angle was bad and the bridge collapsed causing millions in damages and took a few lives. Do you blame steel, all steel, and everybody who uses steel in construction as foolhardy? Or do you blame the engineer, the safety inspectors, and the company that oversaw the project?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#59

Post by justinjlynn »

Analemma_ wrote: post #43
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

> Unmarked functions default to public in Solidity What kind of brain-dead apes designed this language? This would be a stupid decision in any language, never mind one specifically intended for high-value transactions.

Design... before Solidarity I had never seen such an abuse of the word.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#60

Post by calafrax »

cl0rkster wrote: post #23

A much more useful explanation: https://press.swarm.city/parity-multisig-wallet-exploit-hits...

> The Swarm City Core team is more committed than ever to the development of Swarm City. The real value of our token lies in the community, and the technology the developers are creating. Black hat hackers, vulnerabilities, and bugs will not stop us from creating the decentralized sharing economy our community and the world craves.

What?!? That seems like a pretty relaxed response for someone who just lost 8m dollars.

Post reply on HN