Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Critical Update on DAO Vulnerability

blog.ethereum.org

Post reply on HN
Print view View original

61–70 of 629 posts

Re: Critical Update on DAO Vulnerability

#61

Post by joosters »

johncolanduoni wrote: post #48
btrask wrote: post #41

Earlier quoted context omitted.

We already knew that blockchains are vulnerable to 51% attacks. There are real problems with points of centralization (including the developers), but events like this don't prove anything. Edit: to be clear, the 51% attack I'm referring to is actually the defense of the network by developers/miners/users that the parent post is complaining about.

If this is just a 51% attack then we didn't learn anything about etherium qua etherium or blockchains qua blockchains... but we'll learn something about the lower bound for being big enough that they're not a realistic possibility.

It's an interesting question - is the DAO 'too big to fail' ?

I wonder how different ether will turn out to be, will they bail it out by rolling back the blockchain?

Re: Critical Update on DAO Vulnerability

#62

Post by jpereira »

jabgrabdthrow wrote: post #52
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times. It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder…

In my understanding the attack vector was anticipated for the executeProposal() function, but the attacker is using a recursive call of the splitDAO() function.

This blog post[1] from the Ethereum Team describes the possible attack.

[1]https://blog.ethereum.org/2016/06/10/smart-contract-security...

Re: Critical Update on DAO Vulnerability

#63

Post by joosters »

nullc wrote: post #45
joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

> all the talk of blockchains being decentralised All the talk of /ethereum/ being decentralized.

True! It's definitely a situation where the 'market cap' of bitcoin gives it some extra stability. If the DAO contained bitcoins, it would be a far smaller % of the total and there would be fewer calls to roll back the logs.

Re: Critical Update on DAO Vulnerability

#66

Post by joosters »

btrask wrote: post #41
joosters wrote: post #26

Just remember, when the developers inevitably appear with suggestions about how to stop the hack, roll back the blockchain, or come up with other schemes to block the hackers, they are showing everyone that all the talk of blockchains being decentralised, or being beyond the control of governments or other powers... is a complete lie. If this hack can be stopped, then it demonstrates that the currency can be manipula…

We already knew that blockchains are vulnerable to 51% attacks. There are real problems with points of centralization (including the developers), but events like this don't prove anything. Edit: to be clear, the 51% attack I'm referring to is actually the defense of the network by developers/miners/users that the parent post is complaining about.

They do if the developers suddenly come up with schemes to block the attack or hack the DAO. vbuterin has posted on reddit a plea for any DAO holders who were about to 'split' their holdings to contact him - presumably he has a way to hack the DAO more effectively and so grab the money before the attackers grab it.

But when did he know how to do this? Was it a secret that he was sitting on, or has he only learnt about it from the existing attack?

Re: Critical Update on DAO Vulnerability

#67

Post by nullc »

csomar wrote: post #22
popey456963 wrote: post #19

Earlier quoted context omitted.

This is how I understand the situation: - 2,436,828 Ethereum has been routed to the address starting "0x304a554a310c7e546" [0] - This is worth roughly $46,000,000. - This has happened because there is some weakness in the Ethereum security - The conversion between Ethereum and USD is dropping significantly, now down to 16. [1] Due to this security threat, the developer is telling people to try to effectively DDOS the…

Is this a weakness on Ethereum or the DAO?

The fact that many scripts written suffers similar vulnerabilities unless extensive (and, seemingly failure prone) mitigations are applied, suggests that the root cause is a known design flaw in the ethereum smart contract architecture.

Doubly so when the latest reviewers of this systems and custodians of the DAO include the system's creators.

When building systems that provide irreversible transaction processing, safe only under perfect use is not sufficient.

Re: Critical Update on DAO Vulnerability

#68

Post by i_have_to_speak »

dimgl wrote: post #7
SakiWatanabe wrote: post #2

developer asks token holders to spam the network to delay the attack o.O griff [10:05 AM] @channel The DAO is being attacked. It has been going on for 3-4 hours, it is draining ETH at a rapid rate. This is not a drill. You can help: If anyone knows who has the split proposals Congo Split, Beer Split and FUN-SPLT-42, please DM me We need their help! If you want to help, you can vote yes on those aforementioned split p…

This is the nuttiest thing I've ever seen.

There goes $50m...

http://www.coindesk.com/the-dao-just-raised-50-million-but-w...

Re: Critical Update on DAO Vulnerability

#69

Post by buttershakes »

OscarCunningham wrote: post #54
nneonneo wrote: post #30

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing…

Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it

Or, they could just plow that currency into BTC at diminishing value as fast as possible. That's presumably what I would do if I discovered a bug like this and wanted to make bank.
Post reply on HN