5 ms·

Naive question: how is looting vulnerable smart contracts even illegal? Without a legal framework of smart contract enforcement, recognition of literally-hypot

Naive question: how is looting vulnerable smart contracts even illegal? Without a legal framework of smart contract enforcement, recognition of literally-hypothetical assets as valuable, the public nature of blockchains that would preclude "unauthorized access," and unlike an exchange holding assets on behalf of customers - smart contracts are effectively leaving money on the ground for anyone clever enough to pick it up. Clearly I haven't given it as much thought as the people involved, but it seems like if I'm not using my abilities full-time to hack and loot smart contracts, I'm missing the most direct and best possible effort/reward application of that kind of skill.

jude- 6y ago
IANAL, but I'd imagine that for US folks, violating the intent of the code -- namely, doing something while lacking the authorization to do so -- is illegal, even if the code lets you do it. Otherwise, basically all forms of criminal hacking would be legal. Of course, if the smart contract expressly permitted anyone to take tokens out of it via any means allowed by the platform, that's a different story.
- TheRealPomax 6y ago
  Except in the US you can't sue on just intent, the letter of the law still needs to agree. So if the smart contract permits something, by not forbidding it, that something is entirely legal.
  - jude- 6y ago
    That can't be right. That would mean that all forms of hacking are legal, since after all, the remote server permitted you to run your shell code.
- jcranmer 6y ago
  The law you're thinking of is CFAA, and it's not clear that this violates the CFAA. The requisite element is "accesses [...] without authorization or exceeds authorized access." Given the general enthusiasm of blockchain proponents to believe that "the code is law", it's a pretty easy argument to make that taking advantage of poorly-written code is well within the user's authorized capabilities. Will it win in court? shrug
  - jude- 6y ago
    Again IANAL, but I think there's more to it than "the code is law." If we accept that hacking is illegal, then we must also accept that the law recognizes a difference between what the code does and what the code intended to do. I would think that this means that the courts would recognize a faulty but good-faith attempt at an authorization check on token movements to be evidence of the developer's intent to prevent tokens from being moved without authorization. If so, then they would further conclude that token movement that doesn't follow the intended authorization code paths is a violation of the CFAA.
    - jcranmer 6y ago
      IANAL either, but from my following of SCOTUS and other law cases, it does seem that the actual judicial interpretation of CFAA's authorization requirements is kind of vague and unsettled. There's a pending case before SCOTUS this term about CFAA (although it's not directly related to what the question in this thread, it's possible the opinion weighs in on it). Reading the amici, I'm not sure I'd find any consensus as to whether or not people believe this kind of access violates or doesn't violate the CFAA. That's why I ended with shrug--there's not enough clarity to answer if it is or isn't legal with any degree of certainty.
      - NovemberWhiskey 6y ago
        I think regardless of the circuit split on the meaning of "authorization", it seems fairly well settled that the meaning is not "what the computer system allows you to do". e.g. Van Buren is about resolving the question of whether someone who is given access to a computer system for their job can be considered to have used it in an "unauthorized" way if they use that system in ways that are unrelated to that job. The circuit-level decisions both start from the position "authorized" means something like "the owner of the computer has decided to grant access", which is more rather than less. i.e. X intended to give Y access (this is the part of "authorized" on which there is consensus) but Y used it for purposes that X did not approve of (this is the subject matter of the disagreement)
leifg 6y ago
Adding on to that. If you need real life contracts (the law) to enforce consequences of breaching or exploiting a smart contract: why do you need a smart contract at all?
- dylkil 6y ago
  Whether the law to enforce consequences exists or not, smart contracts will still provide value. Some of those contracts will be exploited, and the law will not help in 99% of cases.
  - leifg 6y ago
    Do you care to elaborate on that? How does it add value?
    - dylkil 6y ago
      Do you not think permissionless money systems are valuable?
      - leifg 6y ago
        Are you talking about cryptocurrencies? If so, what does that have to do with smart contracts?
        dylkil 6y ago
        What do you think smart contracts are?
        leifg 6y ago
        Well according to this article it's code that is executed once a requirement is met. If the requirement is trivial like in the Bitcoin blockchain, sure, maybe there is some value in it. But no one in the comments is talking about that. What everyone here seems to be talking about is non-trivial code that is supposed to enforce policies. Or at least that's what I'm asking about. Where is the value in that?

jude- 6y ago

IANAL, but I'd imagine that for US folks, violating the intent of the code -- namely, doing something while lacking the authorization to do so -- is illegal, even if the code lets you do it. Otherwise, basically all forms of criminal hacking would be legal. Of course, if the smart contract expressly permitted anyone to take tokens out of it via any means allowed by the platform, that's a different story.

TheRealPomax 6y ago
Except in the US you can't sue on just intent, the letter of the law still needs to agree. So if the smart contract permits something, by not forbidding it, that something is entirely legal.
- jude- 6y ago
  That can't be right. That would mean that all forms of hacking are legal, since after all, the remote server permitted you to run your shell code.
jcranmer 6y ago
The law you're thinking of is CFAA, and it's not clear that this violates the CFAA. The requisite element is "accesses [...] without authorization or exceeds authorized access." Given the general enthusiasm of blockchain proponents to believe that "the code is law", it's a pretty easy argument to make that taking advantage of poorly-written code is well within the user's authorized capabilities. Will it win in court? shrug
- jude- 6y ago
  Again IANAL, but I think there's more to it than "the code is law." If we accept that hacking is illegal, then we must also accept that the law recognizes a difference between what the code does and what the code intended to do. I would think that this means that the courts would recognize a faulty but good-faith attempt at an authorization check on token movements to be evidence of the developer's intent to prevent tokens from being moved without authorization. If so, then they would further conclude that token movement that doesn't follow the intended authorization code paths is a violation of the CFAA.
  - jcranmer 6y ago
    IANAL either, but from my following of SCOTUS and other law cases, it does seem that the actual judicial interpretation of CFAA's authorization requirements is kind of vague and unsettled. There's a pending case before SCOTUS this term about CFAA (although it's not directly related to what the question in this thread, it's possible the opinion weighs in on it). Reading the amici, I'm not sure I'd find any consensus as to whether or not people believe this kind of access violates or doesn't violate the CFAA. That's why I ended with shrug--there's not enough clarity to answer if it is or isn't legal with any degree of certainty.
    - NovemberWhiskey 6y ago
      I think regardless of the circuit split on the meaning of "authorization", it seems fairly well settled that the meaning is not "what the computer system allows you to do". e.g. Van Buren is about resolving the question of whether someone who is given access to a computer system for their job can be considered to have used it in an "unauthorized" way if they use that system in ways that are unrelated to that job. The circuit-level decisions both start from the position "authorized" means something like "the owner of the computer has decided to grant access", which is more rather than less. i.e. X intended to give Y access (this is the part of "authorized" on which there is consensus) but Y used it for purposes that X did not approve of (this is the subject matter of the disagreement)

leifg 6y ago

Adding on to that. If you need real life contracts (the law) to enforce consequences of breaching or exploiting a smart contract: why do you need a smart contract at all?

dylkil 6y ago
Whether the law to enforce consequences exists or not, smart contracts will still provide value. Some of those contracts will be exploited, and the law will not help in 99% of cases.
- leifg 6y ago
  Do you care to elaborate on that? How does it add value?
  - dylkil 6y ago
    Do you not think permissionless money systems are valuable?
    - leifg 6y ago
      Are you talking about cryptocurrencies? If so, what does that have to do with smart contracts?
      - dylkil 6y ago
        What do you think smart contracts are?
        leifg 6y ago
        Well according to this article it's code that is executed once a requirement is met. If the requirement is trivial like in the Bitcoin blockchain, sure, maybe there is some value in it. But no one in the comments is talking about that. What everyone here seems to be talking about is non-trivial code that is supposed to enforce policies. Or at least that's what I'm asking about. Where is the value in that?