I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
Your reasoning is flawed. Once a contract is developed that proves to be secure, it can be used over and over at no additional cost.
A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
71–80 of 440 posts
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#72Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#73I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
And that's been true right from the beginning with Bitcoin: scams, schemes, heists, data loss - the headlines scream blood all the time. We've never had that kind of "mean time to disaster" in technology before. The status quo was that something would fail, but the failure would never quite get back to the individual or company that produced it. They would spin it away, and no careers would be harmed. But the likes of Solidity produces a meat-grinder, a blind destroyer of any who dare enter calling themselves rockstar.
I think it's kind of awesome and beautiful, in that sense. It will induce a maturation throughout the economy to adapt to this new pressure. But like adolescence, it can be an ugly work in progress, and I don't expect Ethereum itself to be a survivor at this rate.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#74I think the fundamental problem here is an economic one. Make three assumptions: 1) most contracts worth implementing in Ethereum are fairly complex 2) even given great developers, bugs are inevitable in complex code 3) the budget of the contract-makers' security team MUST be smaller than that of the hackers You quickly see that if the chance of a bug is nonzero, "smart contracts" don't make economic sense. If you ha…
> This isn't a normal loss by the way, where you can prosecute someone or sue somebody. No, this is the instant, digital theft of the entire value of the contract, to an anonymous digital address where it will be quickly blended in with hundreds of millions of dollars of similar thefts a month. Also worth pointing out that a non-trivial number of people would say that no theft at all has occurred, as the smart contra…
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#75Earlier quoted context omitted.
Is formal verification of contracts feasible? Is anyone working on it? Also, here's a possibly crazy idea: could one create bug bounties for algorithms (or even arbitrary software) on the Ethereum blockchain by writing the algorithm into a contract such that if you somehow break it you receive the bounty? An example of this would be the massive implicit bounty currently placed on the crypto algorithms (SHA256, ECDSA/…
See: https://www.youtube.com/watch?v=voyespPGQZI (Directions in Smart Contract Research A Selection - Philip Daian)
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#76Earlier quoted context omitted.
I think most developers know not to eval() Why would you execute arbitrary text in any other languages?
Your parallel is not an accurate one. One of the key and powerful features of the Ethereum Virtual Machine or, EVM, is the ability to delegate execution to external libraries. You can think of this much the same way you think of installing 3rd party libraries in your favorite programming language of choice. In the EVM you can write a "library" which performs some common functionality such as manipulation of date-time…
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#77Earlier quoted context omitted.
I think most developers know not to eval() Why would you execute arbitrary text in any other languages?
Your parallel is not an accurate one. One of the key and powerful features of the Ethereum Virtual Machine or, EVM, is the ability to delegate execution to external libraries. You can think of this much the same way you think of installing 3rd party libraries in your favorite programming language of choice. In the EVM you can write a "library" which performs some common functionality such as manipulation of date-time…
> _walletLibrary.delegatecall(msg.data)
Dunno how much contracts in the wild have such brilliant feature.
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#78Earlier quoted context omitted.
"Is there really such a thing as "unbreakable cryptography"?" Yes. One time pads are unbreakable. "Even after the aliens from Andromeda land with their massive spaceships and undreamed-of computing power, they will not be able to read the Soviet spy messages encrypted with one-time pads (unless they can also go back in time and get the one-time pads)." (Bruce Schneier, Applied Cryptography)
One could envision that the transportation of one-time pads as the only objects worth shipping between inhabited solar systems. Value per gram could be enormous.
- Vernor Vinge, "A Fire upon the Deep"
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#79This is a very pro-Ether take on what happened, but ultimately it comes to the right conclusion: > The problem is that his programming toolchain allowed him to make these mistakes. Damn straight. The problem is that the model of 'public by default, opt in for security' is fundamentally daft in this context. There's quite a good read on that particular topic here too http://hackingdistributed.com/2017/07/20/parity-wal…
It's daft in most contexts, and is one of the largest sources of security problems. If your design requires enumerating badness[1], you're doing it wrong.
> from: http://hackingdistributed.com/2017/07/20/parity-wallet-not-a...
>> Just about every ICO, trust and company used the Parity multisig wallet, and that code was considered well-tested.
-sigh- This is, unfortunately, a common problem. "It worked ok the last N times" and "It passed a lot of tests" do not mean it's bug-free and safe to use. Richard Feynman was right during the Challenger investigation when he called this a childish attitude. (He was also right in not wanting to assign blame, instead asking "How do we educate the child?"[2])
[1] http://www.ranum.com/security/computer_security/editorials/d...
Re: A hacker stole $31M of Ether – how it happened, and what it means for Ethereum
#80How did the white hats understood the vulnerability? I don't know anything about ethereum so i'm honestly asking. Is there a public log of the method invocations so they could see the hacker was exploiting that exact vulnerability and decided to replicate it?