It's "cynical" to point out these problems will keep happening, but then they keep happening. So, not much to say.
153k Ether Stolen in Parity Multi-Sig Attack
81–90 of 754 posts
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#82Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control
> Unmarked functions default to public in Solidity Facepalm Wasn't this lesson learned long ago? C# defaults to private on unmarked members. Why would you ever want to default public?
[deleted]
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#83"my favorite part of this latest ICO hack is that it appears to have gone to same wallet as the dao hack ....."
https://mobile.twitter.com/IamNomad/status/88777698177709261...
"incredible plot twist: whitehat hacker supposedly saved most tokens from being stolen using the same vuln."
https://mobile.twitter.com/bcrypt/status/887775417406431232?...
"Multisig wallets affected by this hack: - Edgeless Casino (@edgelessproject) - Swarm City (@swarmcitydapp) - æternity blockchain (@aetrnty)"
https://mobile.twitter.com/maraoz/status/887755889897295872?...
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#84Earlier quoted context omitted.
Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…
Damn, you're right. And if people use smart contracts to do things that are technically allowed, but have unexpected downsides, we should have a review system in place where impartial third parties review the contract language. Two people should be assigned to speak for and against the unexpected behavior, and then maybe a panel of 12 regular citizens could render the actual verdict.
This is the central, glaring flaw in cryptocurrencies to me. Transferring "value" for goods and services is really more of a social problem than a scientific/engineering one.
Money is a social technology that solves a social problem. Cryptocurrency is a engineering technology in search of a problem to solve.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#85Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control
Does this mean ETC is compromised too?
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#86how much money is that?
~30 million USD.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#87I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…
Can't you say the same thing about software that uses encryption in general? For example your browser, yet you still trust it. Also, what you said applies to critical software in airplanes, and cars like Tesla, yet you still somehow trust it without reading the code. Maybe you should replace the word "Ethereum" with "sotware". "Software in general makes sense is all the following are true"
We already have "software", but please remind us why do we need "Ethereum" specifically?
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#88Earlier quoted context omitted.
Let perfect not be the enemy of good. If you demanded that our currencies like dollars live up to your criteria, we would still be trading goods without currency.
Dollars don't purport to have a blockchain or immutable transactions. Ethereum does. Ethereum needs to live up to the standards it has set for itself.
Oh, yeah, I forgot. Dollars are much better; a central bank (actually, any bank) can create arbitrarily many of them and flood the other banks and the market with cheap money, causing things like the subprime crisis. Much better than crypto currencies.
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#89Let's play hypotheticals. If you were the attacker and you now have the ETH in your wallet, how do you cash out without anyone identifying you and maximising your profits? Also has the attacker broken a law by exploiting a bug in the contract?
Tumbler or transfer to another currency (possibly at a markdown). Specifically for ethereum: https://ethereum.stackexchange.com/questions/2699/is-there-a...
Re: 153k Ether Stolen in Parity Multi-Sig Attack
#90I've posted this before [0], but it's still apropos regarding the foolishness that is Ethereum. [Ethereum] only makes sense if all of the following obtain: (a) the code is 100% bug-free (b/c accidents cannot be rewound) (b) all code-writers are 100% honest (their code does what they say) (c) all contract participants are 100% perfect code readers (so as to not enter into fraudulent contracts) (Strictly speaking, only…
Let perfect not be the enemy of good. If you demanded that our currencies like dollars live up to your criteria, we would still be trading goods without currency.
The dollar depends on the willingness of the US government to keep servicing its debts, which would have real-world implications if it stopped. Indeed, political disagreements over this have already resulted in interruptions to governance and the availability of services, which is arguably equivalent to food shortages under communism.