6 ms·

Someone probably has another exploit queued up, so they can immediately create the need for another fork. Ethereum contracts have a giant target on them for sec

by seibelj 10y ago

Someone probably has another exploit queued up, so they can immediately create the need for another fork. Ethereum contracts have a giant target on them for security researchers who want to earn money.

eggie 10y ago
> Ethereum contracts have a giant target on them for security researchers who want to earn money. This is true, but the fork suggests the only way to do this will be by shorting the currency rather than trading the ETH earned from exploits.
- tromp 10y ago
  Another way is to be not as blatantly greedy. Like, steal half a million instead of 60 million. That would have made it so much harder to justify a hard fork...
- smitherfield 10y ago
  Nobody's enough of a sucker to be the counterparty to an ETH short.
  - aianus 10y ago
    Go to any margin trading site (eg. bitfinex) and there is plenty of ETH available to short with.
mikeash 10y ago
If (huge if, I know) people learn from what just happened, there at least won't be another $100 million target to exploit. The NewDAO should see much less investment until it's actually proven. Of course, it may well not happen that way.
- ohnomrbill 10y ago
  The important thing (which no fork can really change) is that the assumed likelihood of contracts having bugs went way, way up as a result of finding one critical bug so quickly in a large contract. You may not be able to steal a massive pot like theDAO again - but this shows that you can make a killing using exploits against smaller players. They either have to hard fork each time an individual gets their savings wiped out, or accept that there is risk of death by 1000 cuts when investing in ETH. Others may see things differently of course.
  - mikeash 10y ago
    It's all going to come down to risk/reward. How much work does it take to find a bug in a contract, and how much money do you get out of it? It's possible that any given contract is likely to have bugs, but that it takes so long to find them that it's not worth the effort. That assumes that different contracts have different bugs, which may not actually be the case. And of course it could be the other way around, where bugs are easy and plentiful and the whole thing collapses. It'll be interesting to see how it actually ends up.
- PeterisP 10y ago
  $100m is not really neccessary, $100k would be enough for me while also being small enough to ensure that in this case noone bothers with a fork.

by seibelj 10y ago

eggie 10y ago

> Ethereum contracts have a giant target on them for security researchers who want to earn money. This is true, but the fork suggests the only way to do this will be by shorting the currency rather than trading the ETH earned from exploits.

tromp 10y ago
Another way is to be not as blatantly greedy. Like, steal half a million instead of 60 million. That would have made it so much harder to justify a hard fork...
smitherfield 10y ago
Nobody's enough of a sucker to be the counterparty to an ETH short.
- aianus 10y ago
  Go to any margin trading site (eg. bitfinex) and there is plenty of ETH available to short with.

mikeash 10y ago

If (huge if, I know) people learn from what just happened, there at least won't be another $100 million target to exploit. The NewDAO should see much less investment until it's actually proven. Of course, it may well not happen that way.

ohnomrbill 10y ago
The important thing (which no fork can really change) is that the assumed likelihood of contracts having bugs went way, way up as a result of finding one critical bug so quickly in a large contract. You may not be able to steal a massive pot like theDAO again - but this shows that you can make a killing using exploits against smaller players. They either have to hard fork each time an individual gets their savings wiped out, or accept that there is risk of death by 1000 cuts when investing in ETH. Others may see things differently of course.
- mikeash 10y ago
  It's all going to come down to risk/reward. How much work does it take to find a bug in a contract, and how much money do you get out of it? It's possible that any given contract is likely to have bugs, but that it takes so long to find them that it's not worth the effort. That assumes that different contracts have different bugs, which may not actually be the case. And of course it could be the other way around, where bugs are easy and plentiful and the whole thing collapses. It'll be interesting to see how it actually ends up.
PeterisP 10y ago
$100m is not really neccessary, $100k would be enough for me while also being small enough to ensure that in this case noone bothers with a fork.