from Hacker News

Attempt to Reverse a $55 Million Ether Heist

by bmj1 on 6/17/17, 11:46 PM with 183 comments

• by n8n3k on 6/18/17, 12:31 PM

  Thief?

  He strictly followed the terms of a contract by people who were very clear that "code is law" and who did not want institutions were the result is decided by human judgement.

• by RcouF1uZ4gsC on 6/18/17, 11:46 AM

  If R2-D2 used Ethereum.

  C-3PO: He made a perfectly legal move.

  Han: Let him have it. It’s not wise to upset a Wookiee (The Ethereum founders).

  C-3PO: But sir. Nobody worries about upsetting a droid (a regular contract user without influence). Han: That’s cause a droid (regular contract user) don’t pull people’s arms out of their sockets (hard fork the entire crypto currency and call you a thief) when they lose. Wookiees (The Ethereum founders) are known to do that.

  C-3PO: I see your point, sir. I suggest a new strategy, R2. Let the Wookiee (Ethereum founders) win.

  With Chewbacca's and the Ethereum founders' behavior, you would be a fool to play their game again thinking that they follow the rules.

• by passivepinetree on 6/18/17, 8:00 AM

  "Just as the global WannaCry ransomware attack in May laid bare weaknesses in computer operating systems, the DAO hack exposed the early frailties of smart-contract security and left many in the community shaken because they hadn’t found the bug in time. "

  This seems like a tenuous connection at best.

• by kbody on 6/18/17, 1:19 PM

  This case feels so closely to the very interesting case of Aviva France[1], where a not "well-futureproofed" life insurance contract is making a person very rich by the day.

  Unfortunately for Aviva, their contracts are actually law in contrast to Ethereum where if the devs feel like it, they can do/revert anything.

  [1]: https://ftalphaville.ft.com/2015/02/27/2120422/meet-the-man-...

• by kator on 6/18/17, 10:53 AM

  > Another decision he made when he had no idea of the bug shows how quirky and unforgiving code can be. “If the capital ‘T’ in line 666 had been a small ‘t,’ that would also have prevented the hack,” he says.

  Can someone familiar with this explain how something financially based can have a capitalization flaw? I would expect a smart contract language to have very strict type and variable linking. Humans make many mistakes in coding but most of the time it doesn't cost $55m. A transaction language should be very strict so either the smart contract language is flawed or the author of this article is overstating something for dramatic effect.

  EDIT: Found this: https://github.com/slockit/DAO/blob/v1.0/DAO.sol#L666

  on a deeper dive: http://hackingdistributed.com/2016/06/18/analysis-of-the-dao...

• by atomical on 6/18/17, 8:11 AM

  Is it even illegal to hack Ethereum? Some purists would say the smart contract was behaving as written.

• by mannykannot on 6/18/17, 4:14 PM

  One thing not mentioned in this article is that the hard fork was only feasible because there was not much else in the way of contracts on Ethereum at the time, other than the DAO itself. If there had been vast networks of interdependent, concurrent contracts and their obligations, as envisioned by many of the most vociferous proponents of smart contracts, I think a rollback would have been impossible, at least in practice. Next time, they may not be so lucky.

• by zenkat on 6/18/17, 4:18 PM

  Etherium's fundamental premise -- "code is law" -- presupposes a general solution to the formal verification of program correctness. This is an unsolved problem (and is likely unsolvable in the complete case).

  Put simply, all code has bugs. How can Etherium ever work in practice at scale?

• by SolarNet on 6/18/17, 8:35 AM

  Part of the problem is they based this language off of JavaScript on purpose no less. It should be hard to make mistakes like this yet a single capitalization would change the semantic meaning enough to prevent this! Terrible design choices for a financial banking language.

• by harwoodleon on 6/19/17, 7:58 AM

  He was a thief, in the spirit that the money invested in the DAO was never intended to go directly to one individual (i.e. him). It was an error in the contract, as outed by numerous individuals.

  Code as law is right, but laws can (and should) change, because the effect they can have can be devastating if loopholes do the opposite of the intention behind the law.

  The fallacy here is that we have one immutable law that governs everything, that is set at one time and never changed - how ridiculous. This is utter nonsense.

  The DAO was a beautiful experiment that went badly wrong. In the grand scheme of things, if this was a heist in the traditional sense - everyone would have lost out. But as it stands, it's probably the biggest bug bounty in history.

  Hopefully no one got hurt. We learn and move on.

• by kensai on 6/18/17, 8:30 PM

  I don't understand why people keep complaining it was an "injustice" to reverse the transaction. Most people followed the hard fork the reversed the effects of the heist. If it was that unjust, Ethereum Classic would be the major Ethereum fork now.

• by roryisok on 6/18/17, 8:22 AM

  This Post Title Needs Sentence Case, More Words

  Ether thief remains a mystery, one year after $55m digital heist

• by jokoon on 6/18/17, 10:54 AM

  This story really needs an ELI5

• by 7ewis on 6/18/17, 12:08 PM

  So I'm assuming the fork, Ethereum isn't at risk?

  At least as far as we're aware.

• by exabrial on 6/19/17, 2:18 AM

  Is Etherium not formally proven? One would think that would be a check box among many things for a financial interchange system...

• by vfclists on 6/18/17, 9:48 AM

  That page is virtually unreadable. Why the fancy CSS, Javascript and fonts?

• by Fej on 6/19/17, 1:30 AM

  Are there any terse explanations out there of the DAO bug?

• by mopedtobias on 6/18/17, 11:12 AM

  Isn't Bruce Wanker the hacker? https://youtu.be/_O5fdMFKEC0

• by devdoomari on 6/18/17, 10:28 AM

  > ". Over email, he said, “We might be up the creek ;).” Later, when Gün pointed to the error in line 666, Daian replied, “Don’t think so.”

  well, isn't the financial law against this kind of incompetence in the first place?

  I don't think the thieves would be guiltier than the team behind DAO.

  ps: and line 666??? who the hell keeps a single source-code file that big? no wonder bugs are around...