5 ms·
The way it looks like, those Ethers are quite safe. Parity's refactoring of the official audited multi-sig contract code has fucked up again. I wonder if they
by bhaak 9y ago
The way it looks like, those Ethers are quite safe.
Parity's refactoring of the official audited multi-sig contract code has fucked up again. I wonder if they even audited their code.
The post-mortem of the last incident
https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ evades that question under the paragraph "Was the wallet not audited?".
If they used a library instead of a contract, this wouldn't have been possible. I hope they had a reason to use a contract otherwise they clearly have noone else to blame this time.
- ceejayoz 9y agoThey're very safe - per https://twitter.com/dguido/status/927896527107952640 https://twitter.com/dguido/status/927896527107952640, they're stuck there forever.
- nikcub 9y ago> they're stuck there forever. It's ethereum, they'll just hardfork those coins back Apparently almost $300M stuck - I don't see them not bringing up another hard fork to retrieve them
- charlesdm 9y agoWell, that's one way to solve the inflation problem before PoS.. Perhaps it can be fixed though, as part of the next hard fork.
- jononor 9y agoDepends on how good friends the affected users are with key players in the Ethereum community...
- TD-Linux 9y agoOne of the Ethereum founders (Gavin Wood) lost the proceeds from their recent ICO to this bug. So, very good friends?
- Slartie 9y agoNot to mention that he wrote the buggy contract...ehm, both buggy contracts, to be precise, the one that let funds be stolen and the one that now freezes funds...
- TD-Linux 9y ago>If they used a library instead of a contract, this wouldn't have been possible. It's actually the opposite, using a library allowed this to break all the wallets using it. However, an Ethereum "library" isn't what you'd expect a software "library" to be - it's an executable contract that just is never supposed to be executed directly. But oops, nothing prevented that from happening. The concept of everyone using a common, well-audited contract makes sense though. Virtually all Bitcoin multisignature transactions use the same script construction and it has never been hacked, despite being much older.
- sciyoshi 9y agoFor something as important as contract code, there should still have been more failsafes. Even just having a kill() on the main contract that doesn't delegate out to the library would have protected against this.
- deleted 9y ago[deleted]
- bhaak 9y ago> The concept of everyone using a common, well-audited contract makes sense though. Just Parity's contract was neither common nor well audited. > Virtually all Bitcoin multisignature transactions use the same script construction and it has never been hacked, despite being much older. The only multi-sig issue that I'm aware of in Bitcoin was the Bitfinex hack but I don't know in what relation BitGo's multi-sig implementation is to the standard multi-sig. The EF multi-sig implementation has been audited and AFAIK there has also never been an issue with it.
- TD-Linux 9y agoThe Bitfinex hack was due to getting enough parties of the multiparty signature to sign it (e.g. by stealing 2 out of 3 keys, or taking advantage of insufficiently secure automatic signing systems), not an issue with the contract itself.