18 ms·

Parity Wallet security alert

394 points by g09980 9y ago

g09980 9y ago
The transaction that nuked the library contract: https://etherscan.io/tx/0x47f7cff7a5e671884629c93b368cb18f58a993f4b19c2a53a8662e3f1482f690 https://etherscan.io/tx/0x47f7cff7a5e671884629c93b368cb18f58...
alva 9y ago
Early estimates suggest $270m worth of Ether has been permanently frozen. Coming 4 months after multimillions stolen from the same wallet.
- deleted 9y ago
  [deleted]
- nikcub 9y ago
  Polkadot has its raised coins in a Parity multisig wallet, and it alone is ~$140M iirc: https://twitter.com/polkadotnetwork/status/927880762053021702 https://twitter.com/polkadotnetwork/status/92788076205302170... edit: they just put out a post to say that not all of their funds were in a Parity multisig wallet: https://medium.com/web3foundation/web-3-multi-sig-wallet-update-245d30df0fb3 https://medium.com/web3foundation/web-3-multi-sig-wallet-upd...
- roywiggins 9y ago
  "The good news is, you still have your Ethereum. The bad news is, you always will..."
  - willitpamp573 9y ago
    Which defeats the purpose of Ethereum, which is to get in, get rich quick, and get out!
- tootie 9y ago
  Permanently frozen? What does that mean? It's as good as gone?
  - alva 9y ago
    Basically good as gone. It is there, just no one can ever access it.
    - lurker456 9y ago
      until the next hard fork
  - CodesInChaos 9y ago
    It means it's gone, if the contract is followed. But a hardfork of Ethereum could change the rules to recover the coins. A similar recovery already happened once, after somebody exploited a bug in The DAO, resulting in a fork into Ethereum and Ethereum Classic, which rejected changing the rules to bail out bugged but too-big-to-fail smart contracts. > In May of 2016, a venture capital fund called The DAO built on Ethereum raised around $168 million, with the intention of investing in projects using smart contracts. In the same month a paper was released detailing security vulnerabilities with The DAO that could allow ether to be stolen. In June, 3.6 million Ether (approximately $50 million USD) was taken from accounts in The DAO and moved to another account without the owners' consent, exploiting one of the vulnerabilities that had been raised in May. Members of The DAO and the Ethereum community debated what actions, if any, should occur to resolve the situation. A vote occurred and in July 2016 it was decided to implement a hard fork in the Ethereum code and to move the Ether taken in the exploit to a new smart contract through which it would be restored to the owners from whom it had been taken. > Ethereum Classic came into existence when some members of the Ethereum community rejected the hard fork on the grounds of "immutability", the principle that the blockchain cannot be changed, and decided to keep using the unforked version of Ethereum. https://en.wikipedia.org/wiki/Ethereum_Classic https://en.wikipedia.org/wiki/Ethereum_Classic
provost 9y ago
> This means that currently no funds can be moved out of the multi-sig wallets. Wait, am I reading this right? All multi-sig wallets are frozen due to this? This is surely concerning, as I've seen others recommend multi-sig wallets as a security best practice. Can anyone comment on the method in which they might revert this? Would it require a hard fork.. again?
- bhaak 9y ago
  > All multi-sig wallets are frozen due to this? All multi-sig Ethereum wallets created by Parity (or using the Parity contract code). > Can anyone comment on the method in which they might revert this? Would it require a hard fork.. again? So far, it doesn't look like you can do anything about it. Of course you can change everything with a hard fork but as this time it doesn't compromise the move to PoS, I don't think a hard fork will be the favored solution. But this time, there is no deadline, so it can be discussed thoroughly.
millette 9y ago
Github issue: https://github.com/paritytech/parity/issues/6995 https://github.com/paritytech/parity/issues/6995
Slartie 9y ago
I am wondering what exactly has been the point of having this code separated in this "library" in the first place, instead of just duplicating the code for each owner of a multisig wallet. It can't be to ease the update process of the core multisig code (since the library is just as non-updatable as any other contract), which otherwise is a typical reason for separating stuff into shared libraries. Has this extra layer of complexity really been injected just to save some bytes on the blockchain?
- bitcoinmoney 9y ago
  it is a way to save on gas. Imagine all those functionality being deployed everytime someone creates a multisig. I read somewhere that the savings are in 90%? In absolute terms though I think it is very minimal and people just got way too cute with shared libraries. Again, I wouldn't trust >1M on a couple of lines of code.
Kiro 9y ago
How can a library be nuked? I thought you deployed static immutable code to the blockchain (I actually have no idea how this works). > I made myself the owner of "0x863df6bfa4469f3ead0be8f9f2aae51c91a907b4" contract How is that possible?
- deleted 9y ago
  [deleted]
- Slartie 9y ago
  The code is immutable, but Ethereum has a functionality called "suicide" by which a contract can, well, commit suicide. It is kind of like a deletion, in that the code can't be executed anymore afterwards, but of course the blockchain still contains the contract in its original, unmodified form. AFAIK this feature was introduced to make owners capable of deactivating contracts which contain known security bugs (so at least nobody can accidentially send any more money to those contracts). And because that's the intended purpose, a suicide is non-revokable, so a dead contract remains dead forever. A library apparently can be nuked because Ethereum does not explicitly have a concept of "libraries". They are after all just contracts, with the only difference being that they are intended to be called by other contracts instead of humans. I see the next controversial, but eventually Vitalik-blessed hard fork incoming...
  - bhaak 9y ago
    > A library apparently can be nuked because Ethereum does not explicitly have a concept of "libraries". They are after all just contracts, with the only difference being that they are intended to be called by other contracts instead of humans. That's not correct. There is a construct "library" that is different from a normal contract. But the code in question didn't use that (for whatever reason). http://solidity.readthedocs.io/en/develop/contracts.html#libraries http://solidity.readthedocs.io/en/develop/contracts.html#lib... > I see the next controversial, but eventually Vitalik-blessed hard fork incoming... I wouldn't be so sure. It's only about 1% of all ETH and the funds are frozen. The DAO hack was ~15% and would have put those funds into the hand of a single entity which would endangered the eventual move to PoS.
bhaak 9y ago
The way it looks like, those Ethers are quite safe. Parity's refactoring of the official audited multi-sig contract code has fucked up again. I wonder if they even audited their code. The post-mortem of the last incident https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ evades that question under the paragraph "Was the wallet not audited?". If they used a library instead of a contract, this wouldn't have been possible. I hope they had a reason to use a contract otherwise they clearly have noone else to blame this time.
- ceejayoz 9y ago
  They're very safe - per https://twitter.com/dguido/status/927896527107952640 https://twitter.com/dguido/status/927896527107952640, they're stuck there forever.
  - nikcub 9y ago
    > they're stuck there forever. It's ethereum, they'll just hardfork those coins back Apparently almost $300M stuck - I don't see them not bringing up another hard fork to retrieve them
    - charlesdm 9y ago
      Well, that's one way to solve the inflation problem before PoS.. Perhaps it can be fixed though, as part of the next hard fork.
    - jononor 9y ago
      Depends on how good friends the affected users are with key players in the Ethereum community...
      - TD-Linux 9y ago
        One of the Ethereum founders (Gavin Wood) lost the proceeds from their recent ICO to this bug. So, very good friends?
seanwilson 9y ago
Can someone break down how funds have been frozen and what the bug that's being exploited is for those less familiar with Ethereum? From what I've read about Ethereum's contract language, it doesn't make itself easy to statically verify properties you want to check so I don't see how problems like this are going to go away until another language is used.
- Slartie 9y ago
  If I get this correctly, this is what happened: The parity wallet uses a "shared library" in which the actual logic is implemented. All individual wallets have their own data storages and coin balances, but contain just a little bit of logic code that redirects calls to this shared codebase. This shared library itself is also just a contract, except that it's intended to be called internally by other contracts (the different wallets). Though it typically doesn't happen, it can be called directly by humans. This is what the makers of this "shared library" apparently forgot to consider, until somebody called the "initialization function" of the shared library directly. By doing this, the shared library initialized itself as if it was one of the individual wallets that normally call the library. It therefore used its own (previously unused) data store, in which it correctly entered the caller of the init function as owner. This wasn't of use for anything, as there are no ethers at all on the shared library, so the owner could not steal any funds. But being the owner, he was able to trigger the kill switch! Since this particular "multisig wallet" was actually not a wallet, but the shared library, killing it not only killed the (empty) wallet, but also the core functionality of all the real wallets that contain real money out there! And of course that functionality is mandatory to work with the funds of these wallets. Without it, the money cannot be moved anywhere. Now comes the fun part: suiciding a contract normally transfers all ethers on that contract to the caller of the suicide function. Knowing this, you could expect that the individual wallet owners could just as easily suicide their now "brain-dead" multisig wallets as well, thereby recovering their funds...but that doesn't work, as performing the suicide requires a call to the shared library to check whether the callers' signatures qualify the caller to perform that suicide ;-)
  - seanwilson 9y ago
ryanlol 9y ago
Another ethereum hardfork coming in 3... 2... 1... Are these guys ever going to learn?
- zaarn 9y ago
  How much are you willing to bet there will be hardfork? I'd be willing to bet some against a hardfork happening.
  - mannykannot 9y ago
    Would creating a contract for that bet be an interesting programming challenge? What would happen to that contract in a hard fork?
    - zaarn 9y ago
      AFAIK hardforks are hard to detect by a contract, the contracts don't know anything outside the chain, if you split the chain, you can't tell there is another. Of course I've briefly entertained the idea but on the other hand, a bet between two mostly-honest individuals doesn't need a blockchain contract, similar to how I don't need a blockchain contract to borrow money from my sister and pay it back later. In any case, if there would be a hardfork, it would include the replay protection, so a simple but working solution would be to prepare a transaction for the fork chain and one for the non-fork chain, the participants can then publish the transactions once either chain becomes available and claim the reward.
      - 1up8192 9y ago
        It wouldn't be that hard in this case. You just have to watch for an address holding stuck ethers because of the bug, if the ethers move, it is a proof that a fork has happened.
    - mitchellberry 9y ago
      It would be a good introduction to solidity and the 3rd party problem of smart contracts. An example betting contract for anyone interested (note it was eventually refunded and not run): https://etherscan.io/address/0xf4b8ccc5734ed7d2d8beb5fddd223d25e55748bc#code https://etherscan.io/address/0xf4b8ccc5734ed7d2d8beb5fddd223... And an overview with some reasonable criticism: https://www.reddit.com/r/ethdev/comments/6sd8hl/mayweather_vs_mcgregor_parimutuel_smart_contract https://www.reddit.com/r/ethdev/comments/6sd8hl/mayweather_v...
homakov 9y ago
FYI this is not the reason Ethereum failed as a blockchain. Security bugs are bad, but what's worse is 9GB/week bandwidth requirement = 3 hours sync on average world connection, if you're lucky. No idea why everyone ignores this metric. And that's why Bitcoin is still somewhat blockchain (also poor sync, but doable)
- jameskegel 9y ago
  This brief comment intrigues me; can you provide more detail?
  - homakov 9y ago
    Wrote this piece for you https://medium.com/@homakov/weekly-sync-friction-the-most-important-blockchain-security-metric-1042c0c172b7 https://medium.com/@homakov/weekly-sync-friction-the-most-im...
    - jameskegel 9y ago
      Thank you
- shawabawa3 9y ago
  9GB/week is not huge at all, and ethereum nodes are not designed to be run on "average world connection". The only people running full nodes realistically should be on extremely fast connections. Bandwidth and storage are only getting cheaper Also "Ethereum failed as a blockchain"? They're the 2nd largest coin after bitcoin, it can hardly be called failed
  - homakov 9y ago
    >9GB/week is not huge at all It's a lot on average. https://medium.com/@homakov/weekly-sync-friction-the-most-important-blockchain-security-metric-1042c0c172b7 https://medium.com/@homakov/weekly-sync-friction-the-most-im... >They're the 2nd largest coin after bitcoin, it can hardly be called failed "caps" are short term hypes, they are not definition of blockchain. Say, Ripple is not a blockchain at all. Try critical thinking, highly recommended.
zaarn 9y ago
Quite interesting. Luckily I moved away from my Parity Multisig a while ago and use my Trezor now. The multisig is vulnerable... I love this feeling of living on the edge when I know that I just evaded a critical bug that could have cost me a lot of money. Though, a lot of people who aren't me will be a lot more angry, especially (and probably only) people actively using the multisig.
slimshady94 9y ago
Isn't it possible to generate a new token that has the same amount of ether lost, and airdrop it to those addresses? That token can be assumed to replace ETH (call it ETH1), and should have the same dollar value in trading markets.
- jcousins 9y ago
  Entities owning those new tokens would rush to the exit, sending the new token towards zero would be my guess.
deleted 9y ago
[deleted]
angrydev 9y ago
Good summary article: https://blog.springrole.com/parity-multi-sig-wallets-funds-frozen-explained-768ac072763c https://blog.springrole.com/parity-multi-sig-wallets-funds-f...
ceejayoz 9y ago
It's probably safe to assume that the title of "most expensive software bug in history" will be held by a cryptocurrency glitch within the next couple years. It's nearing the couple-hundred-million mark of things like Knight Capital or Ariane 5's Flight 501.
- tomalpha 9y ago
  Not to disagree with the thrust of your argument, but Knight Capital's meltdown was nearer $450 million.
Cshelton 9y ago
So I see this as a growing pain. But this is something that has already been thought of as something that could happen, and there is work looking into how to solve it going back a ways: https://github.com/ethereum/EIPs/issues/156 https://github.com/ethereum/EIPs/issues/156 It looks like if this EIP is implemented in the future, the address that created the original multi-sig wallet contract created after July 20th, would just be sent the ether balance in the wallet. I'm not sure on this, but it seems like, if implemented in the future, an owner of a multi sig wallet that is frozen can call this contract from the same address they created the wallet with and it will retrieve the ether from the address where the contract is now blown away? Another option would be during the next planned fork (upgrade), to just say, any contract that matches the byte code of the frozen wallet one, just replace the code with this code and move on. Although the first option is MUCH nicer and future proof. People will write bad code and things like this will happen. I think the more often and earlier on we find these types of flaws and can fix them, the better for the whole ecosystem. It's $300 million today... in 10 years, a mistake like this that hasn't been worked out could cause a shock to the entire world economy. (run on the banks, but there are no banks and everyone's funds are frozen...panic!) So better now than later!
- joosters 9y ago
  Do you really think a $300 million bug is an acceptable 'growing pain'?
  - yarrel 9y ago
    A billion-dollar one was.
  - erikpukinskis 9y ago
    The Pound Sterling had a $1 Billion dollar growing pain. The hacker was George Soros: https://en.m.wikipedia.org/wiki/Black_Wednesday https://en.m.wikipedia.org/wiki/Black_Wednesday Have you lost faith in the Pound yet?
    - tom_mellior 9y ago
fokinsean 9y ago
Holy shit, I just moved my ether off of coinbase on sunday so that it could be more secure and almost chose parity, but went with MyEtherWallet instead. This makes me feel like there is no safe way to store my ether now.
- g09980 9y ago
  To be clear, neither the regular Parity wallet nor MyEtherWallet are affected here. Also, they don't store your coins, all they can ever do is sign and publish transactions when given access to your private key. Parity multi-sig wallets are an entirely different beast. Bit of a confusing naming issue: Parity wallet: light client software that accesses the blockchain. Parity multi-sig wallet: a smart contract deployed on the blockchain, with the coins stored within this contract. The latter is what was affected.
  - fokinsean 9y ago
    Ah okay, thanks for the explanation. I've heard of multi-sig wallets, but wasn't quite sure what they actually do. From what I can tell they are supposed to be more secure, so it is a bit ironic that this is the second time multi-sig wallets have had issues.
- bitcoinmoney 9y ago
  this only affects multisig
- fizwhiz 9y ago
  Serious question, what's wrong with parking funds in a coinbase ETH vault when compared to something like MyEtherWallet/Parity?
  - grafporno 9y ago
    Remember the mtgox debacle..? That is what's wrong with that.
ve55 9y ago
It's pretty bad when the type of wallet that is supposed to be more secure has bugs like this multiple times. For reference, this only affects multi-signature wallets, not normal wallets. Very few normal users use multi-signature wallets. The previous bug with these was very trivial and could have been caught by a unit test or a simple code review, and it resulted in around 9 figures (USD) of Ether being stolen. This bug looks like it's exactly the same. A very simple bug that could have been caught by a simple test or manual audit, and has resulted in 9 figures USD being locked instead of stolen this time. As mentioned by others it's possible at some point (not any time soon) that this frozen ETH can be recovered (https://github.com/ethereum/EIPs/issues/156 https://github.com/ethereum/EIPs/issues/156) by adding rules to recover it in the next Ethereum hard fork. Not creating a specific hard fork just for this, but adding it to one that is planned in the future. That might come across as controversial, and cannot be guaranteed though. For safely storing Ethereum I would advise to keep it out of smart contracts, period. Cold storage and hardware wallets exist, and they are much less likely to have critical bugs related to them than a smart contract is.
- imaginenore 9y ago
  “Code is Law” fails again.
- VMG 9y ago
  Reposting dead, but accurate comment: “Code is Law” fails again. There will probably be a hardfork and increased moral hazard for auditing contract code. Why spend money finding bugs if the "immutable" blockchain can be rolled back?
  - api 9y ago
    "Code is law" demands much better code. A language like Haskell is needed.
    - chowells 9y ago
      Eh. Haskell is a general purpose Turing-complete language. Smart contracts need something far safer.
jimrandomh 9y ago
Parity appears to have a bug bounty program, but the bounty is only $100. Given that they've now had two bugs that caused 9-figure losses in the past year, this is clearly too low. They need real auditing, and they need to pay the market price for real auditing.
- mannykannot 9y ago
  You are right, but unfortunately, the de-facto bug bounty for unethical hackers is way beyond anything that could be offered to well-intentioned researchers. This makes your suggestion of professional auditing the highest priority.
  - gcb0 9y ago
    bug bounties don't compete with crime. crime always will pay more. bug bounties compete among themselves. Honest researchers will be busy finding some mobile game bugs for $700 a pop or improving security at google or yahoo for up to $10k instead of helping your company save from a 9 figure bug because you only offer $100
- whyever 9y ago
  > but the bounty is only $100. This is the minimal bounty.
  - lurker456 9y ago
    I wondered why you didn't mention the maximum, and after checking their website found no other figures besides the $100 minimum. They do state "Rewards over the minimum are at our discretion, but we will pay significantly more for particularly serious issues, i.e. that the identified issue could put a significant number of users at risk of severe damage, monetary or otherwise." What they consider significant is anyone's guess. Given the stakes, even a 10000% increase would still be underwhelming for a high impact bug.
    - mannykannot 9y ago
InclinedPlane 9y ago
Ethereum seems to be based on the principle that it's possible to write bug free code easily. It's working out about as well as I'd expected.
eyezick 9y ago
https://github.com/ConsenSys/smart-contract-best-practices/blob/master/docs/general_philosophy.md https://github.com/ConsenSys/smart-contract-best-practices/b... Bullet #1: Prepare for failure
naasking 9y ago
This might sound mean, but I laugh every time I see Ethereum bugs in the headlines. The developers intentionally made their platform analytically intractable, despite knowing the dangers this presents given our long history of vulnerable software. They then compounded this poor choice with an Ethereum programming language with poor and insecure semantics. I applaud the ambition behind Ethereum, but not it's technical choices.
- ifdefdebug 9y ago
  Hey, this is the first programming platform where everybody writes guaranteed 100% bug-free programs... by definition...
- Drdrdrq 9y ago
  This. It reminds me of PHP in many aspects - Solidity is just awful. Like the way the multi-dim arrays' sizes are written in opposite order to the one used when accessing values? Pure genius. </s>
cocktailpeanuts 9y ago
Solidity needs to get rid of features like library and inheritance. If you write an unstoppable contract that is responsible for holding hundreds of millions of dollars, you alone should be responsible for it, and not some library you used. Better yet, people who have the mindset that it's ok to have these hipster "modular" features that spread out the responsibility (for whose benefit?) should really not be working on such fundamental pieces of technology. If you write software that holds people's money and you fuck up, you and only you are responsible for it. This is a recurring theme with the Ethereum community where people complain about how there was a bug in the system which resulted in a huge hack and people losing tons of money, and developers say "hey don't blame me I just used some library, it's the library's fault".
- root_axis 9y ago
  Certainly each person rolling their own is going to end up worse than the use of modules that are improved over time.
  - MichaelBurge 9y ago
    Most of the trouble is on the module boundary, so improving the modules themselves probably isn't worth as much as you'd think.
- mifeng 9y ago
  Since contracts are immutable, you need modularity to be able to fix bugs like what happened with Parity. The problem is that Solidity libraries are also immutable, which means you can't fix them. The solution is easy: just use contract modules, not libraries.
  - cocktailpeanuts 9y ago
    No you don't. That's a myth. Having modularity in these things only amplifies the damage when something DOES happen. I'm not saying it is bad to have a centralized auditing of contracts, but I am saying it's not a good thing to simply import libraries and inherit some other abstract contract you don't fully understand when it comes to irreversible contracts. This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.
lokerfoi 9y ago
They'll fork it again. The language used is unsafe, and developers didn't test properly. What can be done? Fork I guess. Or maybe leave the developers developing on the Ethereum platform to just fail?
- billmalarky 9y ago
  Why would it need to be forked? Couldn't the smart contract language just be upgraded for better security then deprecate DAPPs using the old language?
  - lokerfoi 9y ago
    They'll fork it to unfreeze millions of funds. It's just funny how decentralized currency is so easily swayed by a few individuals to serve their purpose.
    - zeep 9y ago
      they need to have a majority of mining power moving to the new fork for it to work though...
  - shallot_router 9y ago
    If they don't fork, everyone affected by this will lose all of their ETH. Many would argue the correct thing to do is to not fork and say that people knew the risks beforehand, etc. But that's what people said last time and they still forked, with no (apparent) severe consequences other than complaining about integrity. Two forks may be harder to justify.
    - billmalarky 9y ago
      Ah that makes more sense. I was thinking he was saying they would have to fork for a technical reason not political.
  - johnvonneumann 9y ago
    It will be forked because they have history of forking when people "lose" funds.
SubiculumCode 9y ago
Frozen money. Doesn't sound like a cash replacement to me.
- jsonhero 9y ago
  Banks get hacked all the time
  - TAForObvReasons 9y ago
    Banks have government backstops and other provisions in place to ensure that a hack doesn't result in customer loss of funds. No equivalent here
    - fleitz 9y ago
      Suddenly lots of people with guns to go get your money back is a very useful feature compared to some cryptographic guarantees that people with guns can't get your money back.
      - EGreg 9y ago
        Oh please, consider the freedom of people to lock up their money and not get it back! These men{!} with guns first send a letter to an ETH autonomous corporation, then when it doesn't respond, they threaten it with guns. That's the State. {!} Thanks to today's progressive reforms the State now also employs women with guns. We should just say people with guns to not be sexist.
        derefr 9y ago
        A given "ETH autonomous corporation" might not have any controlling entities that are accessible to the wronged State. Foreign shell companies are already hard enough for most governments to deal with—and that's with trade agreements that enable them to compel disclosure of ownership. DACs are foreign shell companies without a governing state to point guns at. Sure, if the DAC does business in the US, the US government can shut that business down—much like the US government can shut down a domain name associated with foreign illegal activity. But that doesn't stop the business from operating anywhere else. Nobody has the ability to shut down the whole business.
convery 9y ago
I mean, for a currency replacement that will solve all the worlds problems; it sure seems to be a lot of news about large thefts and issues leaving people unable to spend their money..
viach 9y ago
Price is failing, good time to buy. /irony
pixelperfect 9y ago
A few months ago as a newcomer to Ethereum, I looked into Solidity and concluded that due to the poor design of the language, large-scale problems like this would be inevitable. I decided not to invest in ETH. In my opinion, smart contracts are a good idea, but smart contracts written in Solidity are a bad idea.
- DennisP 9y ago
  The issue in this case isn't so much Solidity, as Parity getting too fancy with their code. If you look at the wallet stub contract it's half assembly. They did a good job optimizing the contract to use minimal gas upon deployment, but maybe that's not the best thing to optimize for contracts that will hold millions of dollars. They also don't appear to have gotten fresh external audits when they made changes. Incidentally, there are other Ethereum languages in development that are better suited for formal verification, including Viper and Bamboo.
  - bitcoinmoney 9y ago
    If I do a git clone of the parity github and deploy the multisig wallet, how much will it cost versus just using the stub/delegatecall architecture that's being used by everyone? We talking about >100$ here?
    - DennisP 9y ago
      I haven't checked but these contracts aren't huge and gas prices are low if you don't mind waiting a couple minutes. I think you could post it for a couple bucks. (I also think you'd be better off using a different wallet entirely; Parity's isn't the most popular anyway, especially lately.)
- sjbase 9y ago
  Would you mind elaborating on which aspects of the language reflect poor design? And what was done well for that matter? I have no strong opinions on Solidity, btw - just generally interested in people's views on developer experience.
banteg 9y ago
I've assembled a full list of frozen accounts. It includes Gavin Wood's Polkadot auction proceeds ($90M) and Iconomi wallet ($34.5M). https://gist.github.com/banteg/f61d256d12158b8c344d7889266f43b5 https://gist.github.com/banteg/f61d256d12158b8c344d7889266f4...
banteg 9y ago
I've assembled a full list of frozen accounts. Most notable are Polkadot auction proceeds ($90M) and Iconomi ($34.5M). https://gist.github.com/banteg/f61d256d12158b8c344d7889266f43b5 https://gist.github.com/banteg/f61d256d12158b8c344d7889266f4...
- dbancajas 9y ago
  How did you do this? Did you write a Js script to scan the block chain using web3?
  - banteg 9y ago
    Right, I wrote a script to find contracts with the matching code. See web3.eth.getCode.
    - bitcoinmoney 9y ago
      what code? can you be more specific? Are you just taking the first 4 bytes keccak(initWallet(something somethign))?
onewhonknocks 9y ago
This is a problem with Parity (a company, not 'Ethereum'), and the Parity wallet service that they offer. It's not a vulnerability of Ethereum.
- billmalarky 9y ago
  As such, ETH is probably a "buy" right now.
- dsp1234 9y ago
  Which is what the title, and the actual article say.
- swsieber 9y ago
  You're right that it's not a vulnerability of Ethereum. It's representative of a weakness of Ethereum and it's language which makes mistakes like this bug a lot more prevalent. It's sort of how like a "use after free" bug in a program written in a non-GC'd language isn't a vulnerability of the language itself. Languages encourage or discourage (or even eliminate) lasses of bugs based on their design. Etherum's is particularly bad in this regard.
DennisP 9y ago
So here's what happened: Parity used to have a normal multisig wallet, where every user deploys their own contract and each one is a full copy of the code. They decided it'd be nice if people could have a lower transaction fee when they deployed a new wallet. So they made one master contract that has all the code. Now when you deploy a new wallet, what you actually deploy is a stub that forwards function calls to the master contract, using a "delegatecall" which lets the master execute its functions in the context of the stub contract. However, they didn't think through how they might want to change the master contract code in this new situation. In particular, they didn't remove the selfdestruct function. Self destruct is perfectly sensible when it's your own contract that you're not using anymore, but it's not so great when it's shared code used by lots of people. They also forgot to initialize a function setting contract ownership. Someone came along and made themselves the owner, then called the selfdestruct. They posted about it on github, apparently unaware of the full impact of what they'd just done, which was to destroy the code used by all the stub contracts deployed since July 20. Now those stubs no longer have access to functions for withdrawing the ETH they contain. This master/stub design was also the root cause of Parity's previous multisig hack. Apparently they didn't get a clue and pay for a fresh round of external audits, which I think would have easily caught this problem. In fact, at the end of a post-mortem of the previous hack, published on July 20, they complained that they lacked funds for such things: https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.html https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.h...
- mbrock 9y ago
  I work for a firm that does Ethereum audits and we would have demanded a complete restructuring of Parity's multisig and major simplification.
  - DennisP 9y ago
    I also do Ethereum audits, and I agree. Parity's code is way too complicated for a contract like this.
    - bitcoinmoney 9y ago
theptip 9y ago
Can anyone explain why one would want to do multisig in a smart contract? Can't you split your keys offline? (This is how one would do multisig in Bitcoin, for example).
- hdhzy 9y ago
  Multisig can be a nice compromise between security and convenience. There is a service that allows you to store Bitcoins in a 2 of 3 multisig address where you control two keys (one in offline wallet one in hot wallet) and the service has one key. When you do a transaction they send you one time code (SMS or something like that) if you respond they sign the transaction. So to spend you need to receive their code and your own key. This is kind of 2FA. If the service disappears you can take your offline wallet key together with your hot wallet key to unlock funds. Sadly I forgot the service name :(
- yarrel 9y ago
  Multisig is implemented using smart contracts on Bitcoin as well. That's what P2SH is. Or you could use secret sharing for BTC or Eth, but people tend not to.
  - theptip 9y ago
    Perhaps you _can_ do it that way, but you can also just use m-of-n cryptography (e.g. Shamir's Secret Sharing Scheme) to split your private key. See http://docs.electrum.org/en/latest/multisig.html http://docs.electrum.org/en/latest/multisig.html for an example, and https://en.bitcoin.it/wiki/Multisignature https://en.bitcoin.it/wiki/Multisignature for more background (including links to SSSS). You don't need a smart contract to achieve this. I suppose it's more convenient since your co-signers can just submit their M signatures onto the blockchain, instead of having to collaborate offline to generate a valid signed block. But putting the multisig logic into a smart contract is quite obviously not fail-safe, as these vulnerabilities show.
ricardobeat 9y ago
It's mind boggling that a company like this "doesn't have the funds" for proper security auditing, and treats code updates like they were changing CSS for their blog, yet at the same time can affect $200m+ in funds. Why are they not making money, and in that case, why on earth is so much cash entrusted to an underfunded entity? EDIT: apparently one of the wallets affected holds $90 million raised for the Polkadot project [1,2], which is their own. A quote from the previous incident[3]: > Unfortunately, since Parity is a small, minimally-funded start-up, we have not the resources to do this alone. Outside of a few tips to the shoe fund, Parity has received no funding whatsoever from any organisations within the Ethereum ecosystem. [1] https://polkadot.io/ https://polkadot.io/ [2] http://www.trustnodes.com/2017/10/15/polkadot-ico-raises-130-million-just-begun http://www.trustnodes.com/2017/10/15/polkadot-ico-raises-130... [3] https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.html https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.h...
- bitcoinmoney 9y ago
  It's mind boggling that people entrust 200$M easily.
- taberiand 9y ago
  Is it $200m+, or is it just Eth currently worth $200m+ (and obtained at 1/300 of the current price?) Maybe the people who lost that Eth didn't lose all that much?
  - ricardobeat 9y ago
    ETH market cap is $28 billion, you could sell a good hunk of that without much pressure on price.
  - DennisP 9y ago
    You can't really assume that everyone holding ETH bought it in 2015.
twayamznacct 9y ago
IF there is a hard fork to resolve this I hope some very hard questions are asked regarding why there was a hard fork for this, and not one for the earlier Parity bug given that the amount of funds lost in both were roughly equivalent. Unless I am recalling incorrectly, the bug during the summer did not impact anyone on the Ethereum team, while this one did. Which would make the motivation behind a hard fork in this specific case ... questionable. I think that would be the time I divest myself of the ETH I hold. Disclaimer: (If it wasn't obvious from the above :) ) I hold a decent amount of ETH (thankfully not in a parity multi-sig wallet!)
- CryptoPunk 9y ago
  From what I understand, this can be fixed with a generalized fix for this class of contract bugs, which makes it different than the previous bug. More importantly, this can wait until the next planned hard fork, since the funds are locked and not going anywhere, so wouldn't need its own dedicated hard fork.
otakucode 9y ago
I can't help it... the fact that it was a person named 'devops199' that did this is too delicious. In true devops style, breaking things in production.
- corysama 9y ago
  devops199 is apparently a kid having a very bad day. Not quite a -$300M bad day. But, up there. https://gitter.im/paritytech/parity?at=5a01b9d2b20c6424299b0380 https://gitter.im/paritytech/parity?at=5a01b9d2b20c6424299b0...
seanwilson 9y ago
Is there a way you can do fuzz testing on wallets before deploying to catch similar bugs to this? I'm guessing it would cost a lot of Ether if an attacker wanted to automatically fuzz test many high value wallets looking for exploits?
- Drdrdrq 9y ago
  Not in terms of gas, because one can test on a separate blockchain. But it takes a lot of expertize and time, which means money - and it appears that for all the money that was saved in their wallets they received very little (if any) funds. I find it hard to blame them...
- mannykannot 9y ago
  Because this bug was predicated on both a specific large number (the address of the wallet that happened to serve as the repository of the library code), and a specific sequence of actions, you would likely have to fuzz-test for a very long time before finding it.
narrator 9y ago
This is why I didn't invest in ETH when it was 60 cents. I thought the whole thing had an enormous attack surface and wouldn't scale. Just goes to show that flawed things can be extremely lucrative.
S4705H1 9y ago
Not funny, but still funny. We made a t-shirt with the now famous quote of devops199: "I accidentally killed it" https://cryptoshirt.io/products/devops199-quote-i-accidentally-killed-it-tee https://cryptoshirt.io/products/devops199-quote-i-accidental... #ethereum #eth #ether #parity #devops199
unlmtd 9y ago
> The Parity Ethereum client is built from the ground up to the highest standards of software development.[1] [1]: https://parity.io/ https://parity.io/
GenericsMotors 9y ago
Captains of industry.

394 points by g09980 9y ago

The transaction that nuked the library contract: https://etherscan.io/tx/0x47f7cff7a5e671884629c93b368cb18f58a993f4b19c2a53a8662e3f1482f690 https://etherscan.io/tx/0x47f7cff7a5e671884629c93b368cb18f58...

alva 9y ago

Early estimates suggest $270m worth of Ether has been permanently frozen. Coming 4 months after multimillions stolen from the same wallet.

deleted 9y ago
[deleted]
nikcub 9y ago
Polkadot has its raised coins in a Parity multisig wallet, and it alone is ~$140M iirc: https://twitter.com/polkadotnetwork/status/927880762053021702 https://twitter.com/polkadotnetwork/status/92788076205302170... edit: they just put out a post to say that not all of their funds were in a Parity multisig wallet: https://medium.com/web3foundation/web-3-multi-sig-wallet-update-245d30df0fb3 https://medium.com/web3foundation/web-3-multi-sig-wallet-upd...
roywiggins 9y ago
"The good news is, you still have your Ethereum. The bad news is, you always will..."
- willitpamp573 9y ago
  Which defeats the purpose of Ethereum, which is to get in, get rich quick, and get out!
tootie 9y ago
Permanently frozen? What does that mean? It's as good as gone?
- alva 9y ago
  Basically good as gone. It is there, just no one can ever access it.
  - lurker456 9y ago
    until the next hard fork
- CodesInChaos 9y ago
  It means it's gone, if the contract is followed. But a hardfork of Ethereum could change the rules to recover the coins. A similar recovery already happened once, after somebody exploited a bug in The DAO, resulting in a fork into Ethereum and Ethereum Classic, which rejected changing the rules to bail out bugged but too-big-to-fail smart contracts. > In May of 2016, a venture capital fund called The DAO built on Ethereum raised around $168 million, with the intention of investing in projects using smart contracts. In the same month a paper was released detailing security vulnerabilities with The DAO that could allow ether to be stolen. In June, 3.6 million Ether (approximately $50 million USD) was taken from accounts in The DAO and moved to another account without the owners' consent, exploiting one of the vulnerabilities that had been raised in May. Members of The DAO and the Ethereum community debated what actions, if any, should occur to resolve the situation. A vote occurred and in July 2016 it was decided to implement a hard fork in the Ethereum code and to move the Ether taken in the exploit to a new smart contract through which it would be restored to the owners from whom it had been taken. > Ethereum Classic came into existence when some members of the Ethereum community rejected the hard fork on the grounds of "immutability", the principle that the blockchain cannot be changed, and decided to keep using the unforked version of Ethereum. https://en.wikipedia.org/wiki/Ethereum_Classic https://en.wikipedia.org/wiki/Ethereum_Classic

provost 9y ago

> This means that currently no funds can be moved out of the multi-sig wallets. Wait, am I reading this right? All multi-sig wallets are frozen due to this? This is surely concerning, as I've seen others recommend multi-sig wallets as a security best practice. Can anyone comment on the method in which they might revert this? Would it require a hard fork.. again?

bhaak 9y ago
> All multi-sig wallets are frozen due to this? All multi-sig Ethereum wallets created by Parity (or using the Parity contract code). > Can anyone comment on the method in which they might revert this? Would it require a hard fork.. again? So far, it doesn't look like you can do anything about it. Of course you can change everything with a hard fork but as this time it doesn't compromise the move to PoS, I don't think a hard fork will be the favored solution. But this time, there is no deadline, so it can be discussed thoroughly.

millette 9y ago

Github issue: https://github.com/paritytech/parity/issues/6995 https://github.com/paritytech/parity/issues/6995

Slartie 9y ago

I am wondering what exactly has been the point of having this code separated in this "library" in the first place, instead of just duplicating the code for each owner of a multisig wallet. It can't be to ease the update process of the core multisig code (since the library is just as non-updatable as any other contract), which otherwise is a typical reason for separating stuff into shared libraries. Has this extra layer of complexity really been injected just to save some bytes on the blockchain?

bitcoinmoney 9y ago
it is a way to save on gas. Imagine all those functionality being deployed everytime someone creates a multisig. I read somewhere that the savings are in 90%? In absolute terms though I think it is very minimal and people just got way too cute with shared libraries. Again, I wouldn't trust >1M on a couple of lines of code.

Kiro 9y ago

How can a library be nuked? I thought you deployed static immutable code to the blockchain (I actually have no idea how this works). > I made myself the owner of "0x863df6bfa4469f3ead0be8f9f2aae51c91a907b4" contract How is that possible?

deleted 9y ago
[deleted]
Slartie 9y ago
The code is immutable, but Ethereum has a functionality called "suicide" by which a contract can, well, commit suicide. It is kind of like a deletion, in that the code can't be executed anymore afterwards, but of course the blockchain still contains the contract in its original, unmodified form. AFAIK this feature was introduced to make owners capable of deactivating contracts which contain known security bugs (so at least nobody can accidentially send any more money to those contracts). And because that's the intended purpose, a suicide is non-revokable, so a dead contract remains dead forever. A library apparently can be nuked because Ethereum does not explicitly have a concept of "libraries". They are after all just contracts, with the only difference being that they are intended to be called by other contracts instead of humans. I see the next controversial, but eventually Vitalik-blessed hard fork incoming...
- bhaak 9y ago
  > A library apparently can be nuked because Ethereum does not explicitly have a concept of "libraries". They are after all just contracts, with the only difference being that they are intended to be called by other contracts instead of humans. That's not correct. There is a construct "library" that is different from a normal contract. But the code in question didn't use that (for whatever reason). http://solidity.readthedocs.io/en/develop/contracts.html#libraries http://solidity.readthedocs.io/en/develop/contracts.html#lib... > I see the next controversial, but eventually Vitalik-blessed hard fork incoming... I wouldn't be so sure. It's only about 1% of all ETH and the funds are frozen. The DAO hack was ~15% and would have put those funds into the hand of a single entity which would endangered the eventual move to PoS.

bhaak 9y ago

The way it looks like, those Ethers are quite safe. Parity's refactoring of the official audited multi-sig contract code has fucked up again. I wonder if they even audited their code. The post-mortem of the last incident https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ evades that question under the paragraph "Was the wallet not audited?". If they used a library instead of a contract, this wouldn't have been possible. I hope they had a reason to use a contract otherwise they clearly have noone else to blame this time.

ceejayoz 9y ago
They're very safe - per https://twitter.com/dguido/status/927896527107952640 https://twitter.com/dguido/status/927896527107952640, they're stuck there forever.
- nikcub 9y ago
  > they're stuck there forever. It's ethereum, they'll just hardfork those coins back Apparently almost $300M stuck - I don't see them not bringing up another hard fork to retrieve them
  - charlesdm 9y ago
    Well, that's one way to solve the inflation problem before PoS.. Perhaps it can be fixed though, as part of the next hard fork.
  - jononor 9y ago
    Depends on how good friends the affected users are with key players in the Ethereum community...
    - TD-Linux 9y ago
      One of the Ethereum founders (Gavin Wood) lost the proceeds from their recent ICO to this bug. So, very good friends?

seanwilson 9y ago

Can someone break down how funds have been frozen and what the bug that's being exploited is for those less familiar with Ethereum? From what I've read about Ethereum's contract language, it doesn't make itself easy to statically verify properties you want to check so I don't see how problems like this are going to go away until another language is used.

Slartie 9y ago
If I get this correctly, this is what happened: The parity wallet uses a "shared library" in which the actual logic is implemented. All individual wallets have their own data storages and coin balances, but contain just a little bit of logic code that redirects calls to this shared codebase. This shared library itself is also just a contract, except that it's intended to be called internally by other contracts (the different wallets). Though it typically doesn't happen, it can be called directly by humans. This is what the makers of this "shared library" apparently forgot to consider, until somebody called the "initialization function" of the shared library directly. By doing this, the shared library initialized itself as if it was one of the individual wallets that normally call the library. It therefore used its own (previously unused) data store, in which it correctly entered the caller of the init function as owner. This wasn't of use for anything, as there are no ethers at all on the shared library, so the owner could not steal any funds. But being the owner, he was able to trigger the kill switch! Since this particular "multisig wallet" was actually not a wallet, but the shared library, killing it not only killed the (empty) wallet, but also the core functionality of all the real wallets that contain real money out there! And of course that functionality is mandatory to work with the funds of these wallets. Without it, the money cannot be moved anywhere. Now comes the fun part: suiciding a contract normally transfers all ethers on that contract to the caller of the suicide function. Knowing this, you could expect that the individual wallet owners could just as easily suicide their now "brain-dead" multisig wallets as well, thereby recovering their funds...but that doesn't work, as performing the suicide requires a call to the shared library to check whether the callers' signatures qualify the caller to perform that suicide ;-)
- seanwilson 9y ago

ryanlol 9y ago

Another ethereum hardfork coming in 3... 2... 1... Are these guys ever going to learn?

zaarn 9y ago
How much are you willing to bet there will be hardfork? I'd be willing to bet some against a hardfork happening.
- mannykannot 9y ago
  Would creating a contract for that bet be an interesting programming challenge? What would happen to that contract in a hard fork?
  - zaarn 9y ago
    AFAIK hardforks are hard to detect by a contract, the contracts don't know anything outside the chain, if you split the chain, you can't tell there is another. Of course I've briefly entertained the idea but on the other hand, a bet between two mostly-honest individuals doesn't need a blockchain contract, similar to how I don't need a blockchain contract to borrow money from my sister and pay it back later. In any case, if there would be a hardfork, it would include the replay protection, so a simple but working solution would be to prepare a transaction for the fork chain and one for the non-fork chain, the participants can then publish the transactions once either chain becomes available and claim the reward.
    - 1up8192 9y ago
      It wouldn't be that hard in this case. You just have to watch for an address holding stuck ethers because of the bug, if the ethers move, it is a proof that a fork has happened.
  - mitchellberry 9y ago
    It would be a good introduction to solidity and the 3rd party problem of smart contracts. An example betting contract for anyone interested (note it was eventually refunded and not run): https://etherscan.io/address/0xf4b8ccc5734ed7d2d8beb5fddd223d25e55748bc#code https://etherscan.io/address/0xf4b8ccc5734ed7d2d8beb5fddd223... And an overview with some reasonable criticism: https://www.reddit.com/r/ethdev/comments/6sd8hl/mayweather_vs_mcgregor_parimutuel_smart_contract https://www.reddit.com/r/ethdev/comments/6sd8hl/mayweather_v...

homakov 9y ago

FYI this is not the reason Ethereum failed as a blockchain. Security bugs are bad, but what's worse is 9GB/week bandwidth requirement = 3 hours sync on average world connection, if you're lucky. No idea why everyone ignores this metric. And that's why Bitcoin is still somewhat blockchain (also poor sync, but doable)

jameskegel 9y ago
This brief comment intrigues me; can you provide more detail?
- homakov 9y ago
  Wrote this piece for you https://medium.com/@homakov/weekly-sync-friction-the-most-important-blockchain-security-metric-1042c0c172b7 https://medium.com/@homakov/weekly-sync-friction-the-most-im...
  - jameskegel 9y ago
    Thank you
shawabawa3 9y ago
9GB/week is not huge at all, and ethereum nodes are not designed to be run on "average world connection". The only people running full nodes realistically should be on extremely fast connections. Bandwidth and storage are only getting cheaper Also "Ethereum failed as a blockchain"? They're the 2nd largest coin after bitcoin, it can hardly be called failed
- homakov 9y ago
  >9GB/week is not huge at all It's a lot on average. https://medium.com/@homakov/weekly-sync-friction-the-most-important-blockchain-security-metric-1042c0c172b7 https://medium.com/@homakov/weekly-sync-friction-the-most-im... >They're the 2nd largest coin after bitcoin, it can hardly be called failed "caps" are short term hypes, they are not definition of blockchain. Say, Ripple is not a blockchain at all. Try critical thinking, highly recommended.

zaarn 9y ago

Quite interesting. Luckily I moved away from my Parity Multisig a while ago and use my Trezor now. The multisig is vulnerable... I love this feeling of living on the edge when I know that I just evaded a critical bug that could have cost me a lot of money. Though, a lot of people who aren't me will be a lot more angry, especially (and probably only) people actively using the multisig.

slimshady94 9y ago

Isn't it possible to generate a new token that has the same amount of ether lost, and airdrop it to those addresses? That token can be assumed to replace ETH (call it ETH1), and should have the same dollar value in trading markets.

jcousins 9y ago
Entities owning those new tokens would rush to the exit, sending the new token towards zero would be my guess.

deleted 9y ago

[deleted]

angrydev 9y ago

Good summary article: https://blog.springrole.com/parity-multi-sig-wallets-funds-frozen-explained-768ac072763c https://blog.springrole.com/parity-multi-sig-wallets-funds-f...

ceejayoz 9y ago

It's probably safe to assume that the title of "most expensive software bug in history" will be held by a cryptocurrency glitch within the next couple years. It's nearing the couple-hundred-million mark of things like Knight Capital or Ariane 5's Flight 501.

tomalpha 9y ago
Not to disagree with the thrust of your argument, but Knight Capital's meltdown was nearer $450 million.

Cshelton 9y ago

So I see this as a growing pain. But this is something that has already been thought of as something that could happen, and there is work looking into how to solve it going back a ways: https://github.com/ethereum/EIPs/issues/156 https://github.com/ethereum/EIPs/issues/156 It looks like if this EIP is implemented in the future, the address that created the original multi-sig wallet contract created after July 20th, would just be sent the ether balance in the wallet. I'm not sure on this, but it seems like, if implemented in the future, an owner of a multi sig wallet that is frozen can call this contract from the same address they created the wallet with and it will retrieve the ether from the address where the contract is now blown away? Another option would be during the next planned fork (upgrade), to just say, any contract that matches the byte code of the frozen wallet one, just replace the code with this code and move on. Although the first option is MUCH nicer and future proof. People will write bad code and things like this will happen. I think the more often and earlier on we find these types of flaws and can fix them, the better for the whole ecosystem. It's $300 million today... in 10 years, a mistake like this that hasn't been worked out could cause a shock to the entire world economy. (run on the banks, but there are no banks and everyone's funds are frozen...panic!) So better now than later!

joosters 9y ago
Do you really think a $300 million bug is an acceptable 'growing pain'?
- yarrel 9y ago
  A billion-dollar one was.
- erikpukinskis 9y ago
  The Pound Sterling had a $1 Billion dollar growing pain. The hacker was George Soros: https://en.m.wikipedia.org/wiki/Black_Wednesday https://en.m.wikipedia.org/wiki/Black_Wednesday Have you lost faith in the Pound yet?
  - tom_mellior 9y ago

fokinsean 9y ago

Holy shit, I just moved my ether off of coinbase on sunday so that it could be more secure and almost chose parity, but went with MyEtherWallet instead. This makes me feel like there is no safe way to store my ether now.

g09980 9y ago
To be clear, neither the regular Parity wallet nor MyEtherWallet are affected here. Also, they don't store your coins, all they can ever do is sign and publish transactions when given access to your private key. Parity multi-sig wallets are an entirely different beast. Bit of a confusing naming issue: Parity wallet: light client software that accesses the blockchain. Parity multi-sig wallet: a smart contract deployed on the blockchain, with the coins stored within this contract. The latter is what was affected.
- fokinsean 9y ago
  Ah okay, thanks for the explanation. I've heard of multi-sig wallets, but wasn't quite sure what they actually do. From what I can tell they are supposed to be more secure, so it is a bit ironic that this is the second time multi-sig wallets have had issues.
bitcoinmoney 9y ago
this only affects multisig
fizwhiz 9y ago
Serious question, what's wrong with parking funds in a coinbase ETH vault when compared to something like MyEtherWallet/Parity?
- grafporno 9y ago
  Remember the mtgox debacle..? That is what's wrong with that.

ve55 9y ago

It's pretty bad when the type of wallet that is supposed to be more secure has bugs like this multiple times. For reference, this only affects multi-signature wallets, not normal wallets. Very few normal users use multi-signature wallets. The previous bug with these was very trivial and could have been caught by a unit test or a simple code review, and it resulted in around 9 figures (USD) of Ether being stolen. This bug looks like it's exactly the same. A very simple bug that could have been caught by a simple test or manual audit, and has resulted in 9 figures USD being locked instead of stolen this time. As mentioned by others it's possible at some point (not any time soon) that this frozen ETH can be recovered (https://github.com/ethereum/EIPs/issues/156 https://github.com/ethereum/EIPs/issues/156) by adding rules to recover it in the next Ethereum hard fork. Not creating a specific hard fork just for this, but adding it to one that is planned in the future. That might come across as controversial, and cannot be guaranteed though. For safely storing Ethereum I would advise to keep it out of smart contracts, period. Cold storage and hardware wallets exist, and they are much less likely to have critical bugs related to them than a smart contract is.

imaginenore 9y ago
“Code is Law” fails again.
VMG 9y ago
Reposting dead, but accurate comment: “Code is Law” fails again. There will probably be a hardfork and increased moral hazard for auditing contract code. Why spend money finding bugs if the "immutable" blockchain can be rolled back?
- api 9y ago
  "Code is law" demands much better code. A language like Haskell is needed.
  - chowells 9y ago
    Eh. Haskell is a general purpose Turing-complete language. Smart contracts need something far safer.

jimrandomh 9y ago

Parity appears to have a bug bounty program, but the bounty is only $100. Given that they've now had two bugs that caused 9-figure losses in the past year, this is clearly too low. They need real auditing, and they need to pay the market price for real auditing.

mannykannot 9y ago
You are right, but unfortunately, the de-facto bug bounty for unethical hackers is way beyond anything that could be offered to well-intentioned researchers. This makes your suggestion of professional auditing the highest priority.
- gcb0 9y ago
  bug bounties don't compete with crime. crime always will pay more. bug bounties compete among themselves. Honest researchers will be busy finding some mobile game bugs for $700 a pop or improving security at google or yahoo for up to $10k instead of helping your company save from a 9 figure bug because you only offer $100
whyever 9y ago
> but the bounty is only $100. This is the minimal bounty.
- lurker456 9y ago
  I wondered why you didn't mention the maximum, and after checking their website found no other figures besides the $100 minimum. They do state "Rewards over the minimum are at our discretion, but we will pay significantly more for particularly serious issues, i.e. that the identified issue could put a significant number of users at risk of severe damage, monetary or otherwise." What they consider significant is anyone's guess. Given the stakes, even a 10000% increase would still be underwhelming for a high impact bug.
  - mannykannot 9y ago

InclinedPlane 9y ago

Ethereum seems to be based on the principle that it's possible to write bug free code easily. It's working out about as well as I'd expected.

eyezick 9y ago

https://github.com/ConsenSys/smart-contract-best-practices/blob/master/docs/general_philosophy.md https://github.com/ConsenSys/smart-contract-best-practices/b... Bullet #1: Prepare for failure

naasking 9y ago

This might sound mean, but I laugh every time I see Ethereum bugs in the headlines. The developers intentionally made their platform analytically intractable, despite knowing the dangers this presents given our long history of vulnerable software. They then compounded this poor choice with an Ethereum programming language with poor and insecure semantics. I applaud the ambition behind Ethereum, but not it's technical choices.

ifdefdebug 9y ago
Hey, this is the first programming platform where everybody writes guaranteed 100% bug-free programs... by definition...
Drdrdrq 9y ago
This. It reminds me of PHP in many aspects - Solidity is just awful. Like the way the multi-dim arrays' sizes are written in opposite order to the one used when accessing values? Pure genius. </s>

cocktailpeanuts 9y ago

Solidity needs to get rid of features like library and inheritance. If you write an unstoppable contract that is responsible for holding hundreds of millions of dollars, you alone should be responsible for it, and not some library you used. Better yet, people who have the mindset that it's ok to have these hipster "modular" features that spread out the responsibility (for whose benefit?) should really not be working on such fundamental pieces of technology. If you write software that holds people's money and you fuck up, you and only you are responsible for it. This is a recurring theme with the Ethereum community where people complain about how there was a bug in the system which resulted in a huge hack and people losing tons of money, and developers say "hey don't blame me I just used some library, it's the library's fault".

root_axis 9y ago
Certainly each person rolling their own is going to end up worse than the use of modules that are improved over time.
- MichaelBurge 9y ago
  Most of the trouble is on the module boundary, so improving the modules themselves probably isn't worth as much as you'd think.
mifeng 9y ago
Since contracts are immutable, you need modularity to be able to fix bugs like what happened with Parity. The problem is that Solidity libraries are also immutable, which means you can't fix them. The solution is easy: just use contract modules, not libraries.
- cocktailpeanuts 9y ago
  No you don't. That's a myth. Having modularity in these things only amplifies the damage when something DOES happen. I'm not saying it is bad to have a centralized auditing of contracts, but I am saying it's not a good thing to simply import libraries and inherit some other abstract contract you don't fully understand when it comes to irreversible contracts. This is a new type of problem we as a humanity have never faced before, so we need a different type of solution.

lokerfoi 9y ago

They'll fork it again. The language used is unsafe, and developers didn't test properly. What can be done? Fork I guess. Or maybe leave the developers developing on the Ethereum platform to just fail?

billmalarky 9y ago
Why would it need to be forked? Couldn't the smart contract language just be upgraded for better security then deprecate DAPPs using the old language?
- lokerfoi 9y ago
  They'll fork it to unfreeze millions of funds. It's just funny how decentralized currency is so easily swayed by a few individuals to serve their purpose.
  - zeep 9y ago
    they need to have a majority of mining power moving to the new fork for it to work though...
- shallot_router 9y ago
  If they don't fork, everyone affected by this will lose all of their ETH. Many would argue the correct thing to do is to not fork and say that people knew the risks beforehand, etc. But that's what people said last time and they still forked, with no (apparent) severe consequences other than complaining about integrity. Two forks may be harder to justify.
  - billmalarky 9y ago
    Ah that makes more sense. I was thinking he was saying they would have to fork for a technical reason not political.
- johnvonneumann 9y ago
  It will be forked because they have history of forking when people "lose" funds.

SubiculumCode 9y ago

Frozen money. Doesn't sound like a cash replacement to me.

jsonhero 9y ago
Banks get hacked all the time
- TAForObvReasons 9y ago
  Banks have government backstops and other provisions in place to ensure that a hack doesn't result in customer loss of funds. No equivalent here
  - fleitz 9y ago
    Suddenly lots of people with guns to go get your money back is a very useful feature compared to some cryptographic guarantees that people with guns can't get your money back.
    - EGreg 9y ago
      Oh please, consider the freedom of people to lock up their money and not get it back! These men{!} with guns first send a letter to an ETH autonomous corporation, then when it doesn't respond, they threaten it with guns. That's the State. {!} Thanks to today's progressive reforms the State now also employs women with guns. We should just say people with guns to not be sexist.
      - derefr 9y ago
        A given "ETH autonomous corporation" might not have any controlling entities that are accessible to the wronged State. Foreign shell companies are already hard enough for most governments to deal with—and that's with trade agreements that enable them to compel disclosure of ownership. DACs are foreign shell companies without a governing state to point guns at. Sure, if the DAC does business in the US, the US government can shut that business down—much like the US government can shut down a domain name associated with foreign illegal activity. But that doesn't stop the business from operating anywhere else. Nobody has the ability to shut down the whole business.

convery 9y ago

I mean, for a currency replacement that will solve all the worlds problems; it sure seems to be a lot of news about large thefts and issues leaving people unable to spend their money..

viach 9y ago

Price is failing, good time to buy. /irony

pixelperfect 9y ago

A few months ago as a newcomer to Ethereum, I looked into Solidity and concluded that due to the poor design of the language, large-scale problems like this would be inevitable. I decided not to invest in ETH. In my opinion, smart contracts are a good idea, but smart contracts written in Solidity are a bad idea.

DennisP 9y ago
The issue in this case isn't so much Solidity, as Parity getting too fancy with their code. If you look at the wallet stub contract it's half assembly. They did a good job optimizing the contract to use minimal gas upon deployment, but maybe that's not the best thing to optimize for contracts that will hold millions of dollars. They also don't appear to have gotten fresh external audits when they made changes. Incidentally, there are other Ethereum languages in development that are better suited for formal verification, including Viper and Bamboo.
- bitcoinmoney 9y ago
  If I do a git clone of the parity github and deploy the multisig wallet, how much will it cost versus just using the stub/delegatecall architecture that's being used by everyone? We talking about >100$ here?
  - DennisP 9y ago
    I haven't checked but these contracts aren't huge and gas prices are low if you don't mind waiting a couple minutes. I think you could post it for a couple bucks. (I also think you'd be better off using a different wallet entirely; Parity's isn't the most popular anyway, especially lately.)
sjbase 9y ago
Would you mind elaborating on which aspects of the language reflect poor design? And what was done well for that matter? I have no strong opinions on Solidity, btw - just generally interested in people's views on developer experience.

banteg 9y ago

I've assembled a full list of frozen accounts. It includes Gavin Wood's Polkadot auction proceeds ($90M) and Iconomi wallet ($34.5M). https://gist.github.com/banteg/f61d256d12158b8c344d7889266f43b5 https://gist.github.com/banteg/f61d256d12158b8c344d7889266f4...

banteg 9y ago

I've assembled a full list of frozen accounts. Most notable are Polkadot auction proceeds ($90M) and Iconomi ($34.5M). https://gist.github.com/banteg/f61d256d12158b8c344d7889266f43b5 https://gist.github.com/banteg/f61d256d12158b8c344d7889266f4...

dbancajas 9y ago
How did you do this? Did you write a Js script to scan the block chain using web3?
- banteg 9y ago
  Right, I wrote a script to find contracts with the matching code. See web3.eth.getCode.
  - bitcoinmoney 9y ago
    what code? can you be more specific? Are you just taking the first 4 bytes keccak(initWallet(something somethign))?

onewhonknocks 9y ago

This is a problem with Parity (a company, not 'Ethereum'), and the Parity wallet service that they offer. It's not a vulnerability of Ethereum.

billmalarky 9y ago
As such, ETH is probably a "buy" right now.
dsp1234 9y ago
Which is what the title, and the actual article say.
swsieber 9y ago
You're right that it's not a vulnerability of Ethereum. It's representative of a weakness of Ethereum and it's language which makes mistakes like this bug a lot more prevalent. It's sort of how like a "use after free" bug in a program written in a non-GC'd language isn't a vulnerability of the language itself. Languages encourage or discourage (or even eliminate) lasses of bugs based on their design. Etherum's is particularly bad in this regard.

DennisP 9y ago

So here's what happened: Parity used to have a normal multisig wallet, where every user deploys their own contract and each one is a full copy of the code. They decided it'd be nice if people could have a lower transaction fee when they deployed a new wallet. So they made one master contract that has all the code. Now when you deploy a new wallet, what you actually deploy is a stub that forwards function calls to the master contract, using a "delegatecall" which lets the master execute its functions in the context of the stub contract. However, they didn't think through how they might want to change the master contract code in this new situation. In particular, they didn't remove the selfdestruct function. Self destruct is perfectly sensible when it's your own contract that you're not using anymore, but it's not so great when it's shared code used by lots of people. They also forgot to initialize a function setting contract ownership. Someone came along and made themselves the owner, then called the selfdestruct. They posted about it on github, apparently unaware of the full impact of what they'd just done, which was to destroy the code used by all the stub contracts deployed since July 20. Now those stubs no longer have access to functions for withdrawing the ETH they contain. This master/stub design was also the root cause of Parity's previous multisig hack. Apparently they didn't get a clue and pay for a fresh round of external audits, which I think would have easily caught this problem. In fact, at the end of a post-mortem of the previous hack, published on July 20, they complained that they lacked funds for such things: https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.html https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.h...

mbrock 9y ago
I work for a firm that does Ethereum audits and we would have demanded a complete restructuring of Parity's multisig and major simplification.
- DennisP 9y ago
  I also do Ethereum audits, and I agree. Parity's code is way too complicated for a contract like this.
  - bitcoinmoney 9y ago

theptip 9y ago

Can anyone explain why one would want to do multisig in a smart contract? Can't you split your keys offline? (This is how one would do multisig in Bitcoin, for example).

hdhzy 9y ago
Multisig can be a nice compromise between security and convenience. There is a service that allows you to store Bitcoins in a 2 of 3 multisig address where you control two keys (one in offline wallet one in hot wallet) and the service has one key. When you do a transaction they send you one time code (SMS or something like that) if you respond they sign the transaction. So to spend you need to receive their code and your own key. This is kind of 2FA. If the service disappears you can take your offline wallet key together with your hot wallet key to unlock funds. Sadly I forgot the service name :(
yarrel 9y ago
Multisig is implemented using smart contracts on Bitcoin as well. That's what P2SH is. Or you could use secret sharing for BTC or Eth, but people tend not to.
- theptip 9y ago
  Perhaps you _can_ do it that way, but you can also just use m-of-n cryptography (e.g. Shamir's Secret Sharing Scheme) to split your private key. See http://docs.electrum.org/en/latest/multisig.html http://docs.electrum.org/en/latest/multisig.html for an example, and https://en.bitcoin.it/wiki/Multisignature https://en.bitcoin.it/wiki/Multisignature for more background (including links to SSSS). You don't need a smart contract to achieve this. I suppose it's more convenient since your co-signers can just submit their M signatures onto the blockchain, instead of having to collaborate offline to generate a valid signed block. But putting the multisig logic into a smart contract is quite obviously not fail-safe, as these vulnerabilities show.

ricardobeat 9y ago

It's mind boggling that a company like this "doesn't have the funds" for proper security auditing, and treats code updates like they were changing CSS for their blog, yet at the same time can affect $200m+ in funds. Why are they not making money, and in that case, why on earth is so much cash entrusted to an underfunded entity? EDIT: apparently one of the wallets affected holds $90 million raised for the Polkadot project [1,2], which is their own. A quote from the previous incident[3]: > Unfortunately, since Parity is a small, minimally-funded start-up, we have not the resources to do this alone. Outside of a few tips to the shoe fund, Parity has received no funding whatsoever from any organisations within the Ethereum ecosystem. [1] https://polkadot.io/ https://polkadot.io/ [2] http://www.trustnodes.com/2017/10/15/polkadot-ico-raises-130-million-just-begun http://www.trustnodes.com/2017/10/15/polkadot-ico-raises-130... [3] https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.html https://paritytech.io/blog/the-multi-sig-hack-a-postmortem.h...

bitcoinmoney 9y ago
It's mind boggling that people entrust 200$M easily.
taberiand 9y ago
Is it $200m+, or is it just Eth currently worth $200m+ (and obtained at 1/300 of the current price?) Maybe the people who lost that Eth didn't lose all that much?
- ricardobeat 9y ago
  ETH market cap is $28 billion, you could sell a good hunk of that without much pressure on price.
- DennisP 9y ago
  You can't really assume that everyone holding ETH bought it in 2015.

twayamznacct 9y ago

IF there is a hard fork to resolve this I hope some very hard questions are asked regarding why there was a hard fork for this, and not one for the earlier Parity bug given that the amount of funds lost in both were roughly equivalent. Unless I am recalling incorrectly, the bug during the summer did not impact anyone on the Ethereum team, while this one did. Which would make the motivation behind a hard fork in this specific case ... questionable. I think that would be the time I divest myself of the ETH I hold. Disclaimer: (If it wasn't obvious from the above :) ) I hold a decent amount of ETH (thankfully not in a parity multi-sig wallet!)

CryptoPunk 9y ago
From what I understand, this can be fixed with a generalized fix for this class of contract bugs, which makes it different than the previous bug. More importantly, this can wait until the next planned hard fork, since the funds are locked and not going anywhere, so wouldn't need its own dedicated hard fork.

otakucode 9y ago

I can't help it... the fact that it was a person named 'devops199' that did this is too delicious. In true devops style, breaking things in production.

corysama 9y ago
devops199 is apparently a kid having a very bad day. Not quite a -$300M bad day. But, up there. https://gitter.im/paritytech/parity?at=5a01b9d2b20c6424299b0380 https://gitter.im/paritytech/parity?at=5a01b9d2b20c6424299b0...

seanwilson 9y ago

Is there a way you can do fuzz testing on wallets before deploying to catch similar bugs to this? I'm guessing it would cost a lot of Ether if an attacker wanted to automatically fuzz test many high value wallets looking for exploits?

Drdrdrq 9y ago
Not in terms of gas, because one can test on a separate blockchain. But it takes a lot of expertize and time, which means money - and it appears that for all the money that was saved in their wallets they received very little (if any) funds. I find it hard to blame them...
mannykannot 9y ago
Because this bug was predicated on both a specific large number (the address of the wallet that happened to serve as the repository of the library code), and a specific sequence of actions, you would likely have to fuzz-test for a very long time before finding it.

narrator 9y ago

This is why I didn't invest in ETH when it was 60 cents. I thought the whole thing had an enormous attack surface and wouldn't scale. Just goes to show that flawed things can be extremely lucrative.

S4705H1 9y ago

Not funny, but still funny. We made a t-shirt with the now famous quote of devops199: "I accidentally killed it" https://cryptoshirt.io/products/devops199-quote-i-accidentally-killed-it-tee https://cryptoshirt.io/products/devops199-quote-i-accidental... #ethereum #eth #ether #parity #devops199

unlmtd 9y ago

> The Parity Ethereum client is built from the ground up to the highest standards of software development.[1] [1]: https://parity.io/ https://parity.io/

GenericsMotors 9y ago

Captains of industry.