Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

511–520 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#511

Post by lsc »

grandalf wrote: post #162
vesinisa wrote: post #56

Earlier quoted context omitted.

Seems like a chicken and egg problem. The crypto currency space is currently so fraught with fraud and crime that I assume no sensible insurer would touch it with a long stick. Insurers need a boatload of seed capital and - if they would be to act as expert intermediaries as you suggest - must invest lots and lots of R&D to due diligence. But as long as ETH mostly remains a get rich quick scheme for computer criminal…

Hah I am not sure if you are joking. > The crypto currency space is currently so fraught with fraud and crime The lack of KYC requirements has led to some criminals using cryptocurrencies, but BTC is fully public and so money laundering, counterfeiting, and tax evasion both go away when we move to a public blockchain. Those three crimes are all so much bigger and more costly to society than the petty crime that has f…

>but BTC is fully public and so money laundering, counterfeiting, and tax evasion both go away when we move to a public blockchain.

So you believe that all the public mixers are compromised? It's certainly possible, but even so, they clearly aren't publicly compromised, and as such, I'd argue that tracking down large amounts of money moved conventionally is easier than tracking down large amounts of money through the blockchain, as last I read, traditionally, btc was sent through mixers quite often.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#512

Post by davidgerard »

yourapostasy wrote: post #501
davidgerard wrote: post #318

Earlier quoted context omitted.

You appear to have misconstrued my words. I don't in any way think this is a good idea; just one that has the viral characteristics of "worse is better". I spent about three thousand words on the smart contracts chapter, attempting to conclusively stab this bad idea in the face and supply a suitable rhetorical ammo dump for anyone faced with having to deal with these things to kill the idea stone dead. Absolutely eve…

Are you asserting Szabo's original smart contracts idea "is terrible and misconceived", or Ethereum's implementation "is terrible and misconceived". The latter, I would have to agree; hard forking as a response to these kinds of security holes is neither sustainable nor scalable, and I'm very partial to mechanical proof-based designs and implementations as a result.

Szabo's idea was a hypothetical for two decades. Ethereum is the first smart contracts platform people actually write for. There were attempts to do it previously, but Ethereum is the one that actually took off.

So if you're talking about Ethereum as a bad implementation of a good idea, you're weighing up reality against something that was a hypothetical from 1994 to 2014.

In any case, there's plenty really obviously wrong with the idea of immutable smart contracts. Legal code is a bad match for computer code; immutability means changes in circumstances can't be allowed for; immutability means you must code with zero bugs; the oracle problem (getting real-world data in and out of your smart contract) ...

"Dr. Strangelove" is the story of a smart contract going wrong, unstoppably, immune to human intervention.

Szabo's stuff is better than the reality - he does actually understand law as well as code, and at least early on he considered there was a role for human intervention - but it's still the sort of thing that's "interesting" rather than "a good idea".

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#513

Post by Jabanga »

tzs wrote: post #333
dna_polymerase wrote: post #46

Earlier quoted context omitted.

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

I realize that was probably satire or sarcasm or both, but since I've seen people actually seriously take that position I'm going to go ahead and respond as if it was serious. How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only…

>How do these smart contract deal with the real world? I can see how they can work for things that entirely involve activities that take place on the block chain (e.g., a smart contract that automatically pays a crowd funded project if and only if it meets a threshold for pledges by a deadline, and refunds the donors otherwise).

They can't deal with the real world by themselves, but where they have value in agreements involving real world events is that they allow the real world assessments to be debundled from those aspects of the agreement that can be formalized.

So in the cotton shipment example, the smart contract would have three parties assigned as Oracles that determine whether the correct ship arrives at the correct port on its correct trip. The smart contract would dictate that if 2 out of 3 of the Oracles agree that the condition has been met, then the smart contract will transfer the funds. There could also be a failsafe clause in the smart contract, that is controlled by a set of five oracles, who have the power to override the smart contract if the majority deem that an expected event occurred.

So yes you need human intervention, but only for those parts that cannot be automated. This explicit definition of what the human roles are may encourage better contracts, by forcing the counterparties to spend more time reasoning about which aspects of the smart contract are subject to ambiguity.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#514

Post by kough »

runeks wrote: post #476
aresant wrote: post #185

From the post mortem (1) -=> - A hacker managed to exploit a ICO multisig wallet vulnerability and drain 44,055 ETH - $9,119,385 at present. - A white hat showed up and "saved" 377,000 ETH - $78,039,000 !!! - by draining other accounts. I get the "see cryptos are too insecure / it's a pyramid / it's a bubble / ICOs are scams / etc" arguments. But holy shit turning a world currency into the wild west - for better or w…

> That $10m out the window is like a Series A for a nefarious hacker with deep crypto skills [..] Where "deep crypto skills" refers to someone who bothered to read the documentation on Solidity (the Ethereum contract language), specifically the section on function visibility[1], and the Parity wallet contract itself[2]. In other words, an obscure security hole was not found by a genius hacker. An obvious, trivial, si…

because the people investing money in it provably didn't know what they're were doing.

Very true – the price hasn't really moved in response to this news, which makes very little sense to me. I'd be shorting if I could figure out how.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#515

Post by chillydawg »

52-6F-62 wrote: post #381
chillydawg wrote: post #267

Earlier quoted context omitted.

Eth is worth less right now, as there is an implicit chance that all transactions will be rolled back to a few hours ago. Hence any buyer of ETH will be getting a fair price for the risk. Wild west all round.

None of that is true at all. Rolling it back would do nothing for anybody affected, so there's no way a consensus would form. That and a majority of the hacked accounts were prevented loss by whitehats as things look now.

The probability of rollback is not 0% (or at least it wasn't last night when I wrote that comment). It might only be 0.2%, but it's not 0%.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#516

Post by puranjay »

state wrote: post #70
icelancer wrote: post #57

Black hat hackers nabbed $31MM in ETH. Not a bad payday due to a coding error. https://etherscan.io/address/0xb3764761e297d6f121e79c32a6582...

This whole crypto currency thing has an incredible bug bounty program.

Hacking crypto currencies is the new Series A for smart programmers, I guess.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#517

Post by samblr »

avaer wrote: post #461
vog wrote: post #458

Earlier quoted context omitted.

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

>> it is a marketing tool for enabling and onboarding people onto the Ethereum platform

+1 : My feelings after going thru basics of ethereum.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#518

Post by pimeys »

munin wrote: post #401
youdontknowtho wrote: post #375

Earlier quoted context omitted.

I like your point about language complexity. Can you point to a language that would fit the simple and verified criteria? I don't really follow the subject, so it would be interesting reading.

You could take inspiration from a system like Dafny or F-* and write your contracts with the assistance of a type system and compiler that generated proofs that your contracts satisfied some postcondition given a precondition. People have already written moderately complicated applications like operating systems in these languages, so there's some evidence they could be applied to contracts on the blockchain.

There is some research using dependent types in the Idris language to build safe smart contracts. The earlier discussion (quite limited sadly):

https://news.ycombinator.com/item?id=12130282

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#519

Post by Jabanga »

buckie wrote: post #435
lomnakkus wrote: post #395

Earlier quoted context omitted.

Oh. Dear? (I mean, I understand the pressures of academia, but... ridiculously bad timing, yeah?)

Why bad timing? This is really just an example that while safe smart contracts are technically possible using Solidity/EVM, it's practically impossible. "One of the best Solidity devs" just failed to write a safe contract to the tune of a $30M exploit. Given that, what chance does anyone else have? At some point, it's time to blame the tool and not the user. Moreover, it's not like people didn't see this coming, myse…

>This is really just an example that while safe smart contracts are technically possible using Solidity/EVM, it's practically impossible.

I don't see any justification for this statement. The bug could easily have been discovered if there had been better auditing. That the auditing missed the bug doesn't prove that it's "practically impossible" to write secure code with Solidity.

In any case, nothing is stopping you from porting your formally verifiable language to Ethereum. The EVM is not Solidity. In fact there is already a project underway to create a verifiable programming language for the EVM.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#520

Post by vog »

avaer wrote: post #461
vog wrote: post #458

Earlier quoted context omitted.

I never understood why they chose such a hacky language (an a VM model that encourages these kinds of languages), and expect people to write supposedly secure (in the sense of: obviously correct!) code with it. Any remotely popular functional programming language created over the last years shows a better design (and taste) than this one. And if that only attracts a certain type of programmers? (pun intended) That is…

99 out of 100 questions. Solidity is ostensibly designed to let people write smart contracts for Ethereum. More realistically, it is a marketing tool for enabling and onboarding people onto the Ethereum platform, which Ethereum benefits monetarily (enormously so) from. Security and design are secondary goals to the extent that they help prevent disasters which hurt adoption or churn developers away. Through this lens…

> 99 out of 100 questions.

Curious question of a non-native speaker: What does this phrase mean? (in general, and in this context)

Post reply on HN