6 ms·

Banks aren't legally exploitable.

IanCal 10y ago
Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.
- mmanfrin 10y ago
  Because the point (as I understand it) of this whole experiment is that they were trying to create an altcoin that used strict contracts as the basis for transactions (with no human intervention). Essentially the code is the contract, so code behavior is necessarily abiding by its contract and anything done with that code is legitimate.
- spilk 10y ago
  That depends on if The DAO's terms are enforceable - it basically says the code is the terms, so essentially if the code allows it, it is permitted. https://daohub.org/explainer.html https://daohub.org/explainer.html
- JorgeGT 10y ago
  From The DAO Terms: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation. Basically, the code is the only authentic version of the contract. The attacker entered this contract and used its functionality as was programmed in the blockchain, he didn't modify a bit of the code. So it seems pretty legal.
  - cyphar 10y ago
    It's fraud. It doesn't pass the officious bystander test.
    - Spivak 10y ago
      Yes, this would be considered fraud in the US legal system, but that's not the point. * If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system. * If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state.
      - cyphar 10y ago
        > Yes, this would be considered fraud in the US legal system, but that's not the point. It is the point though. It is the only point that will matter. Since the writers of the software are US citizens, it's most likely that they will get sued if the transaction is not aborted. Any scenario where the money is not returned to investors will result in the investors suing people -- no matter how much conviction people have that the DAO should be outside of the courts. > * If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system. $50 million is missing, and people feel wronged as a result. I wouldn't call it a "failure of the project" that it is accountable to the law. Nobody is above the law, not even programmers that write software which governs itself. > * If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state. Again, nothing and nobody is above the law. You'd have to overrule the Magna Carta if you wanted to change that. And that's just not going to happen.
        thoth 10y ago
        >$50 million is missing, and people feel wronged as a result. So what is the plan going forward - if either party in a "smart contract" feels disadvantaged by the outcome - they go running to the law and outside jurisdictions for remedy? Isn't avoiding all that overhead the point of have a "smart contract" in the first place? It's an interesting concept and I'd like to see the project survive (from a technology standpoint; I not risking any cash with it)... maybe it is good they did a faceplant 6 weeks in and can start answering some very hard questions that have come up.
- RcouF1uZ4gsC 10y ago
  The banks pretty much state that their software is an approximate implementation of the contract not the real contract itself. They specify that the real contract is what their lawyers drew up as interpreted by a human judge considering hundreds of years of legal case law. The DAO basically said screw the lawyers and case law and precedent bullshit, the contract is nothing more or less than the results of running this program on the Ethereum VM. As the program executed a way to transfer 10s of millions of dollars and they specifically stated that the program was the contract, by The DAO no contract violation occurred, hence no hack.
- cyphar 10y ago
  No, it was fraud. I asked a lawyer, and the stealing of $50 million would not be considered a clause of the contract (it doesn't pass the officious bystander test). As much as programmers might try to remove lawyers and courts from our lives, they are vital to actually doing things with other people where you might have a difference of opinion on what a particular agreement means.
  - coldtea 10y ago
    First of all, the "officious bystander" test is from English law, not US law. Second, while there are similar tests in other countries' legal systems, it's not that clear cut whether this would be considered such a case or not -- a single lawyer's opinion aside.
    - cyphar 10y ago
      > First of all, the "officious bystander" test is from English law, not US law. Yeah, sorry. But as you say there are similar tests in other countries. > it's not that clear cut whether this would be considered such a case or not Whether it would be considered a contract, or what are you referring to? Either way, Etherium and/or the authors of the DAO will get sued, and the investors will win the suit. If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional. And if Etherium hard forks the blockchain, then people have lost faith in the system. So IMO this won't end well for Etherium in either case.
      - coldtea 10y ago
        >If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional. Maybe you should read up on financial fraud, white collar crime and Wall Street?
  - icelancer 10y ago
    The fact it has to go to the US courts is why it's a failure.

Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.

mmanfrin 10y ago
Because the point (as I understand it) of this whole experiment is that they were trying to create an altcoin that used strict contracts as the basis for transactions (with no human intervention). Essentially the code is the contract, so code behavior is necessarily abiding by its contract and anything done with that code is legitimate.
spilk 10y ago
That depends on if The DAO's terms are enforceable - it basically says the code is the terms, so essentially if the code allows it, it is permitted. https://daohub.org/explainer.html https://daohub.org/explainer.html
JorgeGT 10y ago
From The DAO Terms: The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation. Basically, the code is the only authentic version of the contract. The attacker entered this contract and used its functionality as was programmed in the blockchain, he didn't modify a bit of the code. So it seems pretty legal.
- cyphar 10y ago
  It's fraud. It doesn't pass the officious bystander test.
  - Spivak 10y ago
    Yes, this would be considered fraud in the US legal system, but that's not the point. * If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system. * If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state.
    - cyphar 10y ago
      > Yes, this would be considered fraud in the US legal system, but that's not the point. It is the point though. It is the only point that will matter. Since the writers of the software are US citizens, it's most likely that they will get sued if the transaction is not aborted. Any scenario where the money is not returned to investors will result in the investors suing people -- no matter how much conviction people have that the DAO should be outside of the courts. > * If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system. $50 million is missing, and people feel wronged as a result. I wouldn't call it a "failure of the project" that it is accountable to the law. Nobody is above the law, not even programmers that write software which governs itself. > * If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state. Again, nothing and nobody is above the law. You'd have to overrule the Magna Carta if you wanted to change that. And that's just not going to happen.
      - thoth 10y ago
        >$50 million is missing, and people feel wronged as a result. So what is the plan going forward - if either party in a "smart contract" feels disadvantaged by the outcome - they go running to the law and outside jurisdictions for remedy? Isn't avoiding all that overhead the point of have a "smart contract" in the first place? It's an interesting concept and I'd like to see the project survive (from a technology standpoint; I not risking any cash with it)... maybe it is good they did a faceplant 6 weeks in and can start answering some very hard questions that have come up.
RcouF1uZ4gsC 10y ago
The banks pretty much state that their software is an approximate implementation of the contract not the real contract itself. They specify that the real contract is what their lawyers drew up as interpreted by a human judge considering hundreds of years of legal case law. The DAO basically said screw the lawyers and case law and precedent bullshit, the contract is nothing more or less than the results of running this program on the Ethereum VM. As the program executed a way to transfer 10s of millions of dollars and they specifically stated that the program was the contract, by The DAO no contract violation occurred, hence no hack.
cyphar 10y ago
No, it was fraud. I asked a lawyer, and the stealing of $50 million would not be considered a clause of the contract (it doesn't pass the officious bystander test). As much as programmers might try to remove lawyers and courts from our lives, they are vital to actually doing things with other people where you might have a difference of opinion on what a particular agreement means.
- coldtea 10y ago
  First of all, the "officious bystander" test is from English law, not US law. Second, while there are similar tests in other countries' legal systems, it's not that clear cut whether this would be considered such a case or not -- a single lawyer's opinion aside.
  - cyphar 10y ago
    > First of all, the "officious bystander" test is from English law, not US law. Yeah, sorry. But as you say there are similar tests in other countries. > it's not that clear cut whether this would be considered such a case or not Whether it would be considered a contract, or what are you referring to? Either way, Etherium and/or the authors of the DAO will get sued, and the investors will win the suit. If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional. And if Etherium hard forks the blockchain, then people have lost faith in the system. So IMO this won't end well for Etherium in either case.
    - coldtea 10y ago
      >If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional. Maybe you should read up on financial fraud, white collar crime and Wall Street?
- icelancer 10y ago
  The fact it has to go to the US courts is why it's a failure.