15 ms·

DAOs, Hacks and the Law

216 points by ikeboy 10y ago

dang 10y ago
Url changed from http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-smart-contracts-were-dumb http://www.bloomberg.com/view/articles/2016-06-17/blockchain..., which points to this, which is arguably a dupe of https://news.ycombinator.com/item?id=11921900 https://news.ycombinator.com/item?id=11921900, but if people want to discuss it separately we'll leave it up.
- mikeyouse 10y ago
  For those looking to know more about how the DAO will actually interact with the 'real world', I'd suggest reading the Bloomberg link too -- Matt Levine is an excellent writer with a history on Wall St. as an M&A lawyer and an I-Banker, so he definitely knows what he's talking about.
- deleted 10y ago
  [deleted]
jacques_chester 10y ago
I have to admit, I share some of the author's smugness. The world is very, very complex. That is why the law is very, very complex. It covers everything humans do, have done, or will do. Alone, together, in small groups or large groups. As private individuals or public bodies. With real objects or imaginary objects. In their homes, on the street, in public buildings, in private parks. On the ground, under the ground, on the water, under the water, in the air, in orbit, out to the limits of human space. Every day people come to the courts with potentially totally novel combinations of people and events, and the courts guarantee they will make a decision. The courts have been doing this for nearly a thousand years and are still chugging along solving new problems. This should indicate that this is not a permanently solvable problem. The law is an adaptive, dynamic system. All of this is why, as a software engineer who once studied (and mercifully quit) law, I am sometimes bemused by the idea that bodies of law can be ignored or swept away by code. The law doesn't see it that way and in this game, the law gets the final move.
- anaphor 10y ago
  Yeah, I think there would need to at the very least be some sort of artificial general intelligence capable of applying the existing body of law to new situations. I.e. able to take penumbral cases and work them out in a way we would consider reasonable, which isn't going to happen any time soon. https://en.wikipedia.org/wiki/Penumbra_(law) https://en.wikipedia.org/wiki/Penumbra_(law)
- Jd 10y ago
  Author here. I'm "smug" in the sense that I've made all of the mistakes of the DAO folks and many more beside. One of them was optimistically assuming that many more things could be done in an extralegal context than actually turned out to be feasible. See for example this "smug" post that I was (correctly) critiqued for 868 days ago: https://news.ycombinator.com/item?id=7155644 https://news.ycombinator.com/item?id=7155644 Note the comment here re: "this guy does not understand how the world actually works": https://news.ycombinator.com/item?id=7155872 https://news.ycombinator.com/item?id=7155872 With the updated forced learning curve on the legal system actually works over the last two years I've learn that a lot o what I previously viewed as cruft in the legal system is actually the complex adjudication of edge cases similar to what we see in well architected and executed software tests. Missed div by zero can bring your whole system down. Forgetting the right clause in a contract can in a multi-million dollar deal as well.
- foota 10y ago
  I'm likely going to be a software engineer after graduating next year with a degree in math, cs, and economics, but I am also vaguely considering going into law (whatever that means, I don't really know) could you share why you say mercifully and what drew you away from it please?
- ars 10y ago
  > The courts have been doing this for nearly a thousand years The courts have been doing this for over five thousand years! Since the beginning of recorded human history. And they have been doing it using basically the same legal ideas we use today - only the details on what the laws are differ. (Did you have a particular event in mind to say "nearly a thousand years"?)
jabgrabdthrow 10y ago
My favorite is how quick Bootlicker Tual showed us all he doesn't give a shit about the principles he's been pumping to sell ethereum and THE
- dang 10y ago
  Personal attacks and name-calling aren't allowed in HN comments. You've posted quite a few uncivil comments to HN, unfortunately. Please don't do that anymore. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html
brianpgordon 10y ago
> according to the DAO’s own legal contract Why does it even matter what's on the DAO's website? They don't control the DAO, and you don't need to have gone through the DAO website to have invested in the original offering or in the spot market afterwards. What legal force would their website have anyway?
stevecalifornia 10y ago
"DAO, I closely read your contract and agreed to execute the clause where I can withdraw eth repeatedly and only be charged for my initial withdraw. Thank you for the $70 million. Let me know if you draw up any other contracts I can participate in. Regards, 0x304a554a310c7e546dfe434669c62820b7d83490"
- will_brown 10y ago
  That is the legal argument the article presents, but it is wrong. Here is a quick legal analysis: Contracts that include illegal activities, such as theft, are unenforceable. If the hacked funds get released the whole of the DAO would be legally invalid. In other words what stopped an investor from day 1 from suing the creators of the DAO in court to get their investment back? Well the fact that there was a contract in place and that contract/DAO had not been breached, meaning the investor would lose such a lawsuit. The argument from the article is suggesting even with the hack the same is true, because its part of the contract; therefore, the contract/DAO hasn't been breached. That is where the legal argument fails. Try contracting for any other illegal activity and see how that works out enforcing it in court. "Your Honor, I have a contract right here that says I paid for the drugs but they weren't delivered." Just imagine, "Your Honor, the contract/DAO says any member can create a child DAO and steal the funds from the other investors/party to the contract...Judge they contracted to be stolen from." I am predicting right now if any of those funds get released as a result of this hack, there will be criminal charges, but it will just as likely be against the creators of the DAO as the hacker. They are not shielded from liability, civilly or criminally, because the victims agreed to be victimized in a contract. As a lawyer I have called the DAO snake oil[1] from the beginning, but mostly because it sold itself as something new legally...which it is not (of course I was downvoted). I suggested if you like the concept of a DAO, great, but start your own that is true decentralization as it really isn't much more than an Investment Club LLC. And more controversial I challenged the charade of the smart contract, again not as a concept, because they do have value legally and otherwise, but as what the DAO sold smart contracts as...a self enforcing contract, that is bullshit any real world example anyone can give me I'll come up with a real world way to breach it. 20 days ago I suggested the first DAO proposal should create: a) a group of lawyers/coders to review all proposed and funded contracts for approval; and b) an insurance company to insure both approved proposed and funded DAO contracts in the instance of bugs/errors.[2] If these hacked funds don't get released and that is not the first step members of the DAO take after cleaning up the actual DAO framework, everyone deserves the next hack. [1] https://news.ycombinator.com/item?id=11707497 https://news.ycombinator.com/item?id=11707497 [2] https://news.ycombinator.com/item?id=11789829 https://news.ycombinator.com/item?id=11789829
curiousgal 10y ago
I believe people are looking at the wrong direction. Whoever did this already made millions shorting Eth right before the "attack". https://mobile.twitter.com/EthereumWiki/status/743905989682855936 https://mobile.twitter.com/EthereumWiki/status/7439059896828...
- Bromskloss 10y ago
  Is the idea that people would lose faith in how practical smart contracts are, or why would this affect Ethereum at large?
  - patio11 10y ago
    The Ethereum team is intimately involved with the DAO, one of whose goals is demonstrating that Ethereum can be used for at least one useful purpose. To say there is a lot riding on it is an understatement.
- DennisP 10y ago
  Yes but that was after ETH went up 50% in a week, and that prompts a lot of people to short anyway.
  - dharma1 10y ago
    With 5k BTC?
api 10y ago
What would happen if the hacker went public, hired legal counsel, and asserted their right to the funds as per the terms of the contract? Now that would be interesting. I could see a top legal team taking it simply for the sake of an opportunity to set legal precedent.
- mlvljr 10y ago
  For more awesomness, imagine, the hacker turns out to be Craig Wright :)
  - jcoffland 10y ago
    He's not nearly talented enough.
    - mlvljr 10y ago
      Likes stealing, though :)
- DennisP 10y ago
  It would, but given the risk of criminal charges I don't think the hacker's likely to do that.
darawk 10y ago
As an investor in the DAO and believer in smart contracts and Ethereum, I agree with this article. I think we all got over-excited and took this way too fast. But I do think it would be a mistake to be too rash in throwing out the entire concept because of this one mistake. Will there be mistakes like this in the future? Definitely. But it is my hope that the entire cryptocurrency community will be chastened by this experience into taking things a little more slowly in the future. IMO those of us who invested in the DAO should lose our investment. We fucked up and we deserve the loss, and if people see that real money was lost, perhaps they will be more judicious in the future with their investment decisions. I certainly will be. But I don't think it makes sense to let the thief get away with the money either. I know in some sense there is a philosophical problem that the 'code is the contract' and the 'contract is the law' and therefore the code is the law, for better or worse. But IMO allowing this to happen would just be counter productive. There's no benefit to letting he (or she!) take the money and run, and quite a bit of harm to the ecosystem and probably lots of people who just held some ether and didn't invest in the DAO. I'd like this event to be seen as a learning experience. People were overzealous and they got burned. In the future, let's be more careful, but let's keep exploring the possibilities of this technology.
- maxander 10y ago
  I mean, stopping the attacker is certainly doing justice, but a soft fork of the underlying Ethereum software that targets a specific account feels like it undermines the idea of Ethereum itself. Ethereum should be a platform, and any technology platform should be simple and reliable- add in an authority's ability to push out updates that muck around with contracts directly (even if they must then be consciously accepted by end users) takes away enough simplicity and reliability that it threatens the practicality of contracts worth millions of dollars. A more principled response would be to simply shrug and say "contracts are hard, lets be extra careful in the future" and move on. An unscrupulous hacker would get rich, but if that's the worst that happens during Ethereum's bootstrap phase its an unequivocal win. Sooner or later the lesson will have to be learned, if anything like Ethereum becomes widely used.
  - darawk 10y ago
biot 10y ago
DAO needs to be battle tested in EVE Online for a year before letting loose on the real world where money is at stake. Much like ponzi schemes and other exploits of the past, the EVE Online developers just consider it part of the game. Caveat emptor.
- simcop2387 10y ago
  That's a really interesting idea, using a virtual economy to field test something like this. I was thinking about how you'd do that and actually attract attackers by having some value, using something like EVE where people are willing/wanting to do it anyway in game might work.
  - Analemma_ 10y ago
    How would this work? If you discovered an attack, what would be the incentive to not just sit on it until it was released to the real world?
    - wmf 10y ago
      In-game money (ISK) can buy influence in the social dynamics of EVE. There's also a prisoner's dilemma aspect where someone else might independently discover the same attack and use/disclose it before you get a chance to.
    - Aelinsaar 10y ago
      I think there are enough people playing EVE who would be more interested about what it would do for them in-game, that if it were something that could be discovered by more than some lone genius with an epiphany, it would come out quickly.
- Jd 10y ago
  I've been building something like this in VR.
- Retr0spectrum 10y ago
  Can't EVE currency be bought and sold for "real" money? That would mean that real money is still at stake.
sbov 10y ago
Is it just me, or would this going to court would be the worst case scenario for Ethereum? I mean, if the "hacker" wins, then it shows how impractically dangerous "code as contract" can be - you better be damn sure it's correct. And if the "hacker" loses, it invalidates code as contract completely. The DAO claimed the code, and only the code matters. But what the DAO claims doesn't mean shit if courts say that is not true. Your whole idea is now just bullshit.
- stevecalifornia 10y ago
  This contract, with this much money, needed NASA levels of QA. I cannot think of many code projects that have a higher value-per-line-of-code than this contract. Sadly, it appears that not only was there not the needed QA but the leaders of this project were alerted to the exact problem in code 5 days ago and they responded by declaring that there was no risk. The actual problem + the response makes this feel like amateur hour. Now everyone involved understands why things that exist in 'old finance' like contracts and IPOs are scrutinized by large, expensive auditors.
  - amaks 10y ago
    Exactly. DAO should have tested the shit out of their "contracts" before starting accepting people's money. Now DAO and Ethereum as result won't have any trust.
  - dangero 10y ago
    > This contract, with this much money, needed NASA levels of QA. Well, if the fork plan goes through I'd say you're wrong because it could clearly be rolled back when there was a problem. You cannot easily do that with a space shuttle.
- naasking 10y ago
  > And if the "hacker" loses, it invalidates code as contract completely. I don't think it does. You've replaced expensive legal fees with an automatically executed contract that costs you nothing after initial setup. As long as most people end up satisfied with their outcomes, then there's still great value in smart contracts for this reason alone, even if some unhappy customers still end up in court.
lpage 10y ago
Good lawyers don't write overly complicated contracts, and they don't speak in legalese. The concepts covered within the contract might be complex, but the writing itself is deliberately readable. Complex things are brittle. Clear, well written contracts are more likely to be interpreted correctly by all parties if something unforeseen happens. Contrast this to the alternative - writing a contract by enumerating every possible outcome, hoping that you don't miss one, knowing that if you do, every party will argue for the interpretation that's most favorable to them. The adversarial aspect makes things that much harder. Contracts in something as flexible as Ethereum strikes me as the ultimate in fragility. There's a great use case for anything that looks like a smallish FSM - formal methods will yield something very usable and provably correct. Being able to do that on a system with a state space the size of Ethereum + The DAO - yea, we're a ways away from that one.
noonespecial 10y ago
Sounds like a case of: https://en.wikipedia.org/wiki/Unjust_enrichment https://en.wikipedia.org/wiki/Unjust_enrichment In regular law there's actually a way to say "that's not what I meant and you knew that's not what I meant". Prove it and the law is with you.
- DannyBee 10y ago
  No, actually. Unjust enrichment explicitly applies only to the situation where no actual contract exists.
  - noonespecial 10y ago
    Oh. I was thinking it might be like this part "On this analysis, the defendant is obliged to make restitution if there is no 'basis' for her receipt: for example, because the contract under which the defendant received the benefit was void ab initio." Obviously, i wouldn't offer a contract that lets someone take an unlimited amount of money and only deduct the amount of the first transaction, and the withdrawer clearly knew this. Not true?
    - DannyBee 10y ago
      Sadly, no. First, it would not be void ab initio. Past that, your issue is that the express terms of the contract appear to allow that, so you will lose regardless of whether that was a good idea for you to do :P You could argue breach of good faith, etc, but not unjust enrichment. Like restitution, unjust enrichment is a theory of implied contracts. You can plead it and breach of express contract at the same time, but you can only recover for one, and you will not recover for unjust enrichment if the court finds an express contract.
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
deleted 10y ago
[deleted]
abalone 10y ago
This armchair legal theory is rather pleasantly eviscerated by Matt Levine today on Bloomberg.[1] In short, you do not get immunity from real world contract law with a one paragraph disclaimer. [1] "Blockchain Company's Smart Contracts Were Dumb" http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-smart-contracts-were-dumb http://www.bloomberg.com/view/articles/2016-06-17/blockchain...
- lpage 10y ago
  Previous discussion on HN - not sure why it got killed as a dupe: https://news.ycombinator.com/item?id=11926084 https://news.ycombinator.com/item?id=11926084
- kristofferR 10y ago
  I'm really confused. So Slock.it (DAO) made their "customers" sign a contract/terms that contradicted their marketing of the DAO. Because the marketing takes precedence the contract would likely be declared invalid in a court. Usually when a contract is declared invalid it's because it tricks the customers and benefits the creators of the contract, but in this case the invalidation seems to benefit both. However, what if I actually read the contract and only became "a customer" because of the content of the contract? It seems weird if it would be my responsibility as a customer to verify that they didn't advertise the content of the contract is misleading ways elsewhere.
  - abalone 10y ago
    So you're asking what if a customer signs a contract with hidden fatally exploitable flaws, but that is the reason why they signed it? It's a nonsensical scenario. The general investor population does not intend to enter into such contracts, and that is who contract law seeks to protect.
    - Natanael_L 10y ago
      But what if they market only to those who do?
    - 10y ago
baby 10y ago
Interestingly, this story has attracted numerous people to Ethereum. It was a pricey advertising but it worked.
_bdog 10y ago
An exam-question a german lawyer told me to illustrate how layman's understanding of law and expectation of logic therein often doesn't apply: "Your employer tells you to break into an opponent's office and steal something. You do that, jump out of the window and break a leg. Is your workplace insurance legally obliged to cover the medical cost?"
- _98fj 10y ago
  (the answer is yes)

216 points by ikeboy 10y ago

dang 10y ago

Url changed from http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-smart-contracts-were-dumb http://www.bloomberg.com/view/articles/2016-06-17/blockchain..., which points to this, which is arguably a dupe of https://news.ycombinator.com/item?id=11921900 https://news.ycombinator.com/item?id=11921900, but if people want to discuss it separately we'll leave it up.

mikeyouse 10y ago
For those looking to know more about how the DAO will actually interact with the 'real world', I'd suggest reading the Bloomberg link too -- Matt Levine is an excellent writer with a history on Wall St. as an M&A lawyer and an I-Banker, so he definitely knows what he's talking about.
deleted 10y ago
[deleted]

jacques_chester 10y ago

I have to admit, I share some of the author's smugness. The world is very, very complex. That is why the law is very, very complex. It covers everything humans do, have done, or will do. Alone, together, in small groups or large groups. As private individuals or public bodies. With real objects or imaginary objects. In their homes, on the street, in public buildings, in private parks. On the ground, under the ground, on the water, under the water, in the air, in orbit, out to the limits of human space. Every day people come to the courts with potentially totally novel combinations of people and events, and the courts guarantee they will make a decision. The courts have been doing this for nearly a thousand years and are still chugging along solving new problems. This should indicate that this is not a permanently solvable problem. The law is an adaptive, dynamic system. All of this is why, as a software engineer who once studied (and mercifully quit) law, I am sometimes bemused by the idea that bodies of law can be ignored or swept away by code. The law doesn't see it that way and in this game, the law gets the final move.

anaphor 10y ago
Yeah, I think there would need to at the very least be some sort of artificial general intelligence capable of applying the existing body of law to new situations. I.e. able to take penumbral cases and work them out in a way we would consider reasonable, which isn't going to happen any time soon. https://en.wikipedia.org/wiki/Penumbra_(law) https://en.wikipedia.org/wiki/Penumbra_(law)
Jd 10y ago
Author here. I'm "smug" in the sense that I've made all of the mistakes of the DAO folks and many more beside. One of them was optimistically assuming that many more things could be done in an extralegal context than actually turned out to be feasible. See for example this "smug" post that I was (correctly) critiqued for 868 days ago: https://news.ycombinator.com/item?id=7155644 https://news.ycombinator.com/item?id=7155644 Note the comment here re: "this guy does not understand how the world actually works": https://news.ycombinator.com/item?id=7155872 https://news.ycombinator.com/item?id=7155872 With the updated forced learning curve on the legal system actually works over the last two years I've learn that a lot o what I previously viewed as cruft in the legal system is actually the complex adjudication of edge cases similar to what we see in well architected and executed software tests. Missed div by zero can bring your whole system down. Forgetting the right clause in a contract can in a multi-million dollar deal as well.
foota 10y ago
I'm likely going to be a software engineer after graduating next year with a degree in math, cs, and economics, but I am also vaguely considering going into law (whatever that means, I don't really know) could you share why you say mercifully and what drew you away from it please?
ars 10y ago
> The courts have been doing this for nearly a thousand years The courts have been doing this for over five thousand years! Since the beginning of recorded human history. And they have been doing it using basically the same legal ideas we use today - only the details on what the laws are differ. (Did you have a particular event in mind to say "nearly a thousand years"?)

jabgrabdthrow 10y ago

My favorite is how quick Bootlicker Tual showed us all he doesn't give a shit about the principles he's been pumping to sell ethereum and THE

dang 10y ago
Personal attacks and name-calling aren't allowed in HN comments. You've posted quite a few uncivil comments to HN, unfortunately. Please don't do that anymore. https://news.ycombinator.com/newsguidelines.html https://news.ycombinator.com/newsguidelines.html

brianpgordon 10y ago

> according to the DAO’s own legal contract Why does it even matter what's on the DAO's website? They don't control the DAO, and you don't need to have gone through the DAO website to have invested in the original offering or in the spot market afterwards. What legal force would their website have anyway?

stevecalifornia 10y ago

"DAO, I closely read your contract and agreed to execute the clause where I can withdraw eth repeatedly and only be charged for my initial withdraw. Thank you for the $70 million. Let me know if you draw up any other contracts I can participate in. Regards, 0x304a554a310c7e546dfe434669c62820b7d83490"

will_brown 10y ago
That is the legal argument the article presents, but it is wrong. Here is a quick legal analysis: Contracts that include illegal activities, such as theft, are unenforceable. If the hacked funds get released the whole of the DAO would be legally invalid. In other words what stopped an investor from day 1 from suing the creators of the DAO in court to get their investment back? Well the fact that there was a contract in place and that contract/DAO had not been breached, meaning the investor would lose such a lawsuit. The argument from the article is suggesting even with the hack the same is true, because its part of the contract; therefore, the contract/DAO hasn't been breached. That is where the legal argument fails. Try contracting for any other illegal activity and see how that works out enforcing it in court. "Your Honor, I have a contract right here that says I paid for the drugs but they weren't delivered." Just imagine, "Your Honor, the contract/DAO says any member can create a child DAO and steal the funds from the other investors/party to the contract...Judge they contracted to be stolen from." I am predicting right now if any of those funds get released as a result of this hack, there will be criminal charges, but it will just as likely be against the creators of the DAO as the hacker. They are not shielded from liability, civilly or criminally, because the victims agreed to be victimized in a contract. As a lawyer I have called the DAO snake oil[1] from the beginning, but mostly because it sold itself as something new legally...which it is not (of course I was downvoted). I suggested if you like the concept of a DAO, great, but start your own that is true decentralization as it really isn't much more than an Investment Club LLC. And more controversial I challenged the charade of the smart contract, again not as a concept, because they do have value legally and otherwise, but as what the DAO sold smart contracts as...a self enforcing contract, that is bullshit any real world example anyone can give me I'll come up with a real world way to breach it. 20 days ago I suggested the first DAO proposal should create: a) a group of lawyers/coders to review all proposed and funded contracts for approval; and b) an insurance company to insure both approved proposed and funded DAO contracts in the instance of bugs/errors.[2] If these hacked funds don't get released and that is not the first step members of the DAO take after cleaning up the actual DAO framework, everyone deserves the next hack. [1] https://news.ycombinator.com/item?id=11707497 https://news.ycombinator.com/item?id=11707497 [2] https://news.ycombinator.com/item?id=11789829 https://news.ycombinator.com/item?id=11789829

curiousgal 10y ago

I believe people are looking at the wrong direction. Whoever did this already made millions shorting Eth right before the "attack". https://mobile.twitter.com/EthereumWiki/status/743905989682855936 https://mobile.twitter.com/EthereumWiki/status/7439059896828...

Bromskloss 10y ago
Is the idea that people would lose faith in how practical smart contracts are, or why would this affect Ethereum at large?
- patio11 10y ago
  The Ethereum team is intimately involved with the DAO, one of whose goals is demonstrating that Ethereum can be used for at least one useful purpose. To say there is a lot riding on it is an understatement.
DennisP 10y ago
Yes but that was after ETH went up 50% in a week, and that prompts a lot of people to short anyway.
- dharma1 10y ago
  With 5k BTC?

api 10y ago

What would happen if the hacker went public, hired legal counsel, and asserted their right to the funds as per the terms of the contract? Now that would be interesting. I could see a top legal team taking it simply for the sake of an opportunity to set legal precedent.

mlvljr 10y ago
For more awesomness, imagine, the hacker turns out to be Craig Wright :)
- jcoffland 10y ago
  He's not nearly talented enough.
  - mlvljr 10y ago
    Likes stealing, though :)
DennisP 10y ago
It would, but given the risk of criminal charges I don't think the hacker's likely to do that.

darawk 10y ago

As an investor in the DAO and believer in smart contracts and Ethereum, I agree with this article. I think we all got over-excited and took this way too fast. But I do think it would be a mistake to be too rash in throwing out the entire concept because of this one mistake. Will there be mistakes like this in the future? Definitely. But it is my hope that the entire cryptocurrency community will be chastened by this experience into taking things a little more slowly in the future. IMO those of us who invested in the DAO should lose our investment. We fucked up and we deserve the loss, and if people see that real money was lost, perhaps they will be more judicious in the future with their investment decisions. I certainly will be. But I don't think it makes sense to let the thief get away with the money either. I know in some sense there is a philosophical problem that the 'code is the contract' and the 'contract is the law' and therefore the code is the law, for better or worse. But IMO allowing this to happen would just be counter productive. There's no benefit to letting he (or she!) take the money and run, and quite a bit of harm to the ecosystem and probably lots of people who just held some ether and didn't invest in the DAO. I'd like this event to be seen as a learning experience. People were overzealous and they got burned. In the future, let's be more careful, but let's keep exploring the possibilities of this technology.

maxander 10y ago
I mean, stopping the attacker is certainly doing justice, but a soft fork of the underlying Ethereum software that targets a specific account feels like it undermines the idea of Ethereum itself. Ethereum should be a platform, and any technology platform should be simple and reliable- add in an authority's ability to push out updates that muck around with contracts directly (even if they must then be consciously accepted by end users) takes away enough simplicity and reliability that it threatens the practicality of contracts worth millions of dollars. A more principled response would be to simply shrug and say "contracts are hard, lets be extra careful in the future" and move on. An unscrupulous hacker would get rich, but if that's the worst that happens during Ethereum's bootstrap phase its an unequivocal win. Sooner or later the lesson will have to be learned, if anything like Ethereum becomes widely used.
- darawk 10y ago

biot 10y ago

DAO needs to be battle tested in EVE Online for a year before letting loose on the real world where money is at stake. Much like ponzi schemes and other exploits of the past, the EVE Online developers just consider it part of the game. Caveat emptor.

simcop2387 10y ago
That's a really interesting idea, using a virtual economy to field test something like this. I was thinking about how you'd do that and actually attract attackers by having some value, using something like EVE where people are willing/wanting to do it anyway in game might work.
- Analemma_ 10y ago
  How would this work? If you discovered an attack, what would be the incentive to not just sit on it until it was released to the real world?
  - wmf 10y ago
    In-game money (ISK) can buy influence in the social dynamics of EVE. There's also a prisoner's dilemma aspect where someone else might independently discover the same attack and use/disclose it before you get a chance to.
  - Aelinsaar 10y ago
    I think there are enough people playing EVE who would be more interested about what it would do for them in-game, that if it were something that could be discovered by more than some lone genius with an epiphany, it would come out quickly.
Jd 10y ago
I've been building something like this in VR.
Retr0spectrum 10y ago
Can't EVE currency be bought and sold for "real" money? That would mean that real money is still at stake.

sbov 10y ago

Is it just me, or would this going to court would be the worst case scenario for Ethereum? I mean, if the "hacker" wins, then it shows how impractically dangerous "code as contract" can be - you better be damn sure it's correct. And if the "hacker" loses, it invalidates code as contract completely. The DAO claimed the code, and only the code matters. But what the DAO claims doesn't mean shit if courts say that is not true. Your whole idea is now just bullshit.

stevecalifornia 10y ago
This contract, with this much money, needed NASA levels of QA. I cannot think of many code projects that have a higher value-per-line-of-code than this contract. Sadly, it appears that not only was there not the needed QA but the leaders of this project were alerted to the exact problem in code 5 days ago and they responded by declaring that there was no risk. The actual problem + the response makes this feel like amateur hour. Now everyone involved understands why things that exist in 'old finance' like contracts and IPOs are scrutinized by large, expensive auditors.
- amaks 10y ago
  Exactly. DAO should have tested the shit out of their "contracts" before starting accepting people's money. Now DAO and Ethereum as result won't have any trust.
- dangero 10y ago
  > This contract, with this much money, needed NASA levels of QA. Well, if the fork plan goes through I'd say you're wrong because it could clearly be rolled back when there was a problem. You cannot easily do that with a space shuttle.
naasking 10y ago
> And if the "hacker" loses, it invalidates code as contract completely. I don't think it does. You've replaced expensive legal fees with an automatically executed contract that costs you nothing after initial setup. As long as most people end up satisfied with their outcomes, then there's still great value in smart contracts for this reason alone, even if some unhappy customers still end up in court.

lpage 10y ago

Good lawyers don't write overly complicated contracts, and they don't speak in legalese. The concepts covered within the contract might be complex, but the writing itself is deliberately readable. Complex things are brittle. Clear, well written contracts are more likely to be interpreted correctly by all parties if something unforeseen happens. Contrast this to the alternative - writing a contract by enumerating every possible outcome, hoping that you don't miss one, knowing that if you do, every party will argue for the interpretation that's most favorable to them. The adversarial aspect makes things that much harder. Contracts in something as flexible as Ethereum strikes me as the ultimate in fragility. There's a great use case for anything that looks like a smallish FSM - formal methods will yield something very usable and provably correct. Being able to do that on a system with a state space the size of Ethereum + The DAO - yea, we're a ways away from that one.

noonespecial 10y ago

Sounds like a case of: https://en.wikipedia.org/wiki/Unjust_enrichment https://en.wikipedia.org/wiki/Unjust_enrichment In regular law there's actually a way to say "that's not what I meant and you knew that's not what I meant". Prove it and the law is with you.

DannyBee 10y ago
No, actually. Unjust enrichment explicitly applies only to the situation where no actual contract exists.
- noonespecial 10y ago
  Oh. I was thinking it might be like this part "On this analysis, the defendant is obliged to make restitution if there is no 'basis' for her receipt: for example, because the contract under which the defendant received the benefit was void ab initio." Obviously, i wouldn't offer a contract that lets someone take an unlimited amount of money and only deduct the amount of the first transaction, and the withdrawer clearly knew this. Not true?
  - DannyBee 10y ago
    Sadly, no. First, it would not be void ab initio. Past that, your issue is that the express terms of the contract appear to allow that, so you will lose regardless of whether that was a good idea for you to do :P You could argue breach of good faith, etc, but not unjust enrichment. Like restitution, unjust enrichment is a theory of implied contracts. You can plead it and breach of express contract at the same time, but you can only recover for one, and you will not recover for unjust enrichment if the court finds an express contract.

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

deleted 10y ago

[deleted]

abalone 10y ago

This armchair legal theory is rather pleasantly eviscerated by Matt Levine today on Bloomberg.[1] In short, you do not get immunity from real world contract law with a one paragraph disclaimer. [1] "Blockchain Company's Smart Contracts Were Dumb" http://www.bloomberg.com/view/articles/2016-06-17/blockchain-company-s-smart-contracts-were-dumb http://www.bloomberg.com/view/articles/2016-06-17/blockchain...

lpage 10y ago
Previous discussion on HN - not sure why it got killed as a dupe: https://news.ycombinator.com/item?id=11926084 https://news.ycombinator.com/item?id=11926084
kristofferR 10y ago
I'm really confused. So Slock.it (DAO) made their "customers" sign a contract/terms that contradicted their marketing of the DAO. Because the marketing takes precedence the contract would likely be declared invalid in a court. Usually when a contract is declared invalid it's because it tricks the customers and benefits the creators of the contract, but in this case the invalidation seems to benefit both. However, what if I actually read the contract and only became "a customer" because of the content of the contract? It seems weird if it would be my responsibility as a customer to verify that they didn't advertise the content of the contract is misleading ways elsewhere.
- abalone 10y ago
  So you're asking what if a customer signs a contract with hidden fatally exploitable flaws, but that is the reason why they signed it? It's a nonsensical scenario. The general investor population does not intend to enter into such contracts, and that is who contract law seeks to protect.
  - Natanael_L 10y ago
    But what if they market only to those who do?
  - 10y ago

baby 10y ago

Interestingly, this story has attracted numerous people to Ethereum. It was a pricey advertising but it worked.

_bdog 10y ago

An exam-question a german lawyer told me to illustrate how layman's understanding of law and expectation of logic therein often doesn't apply: "Your employer tells you to break into an opponent's office and steal something. You do that, jump out of the window and break a leg. Is your workplace insurance legally obliged to cover the medical cost?"

_98fj 10y ago
(the answer is yes)