5 ms·

> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate th

> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system? In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed. An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system. The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.

Lionga 5y ago
You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed" They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.
- yongjik 5y ago
  The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."
- npteljes 5y ago
  A bug implies a software defect. This however sounds like a design defect.
- PragmaticPulp 5y ago
  > They clearly did NOT intended to give the coins away. They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor. This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution. This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.
  - sulam 5y ago
    I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.
    - idiotsecant 5y ago
      The patch changed the design of the system. They obviously didn't forsee the flaw in their system but it's not like someone found a buffer overflow - they only used the levers and buttons that the system provided them to perform this 'attack'.
      - weq 5y ago
        If u take money from an open bank door, u aint gonna be waved off with a laugh and good day. Just because u picked the lock using the mechanisms provided, doesnt mean u didnt steal the bounty. Code is law will only lead to SkyNet.
  - ufo 5y ago
    By this logic, a buffer overrun exploit would not actually be an exploit, because it's just a pointer that goes up or down according to certain rules.
- 6gvONxR4sf7o 5y ago
  > They clearly did NOT intended to give the coins away. I frequently make decisions that don’t turn out as I intended. You need a distinction between whether the outcome is what you intended and whether the process is what you intended. It isn’t a clear line.
- tromp 5y ago
  > their intended system design was obviously flawed No, the design was so complex that its flaws were well hidden, and therefore not intended. Quoting C. A. R. Hoare: “There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.”
  - ehvatum 5y ago
    > No, the design was so complex that its flaws were well hidden, and therefore not intended. That’s no less true for a Chrome sandbox escape. In fact, this Ethereum loan platform’s behavior is encoded in program source codes, just like Chrome. One expects that some exploitable issues in the Chromium code arise not from syntactical but conceptual errors. The code could match a mistaken programmer intent, and this often happens.
- throwawaygh 5y ago
  Even if this is true, what in the world is the point of crypto platforms if courts need to step in and decide intent whenever someone doesn't like the outcome of a transaction?
  - lostmsu 5y ago
    It is the wet dream that some 100 line script will eventually become the only and unbiased arbiter and judge of anything in the world of finance. You are probably reading this comment and thinking "yeah, hah, naive fools". About as naive as the fools, that believe in a 100 line program, that gives you a puzzle that nothing will realistically ever be able to solve, yet the program could tell immediately if the solution is wrong or right.
  - mdoms 5y ago
    > what in the world is the point of crypto platforms Excellent question, one that crypto dudes could ask themselves a little more often.
  - labster 5y ago
    The point is to speculate in assets hidden from the tax man while destroying the environment. So far, crypto is still living up to that promise.
- antonvs 5y ago
  No, you can't say that about every bug. Many bugs occur in the implementation of systems, not in the design. That was not the case here. The system was implemented as designed.
grey-area 5y ago
It acted exactly as designed, not as intended (or they would not have patched the bug).
TomSwirly 5y ago
> In this case, the trade didn’t even violate the intended behavior of systems involved. This is clearly a false statement. The people who set up the system did NOT intend to allow others to take $130 million for nothing. The point was that their code did not express their intentions 100% correctly, and that's because that is quite hard to do.
ashwagary 5y ago
Would you consider this a legal economic attack or illegal criminal attack?

Lionga 5y ago

You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed" They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.

yongjik 5y ago
The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."
npteljes 5y ago
A bug implies a software defect. This however sounds like a design defect.
PragmaticPulp 5y ago
> They clearly did NOT intended to give the coins away. They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor. This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution. This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.
- sulam 5y ago
  I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.
  - idiotsecant 5y ago
    The patch changed the design of the system. They obviously didn't forsee the flaw in their system but it's not like someone found a buffer overflow - they only used the levers and buttons that the system provided them to perform this 'attack'.
    - weq 5y ago
      If u take money from an open bank door, u aint gonna be waved off with a laugh and good day. Just because u picked the lock using the mechanisms provided, doesnt mean u didnt steal the bounty. Code is law will only lead to SkyNet.
- ufo 5y ago
  By this logic, a buffer overrun exploit would not actually be an exploit, because it's just a pointer that goes up or down according to certain rules.
6gvONxR4sf7o 5y ago
> They clearly did NOT intended to give the coins away. I frequently make decisions that don’t turn out as I intended. You need a distinction between whether the outcome is what you intended and whether the process is what you intended. It isn’t a clear line.
tromp 5y ago
> their intended system design was obviously flawed No, the design was so complex that its flaws were well hidden, and therefore not intended. Quoting C. A. R. Hoare: “There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.”
- ehvatum 5y ago
  > No, the design was so complex that its flaws were well hidden, and therefore not intended. That’s no less true for a Chrome sandbox escape. In fact, this Ethereum loan platform’s behavior is encoded in program source codes, just like Chrome. One expects that some exploitable issues in the Chromium code arise not from syntactical but conceptual errors. The code could match a mistaken programmer intent, and this often happens.
throwawaygh 5y ago
Even if this is true, what in the world is the point of crypto platforms if courts need to step in and decide intent whenever someone doesn't like the outcome of a transaction?
- lostmsu 5y ago
  It is the wet dream that some 100 line script will eventually become the only and unbiased arbiter and judge of anything in the world of finance. You are probably reading this comment and thinking "yeah, hah, naive fools". About as naive as the fools, that believe in a 100 line program, that gives you a puzzle that nothing will realistically ever be able to solve, yet the program could tell immediately if the solution is wrong or right.
- mdoms 5y ago
  > what in the world is the point of crypto platforms Excellent question, one that crypto dudes could ask themselves a little more often.
- labster 5y ago
  The point is to speculate in assets hidden from the tax man while destroying the environment. So far, crypto is still living up to that promise.
antonvs 5y ago
No, you can't say that about every bug. Many bugs occur in the implementation of systems, not in the design. That was not the case here. The system was implemented as designed.

grey-area 5y ago

It acted exactly as designed, not as intended (or they would not have patched the bug).

TomSwirly 5y ago

> In this case, the trade didn’t even violate the intended behavior of systems involved. This is clearly a false statement. The people who set up the system did NOT intend to allow others to take $130 million for nothing. The point was that their code did not express their intentions 100% correctly, and that's because that is quite hard to do.

ashwagary 5y ago

Would you consider this a legal economic attack or illegal criminal attack?