2 ms·
> It boggles the fucking mind that they didn't run a small-scale test The issue was a semantic bug in the code, which was exploited by an unanticipated usage p
by grandalf 10y ago
> It boggles the fucking mind that they didn't run a small-scale test
The issue was a semantic bug in the code, which was exploited by an unanticipated usage pattern. It is hard to catch this kind of error with testing, since the programmer is usually the one writing the test.
It is also (often) hard to catch subtle semantic bugs in code review too, unless the reviewer is looking for a known pattern of semantic bug.
There are some interesting things happening as a result -- formal verification, etc., but I am hoping that we end up seeing the emergence of an insurance market on smart contract behavior...
- pavel_lishin 10y agoI didn't mean unit tests; I meant more along the lines of a bug bounty - which is why I said $10k. "Here's a box, it has $10,000 in it. If you break it, you get $10,000 worth of Ethereum."
- grandalf 10y ago> I meant more along the lines of a bug bounty Ahh. Yes, that would have been an excellent thing to do. Even a binary future on "will the DAO be hacked" would have quickly revealed (via its price) the true risk, well before the dollar figure got so high.
- pYQAJ6Zm 10y agoI think that poses an interesting dilemma. Say somebody finds a flaw: would they really want to disclose it? If they doesn’t, and nobody else has found that flaw or any other of similar importance, they stands to benefit more by hacking the system when it goes into production.