Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

51–60 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#51

Post by alextheparrot »

Arnavion wrote: post #40
naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

This is actually a bit amusing, because one of my favorite reading features on iPad is being able to click and hold on an arbitrary word to look it up.

Sure, the UI/UX of a traditional link isn't desirable, but I do want every word to be linkable to the dictionary.

Re: Missing line in a smart contract leads to $10M hack

#52

Post by IG_Semmelweiss »

There's an extremely strong case for Bitcoin as a public ledger of real estate transactions within a particular jurisdiction like a country, but that would necessitate a lot of interested parties losing power that it would be a political 3rd rail.

Outside of that is there any s interesting use cases that have emerged?

Re: Missing line in a smart contract leads to $10M hack

#53

Post by geocrasher »

yojo wrote: post #50
geocrasher wrote: post #25

Can somebody explain to a non-coder who doesn't have anything to do with cryptocurrency what happened here? I find the article itself to be unreadable.

As I understand it: Value DeFi is a company that provides infrastructure for some kind of lending. Money (in this case cryptocurrency) is locked up in a “smart contract” that acts as a sort of bank account. If all is working correctly, the owner of that money can dispense it to borrowers by sending specially crafted and authenticated messages. In this case it looks like the way it was supposed to work is: create the…

Thank you. After some coffee and a re-read, this is the conclusion I came to also.

Re: Missing line in a smart contract leads to $10M hack

#54

Post by ZephyrBlu »

naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

It's a crypto news website. They're not going to link to basic crypto terms.

Your whole comment sounds like confirmation bias to me. You don't like crypto, therefore all the new terms you've never heard of must be bad stuff, everyone is out to scam people and crypto isn't "on the level".

Re: Missing line in a smart contract leads to $10M hack

#55

Post by hiq »

Many people are asking what happened, because the article does not go much into detail.

The code is there (linked in the article): https://bscscan.com/address/0x7a8ac384d3a9086afcc13eb58e9091...

After spending 2min on it and using this hint from the article:

> The affected pool contract had an initialize() function that should have been activated after deployment.

> The line: initialized = true; is missing from the function.

That's really the crux of the issue. Have a look at the `initialize()` function. It's meant to be called only once (that's why it uses the modifier `notInitialized`), right after the smart contract is deployed, and never again. But the `initialized` variable is never set to true, meaning that it can be called again, and it seems that's what the attacker did.

...so for those who expected something fancy and technically advanced, that's not for you.

Re: Missing line in a smart contract leads to $10M hack

#56

Post by Arnavion »

alextheparrot wrote: post #51
Arnavion wrote: post #40

Earlier quoted context omitted.

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

This is actually a bit amusing, because one of my favorite reading features on iPad is being able to click and hold on an arbitrary word to look it up. Sure, the UI/UX of a traditional link isn't desirable, but I do want every word to be linkable to the dictionary.

You can copy-paste a word from the website into your search engine too. The website doesn't have to do anything. Just like the program you used on your iPad didn't do anything, it was the iPad providing the select-and-dictionary feature.

Re: Missing line in a smart contract leads to $10M hack

#57

Post by jollybean »

chriswait wrote: post #12
Barrin92 wrote: post #2

I wonder when people will realize that the complexity inherent in human financial transactions will not go away just because you write code instead of natural language and 'decentralized finance' will reinvent everything it tried to get rid off (but shoddily) because nobody likes to lose their live savings because they missed a semicolon.

Does anyone else feel like replacing all the legacy finance infrastructure with decentralised code is going to produce a worrying number of stories like this? Most of the examples I've seen so far it's happening to someone who works in tech, has disposable income, and is generally a proponent of cryptocurrency. I haven't written a lot of decentralised code in production, but I get the impression there is generally mo…

It's worse than that.

Contracts are not code.

It's a complete misunderstanding to posit them as such.

Contracts depend first and foremost upon the legal regime in which they are valid. Every jurisdiction has rules, precedence, language means specific things.

There is quite a bit of variability in this stuff, which is why we have lawyers. And Judges.

Putting a contract into a crypto ... is basically pointless.

There's possibly more transparency, akin to publishing contracts on the web or something like that.

And of course, there is a 'narrow range of agreement possibilities' that could take place on crypto contracts, for example, things like stock options etc..

But generally speaking, even the contract cryptos are 'technologies looking for application'.

We don't want to 'nay say' new, dreamy ideas, but these new dreamy ideas, combined with a bit of hubris, arrogance, greed, lack of self awareness can create problems.

Re: Missing line in a smart contract leads to $10M hack

#58

Post by jollybean »

BoiledCabbage wrote: post #37
tshaddox wrote: post #15

Earlier quoted context omitted.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

The thing is, that's what a lot of smart contract proponents are pushing for. That the legal system has no say over contracts, so the outcome would stand. Or effectively bake into operating these contracts that the legal system isn't a reprieve against anything.

"That the legal system has no say over contracts, "

An agreement is an agreement subject to laws and jurisdiction. There's no avoiding that.

It will be interesting to see how this plays out in the courts.

Re: Missing line in a smart contract leads to $10M hack

#59

Post by dylan604 »

Arnavion wrote: post #40
naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

I'm pretty sure I've seen some of those ad afiliate javascript libraries that add links to words in a paragraphs back to some random website that used a matching keyword that looked very close to your example.

At least, way back before I started using blockers.

Re: Missing line in a smart contract leads to $10M hack

#60

Post by anyfoo »

alextheparrot wrote: post #51
Arnavion wrote: post #40

Earlier quoted context omitted.

>Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) This is a fine sentiment, but [you] [don't] [link] [every] [word] [in] [your] [sentence] to a dictionary website either, because yo…

This is actually a bit amusing, because one of my favorite reading features on iPad is being able to click and hold on an arbitrary word to look it up. Sure, the UI/UX of a traditional link isn't desirable, but I do want every word to be linkable to the dictionary.

On the Mac too, you can just "force press" the touchpad on any word and a definition comes up. As a non-native English speaker, I use it quite a lot.
Post reply on HN