Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

153k Ether Stolen in Parity Multi-Sig Attack

etherscan.io

Post reply on HN
Print view View original

91–100 of 754 posts

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#91

Post by draw_down »

Deimorz wrote: post #54
sna1l wrote: post #27

https://etherscan.io/address/0x1dba1131000664b884a1ba2384641... -- white hat group exploited the vuln and are holding people's crypto for them.

I don't follow Ethereum closely at all, but I don't really understand a few things about this: - Who's the "white hat group"? Why do people have confidence in it? - Why does everyone believe they'll give back $75M+? If they decided to just keep it, what could anyone do? - How will people even be able to claim ownership of the ETH in a way that's verifiable so they know they're giving it back to the right person?

The question makes sense, but really why do people have confidence in any of this, you know what I'm saying?

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#93

Post by grandalf »

sbierwagen wrote: post #44
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

Damn, you're right. And if people use smart contracts to do things that are technically allowed, but have unexpected downsides, we should have a review system in place where impartial third parties review the contract language. Two people should be assigned to speak for and against the unexpected behavior, and then maybe a panel of 12 regular citizens could render the actual verdict.

> do things that are technically allowed, but have unexpected downsides

Unexpected downsides for whom? Smart contracts cease to be smart if we have to rely not on the VM but on a small group of human overlords.

If a smart contract exists and you don't know clearly how many times it has been used and what percentage of the parties who used it are pleased with its functioning, you really should not use it unless you feel comfortable personally reviewing the code.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#95

Post by pyrale »

csomar wrote: post #71
olegkikin wrote: post #53

Earlier quoted context omitted.

I'm pretty sure a hard fork can undo anything on the block chain. You can start over from the block before the hack. There's probably a cleaner solution than that though.

The problem is, how do you reassign the funds after the hardfork? The funds are attached to addresses and not persons.

You can revert the funds to the address that paid into the contract in the first place, since transactions are public.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#96

Post by inopinatus »

sbierwagen wrote: post #44
grandalf wrote: post #21

Earlier quoted context omitted.

Not really true. Nothing has to be perfect if there is insurance infrastructure. People should not use contracts they have no reason to trust. As a contract becomes more important it should be viewed/vetted/trusted by as many entities as possible. Users of the contract should pay an insurance fee that goes to the vetters, who promise to reimburse in case of unpredictable behavior. Yes, this means applying some meatsp…

Damn, you're right. And if people use smart contracts to do things that are technically allowed, but have unexpected downsides, we should have a review system in place where impartial third parties review the contract language. Two people should be assigned to speak for and against the unexpected behavior, and then maybe a panel of 12 regular citizens could render the actual verdict.

I have heard of a similar system in which two opposing teams are formed and argue over technicalities of the language used in front of a lifetime appointee with no particular experience of the topic who will decide the outcome.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#97

Post by vkou »

52-6F-62 wrote: post #28
samstave wrote: post #20

Forgive me for being harsh: Why is there no "pen-test" phase to any crytocurrency which hits the market. So, let me understand; you're ostensibly smart enough to (perhaps as a body of contributors, even) develop a cryptocurrency offering - yet youre also fucking stupid enough to not have same/wider network of ppl attempt to hack the fuck out of your plan? Does this already occur? or some savant comes and owns them? W…

It has nothing to do with any currency or protocol. It was a broken feature in a piece of software used on the network that was bad. Unfortunately, it was widely used and somebody caught the fault and exploited it. It's more like a company's open source software allowing somebody to steal your bank password. It doesn't have anything to do with USD or the Fed, or even the bank's larger practices. It has to do with how…

Of course, there is a very large financial system designed to deal with the fallout of a bank password being stolen. There is no such system with crypto-currencies.

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#98

Post by jacopofar2 »

dna_polymerase wrote: post #46
earlz wrote: post #25

Here's the root error I believe: https://github.com/paritytech/parity/blob/master/js/src/cont... The initWallet function should have been marked internal, but was instead not marked. Unmarked functions default to public in Solidity, so anyone can call that function and reinitialize the wallet to be under their control

I can literally feel how Ethereum changes the law. I mean, seriously, no need for lawyers anymore. On ethereum it's is simple: You got fucked, live with it. "Bad faith? It's the code, didn't you read it?"

Except for that DAO of last summer, in that case the law changed...

Re: 153k Ether Stolen in Parity Multi-Sig Attack

#99

Post by 52-6F-62 »

AlexandrB wrote: post #69
52-6F-62 wrote: post #58

Earlier quoted context omitted.

This is somehow the top comment, but doesn't deal with the issue at hand. In fact it entirely ignores it. The theft wasn't due to an issue in the core protocol of Ethereum, it's due to faulty code in a single piece of software (as you can see throughout the rest of the thread). It's a matter of poor engineering practices, not a flaw in the fundamentals of the protocol. If an engineer designed a bridge, and it failed…

> The theft wasn't due to an issue in the core protocol of Ethereum True enough, but what the parent pointed out is that this class of problems is due to a flaw in the core concept of Ethereum - which is much worse than just a flaw in the protocol. To extend your analogy - Ethereum is like if a company advocated for building bridges using a process that made the bridge's integrity unverifiable using traditional engin…

I understand your counterpoint, but I don't think it's accurate. I mean, if it isn't verifiable, then how would it at all be exploitable, and then patchable?

Even so, any product designed for the network could be tested to death on any of the available testnets. It would be foolish not to ram any project up against everything in that environment, which is why I suggest poor practice as a primary cause.

It was an oversight, to be sure, and a major one. (that's not nearly strong enough language, but I want to be civil)

Post reply on HN