10 ms·

This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. The same happened to Ethereum at launch where they had to renege on their "pro

This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. The same happened to Ethereum at launch where they had to renege on their "promise" of (not-so-)smart contracts and create a fork. From the article: C.R.E.A.M. was targeted by what is known as a flash loan attack. Flash loans are uncollateralized cryptocurrency loans structured so that they must be paid back instantly using smart contracts, making them attractive for things like arbitrage across exchanges. If the loan isn’t paid back, then it never happens, because both occur in the same transaction. Analysts on social media who pored over the details of the attack suggested that the hacker exploited C.R.E.A.M. in an incredibly complex transaction for a flash loan that ultimately allowed the hacker to drain C.R.E.A.M.’s Ethereum-based lending pools, leading to a gain of around $130 million in different tokens. The attack cost the hacker roughly 9 ETH in network fees, or around $36,000.

Stevvo 5y ago
"Someone cleverly exploiting loopholes" That's what a cyberattack hack is.
rossdavidh 5y ago
One definition of "hack", close to the earliest sense of the word, is "to use something in a way it was not intended when it was made". This was definitely not the way the creators of the platform intended it to be used. Whether it qualifies underall all common senses of "hack" is debatable, but it at least qualifies under a common sense of the word.
- newacc9 5y ago
  pg has a whole article about the word. "Ugly and imaginative solutions have something in common: they both break the rules. And there is a gradual continuum between rule breaking that's merely ugly (using duct tape to attach something to your bike) and rule breaking that is brilliantly imaginative (discarding Euclidean space)."
- registeredcorn 5y ago
  > This was definitely not the way the creators of the platform intended it to be used. This question might be getting way too philosophical or abstract, but would the following statement be fair: "If something is designed, its design is intentional." That isn't to say, a thing that is designed can't have flaws, but, if it was created to process things in a predetermined series of events, isn't that how it's supposed to work? If someone is able to exploit the layout of that design - a flaw of logic, not of security - it seems weird to think that the act of someone using it would be considered unintended, you know? I feel like a lack of planning or thought by the designer doesn't necessarily put any responsibility on the user. Again, might be more of a debate around the concept of design...it's just a weird thing to consider something like, "Yes, the platform was built to do that, but you weren't expected to use the platform to do that!" ¯\_(ツ)_/¯
toomuchtodo 5y ago
Sure sounds like fraud to me, but even if technically not, I’m happy to have more public examples on display for regulators to demonstrate their need for tighter regulatory authority (and legislation) around crypto.
- brighton36 5y ago
  Code is law. Lol.
misiti3780 5y ago
Can you provide an article about the Ethereum launch incident ?
- f38zf5vdt 5y ago
  https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization)
- arcticbull 5y ago
  Pretty big deal at the time, there's a lot of write-ups, just google "DAO hack" [1] [edit] tl;dr: it's the reason there's now an Ethereum Classic, and we learned that Code is Law and trustlessness only applies to grandma's savings, not Vitaliks. [1] https://www.coindesk.com/learn/2016/06/25/understanding-the-dao-attack/ https://www.coindesk.com/learn/2016/06/25/understanding-the-...
  - brokensegue 5y ago
    The dao hack happened well after Ethereum launch
  - ineedasername 5y ago
    we learned that Code is Law... Yep. Legal jargon IRL is about as close as you get IRL to "code", with roughly 1,000 years of legal development underlying common law and modern legal systems to inform a style of language that is practically its own dialect. Quite a bit of it has developed over the centuries in an effort to eliminate potential ambiguities in things like contracts so there would be no question about how the legal instrument should be executed. This is why, to the butt of many jokes & frustrations, legalese is so extremely verbose & dense. Eliminating ambiguities or unintentional side effects or loopholes is extremely difficult. Code appears to be little different in this respect: Implementing code that effectively says "don't manipulate the market in a way that makes us lose $millions" is not a straightforward task.
  - _jal 5y ago
    > trustlessness only applies to grandma's savings This is the lesson a lot of people fail to learn from watching. They seem to have to experience it.
arcticbull 5y ago
> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? I believe there is actually a case making its way through the courts as we speak where someone is making the case that "code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. [1] [1] https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts/ https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...
- deleted 5y ago
  [deleted]
- ineedasername 5y ago
  >Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction. Both are exploits. But they are not the same type of exploit.
  - deleted 5y ago
    [deleted]
- PragmaticPulp 5y ago
  > Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed. An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system. The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.
delaaxe 5y ago
Can you elaborate on the initial promise of smart contracts?
- EGreg 5y ago
  Code is law? hehe I actually think Smart Contracts have loads of potential beyond all this "number go up" stuff Here just a few : https://intercoin.org/applications https://intercoin.org/applications
- twox2 5y ago
  The promise of smart contracts is "programmable money". Humans use money to interact with each other. When money becomes software, then you can create new and unique methods of transacting/interacting.
- G3rn0ti 5y ago
  > smart contracts This word to describe software settling monetary transactions is actually a bad choice and oversells what Ethereum actually can provide. A better term would be a financial vending machine. On chain EVM transactions are essentially just stupid scripts that act according to the same simple, deterministic roles every time you put money into it. The end result is always either you gaining or losing money (but return some other form of “value” like a chocolate bar from a vending machine) by means of a transaction between two people that do not need to know i.e. “trust” each other. While it certainly does not redefine civil law, a vending machine — if well designed — can enforce compliance with the law without requiring a middle man like a bank or a lawyer. As every programmer can testify, however, even simple programs can exhibit fairly complex behavior and that’s often impossible to fully predict by static analysis alone. Still „virtual financial vending machines“ (it’s not as catchy as “smart contracts”) have a huge potential to disrupt the banking and financial services sector.
deleted 5y ago
[deleted]
simonebrunozzi 5y ago
I think most people don't realize how easy it is to "launder" stolen crypto using various techniques. Good article that covers the topic: https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f539 https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f...
mementomori 5y ago
For the Ethereum attack that's similar to the CREAM attack, are you referring to the DAO attack, or something else? Can you please share some links on that incident?
G3rn0ti 5y ago
> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Well, while the attacker did not exploit a bug inside the lending protocol code per se that person surely relied on a design flaw. Basically, what successful flash loan attacks do is to manipulate the price of an asset inside a „liquidity pool“ of a single „distributed exchange“ (DEX) temporarily to a much lower value and then buy off this asset cheaply and sell it on another DEX for profit. To protect itself from a flash loan attack, a DEX protocol should use an external „oracle“ to determine the price of an asset instead of relying on the „in-house price“ (in lieu of a better word). C.R.E.A.M. does not seem to do this. This is clearly a flaw in its pricing model.

Stevvo 5y ago

"Someone cleverly exploiting loopholes" That's what a cyberattack hack is.

rossdavidh 5y ago

One definition of "hack", close to the earliest sense of the word, is "to use something in a way it was not intended when it was made". This was definitely not the way the creators of the platform intended it to be used. Whether it qualifies underall all common senses of "hack" is debatable, but it at least qualifies under a common sense of the word.

newacc9 5y ago
pg has a whole article about the word. "Ugly and imaginative solutions have something in common: they both break the rules. And there is a gradual continuum between rule breaking that's merely ugly (using duct tape to attach something to your bike) and rule breaking that is brilliantly imaginative (discarding Euclidean space)."
registeredcorn 5y ago
> This was definitely not the way the creators of the platform intended it to be used. This question might be getting way too philosophical or abstract, but would the following statement be fair: "If something is designed, its design is intentional." That isn't to say, a thing that is designed can't have flaws, but, if it was created to process things in a predetermined series of events, isn't that how it's supposed to work? If someone is able to exploit the layout of that design - a flaw of logic, not of security - it seems weird to think that the act of someone using it would be considered unintended, you know? I feel like a lack of planning or thought by the designer doesn't necessarily put any responsibility on the user. Again, might be more of a debate around the concept of design...it's just a weird thing to consider something like, "Yes, the platform was built to do that, but you weren't expected to use the platform to do that!" ¯\_(ツ)_/¯

toomuchtodo 5y ago

Sure sounds like fraud to me, but even if technically not, I’m happy to have more public examples on display for regulators to demonstrate their need for tighter regulatory authority (and legislation) around crypto.

brighton36 5y ago
Code is law. Lol.

misiti3780 5y ago

Can you provide an article about the Ethereum launch incident ?

f38zf5vdt 5y ago
https://en.wikipedia.org/wiki/The_DAO_(organization) https://en.wikipedia.org/wiki/The_DAO_(organization)
arcticbull 5y ago
Pretty big deal at the time, there's a lot of write-ups, just google "DAO hack" [1] [edit] tl;dr: it's the reason there's now an Ethereum Classic, and we learned that Code is Law and trustlessness only applies to grandma's savings, not Vitaliks. [1] https://www.coindesk.com/learn/2016/06/25/understanding-the-dao-attack/ https://www.coindesk.com/learn/2016/06/25/understanding-the-...
- brokensegue 5y ago
  The dao hack happened well after Ethereum launch
- ineedasername 5y ago
  we learned that Code is Law... Yep. Legal jargon IRL is about as close as you get IRL to "code", with roughly 1,000 years of legal development underlying common law and modern legal systems to inform a style of language that is practically its own dialect. Quite a bit of it has developed over the centuries in an effort to eliminate potential ambiguities in things like contracts so there would be no question about how the legal instrument should be executed. This is why, to the butt of many jokes & frustrations, legalese is so extremely verbose & dense. Eliminating ambiguities or unintentional side effects or loopholes is extremely difficult. Code appears to be little different in this respect: Implementing code that effectively says "don't manipulate the market in a way that makes us lose $millions" is not a straightforward task.
- _jal 5y ago
  > trustlessness only applies to grandma's savings This is the lesson a lot of people fail to learn from watching. They seem to have to experience it.

arcticbull 5y ago

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? I believe there is actually a case making its way through the courts as we speak where someone is making the case that "code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. [1] [1] https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts/ https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

deleted 5y ago
[deleted]
ineedasername 5y ago
>Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction. Both are exploits. But they are not the same type of exploit.
- deleted 5y ago
  [deleted]
PragmaticPulp 5y ago
> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed. An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system. The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.

delaaxe 5y ago

Can you elaborate on the initial promise of smart contracts?

EGreg 5y ago
Code is law? hehe I actually think Smart Contracts have loads of potential beyond all this "number go up" stuff Here just a few : https://intercoin.org/applications https://intercoin.org/applications
twox2 5y ago
The promise of smart contracts is "programmable money". Humans use money to interact with each other. When money becomes software, then you can create new and unique methods of transacting/interacting.
G3rn0ti 5y ago
> smart contracts This word to describe software settling monetary transactions is actually a bad choice and oversells what Ethereum actually can provide. A better term would be a financial vending machine. On chain EVM transactions are essentially just stupid scripts that act according to the same simple, deterministic roles every time you put money into it. The end result is always either you gaining or losing money (but return some other form of “value” like a chocolate bar from a vending machine) by means of a transaction between two people that do not need to know i.e. “trust” each other. While it certainly does not redefine civil law, a vending machine — if well designed — can enforce compliance with the law without requiring a middle man like a bank or a lawyer. As every programmer can testify, however, even simple programs can exhibit fairly complex behavior and that’s often impossible to fully predict by static analysis alone. Still „virtual financial vending machines“ (it’s not as catchy as “smart contracts”) have a huge potential to disrupt the banking and financial services sector.

deleted 5y ago

[deleted]

simonebrunozzi 5y ago

I think most people don't realize how easy it is to "launder" stolen crypto using various techniques. Good article that covers the topic: https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f539 https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f...

mementomori 5y ago

For the Ethereum attack that's similar to the CREAM attack, are you referring to the DAO attack, or something else? Can you please share some links on that incident?

G3rn0ti 5y ago

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Well, while the attacker did not exploit a bug inside the lending protocol code per se that person surely relied on a design flaw. Basically, what successful flash loan attacks do is to manipulate the price of an asset inside a „liquidity pool“ of a single „distributed exchange“ (DEX) temporarily to a much lower value and then buy off this asset cheaply and sell it on another DEX for profit. To protect itself from a flash loan attack, a DEX protocol should use an external „oracle“ to determine the price of an asset instead of relying on the „in-house price“ (in lieu of a better word). C.R.E.A.M. does not seem to do this. This is clearly a flaw in its pricing model.