6 ms·

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is s

The provided link is just a page showing a bunch of transactions. For someone like me, who is not so intimate with the Ethereum terminology in use (but who is still interested in the DAO, as an observer), could someone provide a layman's explanation of what's going on? Somewhat more specifically, I'm wondering the following: - At a high level, what does this attack actually consist of? - How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints? - Who loses and who gains from an attack of this scale? - How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)? - How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?

jabgrabdthrow 10y ago
It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times. It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder some of the coins). Watch for a wave of rebranding. > How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)? We will see. The group behind TheDAO has a lot of pull - if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept. > How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected? Why, take a look: https://blog.slock.it/no-dao-funds-at-risk-following-the-ethereum-smart-contract-recursive-call-bug-discovery-29f482d348b#.skdl752nu https://blog.slock.it/no-dao-funds-at-risk-following-the-eth... Copied: """ No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery Our team is blessed to have Dr. Christian Reitwießner, Father of Solidity, as its Advisor. During the early development of the DAO Framework 1.1 and thanks to his guidance we were made aware of a generic vulnerability common to all Ethereum smart contracts. We promptly circumvented this so-called “recursive call vulnerability” or “race to empty” from the DAO Framework 1.1 as can be seen on line 580: // we are setting this here before the CALL() value transfer to // assure that in the case of a malicious recipient contract trying // to call executeProposal() recursively money can’t be transferred // multiple times out of the DAO p.proposalPassed = true; Three days ago this design vulnerability potential was raised in a blog post which subsequently led to the discovery of such an issue in an unrelated project, MakerDAO. This was highlighted in a reddit post, with MakerDAO being able to drain their own funds safely before the vulnerability could be exploited. Around 12 hours ago user Eththrowa on the DAOHub Forum spotted that while we had identified the vulnerability in one aspect of the DAO Framework, the existing (and deployed) DAO reward account mechanism was affected. His message and our prompt confirmation can be found here. We issued a fix immediately as part of the DAO Framework 1.1 milestone. The important takeaway from this is: as there is no ether whatsoever in the DAO’s rewards account — this is NOT an issue that is putting any DAO funds at risk today. """
- joosters 10y ago
  Slock.it are the cheerleaders of the DAO (and were the likely recipients of its funds had it not been hacked). They previously boasted about how their audit of the code found no issues other than a slight rounding error if the DAO became worth trillions of dollars. It's entirely in character for them to post further messages reporting how wonderful, secure and perfect their code is, in the face of terrible problems.
- jpereira 10y ago
  In my understanding the attack vector was anticipated for the executeProposal() function, but the attacker is using a recursive call of the splitDAO() function. This blog post[1] from the Ethereum Team describes the possible attack. [1]https://blog.ethereum.org/2016/06/10/smart-contract-security/ https://blog.ethereum.org/2016/06/10/smart-contract-security...
- tomp 10y ago
  > if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept. I guess if Ethereum makes a hard fork, that will damage it much more - basically, it makes the "smart" contracts unenforcable.
- nneonneo 10y ago
  I find it truly amazing that a project with hundreds of millions of dollars at stake could have such a simple bug. After they discovered the first bug, it seems like they should have sat down to carefully audit all other places where that could happen - because it seems like the attackers certainly did! From reading the article on Smart Contract security (https://blog.ethereum.org/2016/06/10/smart-contract-security/ https://blog.ethereum.org/2016/06/10/smart-contract-security...), I get the feeling that the programming model might be somewhat to blame. The "obvious" ways of implementing something are subtly broken, in ways that are very difficult to anticipate without a very deep understanding of the protocol. The programming model demands that the program be capable of calling functions that are not under the programmer's control, and which can do nearly anything. This is very, very difficult to get right, and very easy to screw up, as anyone who has tried to write a sandbox environment can attest to.
OscarCunningham 10y ago
Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it
- buttershakes 10y ago
  Or, they could just plow that currency into BTC at diminishing value as fast as possible. That's presumably what I would do if I discovered a bug like this and wanted to make bank.
- lazaroclapp 10y ago
  I think they could also be shorting ETH, in dollars/euros/rubles/yuans, in which case destroying the currency would be excellent business for them, even if they can't extract what they stole.
  - brohee 10y ago
    Any (presumably buoyant) entity actually offering that possibility?
    - deleted 10y ago
      [deleted]
    - forgotpwtomain 10y ago
      Poloniex seems to be the exchange with the largest volume (I somehow doubt anyone is buying long-positions larger than that) - so it looks like they could at least cash out several thousand bitcoins - although it's been a while since I've been on their site and if they offer API access some of those positions might be automatically diverted as the price moves. [0] http://coinmarketcap.com/currencies/ethereum/#markets http://coinmarketcap.com/currencies/ethereum/#markets [1] https://poloniex.com/exchange#btc_eth https://poloniex.com/exchange#btc_eth
      - tinkerrr 10y ago
ThomasRooney 10y ago
- I don't think there's any definitive details yet, but it could be an instance of this attack [1]. The code behind the DAO is available here [2]. Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open. - Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inverse a hash" type of problem. - People lose if they're holding a long position on ETH, or have DAO which they can now no longer recoup to ETH. People gain if they're shorting ETH, or are the attacker themselves (it looks like the ETH from the dao is going to this address [4]) - Looks to be an existential threat to the DAO from where we're standing right now. I can't see any mitigations but an entire Ethereum blockchain split. [1] https://blog.slock.it/no-dao-funds-at-risk-following-the-ethereum-smart-contract-recursive-call-bug-discovery-29f482d348b#.b5al1f7i7 https://blog.slock.it/no-dao-funds-at-risk-following-the-eth... [2] https://github.com/slockit/DAO/blob/develop/DAO.sol https://github.com/slockit/DAO/blob/develop/DAO.sol [3] http://pastebin.com/DykumjLs http://pastebin.com/DykumjLs [4] http://etherscan.io/address/0x304a554a310c7e546dfe434669c62820b7d83490 http://etherscan.io/address/0x304a554a310c7e546dfe434669c628...
- makomk 10y ago
  This is astonishing. The company behind the DAO knew that the bug in question affected withdrawals from the DAO rewards balance and wrote a blog post saying this isn't an issue because it's empty, but either didn't bother checking whether withdrawals of of people's original capital through the splitDAO mechanism (which is possible) had the same bug, or did and pretended it didn't exist and everyone's funds were fine.
- nneonneo 10y ago
  Ah, I see: the money isn't missing, it's just gone to an unknown party (the hacker) - so we're practically watching a bank heist in progress, where the "good guys" are trying to slow down the robber's getaway vehicle (by flooding the transaction network). I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546dfe434669c62820b7d83490 https://live.ether.camp/account/304a554a310c7e546dfe434669c6..., I can see that most of the transactions are internal, with the API reporting monotonically increasing call-depth values. It seems like there are three recursive calls involved here: one call in the DAO, a second call to transfer money to the attacker, and a third "dummy" call which appears to transfer nothing (but presumably kicks off the next recursion into the DAO). The scary thing, to me, is that someone else could figure out the bug right now and start exploiting it - presumably, all the relevant code is open source.
a2800276 10y ago
> - At a high level, what does this attack actually consist of? At a high level, The Dao is like Pokemon. Casual observation suggests that it may be a more or less consistent world internally and that a lot of people are very excited about it. A few of those people even claim to fully understand how it works. But there's a lot of fat guys with acne blindly spending on Pokemon cards thinking it's a wise investment. Unfortunately, the fans are so excited that they jump up and down clapping all the time and forget to breath while they're talking. This makes it very difficult to understand what they're trying to say. If you manage to understand, you will hear something like: "Most Pokémon have only one type. However, EX Team Magma vs Team Aqua introduced Dual-type Pokémon, which have two different types. For a while, all existing dual-type cards had either Darkness or Metal as their secondary type, with the exception of certain Pokémon cards with the Dual Armor Poké-Body, such as Medicham from the EX Crystal Guardians expansion, which can have multiple types when certain energy are attached." Now what possibly happened during the attack is that Pokemon cards are spontaneously catching fire! This is particularly troubling, because Pokemon just came out with a super-duper fire defence card and told everyone to buy it for lots and lots of money. And everybody did. Now while all of this is clearly very troubling for heavily invested Pokemon fans. But in the grand scheme of things, well a butterfly flapped it's wings in China: there's a theoretical possibility that this affects anything, but in practice no one but fans cares. > - How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints? 1. keep the exp you earned 2. lose some money 3. wind back at the pokemon center at the pokemon league 4. have to start over on the e4 > Who loses and who gains from an attack of this scale? Pokemon fans, obviously. > How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)? Synchronoise when used by Pokémon like Umbreon. It deals damage to every Pokémon that shares the user's type, so in Umbreon's case it hits every Dark type Pokémon. Only it doesn't, because it's a Psychic move and always fails.
- seibelj 10y ago
  Finally, an explanation of ethereum that makes sense!
- to3m 10y ago
  Ah, thanks... I think I understand Pokemon now.
sctb 10y ago
We merged the earlier thread which linked to the transaction list (https://news.ycombinator.com/item?id=11921216 https://news.ycombinator.com/item?id=11921216) with this one, which has more context.
- fudged71 10y ago
  Here is a message from the attacker, I'm not sure if it was posted elsewhere http://blockchainforum.info/t/time-for-a-big-bank-roll-after-many-days/184 http://blockchainforum.info/t/time-for-a-big-bank-roll-after...

jabgrabdthrow 10y ago

It's a reentry bug - native ETH always calls the recipient contract's code on transfer, which can call back into the current function. If you manage native ETH do accounting in the wrong order, you can "withdraw" multiple times. It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder some of the coins). Watch for a wave of rebranding. > How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)? We will see. The group behind TheDAO has a lot of pull - if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept. > How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected? Why, take a look: https://blog.slock.it/no-dao-funds-at-risk-following-the-ethereum-smart-contract-recursive-call-bug-discovery-29f482d348b#.skdl752nu https://blog.slock.it/no-dao-funds-at-risk-following-the-eth... Copied: """ No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery Our team is blessed to have Dr. Christian Reitwießner, Father of Solidity, as its Advisor. During the early development of the DAO Framework 1.1 and thanks to his guidance we were made aware of a generic vulnerability common to all Ethereum smart contracts. We promptly circumvented this so-called “recursive call vulnerability” or “race to empty” from the DAO Framework 1.1 as can be seen on line 580: // we are setting this here before the CALL() value transfer to // assure that in the case of a malicious recipient contract trying // to call executeProposal() recursively money can’t be transferred // multiple times out of the DAO p.proposalPassed = true; Three days ago this design vulnerability potential was raised in a blog post which subsequently led to the discovery of such an issue in an unrelated project, MakerDAO. This was highlighted in a reddit post, with MakerDAO being able to drain their own funds safely before the vulnerability could be exploited. Around 12 hours ago user Eththrowa on the DAOHub Forum spotted that while we had identified the vulnerability in one aspect of the DAO Framework, the existing (and deployed) DAO reward account mechanism was affected. His message and our prompt confirmation can be found here. We issued a fix immediately as part of the DAO Framework 1.1 milestone. The important takeaway from this is: as there is no ether whatsoever in the DAO’s rewards account — this is NOT an issue that is putting any DAO funds at risk today. """

joosters 10y ago
Slock.it are the cheerleaders of the DAO (and were the likely recipients of its funds had it not been hacked). They previously boasted about how their audit of the code found no issues other than a slight rounding error if the DAO became worth trillions of dollars. It's entirely in character for them to post further messages reporting how wonderful, secure and perfect their code is, in the face of terrible problems.
jpereira 10y ago
In my understanding the attack vector was anticipated for the executeProposal() function, but the attacker is using a recursive call of the splitDAO() function. This blog post[1] from the Ethereum Team describes the possible attack. [1]https://blog.ethereum.org/2016/06/10/smart-contract-security/ https://blog.ethereum.org/2016/06/10/smart-contract-security...
tomp 10y ago
> if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept. I guess if Ethereum makes a hard fork, that will damage it much more - basically, it makes the "smart" contracts unenforcable.
nneonneo 10y ago
I find it truly amazing that a project with hundreds of millions of dollars at stake could have such a simple bug. After they discovered the first bug, it seems like they should have sat down to carefully audit all other places where that could happen - because it seems like the attackers certainly did! From reading the article on Smart Contract security (https://blog.ethereum.org/2016/06/10/smart-contract-security/ https://blog.ethereum.org/2016/06/10/smart-contract-security...), I get the feeling that the programming model might be somewhat to blame. The "obvious" ways of implementing something are subtly broken, in ways that are very difficult to anticipate without a very deep understanding of the protocol. The programming model demands that the program be capable of calling functions that are not under the programmer's control, and which can do nearly anything. This is very, very difficult to get right, and very easy to screw up, as anyone who has tried to write a sandbox environment can attest to.

OscarCunningham 10y ago

Presumably the attacker will stop short of doing anything that would completely destroy the currency, since they now own a lot of it

buttershakes 10y ago
Or, they could just plow that currency into BTC at diminishing value as fast as possible. That's presumably what I would do if I discovered a bug like this and wanted to make bank.
lazaroclapp 10y ago
I think they could also be shorting ETH, in dollars/euros/rubles/yuans, in which case destroying the currency would be excellent business for them, even if they can't extract what they stole.
- brohee 10y ago
  Any (presumably buoyant) entity actually offering that possibility?
  - deleted 10y ago
    [deleted]
  - forgotpwtomain 10y ago
    Poloniex seems to be the exchange with the largest volume (I somehow doubt anyone is buying long-positions larger than that) - so it looks like they could at least cash out several thousand bitcoins - although it's been a while since I've been on their site and if they offer API access some of those positions might be automatically diverted as the price moves. [0] http://coinmarketcap.com/currencies/ethereum/#markets http://coinmarketcap.com/currencies/ethereum/#markets [1] https://poloniex.com/exchange#btc_eth https://poloniex.com/exchange#btc_eth
    - tinkerrr 10y ago

ThomasRooney 10y ago

- I don't think there's any definitive details yet, but it could be an instance of this attack [1]. The code behind the DAO is available here [2]. Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open. - Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inverse a hash" type of problem. - People lose if they're holding a long position on ETH, or have DAO which they can now no longer recoup to ETH. People gain if they're shorting ETH, or are the attacker themselves (it looks like the ETH from the dao is going to this address [4]) - Looks to be an existential threat to the DAO from where we're standing right now. I can't see any mitigations but an entire Ethereum blockchain split. [1] https://blog.slock.it/no-dao-funds-at-risk-following-the-ethereum-smart-contract-recursive-call-bug-discovery-29f482d348b#.b5al1f7i7 https://blog.slock.it/no-dao-funds-at-risk-following-the-eth... [2] https://github.com/slockit/DAO/blob/develop/DAO.sol https://github.com/slockit/DAO/blob/develop/DAO.sol [3] http://pastebin.com/DykumjLs http://pastebin.com/DykumjLs [4] http://etherscan.io/address/0x304a554a310c7e546dfe434669c62820b7d83490 http://etherscan.io/address/0x304a554a310c7e546dfe434669c628...

makomk 10y ago
This is astonishing. The company behind the DAO knew that the bug in question affected withdrawals from the DAO rewards balance and wrote a blog post saying this isn't an issue because it's empty, but either didn't bother checking whether withdrawals of of people's original capital through the splitDAO mechanism (which is possible) had the same bug, or did and pretended it didn't exist and everyone's funds were fine.
nneonneo 10y ago
Ah, I see: the money isn't missing, it's just gone to an unknown party (the hacker) - so we're practically watching a bank heist in progress, where the "good guys" are trying to slow down the robber's getaway vehicle (by flooding the transaction network). I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546dfe434669c62820b7d83490 https://live.ether.camp/account/304a554a310c7e546dfe434669c6..., I can see that most of the transactions are internal, with the API reporting monotonically increasing call-depth values. It seems like there are three recursive calls involved here: one call in the DAO, a second call to transfer money to the attacker, and a third "dummy" call which appears to transfer nothing (but presumably kicks off the next recursion into the DAO). The scary thing, to me, is that someone else could figure out the bug right now and start exploiting it - presumably, all the relevant code is open source.

a2800276 10y ago

> - At a high level, what does this attack actually consist of? At a high level, The Dao is like Pokemon. Casual observation suggests that it may be a more or less consistent world internally and that a lot of people are very excited about it. A few of those people even claim to fully understand how it works. But there's a lot of fat guys with acne blindly spending on Pokemon cards thinking it's a wise investment. Unfortunately, the fans are so excited that they jump up and down clapping all the time and forget to breath while they're talking. This makes it very difficult to understand what they're trying to say. If you manage to understand, you will hear something like: "Most Pokémon have only one type. However, EX Team Magma vs Team Aqua introduced Dual-type Pokémon, which have two different types. For a while, all existing dual-type cards had either Darkness or Metal as their secondary type, with the exception of certain Pokémon cards with the Dual Armor Poké-Body, such as Medicham from the EX Crystal Guardians expansion, which can have multiple types when certain energy are attached." Now what possibly happened during the attack is that Pokemon cards are spontaneously catching fire! This is particularly troubling, because Pokemon just came out with a super-duper fire defence card and told everyone to buy it for lots and lots of money. And everybody did. Now while all of this is clearly very troubling for heavily invested Pokemon fans. But in the grand scheme of things, well a butterfly flapped it's wings in China: there's a theoretical possibility that this affects anything, but in practice no one but fans cares. > - How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints? 1. keep the exp you earned 2. lose some money 3. wind back at the pokemon center at the pokemon league 4. have to start over on the e4 > Who loses and who gains from an attack of this scale? Pokemon fans, obviously. > How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)? Synchronoise when used by Pokémon like Umbreon. It deals damage to every Pokémon that shares the user's type, so in Umbreon's case it hits every Dark type Pokémon. Only it doesn't, because it's a Psychic move and always fails.

seibelj 10y ago
Finally, an explanation of ethereum that makes sense!
to3m 10y ago
Ah, thanks... I think I understand Pokemon now.

sctb 10y ago

We merged the earlier thread which linked to the transaction list (https://news.ycombinator.com/item?id=11921216 https://news.ycombinator.com/item?id=11921216) with this one, which has more context.

fudged71 10y ago
Here is a message from the attacker, I'm not sure if it was posted elsewhere http://blockchainforum.info/t/time-for-a-big-bank-roll-after-many-days/184 http://blockchainforum.info/t/time-for-a-big-bank-roll-after...