Live data from Hacker News

The bug which lost more than $600M in various cryptocurrencies a few hours ago

twitter.com

81–90 of 126 posts

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#81
post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

Over time, there will be old smart contract code that is trusted because it has been used for so long, and there will be new code that is less trusted because it is new. Time will ensure that smart contract code that is flawed will be discarded and forgotten, or blacklisted, so it will be safe to assume that any old code that is still popular is trustworthy. Time will also ensure that popular code is well understood…

The problem is that it is totally possible for there to be a hidden bug in an old smart contract that everyone trusts. And only a single bug like that can destroy the entire ecosystem. It's not enough for trusted smart contracts to be less buggy, they have to be so secure that they don't have any bugs ever

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#82
post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

> And law enforcement is a thing!

More than that, there's a minority perspective in DeFi that the code is the law. If the code allows it (e.g., withdrawals under an unintended circumstance), it's therefore legal. If it were illegal, the code wouldn't allow it.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#83
post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

I think the bigger problem is people who are intentionally being malicious rather than people who stumble upon a bug. Just look at how many people fall for wire transfer or gift card scams. Crypto allows scammers to do that much more easily, since there is no human in the pipeline to flag transactions, and since there aren't the same limits that banks put in place on transactions. If someone finds a way to exploit a particular pattern/transaction type/etc. it's not like you can just immediately patch it when you have a decentralized currency. Ex. in an Bitcoin wallet malicious actors could show any text they wanted in an update popup [0]. So of course this was immediately used to steal millions.

With crypto all it takes is one piece of malicious software, or to fall for a single phishing email, and you've lost everything.

[0] https://www.zdnet.com/article/bitcoin-wallet-trick-has-nette...

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#84
post #69
post #50

Earlier quoted context omitted.

It's not that merchants are inherently more trustworthy, it's that the buyer has ample opportunity to research the merchant and establish credibility. If there's a merchant that only accepts crypto and the buyer can't get comfortable that the merchant is trustworthy, the buyer can walk away instead of making a purchase. The merchant has much less to go on. There aren't review websites detailing the reputation and his…

I don't quite buy that. The ability to claw back credit card payments to fraudulent merchants enables commerce before credibility is established. This is in the merchant's interest too, especially when they're starting out.

It's only in the interest of the merchant if they are selling items that have a low enough chargeback rate. Credit cards and clawbacks work great in-person and for low value online merchandise but it's non-viable for online high resale value merchandise.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#85
post #72
post #55

Earlier quoted context omitted.

The chargeback returning the money to the rightful owner doesn't help the merchant who shipped $6,000 of hardware to some stranger. Certain types of electronic sales simply can't be done online because of the high rates of fraud. When you add crypto, these sales become possible. Yes, they become possible at the cost of putting the counterparty risk onto the consumer, but that's better than the sale being entirely non…

I don’t understand your line of reasoning at all. Like the others have said, moving risk from sellers to customers is not a solution. Especially when the risk of customers committing fraud is incredibly low. Why would you start with an assumption that this is something so rampant it needs to be solved in a way that harms literally all honest customers?

I operated an online store selling $2,000 pieces of computer hardware, and both credit card companies and banks alike refused to service us because fraud rates were extremely high.

If you think fraud rates are extremely low, you've never tried to sell $2,000 electronics online as a boutique electronics store.

Bitcoin was the only option.

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#86
post #23

There's a serious fundamental problem with DeFi that can't be solved with blockchains. Someone starts a blockchain company and hires a bunch of devs who make, idk, $40 to $100 per hour to build the thing. Maybe more, it doesn't really matter. Even just one dev or a few devs can make all the contracts needed for this. One day that dev notices a vulnerability in the smart contract he's writing! He has two choices: (a)…

Why should law enforcement be a problem? I thought the idea behind smart contracts was that code is law?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#87
post #85
post #72

Earlier quoted context omitted.

I don’t understand your line of reasoning at all. Like the others have said, moving risk from sellers to customers is not a solution. Especially when the risk of customers committing fraud is incredibly low. Why would you start with an assumption that this is something so rampant it needs to be solved in a way that harms literally all honest customers?

I operated an online store selling $2,000 pieces of computer hardware, and both credit card companies and banks alike refused to service us because fraud rates were extremely high. If you think fraud rates are extremely low, you've never tried to sell $2,000 electronics online as a boutique electronics store. Bitcoin was the only option.

It’s not that I don’t believe there is fraud, I’m saying the vast majority of customers are well-intentioned. If this is not the case, could you point me to some sources and not just your anecdote?

Regardless, how does Bitcoin solve this? There’s a lot of illegitimate users of crypto, how are you solving fraud with irreversible transactions?

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#88
post #11
post #7

So as someone very critical of the whole DeFi / Smart Contracts philosophy (purely in terms of practicality, not the high-level concepts behind it) - please explain to me how the impacts of those bugs are going to be mitigated going forward. At will and ex-post broadcasting "oops, we had a bug - please roll back or block the bad actors" doesn't strike me as a solid solution, nor a fair & automated one. I was under th…

You can't really mitigate this entirely as you can't really write software without bugs. There will always be a need for this eventual "please roll back or block the bad actors". And more money you put into the game more it will be demanded when someone gets hurt. I don't like crypto but this way of fixing things is pretty normal and standard in software and orher industries also. You simply can run into situations w…

> you can't really write software without bugs

Formal verification

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#89
post #19

I'm having a great laugh every time I hear about crypto-stuff goofs. Who thought an amazing new P2P invention would improve the image of normal money and traditional banks?

Rome was not built in a day. Examples of 2008, GME fiasco, and many other display a clear and obvious need for decentralized finance.

In my opinion, 2008, GME, and many other gaffes really show we need more regulation -- not less!

Re: The bug which lost more than $600M in various cryptocurrencies a few hours ago

#90
post #19

I'm having a great laugh every time I hear about crypto-stuff goofs. Who thought an amazing new P2P invention would improve the image of normal money and traditional banks?

Mocking inventors for the challenges they cross along the way tends to not age well.
Post reply on HN