13 ms·

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Could you not use the same exact description of anyone exploiting bugs in s

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? I believe there is actually a case making its way through the courts as we speak where someone is making the case that "code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. [1] [1] https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-this-teen-hacker-seems-intent-on-testing-code-is-law-in-the-courts/ https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

deleted 5y ago
[deleted]
ineedasername 5y ago
>Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction. Both are exploits. But they are not the same type of exploit.
- deleted 5y ago
  [deleted]
PragmaticPulp 5y ago
> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed. An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system. The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.
- Lionga 5y ago
  You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed" They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.
  - yongjik 5y ago
    The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."
  - npteljes 5y ago
    A bug implies a software defect. This however sounds like a design defect.
  - PragmaticPulp 5y ago
    > They clearly did NOT intended to give the coins away. They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor. This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution. This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.
    - sulam 5y ago
      I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.
delaaxe 5y ago
That's why code is not law. Intent is law.
- PragmaticPulp 5y ago
  No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money. Accidentally killing someone can still be a crime even if you didn't intend to kill them. Intent plays a role in deciding outcomes and can influence the judgment, but intent doesn't overrule or negate law. And that’s basically what happened here: Someone read the fine print of the trading platform and realized they could use a flash loan to push the system into a space where the trade would default and the attacker would profit. So they pressed the button and the system worked as designed.
  - gitfan86 5y ago
    So the way to fix this is to do what banks and stock exchanges do. Operate under a regulatory framework that has defined legal precedence to avoid someone take advantage of an unintended loophole. But at that point you are defeating the whole point of crypto being decentralized and permissionless.
    - campbel 5y ago
      bingo
    - sokoloff 5y ago
      Isn't the entire $GME thing an example where someone took advantage of a situation where counterparties got way out over their skis and buyers of $GME profited well in excess of any reasonable estimation of Gamestop's promise of business results via what amounts to an unintended loophole?
      - deleted 5y ago
        [deleted]
      - 5y ago
enjo 5y ago
A hack requires three things: 1. Someone locking themselves in a dark (usually smoky) room with someone in a button down shirt (with rolled up sleeves) standing over their shoulder. 2. Green text on a black background 3. The words "I'm in" yelled at some point. Doesn't sound like any of that happened here.
- JackFr 5y ago
  If the hack is sufficiently sophisticated there should be an animated progress bar of funds being transferred.
  - skohan 5y ago
    Even better with an animation of bills flying from one account to the other in the background and/or a laughing skull on the computer of the person being hacked
    - DarmokJalad1701 5y ago
      Unless the person being hacked can type faster
- arcticbull 5y ago
  And a computer that beeps with every keypress.
  - antupis 5y ago
    and some 90s techno blasting at background
- CalChris 5y ago
  I submitted We're In as a trope to TVTropes with Theo clickity-clicking in Die Hard as the example. But it got dinged because of the hard rule against the trope namer quoting script. So I resubmitted it as I Wasn't Before But I Sure As Hell Am Now and still no go.
- 5y ago
dkarl 5y ago
This could be very interesting. The argument that "you put your money behind a pickable lock so you gave permission to anyone with lock-picking skills to take it" is a classic immature and self-serving understanding of the law, but in this case the system was built with the declared intention of creating a space where that logic applies. How do you appeal to the courts after doing business under an explicit shared understanding that the courts are unnecessary and irrelevant? It will be difficult to prove that you had any expectation of the other party obeying any norms other than doing everything within its technical power to benefit from the transactions.
- tshaddox 5y ago
  > in this case the system was built with the declared intention of creating a space where that logic applies Why do you suppose this is the case? Surely that’s not in any way true.
  - Qworg 5y ago
    For my part, you can't declare "we're building this outside of the bounds of the legal system, but we're going to lean on that self-same legal system when it fails". You have to pick between outside and inside the law.
    - tshaddox 5y ago
      But you seem to be picking whatever is your least favorite defense of blockchain tech from Twitter and declaring that it's the only "purpose" of the whole category of technologies. This is just as preposterous as saying "locks are built with the declared intention of protecting private property without any government protection of property, therefore if someone breaks your lock and steals your stuff you can't just go to the police and expect them to help."
- kwertyoowiyop 5y ago
  Which country’s court do you appeal to? Does the transaction take place where either or both parties are? Or where the server is? What if the server DB is in one country, the outward-facing API is in another, and the actual transaction API in another? Yikes.
slim 5y ago
If you're going to argue this, then there's no purpose on contracts or ETH
archontes 5y ago
Could you not make an argument that you're merely taking people up on their offer to the letter, making the earnings essentially an expensive bug bounty?
trhway 5y ago
>"code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. i feel that there is a case of false advertising somewhere here. The classic finance system doesn't advertise "code is law" as a feature, and thus easily claws back accidentally transferred into your account $1B. The Ethereum based crypto and the likes are heavily promoting the "code is law" feature, and thus their readiness and attempts to back off from it anytime the things not going their way suggests false advertising and intentional, at this point giving the history, misleading of the users/customers. Wrt. the original post - it is pretty surreal, users just borrow and mint $500M-2B in a transaction. The crypto proponents tear at Fed for printing money. Yet even the Fed and WallStreet rarely do $2B flash transaction, and not on a whim by some passer-by Shmoe user. The crypto is really democratizing/distributing and multiplying the financial madness that previously was limited to the exclusive club of big money. I have hard time to see how that is any good, and the wolves of crypto look to me much worse than the wolves of the WallStreet.
- arcticbull 5y ago
  The wolves of wall street know they're doing something bad and at minimum try to avoid getting caught, the wolves of crypto will tell you its fabulous medicine that'll save you from the big bad fed while simultaneously screwing you from all sides.

deleted 5y ago

[deleted]

ineedasername 5y ago

>Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction. Both are exploits. But they are not the same type of exploit.

deleted 5y ago
[deleted]

PragmaticPulp 5y ago

> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed. An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system. The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.

Lionga 5y ago
You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed" They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.
- yongjik 5y ago
  The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."
- npteljes 5y ago
  A bug implies a software defect. This however sounds like a design defect.
- PragmaticPulp 5y ago
  > They clearly did NOT intended to give the coins away. They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor. This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution. This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.
  - sulam 5y ago
    I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.

delaaxe 5y ago

That's why code is not law. Intent is law.

PragmaticPulp 5y ago
No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money. Accidentally killing someone can still be a crime even if you didn't intend to kill them. Intent plays a role in deciding outcomes and can influence the judgment, but intent doesn't overrule or negate law. And that’s basically what happened here: Someone read the fine print of the trading platform and realized they could use a flash loan to push the system into a space where the trade would default and the attacker would profit. So they pressed the button and the system worked as designed.
- gitfan86 5y ago
  So the way to fix this is to do what banks and stock exchanges do. Operate under a regulatory framework that has defined legal precedence to avoid someone take advantage of an unintended loophole. But at that point you are defeating the whole point of crypto being decentralized and permissionless.
  - campbel 5y ago
    bingo
  - sokoloff 5y ago
    Isn't the entire $GME thing an example where someone took advantage of a situation where counterparties got way out over their skis and buyers of $GME profited well in excess of any reasonable estimation of Gamestop's promise of business results via what amounts to an unintended loophole?
    - deleted 5y ago
      [deleted]
    - 5y ago

enjo 5y ago

A hack requires three things: 1. Someone locking themselves in a dark (usually smoky) room with someone in a button down shirt (with rolled up sleeves) standing over their shoulder. 2. Green text on a black background 3. The words "I'm in" yelled at some point. Doesn't sound like any of that happened here.

JackFr 5y ago
If the hack is sufficiently sophisticated there should be an animated progress bar of funds being transferred.
- skohan 5y ago
  Even better with an animation of bills flying from one account to the other in the background and/or a laughing skull on the computer of the person being hacked
  - DarmokJalad1701 5y ago
    Unless the person being hacked can type faster
arcticbull 5y ago
And a computer that beeps with every keypress.
- antupis 5y ago
  and some 90s techno blasting at background
CalChris 5y ago
I submitted We're In as a trope to TVTropes with Theo clickity-clicking in Die Hard as the example. But it got dinged because of the hard rule against the trope namer quoting script. So I resubmitted it as I Wasn't Before But I Sure As Hell Am Now and still no go.
5y ago

dkarl 5y ago

This could be very interesting. The argument that "you put your money behind a pickable lock so you gave permission to anyone with lock-picking skills to take it" is a classic immature and self-serving understanding of the law, but in this case the system was built with the declared intention of creating a space where that logic applies. How do you appeal to the courts after doing business under an explicit shared understanding that the courts are unnecessary and irrelevant? It will be difficult to prove that you had any expectation of the other party obeying any norms other than doing everything within its technical power to benefit from the transactions.

tshaddox 5y ago
> in this case the system was built with the declared intention of creating a space where that logic applies Why do you suppose this is the case? Surely that’s not in any way true.
- Qworg 5y ago
  For my part, you can't declare "we're building this outside of the bounds of the legal system, but we're going to lean on that self-same legal system when it fails". You have to pick between outside and inside the law.
  - tshaddox 5y ago
    But you seem to be picking whatever is your least favorite defense of blockchain tech from Twitter and declaring that it's the only "purpose" of the whole category of technologies. This is just as preposterous as saying "locks are built with the declared intention of protecting private property without any government protection of property, therefore if someone breaks your lock and steals your stuff you can't just go to the police and expect them to help."
kwertyoowiyop 5y ago
Which country’s court do you appeal to? Does the transaction take place where either or both parties are? Or where the server is? What if the server DB is in one country, the outward-facing API is in another, and the actual transaction API in another? Yikes.

slim 5y ago

If you're going to argue this, then there's no purpose on contracts or ETH

archontes 5y ago

Could you not make an argument that you're merely taking people up on their offer to the letter, making the earnings essentially an expensive bug bounty?

trhway 5y ago

>"code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. i feel that there is a case of false advertising somewhere here. The classic finance system doesn't advertise "code is law" as a feature, and thus easily claws back accidentally transferred into your account $1B. The Ethereum based crypto and the likes are heavily promoting the "code is law" feature, and thus their readiness and attempts to back off from it anytime the things not going their way suggests false advertising and intentional, at this point giving the history, misleading of the users/customers. Wrt. the original post - it is pretty surreal, users just borrow and mint $500M-2B in a transaction. The crypto proponents tear at Fed for printing money. Yet even the Fed and WallStreet rarely do $2B flash transaction, and not on a whim by some passer-by Shmoe user. The crypto is really democratizing/distributing and multiplying the financial madness that previously was limited to the exclusive club of big money. I have hard time to see how that is any good, and the wolves of crypto look to me much worse than the wolves of the WallStreet.

arcticbull 5y ago
The wolves of wall street know they're doing something bad and at minimum try to avoid getting caught, the wolves of crypto will tell you its fabulous medicine that'll save you from the big bad fed while simultaneously screwing you from all sides.