Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Missing line in a smart contract leads to $10M hack

rekt.news

Post reply on HN
Print view View original

71–80 of 333 posts

Re: Missing line in a smart contract leads to $10M hack

#71

Post by hiq »

koolba wrote: post #43

Serious question for people familiar with this space. Would you encourage an ambitious expert programmer with a substantial finance background to avoid this space entirely, or enter it as a creator, a contractor, or black hat?

What's your goal?

I don't think committing crimes as an expert programmer is a rational choice with most utility functions. Do you really want to make 10x or 100x as much in exchange of your peace of mind? Given that you're probably a top earner already? And that's already taking it from a purely selfish point of view.

Re: Missing line in a smart contract leads to $10M hack

#72

Post by alisonkisk »

ethanbond wrote: post #31
hhvn wrote: post #26

Earlier quoted context omitted.

You could argue all hacking is just doing something that is (accidentally) allowed by the target system.

Not really, because the entire premise of smart contracts is that the code IS the only representation of the contract. In normal software systems there’s an intent and then an implementation. There’s no explicit guarantee they are identical, which is exactly why there are subsystems to allow e.g. refunds or transaction invalidations.

That's just ignoring the intent part.

Re: Missing line in a smart contract leads to $10M hack

#73

Post by CuriousCosmic »

_pdp_ wrote: post #23

These kind of mistakes should not be possible in smart contracts if they are to become more mainstream. There has to be layers upon layers of defence built in to protect against common pitfalls. It is crazy that a single line can cause so much damage.

There are better tools for this, they just aren't in common use unfortunately. Had this been written in Glow, both this bug and the bug that followed where another 7M was stolen would have been compile errors.

This is just the consequence of people developing code in languages that provide little to no protection against their various footguns. At the very least we should expect to see some additional tool on top of the language that can reason about the correction of the code.

Re: Missing line in a smart contract leads to $10M hack

#74

Post by echelon »

CuriousCosmic wrote: post #41
naikrovek wrote: post #19

After reading a bit, not knowing WTH is being talked about, I did some searching. Because the author(s) of this article forgot what makes hypertext so powerful. (In fact, I think a lot of people have forgotten that. Don't be afraid to link things, people. Linking to something literally saves you the trouble of explaining it yourself. LINK MORE, PLEASE. I will click.) So this is apparently about some stock market for…

Basically what this (and DeFi in general) is is a decentralised lending platform and "liquidity farm". The lending part is relatively self-evident. You can pool funds together and the contract automatically issues loans when requested provided the user has X amount of collateral. Most "DeFi" lending basically acts like a margin for margin trading at the moment. The liquidity farming however is a bit more practical. I…

What happens if you don't pay back a DeFi loan?

Re: Missing line in a smart contract leads to $10M hack

#75

Post by unyttigfjelltol »

lottin wrote: post #30
tshaddox wrote: post #15

Earlier quoted context omitted.

But also, surely the traditional legal system will still handle disputes over smart contracts just like it does with traditional contracts. I can’t imagine that a missing line of code (intentional or not) would be treated any differently by the legal system than a vaguely-worded clause in a traditional contract. The legal system almost certainly will not say “your contract was just code and the code executed properly…

I'm pretty sure a "smart contract" isn't a legally-binding contract. A smart contract is a piece of software code, like a text editor or a web browser.

Well ... first, what's described in the article isn't that smart. It's actually dumb.

If we describe these code-as-law thingys as 'dumb contracts' it is crystal clear that 'YES' this is a dumb contract and any sane judge presented with one may well decide to give the participants exactly what they deserve, just like paper-based 'dumb contracts.'

The key innovation here is that we've gone to the remedy residing in programmer malpractice, rather than attorney malpractice. Which in turn, when it becomes obvious to all involved, hopefully will have a chilling effect on any smart programmer asked to write a 'dumb contract.'

Re: Missing line in a smart contract leads to $10M hack

#76

Post by kamyarg »

yaitsyaboi wrote: post #46
latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

What is the purpose of Solidity? Why did there need to be a new language for interacting with the Ethereum Virtual Machine? This really couldn't be accomplished by a python SDK?

Not an expert in solidity but from my limited experience EVM and smart contracts have really different approach when it comes to computation.

two things that come to my mind:

- There is really no random() function due to need for determinism

- Space vs. Time complexity is distorted, the gas you pay for instruction vs. byte is really different economics compared to AWS EC2 instance/hour etc.

Re: Missing line in a smart contract leads to $10M hack

#77

Post by [deleted] »

lottin wrote: post #18
paulpauper wrote: post #5

Why do ransomware when you can just find exploit and get away without having tainted crypto and also make much more $ too. Defi is such a big gift to hackers. Probably $100 million stolen total in past 2 year. These protocols and contracts are so complicated that such hacks are inevitable and more to come.

Moreover the "hacker" is simply doing something that is allowed by the contract so it's hard to argue that these hacks are even unlawful.

[deleted]

Re: Missing line in a smart contract leads to $10M hack

#78

Post by CuriousCosmic »

echelon wrote: post #74
CuriousCosmic wrote: post #41

Earlier quoted context omitted.

Basically what this (and DeFi in general) is is a decentralised lending platform and "liquidity farm". The lending part is relatively self-evident. You can pool funds together and the contract automatically issues loans when requested provided the user has X amount of collateral. Most "DeFi" lending basically acts like a margin for margin trading at the moment. The liquidity farming however is a bit more practical. I…

What happens if you don't pay back a DeFi loan?

In most cases it's bound to your collateral so if you don't pay back or the value of the collateral dips below some level, the loan is automatically reclaimed from your collateral.

A lot of the loans are 1:2, 1:4, or greater depending on what the currency it is being traded in is. If your total collateral dips below that multiple of the loan, you forfeit the value of the loan from your collateral plus some penalty fee.

Re: Missing line in a smart contract leads to $10M hack

#80

Post by geonic »

latchkey wrote: post #24

Another one _just_ happened... $10m. This time using the wrong variable. https://bearn-defi.medium.com/bvaults-busd-alpaca-strategy-e...

For the crypto currency layman this reads like an article from some other weird parallel universe.

You get the idea that the article is talking about money but the details seem crazy like a dream.

Post reply on HN