13 ms·

Ethereum is Doomed

299 points by kushti 10y ago

endergen 10y ago
I love that Smart Contracts act basically as bug bounties to make the Ethereum systems, community knowledge, and open contracts improve dramatically.
- dragontamer 10y ago
  I love how law and court systems are basically bug bounties on legal systems, community knowledge, and social constructs. Society will inevitably improve dramatically. Oh wait, no. We just turned programmers into politicians and lawyers. I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract". Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.
  - endergen 10y ago
    I hear your sentiment. But not your argument as much. Politicians and Lawyers are inherently > smart contract writers? 'I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract".' How is this different than not trusting Lawyers? 'Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.' Agreed on using Ethereum contracts anytime in the near future (or ever) for anything life or death or over exposing your self financially is insane. There are plenty of cases that are a better fit for a smart contract system. People should invest affordable proportions of their money.
- verbify 10y ago
  Except that once theere's a lot of money in smart contracts, people will hack the contracts without letting people know. Somebody's going to complain about "losing all their money in a contract and they don't know why" but they'll be ignored as technically ignorant and in the meantime, the thief will walk with lots of money.
SlipperySlope 10y ago
The programming classic "Mythical Man Month" had a chapter for the "second system effect". Its where developers put lots of complicated features in to the second system in a series. Its a pattern for failure. In this case, Ethereum developers built a much more complicated cryptocurrency by making it Turing complete - to the extent of writing their own new computer language and virtual machine to run it. They skipped over the halfway step of declaring parameters in the payment transactions, that open source enterprise library code, e.g. Java, could execute for for required behavior. No. They made the new code itself a user-contributed and immutable! part of the system.
- viraptor 10y ago
  That's actually a pretty good decision in my opinion. At least in this case. Think what would happen if they went for alternative solutions: 1. If it wasn't immutable, you'd never be sure when a contract changes. That's the basic assumption about contract - once you sign it, whether in real world, or by doing some action in Ethereum, you don't expect it to change how it works. That's why immutable is good. 2. User-contributed is just how it's supposed to work. It's decentralised. Everyone's a user. The content has to be user-contributed. Having some central publisher/gatekeeper is contrary to the whole idea. 3. Own VM is debatable. Sure, they could go with JVM, but the scope would have to include much more complexity (classes, namespaces, etc.) than just function/instruction execution. Maybe the limits of javacard would be enough, maybe not. I really don't think the second system effect applies here. It's not a rewrite of something that existed and had issues.
  - yawaramin 10y ago
    Solidity contracts are already modules which contain functions. They're equivalent to Java classes with static methods or Scala objects. As for namespacing, I don't know how in this day and age programmers can say that's not worth it.
    - viraptor 10y ago
      Solidity contracts do contain functions and some state. But that's at a fairly different level than Java's classes. Internals are not exported. The contract's structs belong to contracts. There's no need for namespaces within code because addresses provides namespacing already - all your code is normally visible to you already and you'll not get unexpected names shadowing anything in your code. I'm not saying namespacing is bad, just that namespacing as defined in Java is likely not necessary in ethereum world, as I understand it. It would likely just confuse what's immutable vs what's referenced by name.
cheez 10y ago
> They created a situation in which bugs would be expected to arise in an environment in which bugs are legally exploitable. That is hacker heaven. Every single system has this problem. You think banks aren't hacked?
- pmorici 10y ago
  What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.
  - cheez 10y ago
    It's effectively legal because a lot of financial fraud is not pursued. For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions. That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract. In the case of smart contracts, there is no recourse unless built in to the contract. This is by design. All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods. So if you're a good software engineer, there is potentially a huge market about to open up for you.
    - pmorici 10y ago
      Scamming old people isn't a bug with the bank.
      - cheez 10y ago
        It's a bug in the system though.
        pmorici 10y ago
        No it isn't. People are meant to have free control over their money. Are advocating that banks should be required to protect people from themselves?
barisser 10y ago
Software is almost always flawed to a certain extent. The problem with Ethereum is that you can't push a fix to your contract.
- vessenes 10y ago
  You absolutely can if you're not too proud to imagine you'll need to upfront.
mmanfrin 10y ago
Having a little bit of trouble parsing how the attack worked -- so when a transfer happens, the destination account gets to run a command; they then ran a command that called the source's send-ether command, which ran because it was still in 'we owe destination account money' mode because the full initial contract had not concluded? Then at some point it terminates itself before emptying the source account (and thereby causing a rollback that would cascade back?)
- darawk 10y ago
  My understanding is that it looks essentially like this: send(theEther, childDao) deduct(theEther, tokenHolder) But that you can get it to overflow the stack in between the two so that the send completes but the deduction no longer happens.
  - DennisP 10y ago
    If you overflow the stack it throws and rolls back (which is another attack in certain circumstances). What killed TheDAO is basically that childDao called back the sender method, which sends again without having deducted yet. Do the deduct before the send, and the whole problem goes away.
    - rtpg 10y ago
      Right, but would the deduction commit even if the send fails? Isn't this the whole concurrency 101 "Atomic deduct and send" problem?
      - DennisP 10y ago
        It's not really concurrent, the VM runs one transaction at a time. The send returns false if it fails. So if you check for that, you can throw an exception, which rolls back the whole transaction just like in SQL. The reason the send doesn't automatically throw is that if you were doing lots of sends in a loop, you'd actually want to ignore the exception, so if one send fails it doesn't block everybody.
3pt14159 10y ago
Ethereum isn't doomed. I don't think it will ever have as much backing as Bitcoin because of institutional buy-in; but the world needs programmable smart contracts. Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them. Individual will is what cryptocurrencies are about. Bitcoin in terms of international payments and store-of-value; and Ethereum in terms of contracts and computing.
- JorgeGT 10y ago
  > Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them. But apparently it only takes a fork to freeze/reverse their contracts. I would take my chances with a traditional foundation, Alfred Nobel's is still running smoothly since +110 years ago, yearly executing its "code".
- altoz 10y ago
  RTFA. The idea of smart contracts isn't dead, but Ethereum looks like a terrible platform for it, given that it's very hard to audit the smart contracts on it.
  - whiddershins 10y ago
    I agree with your sentiment but downvoting because the guidelines specifically ask that you not say things that imply a commenter hasn't read the article.
- jerf 10y ago
  A contract-based blockchain seems very likely to me. But there's no reason that has to be Ethereum. Having had the chance to sort of ponder this over the last couple of days, I can't help but come to the conclusion that Ethereum is indeed fundamentally flawed and probably entirely unsalvageable, for all the reasons given in that blog post and more. The eventual contract-based blockchain that succeeds is going to look a lot more, well, engineered, for lack of a better word. Probably a lot more proofs of various things. Fewer features that are all individually much stronger. In fact, there's little reason to believe that something this complicated would be done correctly the first time. Remember... Bitcoin is not the first digital currency either!
dkarapetyan 10y ago
I didn't know the language was turing complete. Isn't this computing 101? If you want a secure thing then you must be able to reason about it statically. Making things turing complete means any non-trivial property of program correctness can not have a generic solution and so you've just opened yourself up to a world of hurt.
- aakilfernandes 10y ago
  The whole point of Ethereum is turing completeness. Ethereum without Turing completeness already exists and its called Bitcoin. While this implementation of The Dao has failed, Ethereum is the only blockchain where implementing The Dao is possible.
  - TylerE 10y ago
    There is a huge canyon between "you can use this small set of ops" and "turing complete".
    - jacques_chester 10y ago
      Not really. Any language that has sequential instructions, branching and loops is Turing complete, per the Structured Programming Theorem. Given how hard it is to avoid accidentally introducing these three "simple" elements, Turing completeness often turns up without being planned for.
  - drdeca 10y ago
    There is a thing that advertises itself as being like Ethereum but without the Turing completeness. It is meant to be able to do more computation based stuff than Bitcoin, but without being Turing complete. However, they seem to have confused the halting problem not being computable with Godel's second incompleteness theorem? (They might have corrected this since I saw when they published something with this.)
    - wtallis 10y ago
DennisP 10y ago
I have actually tested this attack technique (using my own contracts on a local test chain), and I've been in discussions with some Solidity developers and the guy who first published the attack. The situation is not as bad as this article claims. For starters, you can use address.send(x) instead of address.call.value(x)(). All computations on Ethereum have to be funded with "gas" (transaction fees), and send() only forwards a small amount of gas. The recipient can write to the log but that's about it. TheDAO used .value() which forwards all the available gas. If you do use .value(), then you can do it safely by doing it only once per method, as the very last step, and only using it in top-level methods. Then any sort of reentrant callback will find any required state changes already done. E.g. subtract from the user's balance, send the funds, and if the send fails then throw. The recipient can call back but the balance is already decremented. Using a mutex is another option. I've tested all this and it works. There are a lot of reasons Ethereum is designed this way. The most common reason for a contract to run code when receiving funds is to prevent users from accidentally losing their money. E.g. in any contract that holds ether and maintains a ledger with balances for multiple users, if anyone sends ether to the contract address, they'll lose it, unless the contract either throws an exception or automatically adds to the user's balance on its ledger. User addresses and contract addresses are interchangeable, because it lets you do things like use a multisig timelocked vault to receive funds and anything can send to it just as if it were a regular user account. All that said, the devs are working on improvements too.
- amaks 10y ago
  > All computations on Ethereum have to be funded with "gas" (transaction fees) But that's what was wrong with the exploited DAO code - it didn't use gas. The point of the article is that it's very hard or impossible to verify the correctness of the smart contracts.
  - aakilfernandes 10y ago
    > it didn't use gas this is incorrect
    - 10y ago
aakilfernandes 10y ago
Here's a better explanation of the attack: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-the-real-deal/ http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t... Ethereum is not doomed. But devs do need to be educated of this attack.
- coldcode 10y ago
  It is doomed, who would trust a contract now with real "money"? Unless you have a mathematically rigorous proof that the contract is trustworthy I sure wouldn't.
  - aakilfernandes 10y ago
    Hopefully no on ever trusts a contract with 100 mill for a while, but for lower values and simpler contracts... absolutely i would.
    - CoffeeDregs 10y ago
      So you would you sell your house and take an Ethereum contract in return? Note: I loved Charles Stross's suggestion of code-as-contract in Acccelerando, so I dig the concept.
    - tamana 10y ago
      Someone can write a bot to steal money from every open DAO of any size.
    - amaks 10y ago
      Sorry, but this is bullshit. You sound like Ethereum or SlockIt employee. No one in their sane mind would trust their money a company which can't guarantee security of your funds, let alone good coding practice (the DAO code is shit, sorry -- there are no tests, no comments, no spec, no clear upgrade story etc.). Good attempt, and I can feel for Ethereum folks, but something this important should be rock solid, not "experiment" when you're fucking with people's money. This is not a hacker's playground.
munificent 10y ago
> Solidity is like programming in JavaScript, except with your bank account accessible through the Document Object Model. Such a beautiful, terrifying sentence.
- henrik_w 10y ago
  I recently saw this on Twitter, and thought it was pretty funny: "What's Ethereum?" Imagine that your dollar bills were written in Javascript. (from @random_eddie)
- graup 10y ago
  This is a very snarky hyperbole. Solidity has as much to do with Javascript as Java does. For starters, Solidity is a compiled, typed language. It is still new and has to be improved.
  - deleted 10y ago
    [deleted]
  - sesm 10y ago
    > Solidity is a compiled, typed language. The same language can be both compiled and interpreted, this doesn't affect the semantics of the language. For example, OCaml ships with both a compiler and an interpreter. There exist AOT compilers for JavaScript too. Also, JavaSript is a typed language. It is just dynamically typed and does too much type coercion.
    - graup 10y ago
      Thanks for the clarification. So, Solidity is a compile-only, strongly typed language? While Javascript is usually interpreted (or JIT compiled) and dynamically typed.
anaphor 10y ago
What if they had used a language without the possibility of recursion and without loops? I'm being serious. Languages that disallow certain types of recursion, and disallow loops exist. You'd think they would've used something that actually allows for total functions that are guaranteed to terminate in a certain way, instead of a JavaScript clone...
- aakilfernandes 10y ago
  We want to allow recursion and loops. We want to be able to run arbitrary code. We just need to be a little wiser about how we do it.
  - dkarapetyan 10y ago
    How did this madness start? I don't want law to be turing complete. Especially programatic law. Why are people so nonchalant about this? This is not sane design. You want totality and termination proofs. At least that's what I would look for in any programatic system of law.
    - saalweachter 10y ago
      Biggest rock is best rock.
    - aakilfernandes 10y ago
      The DAO would not be possible without it.
  - marssaxman 10y ago
    Why on earth would you want that? How can such a staggering explosion of potential complexity justify itself?
    - tamana 10y ago
      TheDAO showed a $40m reason why we hackers want the complexity :-)
AceJohnny2 10y ago
I'm getting a strong Accelerando deja-vu here. (ref: http://www.antipope.org/charlie/blog-static/fiction/accelerando/accelerando-intro.html http://www.antipope.org/charlie/blog-static/fiction/accelera... )
odrekf 10y ago
As expected, "Ethereum is turing-complete" turned out to be just a marketing meme (or a horrible idea at best), just like "Litecoin is silver", "Doge is community", and all the others.
heliumcraft 10y ago
Absolute trash article.
bithive123 10y ago
"I thought again about my early plan of a new language or writing-system of reason, which could serve as a communication tool for all different nations... If we had such an universal tool, we could discuss the problems of the metaphysical or the questions of ethics in the same way as the problems and questions of mathematics or geometry. That was my aim: Every misunderstanding should be nothing more than a miscalculation (...), easily corrected by the grammatical laws of that new language. Thus, in the case of a controversial discussion, two philosophers could sit down at a table and just calculating, like two mathematicians, they could say, 'Let us check it up ...'" --Gottfried Wilhelm Leibniz
teslaberry 10y ago
run for the bitcoin hills!.
apapli 10y ago
Surely an issue here irrespective of technology flaws or not is the economic impact on the time taken to write smart contracts. If it now takes substantially more dev time to write a smart contract that is "secure" (ie by spending lots and lots of time testing for vulnerabilities) this will invariably come at a cost. So while the theory of smart contracts is brilliant this recent hack might go down in history as a case study as to why writing contracts is too expensive to do in all but the top 1% of situations.
xoa 10y ago
I wrote this originally in response to a post by cyphar (https://news.ycombinator.com/reply?id=11942889 https://news.ycombinator.com/reply?id=11942889), but I'd really love a response from anyone with more knowledge or thoughts on how the law might interpret this situation in relation to already existing "virtual legal systems". cyphar wrote: "It was definitely fraud. Either it was a contract, in which case "taking $50 million without anyone's consent" doesn't pass the officious bystander test. Otherwise it wasn't a contract, so the default is still fraud (though in that case, the DAO would be the thing being defrauded rather than the investors)." I'd like significantly more details on your legal theory for how this was "definitely fraud" or how "the default is fraud" if there was no legal contract, the split executor was a direct party to the agreement, and the terms of the agreement were followed. "$50 million" was not taken, 3.6 million or so "ether" was split out from the original smart contract/account, which may or may not end up having some dollar value. In at least two previous threads [1, 2], comparisons were made to the MMOG EVE Online (developed by CCP Games), and I think the analogy raises some interesting questions. EVE is a self-contained artificial system that, so long the system framework itself is not exploited, is ruled entirely by code. It has a digital currency (ISK) that has an official conversion rate from real world fiat currency to ISK, and an unofficial ToS breaking (but non-criminal AFAIK) conversion rate from ISK back to fiat. CCP has nothing to do with this exchange, but exchanges for ether to other currencies are also 3rd party. Virtual items as well as ISK itself thus have calculable value, both within the system, in terms of time/rarity, and in terms of nation-state issued money. There are person-actor driven "contracts" of various sorts, and people driven markets. There is fraud, piracy, and pure chaotic destruction as well, and that's considered entirely within the system framework so long as the overall code rules of the world are not violated. Given that, what exactly is the legal difference between the DAO and EVE Online? In EVE, if Alice attacks Bob, or infiltrates his organization, and steals/destroys a few hundred billion in ISK (equivalent to a few thousand dollars at current exchange rate), or sets up a fraudulent bank/scheme that makes off with hundreds of billions or trillions (this has actually happened), do you think Bob should be able to sue in a real world court of law? The essence of the situation looks similar/identical to me: that the parties are operating under a non-contract non-legal agreement to be governed within the a specific set of world rules, and that therefore any interactions within those world rules, however angry they might get about it on a personal level and whatever colloquial English they might use to describe it, creates no legal standing of any sort outside. If EVE client/server were hacked (the world rules distorted) it'd be an issue (though still not necessarily a legal one), just as if the Ethereum VM was hacked it'd be an issue, but if those were operating entirely as they should be then what's the basis of legal complaint? What's the generalized objective basis for court involvement in people agreeing to mess around with made up numbers on computers, even if other people decide to try to exchange those numbers for money? 1: https://news.ycombinator.com/item?id=11925904 https://news.ycombinator.com/item?id=11925904 2: https://news.ycombinator.com/item?id=11929208 https://news.ycombinator.com/item?id=11929208
baybal2 10y ago
Fiy, i recently came upon this company http://m.imgur.com/Hv9n7fk,55JgdgK http://m.imgur.com/Hv9n7fk,55JgdgK that wants to sell ETH to Chinese. I checked the company registry, and found out that the guy has registered a proprietorship back in 2013. Apparently a friend of Vitalik
- amq 10y ago
  It is just a job posting.
erikpukinskis 10y ago
People (rightly) make the same critique of Bitcoin: it is very easy for regular people to lose their money. To keep it safe you need to be a security expert, and even then there are no guarantees, and mistakes are forever. My response is the same for both Bitcoin and Ethereum: Even if these technologies are only used by trained professionals, they can still be revolutionary. Almost no one can safely operate a printing press, and yet that invention has toppled empires. At worst, these are back office technologies. At best in a decade or two someone will figure out how to design a good enough GUI that a novice can safely explore a powerful subset the technology, trusting that bumpers are in place around the sharp edges.
- jbmorgado 10y ago
  People at large are not supposed to put money in printing presses they can't use properly, they are supposed to put money in books made by those printing presses. Ethereum is definitively unsafe, it's basically impossible to create code without any bugs, and it's impossible to prove a piece of code doesn't have any bug. That defeats the all purpose of Euthereum. Bitcoin is just unsafe by nature for the user, although the protocol itself is most probably safe.
bobjones201606 10y ago
Could the person who got the DAO's ETH create a contract to pay out miners who vote against a hard fork with the "stolen" ETH?
- patrickk 10y ago
  Probably quite difficult in practice, unless he/she could somehow convince a mining pool or something. Another option would be to set up mining hardware in a place like China with low cost electricity. However, this would take time, money and serious effort - if you cash out ether to fund it, you likely crash the price, and if you succeed in fighting the hard fork, the split in the community would likely destroy the trust in Ethereum and your funds go poof.
- tromp 10y ago
  Assuming contracts can identify the coinbase address of past blocks, then that would be relatively straightforward. But this may not be up to the miners alone. Perhaps even more important is what for the major exchanges choose to run, since they're needed to convert Ether back into BTC/fiat currency. If a major exchange makes a public announcement committing to either the soft or hardfork, then that will sway a great many miners.
yarrel 10y ago
....to succeed. ;-)
deleted 10y ago
[deleted]
lquist 10y ago
The Coinbase founder that a month ago called ethereum the future of cryptocurrency looks kind of silly now.
Animats 10y ago
It's now clear that Ethereum's contract system has major security vulnerabilities. This is a killer flaw for something which exists only to secure transactions between mutually mistrustful parties. Maybe someone else will do this again, better. Etherium itself probably is doomed. There are also hard questions to ask the people involved. The same people seem to be behind Etherium, the DAO, and the programmable door-lock startup which the DAO was supposed to fund. This is suspicious. This might be an inside job. At least three times in the Bitcoin world, some Bitcoin exchange claimed they lost money due to a "hack", but in the end it turned out to be an inside job.
rwallace 10y ago
The problem with Turing completeness is that if it's not there from the start, people inevitably end up needing features that aren't present in the restricted language, and then a Turing complete language is added to either the original system or a successor, and being an afterthought it usually ends up being a hack job. Examples: SQL was supplemented with procedural languages for stored procedures, Excel was supplemented with VBA, HTML was supplemented with JavaScript and, well, Bitcoin was supplemented with Ethereum. So providing a Turing complete language was the right decision as far as it goes, but it's not enough by itself. If you need reliability - which this does - it needs to be the case that typical code does not involves arbitrarily complex computation. Typical code needs to fit stereotyped patterns whose behavior is predictable. If Ethereum is to continue, it's clear that exhorting people to try even harder not to make mistakes in the current version of Solidity, won't cut it. The language needs to be supplemented or replaced with something that makes it easy to write correct code for the kind of things people typically want to do.
- edejong 10y ago
  There are languages which are both expressive and Turing incomplete, for example Coq. In the Coq language, Turing incompleteness is actually needed to be able to make complete proofs. Maybe Solidity would have been better implemented within Coq, but it's too late now.
  - lmm 10y ago
    See http://publications.lib.chalmers.se/records/fulltext/234939/234939.pdf http://publications.lib.chalmers.se/records/fulltext/234939/... (suggesting Idris for this use case)
    - mbrock 10y ago
      That particular thesis actually ends up recommending against using a dependent functional language for Ethereum contracts... I think we might need to think of contracts as very important algorithms and prove them like we prove quick sort. That doesn't require dependent typing and functional programming; you can prove theorems about imperative code if you just have formal semantics. I'd be interested to see a verified dependently typed compiler to EVM for some simple language... but it kind of seems like a PhD project.
pt1988 10y ago
Its too bad, I really thought Vitalik was the Chosen One, but I think he reacted incorrectly here by panicking and showing concern. If I had been him I would have let DAO fail without even discussing any fork. Be as emotionless about it as the code itself. Admit mistakes were made, somebody (DAO investors) will lose some money in the short term but stay true to the principles of Ethereum. PLUS even after all this drama, $ETH has a market cap of ~$1B as well as independence (fingers crossed) from government intervention making it an alternative to Fiat currency, as well as a much better block rate than BTC lending itself to mining on consumer-grade GPU's for the moment at least. I'm looking at litecoin LTC as my next crypto-bubble investment as well. There's still lots of good to be said about Ethereum. DAO is toast, long live DAO2! Ethereum will come out stronger long term.
thelollies 10y ago
I wonder if a language like Haskell with a strong type system and strict typing could help. If you were able to express exchange of currency with the type system.
- codygman 10y ago
  I'm pretty sure you can do that. See units in F# for example.
anonbanker 10y ago
Doom articles mean market debasement is happening. If you have the ability to invest, this is a good time to do so. you're about to see massive increases in valuation.

299 points by kushti 10y ago

I love that Smart Contracts act basically as bug bounties to make the Ethereum systems, community knowledge, and open contracts improve dramatically.

dragontamer 10y ago
I love how law and court systems are basically bug bounties on legal systems, community knowledge, and social constructs. Society will inevitably improve dramatically. Oh wait, no. We just turned programmers into politicians and lawyers. I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract". Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.
- endergen 10y ago
  I hear your sentiment. But not your argument as much. Politicians and Lawyers are inherently > smart contract writers? 'I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract".' How is this different than not trusting Lawyers? 'Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.' Agreed on using Ethereum contracts anytime in the near future (or ever) for anything life or death or over exposing your self financially is insane. There are plenty of cases that are a better fit for a smart contract system. People should invest affordable proportions of their money.
verbify 10y ago
Except that once theere's a lot of money in smart contracts, people will hack the contracts without letting people know. Somebody's going to complain about "losing all their money in a contract and they don't know why" but they'll be ignored as technically ignorant and in the meantime, the thief will walk with lots of money.

SlipperySlope 10y ago

The programming classic "Mythical Man Month" had a chapter for the "second system effect". Its where developers put lots of complicated features in to the second system in a series. Its a pattern for failure. In this case, Ethereum developers built a much more complicated cryptocurrency by making it Turing complete - to the extent of writing their own new computer language and virtual machine to run it. They skipped over the halfway step of declaring parameters in the payment transactions, that open source enterprise library code, e.g. Java, could execute for for required behavior. No. They made the new code itself a user-contributed and immutable! part of the system.

viraptor 10y ago
That's actually a pretty good decision in my opinion. At least in this case. Think what would happen if they went for alternative solutions: 1. If it wasn't immutable, you'd never be sure when a contract changes. That's the basic assumption about contract - once you sign it, whether in real world, or by doing some action in Ethereum, you don't expect it to change how it works. That's why immutable is good. 2. User-contributed is just how it's supposed to work. It's decentralised. Everyone's a user. The content has to be user-contributed. Having some central publisher/gatekeeper is contrary to the whole idea. 3. Own VM is debatable. Sure, they could go with JVM, but the scope would have to include much more complexity (classes, namespaces, etc.) than just function/instruction execution. Maybe the limits of javacard would be enough, maybe not. I really don't think the second system effect applies here. It's not a rewrite of something that existed and had issues.
- yawaramin 10y ago
  Solidity contracts are already modules which contain functions. They're equivalent to Java classes with static methods or Scala objects. As for namespacing, I don't know how in this day and age programmers can say that's not worth it.
  - viraptor 10y ago
    Solidity contracts do contain functions and some state. But that's at a fairly different level than Java's classes. Internals are not exported. The contract's structs belong to contracts. There's no need for namespaces within code because addresses provides namespacing already - all your code is normally visible to you already and you'll not get unexpected names shadowing anything in your code. I'm not saying namespacing is bad, just that namespacing as defined in Java is likely not necessary in ethereum world, as I understand it. It would likely just confuse what's immutable vs what's referenced by name.

cheez 10y ago

> They created a situation in which bugs would be expected to arise in an environment in which bugs are legally exploitable. That is hacker heaven. Every single system has this problem. You think banks aren't hacked?

pmorici 10y ago
What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.
- cheez 10y ago
  It's effectively legal because a lot of financial fraud is not pursued. For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions. That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract. In the case of smart contracts, there is no recourse unless built in to the contract. This is by design. All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods. So if you're a good software engineer, there is potentially a huge market about to open up for you.
  - pmorici 10y ago
    Scamming old people isn't a bug with the bank.
    - cheez 10y ago
      It's a bug in the system though.
      - pmorici 10y ago
        No it isn't. People are meant to have free control over their money. Are advocating that banks should be required to protect people from themselves?

barisser 10y ago

Software is almost always flawed to a certain extent. The problem with Ethereum is that you can't push a fix to your contract.

vessenes 10y ago
You absolutely can if you're not too proud to imagine you'll need to upfront.

mmanfrin 10y ago

Having a little bit of trouble parsing how the attack worked -- so when a transfer happens, the destination account gets to run a command; they then ran a command that called the source's send-ether command, which ran because it was still in 'we owe destination account money' mode because the full initial contract had not concluded? Then at some point it terminates itself before emptying the source account (and thereby causing a rollback that would cascade back?)

darawk 10y ago
My understanding is that it looks essentially like this: send(theEther, childDao) deduct(theEther, tokenHolder) But that you can get it to overflow the stack in between the two so that the send completes but the deduction no longer happens.
- DennisP 10y ago
  If you overflow the stack it throws and rolls back (which is another attack in certain circumstances). What killed TheDAO is basically that childDao called back the sender method, which sends again without having deducted yet. Do the deduct before the send, and the whole problem goes away.
  - rtpg 10y ago
    Right, but would the deduction commit even if the send fails? Isn't this the whole concurrency 101 "Atomic deduct and send" problem?
    - DennisP 10y ago
      It's not really concurrent, the VM runs one transaction at a time. The send returns false if it fails. So if you check for that, you can throw an exception, which rolls back the whole transaction just like in SQL. The reason the send doesn't automatically throw is that if you were doing lots of sends in a loop, you'd actually want to ignore the exception, so if one send fails it doesn't block everybody.

3pt14159 10y ago

Ethereum isn't doomed. I don't think it will ever have as much backing as Bitcoin because of institutional buy-in; but the world needs programmable smart contracts. Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them. Individual will is what cryptocurrencies are about. Bitcoin in terms of international payments and store-of-value; and Ethereum in terms of contracts and computing.

JorgeGT 10y ago
> Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them. But apparently it only takes a fork to freeze/reverse their contracts. I would take my chances with a traditional foundation, Alfred Nobel's is still running smoothly since +110 years ago, yearly executing its "code".
altoz 10y ago
RTFA. The idea of smart contracts isn't dead, but Ethereum looks like a terrible platform for it, given that it's very hard to audit the smart contracts on it.
- whiddershins 10y ago
  I agree with your sentiment but downvoting because the guidelines specifically ask that you not say things that imply a commenter hasn't read the article.
jerf 10y ago
A contract-based blockchain seems very likely to me. But there's no reason that has to be Ethereum. Having had the chance to sort of ponder this over the last couple of days, I can't help but come to the conclusion that Ethereum is indeed fundamentally flawed and probably entirely unsalvageable, for all the reasons given in that blog post and more. The eventual contract-based blockchain that succeeds is going to look a lot more, well, engineered, for lack of a better word. Probably a lot more proofs of various things. Fewer features that are all individually much stronger. In fact, there's little reason to believe that something this complicated would be done correctly the first time. Remember... Bitcoin is not the first digital currency either!

dkarapetyan 10y ago

I didn't know the language was turing complete. Isn't this computing 101? If you want a secure thing then you must be able to reason about it statically. Making things turing complete means any non-trivial property of program correctness can not have a generic solution and so you've just opened yourself up to a world of hurt.

aakilfernandes 10y ago
The whole point of Ethereum is turing completeness. Ethereum without Turing completeness already exists and its called Bitcoin. While this implementation of The Dao has failed, Ethereum is the only blockchain where implementing The Dao is possible.
- TylerE 10y ago
  There is a huge canyon between "you can use this small set of ops" and "turing complete".
  - jacques_chester 10y ago
    Not really. Any language that has sequential instructions, branching and loops is Turing complete, per the Structured Programming Theorem. Given how hard it is to avoid accidentally introducing these three "simple" elements, Turing completeness often turns up without being planned for.
- drdeca 10y ago
  There is a thing that advertises itself as being like Ethereum but without the Turing completeness. It is meant to be able to do more computation based stuff than Bitcoin, but without being Turing complete. However, they seem to have confused the halting problem not being computable with Godel's second incompleteness theorem? (They might have corrected this since I saw when they published something with this.)
  - wtallis 10y ago

DennisP 10y ago

I have actually tested this attack technique (using my own contracts on a local test chain), and I've been in discussions with some Solidity developers and the guy who first published the attack. The situation is not as bad as this article claims. For starters, you can use address.send(x) instead of address.call.value(x)(). All computations on Ethereum have to be funded with "gas" (transaction fees), and send() only forwards a small amount of gas. The recipient can write to the log but that's about it. TheDAO used .value() which forwards all the available gas. If you do use .value(), then you can do it safely by doing it only once per method, as the very last step, and only using it in top-level methods. Then any sort of reentrant callback will find any required state changes already done. E.g. subtract from the user's balance, send the funds, and if the send fails then throw. The recipient can call back but the balance is already decremented. Using a mutex is another option. I've tested all this and it works. There are a lot of reasons Ethereum is designed this way. The most common reason for a contract to run code when receiving funds is to prevent users from accidentally losing their money. E.g. in any contract that holds ether and maintains a ledger with balances for multiple users, if anyone sends ether to the contract address, they'll lose it, unless the contract either throws an exception or automatically adds to the user's balance on its ledger. User addresses and contract addresses are interchangeable, because it lets you do things like use a multisig timelocked vault to receive funds and anything can send to it just as if it were a regular user account. All that said, the devs are working on improvements too.

amaks 10y ago
> All computations on Ethereum have to be funded with "gas" (transaction fees) But that's what was wrong with the exploited DAO code - it didn't use gas. The point of the article is that it's very hard or impossible to verify the correctness of the smart contracts.
- aakilfernandes 10y ago
  > it didn't use gas this is incorrect
  - 10y ago

aakilfernandes 10y ago

Here's a better explanation of the attack: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-the-real-deal/ http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t... Ethereum is not doomed. But devs do need to be educated of this attack.

coldcode 10y ago
It is doomed, who would trust a contract now with real "money"? Unless you have a mathematically rigorous proof that the contract is trustworthy I sure wouldn't.
- aakilfernandes 10y ago
  Hopefully no on ever trusts a contract with 100 mill for a while, but for lower values and simpler contracts... absolutely i would.
  - CoffeeDregs 10y ago
    So you would you sell your house and take an Ethereum contract in return? Note: I loved Charles Stross's suggestion of code-as-contract in Acccelerando, so I dig the concept.
  - tamana 10y ago
    Someone can write a bot to steal money from every open DAO of any size.
  - amaks 10y ago
    Sorry, but this is bullshit. You sound like Ethereum or SlockIt employee. No one in their sane mind would trust their money a company which can't guarantee security of your funds, let alone good coding practice (the DAO code is shit, sorry -- there are no tests, no comments, no spec, no clear upgrade story etc.). Good attempt, and I can feel for Ethereum folks, but something this important should be rock solid, not "experiment" when you're fucking with people's money. This is not a hacker's playground.

munificent 10y ago

> Solidity is like programming in JavaScript, except with your bank account accessible through the Document Object Model. Such a beautiful, terrifying sentence.

henrik_w 10y ago
I recently saw this on Twitter, and thought it was pretty funny: "What's Ethereum?" Imagine that your dollar bills were written in Javascript. (from @random_eddie)
graup 10y ago
This is a very snarky hyperbole. Solidity has as much to do with Javascript as Java does. For starters, Solidity is a compiled, typed language. It is still new and has to be improved.
- deleted 10y ago
  [deleted]
- sesm 10y ago
  > Solidity is a compiled, typed language. The same language can be both compiled and interpreted, this doesn't affect the semantics of the language. For example, OCaml ships with both a compiler and an interpreter. There exist AOT compilers for JavaScript too. Also, JavaSript is a typed language. It is just dynamically typed and does too much type coercion.
  - graup 10y ago
    Thanks for the clarification. So, Solidity is a compile-only, strongly typed language? While Javascript is usually interpreted (or JIT compiled) and dynamically typed.

anaphor 10y ago

What if they had used a language without the possibility of recursion and without loops? I'm being serious. Languages that disallow certain types of recursion, and disallow loops exist. You'd think they would've used something that actually allows for total functions that are guaranteed to terminate in a certain way, instead of a JavaScript clone...

aakilfernandes 10y ago
We want to allow recursion and loops. We want to be able to run arbitrary code. We just need to be a little wiser about how we do it.
- dkarapetyan 10y ago
  How did this madness start? I don't want law to be turing complete. Especially programatic law. Why are people so nonchalant about this? This is not sane design. You want totality and termination proofs. At least that's what I would look for in any programatic system of law.
  - saalweachter 10y ago
    Biggest rock is best rock.
  - aakilfernandes 10y ago
    The DAO would not be possible without it.
- marssaxman 10y ago
  Why on earth would you want that? How can such a staggering explosion of potential complexity justify itself?
  - tamana 10y ago
    TheDAO showed a $40m reason why we hackers want the complexity :-)

AceJohnny2 10y ago

I'm getting a strong Accelerando deja-vu here. (ref: http://www.antipope.org/charlie/blog-static/fiction/accelerando/accelerando-intro.html http://www.antipope.org/charlie/blog-static/fiction/accelera... )

odrekf 10y ago

As expected, "Ethereum is turing-complete" turned out to be just a marketing meme (or a horrible idea at best), just like "Litecoin is silver", "Doge is community", and all the others.

heliumcraft 10y ago

Absolute trash article.

bithive123 10y ago

"I thought again about my early plan of a new language or writing-system of reason, which could serve as a communication tool for all different nations... If we had such an universal tool, we could discuss the problems of the metaphysical or the questions of ethics in the same way as the problems and questions of mathematics or geometry. That was my aim: Every misunderstanding should be nothing more than a miscalculation (...), easily corrected by the grammatical laws of that new language. Thus, in the case of a controversial discussion, two philosophers could sit down at a table and just calculating, like two mathematicians, they could say, 'Let us check it up ...'" --Gottfried Wilhelm Leibniz

teslaberry 10y ago

run for the bitcoin hills!.

apapli 10y ago

Surely an issue here irrespective of technology flaws or not is the economic impact on the time taken to write smart contracts. If it now takes substantially more dev time to write a smart contract that is "secure" (ie by spending lots and lots of time testing for vulnerabilities) this will invariably come at a cost. So while the theory of smart contracts is brilliant this recent hack might go down in history as a case study as to why writing contracts is too expensive to do in all but the top 1% of situations.

xoa 10y ago

I wrote this originally in response to a post by cyphar (https://news.ycombinator.com/reply?id=11942889 https://news.ycombinator.com/reply?id=11942889), but I'd really love a response from anyone with more knowledge or thoughts on how the law might interpret this situation in relation to already existing "virtual legal systems". cyphar wrote: "It was definitely fraud. Either it was a contract, in which case "taking $50 million without anyone's consent" doesn't pass the officious bystander test. Otherwise it wasn't a contract, so the default is still fraud (though in that case, the DAO would be the thing being defrauded rather than the investors)." I'd like significantly more details on your legal theory for how this was "definitely fraud" or how "the default is fraud" if there was no legal contract, the split executor was a direct party to the agreement, and the terms of the agreement were followed. "$50 million" was not taken, 3.6 million or so "ether" was split out from the original smart contract/account, which may or may not end up having some dollar value. In at least two previous threads [1, 2], comparisons were made to the MMOG EVE Online (developed by CCP Games), and I think the analogy raises some interesting questions. EVE is a self-contained artificial system that, so long the system framework itself is not exploited, is ruled entirely by code. It has a digital currency (ISK) that has an official conversion rate from real world fiat currency to ISK, and an unofficial ToS breaking (but non-criminal AFAIK) conversion rate from ISK back to fiat. CCP has nothing to do with this exchange, but exchanges for ether to other currencies are also 3rd party. Virtual items as well as ISK itself thus have calculable value, both within the system, in terms of time/rarity, and in terms of nation-state issued money. There are person-actor driven "contracts" of various sorts, and people driven markets. There is fraud, piracy, and pure chaotic destruction as well, and that's considered entirely within the system framework so long as the overall code rules of the world are not violated. Given that, what exactly is the legal difference between the DAO and EVE Online? In EVE, if Alice attacks Bob, or infiltrates his organization, and steals/destroys a few hundred billion in ISK (equivalent to a few thousand dollars at current exchange rate), or sets up a fraudulent bank/scheme that makes off with hundreds of billions or trillions (this has actually happened), do you think Bob should be able to sue in a real world court of law? The essence of the situation looks similar/identical to me: that the parties are operating under a non-contract non-legal agreement to be governed within the a specific set of world rules, and that therefore any interactions within those world rules, however angry they might get about it on a personal level and whatever colloquial English they might use to describe it, creates no legal standing of any sort outside. If EVE client/server were hacked (the world rules distorted) it'd be an issue (though still not necessarily a legal one), just as if the Ethereum VM was hacked it'd be an issue, but if those were operating entirely as they should be then what's the basis of legal complaint? What's the generalized objective basis for court involvement in people agreeing to mess around with made up numbers on computers, even if other people decide to try to exchange those numbers for money? 1: https://news.ycombinator.com/item?id=11925904 https://news.ycombinator.com/item?id=11925904 2: https://news.ycombinator.com/item?id=11929208 https://news.ycombinator.com/item?id=11929208

baybal2 10y ago

Fiy, i recently came upon this company http://m.imgur.com/Hv9n7fk,55JgdgK http://m.imgur.com/Hv9n7fk,55JgdgK that wants to sell ETH to Chinese. I checked the company registry, and found out that the guy has registered a proprietorship back in 2013. Apparently a friend of Vitalik

amq 10y ago
It is just a job posting.

erikpukinskis 10y ago

People (rightly) make the same critique of Bitcoin: it is very easy for regular people to lose their money. To keep it safe you need to be a security expert, and even then there are no guarantees, and mistakes are forever. My response is the same for both Bitcoin and Ethereum: Even if these technologies are only used by trained professionals, they can still be revolutionary. Almost no one can safely operate a printing press, and yet that invention has toppled empires. At worst, these are back office technologies. At best in a decade or two someone will figure out how to design a good enough GUI that a novice can safely explore a powerful subset the technology, trusting that bumpers are in place around the sharp edges.

jbmorgado 10y ago
People at large are not supposed to put money in printing presses they can't use properly, they are supposed to put money in books made by those printing presses. Ethereum is definitively unsafe, it's basically impossible to create code without any bugs, and it's impossible to prove a piece of code doesn't have any bug. That defeats the all purpose of Euthereum. Bitcoin is just unsafe by nature for the user, although the protocol itself is most probably safe.

bobjones201606 10y ago

Could the person who got the DAO's ETH create a contract to pay out miners who vote against a hard fork with the "stolen" ETH?

patrickk 10y ago
Probably quite difficult in practice, unless he/she could somehow convince a mining pool or something. Another option would be to set up mining hardware in a place like China with low cost electricity. However, this would take time, money and serious effort - if you cash out ether to fund it, you likely crash the price, and if you succeed in fighting the hard fork, the split in the community would likely destroy the trust in Ethereum and your funds go poof.
tromp 10y ago
Assuming contracts can identify the coinbase address of past blocks, then that would be relatively straightforward. But this may not be up to the miners alone. Perhaps even more important is what for the major exchanges choose to run, since they're needed to convert Ether back into BTC/fiat currency. If a major exchange makes a public announcement committing to either the soft or hardfork, then that will sway a great many miners.

yarrel 10y ago

....to succeed. ;-)

deleted 10y ago

[deleted]

lquist 10y ago

The Coinbase founder that a month ago called ethereum the future of cryptocurrency looks kind of silly now.

Animats 10y ago

It's now clear that Ethereum's contract system has major security vulnerabilities. This is a killer flaw for something which exists only to secure transactions between mutually mistrustful parties. Maybe someone else will do this again, better. Etherium itself probably is doomed. There are also hard questions to ask the people involved. The same people seem to be behind Etherium, the DAO, and the programmable door-lock startup which the DAO was supposed to fund. This is suspicious. This might be an inside job. At least three times in the Bitcoin world, some Bitcoin exchange claimed they lost money due to a "hack", but in the end it turned out to be an inside job.

rwallace 10y ago

The problem with Turing completeness is that if it's not there from the start, people inevitably end up needing features that aren't present in the restricted language, and then a Turing complete language is added to either the original system or a successor, and being an afterthought it usually ends up being a hack job. Examples: SQL was supplemented with procedural languages for stored procedures, Excel was supplemented with VBA, HTML was supplemented with JavaScript and, well, Bitcoin was supplemented with Ethereum. So providing a Turing complete language was the right decision as far as it goes, but it's not enough by itself. If you need reliability - which this does - it needs to be the case that typical code does not involves arbitrarily complex computation. Typical code needs to fit stereotyped patterns whose behavior is predictable. If Ethereum is to continue, it's clear that exhorting people to try even harder not to make mistakes in the current version of Solidity, won't cut it. The language needs to be supplemented or replaced with something that makes it easy to write correct code for the kind of things people typically want to do.

edejong 10y ago
There are languages which are both expressive and Turing incomplete, for example Coq. In the Coq language, Turing incompleteness is actually needed to be able to make complete proofs. Maybe Solidity would have been better implemented within Coq, but it's too late now.
- lmm 10y ago
  See http://publications.lib.chalmers.se/records/fulltext/234939/234939.pdf http://publications.lib.chalmers.se/records/fulltext/234939/... (suggesting Idris for this use case)
  - mbrock 10y ago
    That particular thesis actually ends up recommending against using a dependent functional language for Ethereum contracts... I think we might need to think of contracts as very important algorithms and prove them like we prove quick sort. That doesn't require dependent typing and functional programming; you can prove theorems about imperative code if you just have formal semantics. I'd be interested to see a verified dependently typed compiler to EVM for some simple language... but it kind of seems like a PhD project.

pt1988 10y ago

Its too bad, I really thought Vitalik was the Chosen One, but I think he reacted incorrectly here by panicking and showing concern. If I had been him I would have let DAO fail without even discussing any fork. Be as emotionless about it as the code itself. Admit mistakes were made, somebody (DAO investors) will lose some money in the short term but stay true to the principles of Ethereum. PLUS even after all this drama, $ETH has a market cap of ~$1B as well as independence (fingers crossed) from government intervention making it an alternative to Fiat currency, as well as a much better block rate than BTC lending itself to mining on consumer-grade GPU's for the moment at least. I'm looking at litecoin LTC as my next crypto-bubble investment as well. There's still lots of good to be said about Ethereum. DAO is toast, long live DAO2! Ethereum will come out stronger long term.

thelollies 10y ago

I wonder if a language like Haskell with a strong type system and strict typing could help. If you were able to express exchange of currency with the type system.

codygman 10y ago
I'm pretty sure you can do that. See units in F# for example.

anonbanker 10y ago

Doom articles mean market debasement is happening. If you have the ability to invest, this is a good time to do so. you're about to see massive increases in valuation.