The math prodigy whose hack upended DeFi won’t return funds • Hacker News Board

Re: The math prodigy whose hack upended DeFi won’t return funds

#91

Post by SkyMarshal » Mon, May 23, 2022, 4:45 PM UTC

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

> With this worldview, if the attacker simply exploited poorly-written code to find a loophole, how do the owners of Index have a leg to stand on?

They don’t. They simply have to accept it as a bug bounty successfully collected and paid out, and treat it as a learning experience and evolutionary process. Do better next time, if there is a next time.

Re: The math prodigy whose hack upended DeFi won’t return funds

#92

Post by isolli » Mon, May 23, 2022, 4:46 PM UTC

meetups323 wrote: post #74

tzs wrote: post #55

> It would take weeks to figure out precisely what had happened, but it appeared that the platform had been fooled into severely undervaluing tokens that belonged to its users and selling them to the attacker at an extreme discount. Q: is the programming language these things are written in powerful enough and have sufficient data access for the developers to include sanity checks that would halt trading automaticall…

The language could represent that, but you pay per operation so checks tend to get thrown out the window.

This part seems relevant:

> It also saved on costs by limiting the number of interactions between the platform and outside entities. For example, when Indexed needed to calculate the total value held within a pool, instead of checking token prices on an exchange such as Uniswap, it sometimes extrapolated from the value and weight of the largest token within the pool, called the “benchmark” token.

> This way, it reduced the fees it paid for transactions on the Ethereum blockchain.

This cost-saving mechanism ultimately allowed the hack to take place.

Re: The math prodigy whose hack upended DeFi won’t return funds

#93

Post by kristjansson » Mon, May 23, 2022, 4:52 PM UTC

There's something delicious in a critical part of the arb relying on a mechanism the contract authors included to reduce gas fees. Not only are we enshrining code as law, we're playing code golf with it first!

Re: The math prodigy whose hack upended DeFi won’t return funds

#94

Post by Ataraxic » Mon, May 23, 2022, 4:54 PM UTC

SamBam wrote: post #77

Ajedi32 wrote: post #65

Earlier quoted context omitted.

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

But that is the premise of smart contracts. Sure, it doesn't excuse you from the law if your contract is to pay someone to shoot someone, but it's supposed to be the final word on the actual financial transactions that happen within the contract. Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm: > Guaranteed Outcomes: Potentially the…

That may be the premise, but has that actually be held up and recognized as such in courts in major countries? Like are there precedents regarding this?

At that point it's no longer a premise (for those particular countries), but until then it's just a supposition.

I think courts are wary to wade deeply into a new financial system like this but at the same time I find it hard to believe that the judiciary and the legislature would rule (in the long run) that they have no ability to "make things right".

If crypto grows as as many people suggest and you have some significant percentage of the country that has savings or investments tied to these smart contracts, if there is a loophole like in this case, you'd have lots of people writing their local or national representative about this. I find it hard to believe that politicians would tell the people they represent "tough luck code is law".

Re: The math prodigy whose hack upended DeFi won’t return funds

#95

Post by [deleted] » Mon, May 23, 2022, 4:54 PM UTC

Brian_K_White wrote: post #86

kristjansson wrote: post #73

This is an outright copy of https://www.bloomberg.com/news/features/2022-05-19/crypto-pl... . e: missed at the end of the article: > (Except for the headline, this story has not been edited by NDTV staff and is published from a syndicated feed.) So perhaps this is reproduced under a legit syndication deal?

It says "(c) 2022 Bloomberg Christopher Beam, Bloomberg Businessweek" right in it.

[deleted]

Re: The math prodigy whose hack upended DeFi won’t return funds

#96

Post by dimator » Mon, May 23, 2022, 4:54 PM UTC

I'm getting strong Neuromancer vibes from this. It's so interesting that we're now officially cyberpunk in some corners of our world.

Re: The math prodigy whose hack upended DeFi won’t return funds

#97

Post by postalrat » Mon, May 23, 2022, 4:54 PM UTC

billpg wrote: post #83

postalrat wrote: post #34

Earlier quoted context omitted.

Would it be an exploit if I discover the math to move all bitcoin in existence to whatever address I want then do so?

If you discovered a significant shortcut to hashing and then went back to block 1 and re-mined every block until your branch was the one with the most proof-of-work, I'd have a hard time trying to claim that your branch wasn't the legitimate one, according to Bitcoin's own rules. I suspect in this hypothetical scenario, however, the bitcoin developers would write a new rule.

Perhaps a way to generate working private keys for any address. So I could move coins as I wish.

Re: The math prodigy whose hack upended DeFi won’t return funds

#98

Post by yongjik » Mon, May 23, 2022, 4:55 PM UTC

Ajedi32 wrote: post #65

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

I've seen this argument regarding smart contracts several times now, and I don't think it makes any sense. It's like robbing someone in real life, then claiming you did nothing wrong because you didn't violate the "laws" of physics. Those are two entirely separate things. In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used…

I think the problem is, if you put a sign saying "Feel free to break in, I dare you, if you manage to get in the house then you're free to take anything you want!" then you can't later complain when someone does exactly that.

(Well, maybe you can still complain, IANAL, but it gets a lot murkier.)

Re: The math prodigy whose hack upended DeFi won’t return funds

#99

Post by ddingus » Mon, May 23, 2022, 4:58 PM UTC

Ajedi32 wrote: post #90

daveed wrote: post #72

Earlier quoted context omitted.

Respectfully disagree. I think I've seen several times the belief(from crypto supporters) that the code is the code is the code, and these are the rules that we play with. The "laws of physics" analogy doesn't match up. I feel like it would be more appropriate in an anarchist society (physics are the only laws, thus everything that obeys physics is game). This feels more like discovering an exploit in a video game. I…

That's not how the law works though, at least not in any country I know of. If you exploit flaws in computer code to steal something of real-world value, that's a crime. We're all bound to the laws of physics, just as in the world of smart contracts all are bound to the laws of code. But none of that changes the existence of the laws of men.

Actually, we are only bound to the laws of physics within the limits of our understanding. As our understanding grows, those laws become less and less restrictive. I think it's an interesting analogy or parallel for the case we are discussing.

Re: The math prodigy whose hack upended DeFi won’t return funds

#100

Post by gizmo686 » Mon, May 23, 2022, 5:00 PM UTC

twox2 wrote: post #57

SamBam wrote: post #50

> But in our email exchanges, he argued that he'd executed a perfectly legal series of trades. In real finance, there is an understanding that technical loopholes can exist, since not every outcome can be foreseen when writing laws, but the legal system can frequently prosecute against a series of actions which are, individually, legal, but which together are taken in order to achieve something illegal. That is, mode…

"Code is law" is a dream that is not actualized. It's not actually law, it's just code. I'm pretty sure law enforcement will gladly prosecute for a lot of these "hacks".

What specific law was broken? In the US, generic "hacks" generally fall under the computer fraud and abuse act, which is notoriously vague about what qualifues as "authorized". Perhaps some other lawvis applicable. But I cannot think of any that are obviously on point. Nor can I think of a clear precedent that clarifies the issue.