13 ms·
Zcoin implementation bug enabled attacker to create over 500K Zcoins
- seibelj 10y ago> If the attacker managed to liquidate their Zcoins at an average price of $1.25, they may have netted themselves upto USD 750,000. If you are a skilled programmer / security expert / mathematician, crypto currency exploit creation seems to be an extremely lucrative hobby.
- LightMachine 10y agoWhich is a great thing for the whole
- Taek 10y agoEspecially because a lot of the exploits end up being simple integer overflows or failed copy-paste
- goatsi 10y agoIndeed. Everything that crypto-currency touches gets an automatic bug bounty. With rewards that are much nicer than limited editions t-shirts.
- bbcbasic 10y agoDepends what side of the reward you are on.
- elastic_church 10y agothe savant programmer obviously
- popopobobobo 10y agoWell, same thing goes to paper note forgery.
- jedberg 10y agoExcept that, for the moment, paper note forgery is illegal but creating "extra" crypto coins doesn't seem to be.
- mikeyouse 10y agoAnd paper notes have the unfortunate characteristic of being.. paper.. the risk:reward logic is much different if you can pick your own jurisdiction to operate from and hide behind 7 proxies. It's also a very modern business model to avoid big capex expenses like printers and special paper.
- wyldfire 10y agoYou're never beyond the reach of a civil suit. If you identify yourself with the scheme and you're in the same country where there's adoption, you could be easily targeted. Plus, the language in 18 U.S.C. § 1030(e)(2) (courtesy of CFAA) refers specifically to "any computer, when [it affects] use by or for [a] financial institution." And later it mentions "...affecting interstate or foreign commerce or communication...". This statute is one that gives so much leeway to prosecutors that it's frequently abused.
- echelon 10y agoI would really like to see this happen. Without an EULA, is it even possible? Perhaps the next generation of cryptocurrencies can have a simple EULA that prohibits exploitation and can be used to firewall off stolen coins.
- stale2002 10y agoUhhh, no. The whole point of cryptocurrencies is that they are permissionless. Government censorship of coins or transactions is an attack vector, not a feature.
- wyldfire 10y agoAn EULA ("End-User License Agreeement") has to do primarily with copyright (17 USC [1]). As such it's pretty much orthogonal to the criminal statutes related to this act of "misusing" cryptocoins. > next generation of cryptocurrencies can have a simple EULA This is anathema to the nature of cryptocurrencies, all (?pretty sure all that matter anyways) of which have Open Source implementations. Really, most cryptocoins which are worth anything have already had a big market cap "bounty" that has effectively proven their safety. We don't need a EULA. Like I said, you could maaaybe sue for damages. Unfortunately there's no easy way to undo the impact to a coin's reputation once it's shown to have a weakness like this. Even once the bug's patched and the nodes all get back on board, exchange rates will suffer for a long time. [1] https://en.wikipedia.org/wiki/Title_17_of_the_United_States_Code https://en.wikipedia.org/wiki/Title_17_of_the_United_States_...
- tyingq 10y agoThere's even room for marginally technically skilled to rake it in. I think Karpeles is still out on bail. And there's a few that did well with just marketing skill and vaporware mining gear.
- nathancahill 10y agoDon't "mine" gold, sell shovles.
- paulcole 10y agoDon't "sell shovles", license spellcheck software.
- bbcbasic 10y agospellcheck? I have no need for this, I am not a witch.
- Sanddancer 10y agoI'd take that as not even needing to sell what's needed, sell approximately what's needed. Your snake oil just needs to make their cough hurt a bit less, not cure their tuberculosis.
- EGreg 10y agoDo you think this is immoral? I am genuinely curious as to what the arguments would be one way or another. People are taking a risk with these things and they know they're risky. So it's not really stealing.
- flatline 10y agoI believe it is a crime, both in spirit and on paper. In spirit, you took something that was not yours and not meant for you, and by selling the coins you decreased the value of everyone else's. On paper, let's say that the developers behind whatever coin you hack decide that they are going to take no action. You still run afoul of countless computer security laws designed, however poorly, to protect people from hacking, so at least in the first world you could find yourself in a legal bind if your identity is ever discovered. Even if the devs don't go after you, the rest of the community may, or the government may of its own accord. Now, in keeping your identity private, you have to launder the money, putting you in violation of even more laws and ones that the government will most definitely care about. The biggest player left is probably the IRS, who will take all kinds of interest in either your newfound, undisclosed wealth, or your half million dollars in untraceable gambling wins. It's an extremely reckless move unless you are effectively a pirate living in some lawless part of the world with good connections to foreign banks.
- prance 10y ago> You still run afoul of countless computer security laws Only if you're citizen of/doing it in a country with such laws.
- TheSpiceIsLife 10y agoAnd with all that said, this type of activity is still attractive to some folk. I'm content getting my kicks out of intentionally running the occasional red light. But it takes all types. Imagine how boring the world would be without crime!
- bubblethink 10y agoThe OP's point was about morality, and it is as immoral as cheating in any system. Whether it's a crime is entirely different. Crime necessitates a judicial system, and the whole framework of crypto currencies has be outside the purview of any government or judicial systems. So the word crime itself doesn't mean anything in this context. Secondly, your argument relies heavily on the gravity of this act, which is entirely derived from the implied value of the coin. In isolation, this is no different from someone cheating in a computer game. Note that you cannot make the computer game analogy with other markets and banking systems easily because of dependence on other inputs. This, in contrast, is completely isolated from the rest of the world. As such, the guy may not do anything with the coins, and they would cease to exist (in their universe much like how they came into being). Would your argument still hold ? The fact that people have created a secondary market out of the coins, which came into existence out of thin air in the first place, doesn't automatically determine the criminality of the act.
- repomies6991 10y agoWell, crypto/bitcoin businesses in general tend to be quite lucrative. However lots of risks as well. For a security researcher there are no downside risks as much.
- matt4077 10y ago> crypto/bitcoin businesses in general tend to be quite lucrative. That's called a pyramid, or ponzi scheme.
- leadingthenet 10y agoJust to clarify: are you saying Bitcoin is a Ponzi scheme?
- leadingthenet 10y agoJust to clarify: are you saying Bitcoin is a Ponzi scheme?
- TD-Linux 10y agoNote that this is unrelated to Zcash, the zk-SNARKS based cryptocurrency perhaps more known to HN.
- sigmar 10y agoPeople complained a lot for 10% of Zcash going to the founders (in the form of a 20% draw on the first half of mining). But that value and expertise are used to ensure bugs like this Zcoin attack do not occur.
- hueving 10y agoThere is no proof that currencies that have pre-allocations for certain people are more bug-free than ones that don't.
- jacquesm 10y agoI'd argue that any pre-allocation should be seen as a bug and so the number of bugs on average is about 1 higher in those cases.
- JumpCrisscross 10y ago> used to ensure bugs like this...do not occur Then compensate for that. Create a pool that pays out for each year without vulnerabilities.
- sigmar 10y agoIf there are vulnerabilities, those vulnerabilities will be exploited. That will reduce the currency value and the value of their 'founders reward'
- lend000 10y agoNot if they cash out during "IPO." I don't like the idea of a founder/developer pool, but if they are going to have one, there should be a vesting period, such that the granted coins cannot be moved for X years after receiving them. This will keep the incentive alive, and I think Ethereum would have a lot more potential if something like this was employed.
- kondro 10y agoIm curious. Is this actually illegal? Is there any requirement on how valid crypto currency is created? I understand the network could implement a fix and prevent future transactions or even roll back old ones if there's enough desire, that's what democracies are about right? But was there anything illegal about creating and then trading them? A rollback would hurt the exchanges, but if they didn't already have something in their T&Cs about currencies needing to be created legitimately (and what legitimately actually means), then is it anything other than morally wrong?
- belovedeagle 10y agoThis could probably be spun as a violation of the cfaa. IANAL, but the practical interpretation of that seems to be "don't do bad stuff using a computer", kind of like mail fraud but worse.
- austenallred 10y ago> This could probably be spun as a violation of the CFAA I'm not sure there's much that couldn't
- vortico 10y agoYour mildly snarky response has been recorded and you will be fined $120,000 for use of a computer for producing such a comment.
- 07d046 10y agoI'm under the impression that the general philosophy of cryptocurrencies is that the code is the law. You can do anything that the code will allow you to do, because it's designed so that you can trust the system and not people. It's a small step to say that it's also not the programmers' intent that matters, but the code itself, because it's the code that matters, not people. (I'm not sure how this relates to courts of law.)
- iopq 10y ago
- eruditely 10y agoIs this displaying in a weird way for anyone else? I half thought that this was a bug or something, some attack(?).
- Sunset 10y agoWorks ok. Try Archive.is
- tedunangst 10y agoFrom the blog post explaining the bug, https://zcoin.io/language/en/zcoins-zerocoin-bug-explained-in-detail/ https://zcoin.io/language/en/zcoins-zerocoin-bug-explained-i..., how is that not a "useless statement has no side effect" warning?
- Sanddancer 10y agoIt does. It seems like the devs are of the "it compiles, ship it" sort. Building the source, I'm seeing all kinds of warnings -- the code trying to return consts, warnings about sign differences, etc. Looks like lots of potential places for naughtiness to occur.
- martinpw 10y agoIndeed. I was hoping that the blog post would conclude with a section describing how they had learned an important lesson and would now be much more strict about dealing with this compiler warning in particular, and indeed compiler warnings in general, but there was nothing like that. Which implies it will quite likely happen again.
- SCAQTony 10y agoIf I were to put a soundtrack to that article it would be "The B-52's, 1983 hit, "Legal Tender." The thievery in industry never stops.
- known 10y ago"Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the Universe trying to produce bigger and better idiots. So far, the Universe is winning" --Rick Cook
- Sunset 10y agoThe whole world runs on ducttape and bubblegum and it's a small miracle that satellites aren't falling out of the sky and everything isn't on fire all the time.
- WalterBright 10y agoThe error is here: https://github.com/zcoinofficial/zcoin/blob/81a667867b5d84893e4c225a8d73eddd78ac16c2/src/main.cpp#L963 https://github.com/zcoinofficial/zcoin/blob/81a667867b5d8489... and the line of code: zccoinSpend.denomination == libzerocoin::ZQ_LOVELACE; In other words, a statement with no effect. In D, such a line gives an error, not a warning: Error: == has no effect in expression You can force the statement to be accepted by casting it to void. It's really past time for languages to not accept such code any more. Legacy code needs to get fixed.
- Strom 10y agoAny C++ static analyzer worth its salt would catch this. I don't think this is so much of a C++ language issue, but more of an issue with C++ environments/compilers not doing static analyzing by default, and/or the authors of this software not being aware of the fact that they need to use static analyzers.
- WalterBright 10y agoYou're right. My contention is that the language itself should no longer accept such code, it shouldn't be relegated to an ignorable warning or a 3rd party tool that isn't run.
- Strom 10y agoYes, major improvements could be made by changing the defaults of the tools that beginners use. I edited my original comment to be more clear on this as well.
- WalterBright 10y agoI think we're going to have to disagree. It isn't just an issue for beginner code. Experts make such mistakes, too. Expecting them to not make mistakes is unrealistic, and sending them back for more training isn't going to work, either. I can't think of a reason any modern language should accept such code. If you're interested, I recommend the series "Air Disasters" on TV. Each episode analyzes one crash, where investigators determine the cause of the accident, and what the corrective action should be taken. Often, it comes down to "how could a pilot with 10,000 hours experience make such a mistake". While it would be easy for investigators to blame the pilot, often they find that the mistake was just too easy to make, and they recommend changing the design or procedures or both.
- davidgerard 10y agoIn which a premined altcoin scam is outscammed because the preminers were sloppy.
- MrDosu 10y agoI always wonder how these "five conditions ANDed together in an if" make it past code review in general (i know thats not where the actual bug was). I don't care how brilliant a programmer you are, but mistakes in those are very difficult to grasp.
- jacquesm 10y agoThat's the equivalent of a 32 branch switch statement in one line. So only 31 other cases to test for, now let's hope they did all those tests.
- dtran 10y agoI'm definitely not advocating for unnecessarily complex or long conditionals on a single line or any other hard-to-grok code, but this comment reminded me of something I just learned recently! Someone on my team introduced me to property-based testing, which generates ranges of test cases that would otherwise be very repetitive to write manually. We've used http://hypothesis.works/ http://hypothesis.works/ in a few places recently and caught bugs that we might have missed if we had just written tests the usual way.
- jacquesm 10y agoWere you using their python version or the Java one?
- dagw 10y agoI always wonder how these "five conditions ANDed together in an if" make it past code review in general Easy. Either there is no code review, the code review is done by someone who has far too much on his plate a works on the theory that as long as it compiles and runs it's probably fine or the code review is done by someone likes writing code with five conditions ANDed together in an if and thinks it's fine
- anjc 10y agoAs convoluted as they can be, what alternatives are there other than nested conditions, which are equally convoluted? Surely if you need to logically compare five variable then you'll be doing it in some variation of 5 chained operations.
- gankedfrank 10y ago"""frankly I don't even know how zero-knowledge proofs work""" Isn't this that same guy?
- prance 10y agoI'm not too familiar with cryptocurrency or generally blockchain implementations, so I wonder: shouldn't it be normal that at least the reference clients of any such protocol should be proven correct, and follow a rigorous scheme accepting contributions? I mean, all the mathematical rigor and proofs of the underlying theory and protocols are basically useless if the rigor isn't carried over to at least the reference implementations. (If people choose to use alternative, non-proven clients, fine, that's their own decision and risk.)
- rebuilder 10y agoThat's not really how the whole scene works. There's little upfront demand for such rigour, because the potential userbase for any given coin largely don't know to demand it. Instead, poor implementations fail and either get discarded or patched, and eventually, hopefully, whatever remains will be solid. What I'm trying to say here is, the whole cryptocurrency field is much, much messier than you seem to expect.
- prance 10y agoWell, maybe I was indeed too optimistic about a field that's both open source and has the word "crypto" in it :(
- yjgyhj 10y agoThe point I'm about to make in this comment is so old and has been said so many times that we all are tired of hearing it. But why do we use a language like C++ to implement something where we don't wish to have bugs? C++ is not memory-safe (no GC or whatever Rust does), it's not type safe (in the ML sense), it relies on writing to memory a lot (instead of having pure functions). Had this program been written in Ocaml or Haskell or a strongly typed functional Lisp, this bug would have been impossible to make. Why do we do this, still? Is it not irresponsible?
- willtim 10y agoLuckily there are some Blockchain/Crypto currency startups that do understand the value of using something like Haskell. See https://iohk.io/projects/cardano/ https://iohk.io/projects/cardano/
- wyager 10y agoThese pump-and-dump schemes are getting ridiculous. Implementing a cryptocurrency client in Haskell isn't enough to justify creating an entirely new currency. Whether or not the protocol itself is sound is (almost) completely orthogonal to the language in which it's implemented, and at this point there are dozens of Bitcoin clients written in many languages (including Haskell [1]), so it's extremely unlikely that Bitcoin as a whole is still at risk from unsafe language choice. 1: http://haskoin.com http://haskoin.com
- NKCSS 10y agoBecause old habits die hard. Using 'unmanaged' languages for 'performance' reasons is no longer a good reason, because the likes of C# have shown multiple times that there is no reason to choose C++ over C# if you look at performance alone (difference is neglible).
- iopq 10y agoThe difference is not negligible: http://benchmarksgame.alioth.debian.org/u64q/compare.php?lang=csharpcore&lang2=gpp http://benchmarksgame.alioth.debian.org/u64q/compare.php?lan... Sure, it's silly benchmarks, so I wouldn't take the results as gospel. But the fact is, nobody who writes C# managed to produce a benchmark yet that beats a C++ program. Fast languages like Rust have managed to at least match the performance of C in some benchmarks (and even beat it in others).
- alienjr 10y agoCentral banks have similar bug with government money.
- 10129838131 10y agoWaiting for: IBM/Maersk blockchain bug caused 548,000 containers to end up in Lagos.
- hodder 10y agoSerious question... is this a crime?
- abrkn 10y agoI spent quite a bit of time and effort on Zcoin during the launch, including setting up the first block explorer and mining with hundreds of EC2 instances to the point where I possessed more than 30% of the money supply. It was a disaster. Some founders started selling their Zcoin as soon as it was listed on an exchange. The mining algorithm was changed several times. It's a shame. Zerocoin, the underlying technology, is interesting.