10 ms·

If code is law, then the exploiter was perfectly within their rights to do this and they're entitled to the money. Not their fault that they read the contract

If code is law, then the exploiter was perfectly within their rights to do this and they're entitled to the money. Not their fault that they read the contract more carefully than the contract writers did.

TekMol 4y ago
Articles should also be read carefully. This was not related to the contract behaving in unexpected ways.
- anamexis 4y ago
  It certainly doesn't seem like they expected this.
  - bena 4y ago
    No, they didn't. They figured human nature would keep them safe. And that no one who could muster the capital to perform this action would want to, and anyone that would want to wouldn't be able to muster the capital. Technically, the risk of borrowing that amount of money is high. As is the risk of investing that amount of money into one coin. They figured anyone that would even begin to attempt something like that would operate in good faith. No way they'd tank the coin, because they have so much skin in the game. Well, that doesn't matter when you can take your skin and go home. Not to mention the skins of everyone else, wearing them Hannibal Lecter style.
- whimsicalism 4y ago
  It was expected that it would be possible to take $182 million in reserves easily with a flash loan?
  - bilbo0s 4y ago
    No, it was expected that people with more skin in could decide to take any action they liked. Including, "take $182 million in reserves easily with a flash loan".
    - whimsicalism 4y ago
      But it was a flash loan, so they didn't have skin in. Maybe if they had had a time delay for taking actions?
thghtihadanacct 4y ago
I have been thinking this for a while. This is being called an 'attack' and a 'hack' although it seems pretty clear the user(s, probably) just understood the code well. It doesnt seem any of the steps in execution would have been illicit otherwise.
- cdumler 4y ago
  This is the crux of the whole DeFi thing, and I strongly agree this was not a hack. My whole problem with DeFi is Gödel's Incompleteness Theorem. Roughly, it states that any reasonably complex code is going to have outcomes that cannot be determined by reading the code. In this case: * Started with currencies that didn't allow flash loans. * Made a "we feel good about democracy of involvement" rule that supermajority could make any decisions with the funds "because we like people who invest in our work." * They added two currencies that supported flash loans. * Person or persons with currencies used flash loans to gain supermajority to transfer the funds out. This is why banks are inefficient. There are (in theory) safeguards to transfers make it possible to stop or reverse activities. DeFi is forever going to be dealing with these issues after the fact.
  - bweitzman 4y ago
    Applying the incompleteness theorem wouldn't say that every piece of complex code has unpredictable outcomes, but that there exists some pieces of code that have unpredictable outcome. Seems like in this case the outcomes were entirely predicted by the "attacker".
    - fabianhjr 4y ago
      Incompletness Theorem states that any system/language with primitive recursive arithmetic is either incomplete (since there is a construction of an undecidable statement via self reference) or unsound (since that same undecidable statement would be in contradiction) AFAIK but speculating every programming language has primitive recursive arithmetic.
      - 4y ago
dragonwriter 4y ago
> If code is law Code is not law.
- blueprint 4y ago
  it is if we're talking about binding ourselves to legal contracts that execute on the basis of the result of proof of work security instead of proof of stake and centralized-forking garbagecoins
  - exdsq 4y ago
    The quality of HN posts on crypto is borderline - writing stuff like this pushes it off the edge towards flame wars and ‘All crypto is bad, just look at these flame wars’. Please try add more substance to posts, such as how PoW vs PoS has any impact on Code is Law (especially when Eth moves to PoS and Bitcoin becomes the last big PoW chain left, yet doesn’t have smart contracts).
- eric_cc 4y ago
  When you willingly take financial action with a smart contract, you are agreeing to the smart contract. The smart contract is code. While code is not “law” literally, in this case it is the lawful contract definition. How else can you possibly interpret this?
  - deleted 4y ago
    [deleted]
  - jeroenhd 4y ago
    A "smart contract" is merely a program. Manipulating a program or abusing it for your personal gains at the expense of others is often illegal. If you're not into the cryptocurrency mess, this reads like regular old hacking. "If code is law and your code allows me to execute arbitrary SQL queries, then this SQL injection is perfectly legal" doesn't hold up in court. The FBI will not let you go because technically you only asked the remote server to execute your request. It does invalidate the "code is law" concept, but in the real world, code isn't law.
narrator 4y ago
Fully autonomous weapons are also a code is law problem. Ethereum is a preview of the killer robot problems of the future.
- gerry_shaw 4y ago
  The speed at which computers run is beyond human intuition and beyond the speed for humans to respond. A killer robot will kill everybody in range practically instantly. It would be nothing like what movies show.
  - trhr 4y ago
    Fortunately for us, you can't kill someone with a CPU cycle. You need to use a servo for that. Which, while quick, are far from instant, and will always be limited by basic physics like thermal management.
  - adhesive_wombat 4y ago
    Urgh, yes, that's so annoying. Skynet drones won't pepper the ground behind the hero with bullets while flying low and slow, they'll land every shot on target in milliseconds, before any human even sensed there was a threat. And they won't have a standards-compliant USB port to take over control either. The only real question is whether the machines think one bullet to the head is most efficient use of resources, one bullet per organ, or an equivalent mass of non-depleted (they don't care about radiation, the biosphere is not their problem) uranium to the target biomass.
    - flerchin 4y ago
      Machines don't currently, in any form, do their own maintenance. A killer robot army would utterly dominate the battlefield until it broke down and ran out of consumables. It would then completely stop.
      - alasdair_ 4y ago
        A GAI that is significantly smarter than a human can figure that part out on its own.
chx 4y ago
https://twitter.com/qrs/status/1395784294451265536 https://twitter.com/qrs/status/1395784294451265536 > Smart contracts should be considered self-funded bug-bounty platforms.
- paulpauper 4y ago
  yes this. Crypto bug bounties are way too small given the stakes. $30k and bragging rights is not as enticing as $30 + million instant. A bug that allows some possible code execution if a dozen improbable conditions are met would be worth disclosing for $30k, but the if you're talking tens of hundreds millions for the taking right now literally with a single tx, then you need to do better than that.
  - cinntaile 4y ago
    I'm somewhat sympathetic to this view but I don't think it's consistent. If your bank gets hacked due to a flaw in the code and millions get stolen, why would you not apply the same code is law principle?
    - zwkrt 4y ago
      Because a bank's code is not the law. Banks handle actual money, for which there is a thousand year history of common law for settling disputes of ownership, debt, theft, collection practices, and insurance.
      - rednerrus 4y ago
        Isn't the case here that the attacker was playing by the "rules" but found a loophoole?
    - ikura 4y ago
      Because the bank's relationship with its customers, central banks, and society as a whole, is codified in law and not in code. So if you find a legal loophole that's different from hacking the bank to get something the legal system doesn't entitle you to. When the code is the law, a hack is a loophole.
m348e912 4y ago
A similar thing happened with an Ethereum smart contract that was exploited several years ago. The "code is law" principle didn't apply there either, since the developers forked the Ethereum block chain and reversed the offending smart contract transactions. The original Ethereum chain still exists today (known as Ethereum Classic) but it's not worth nearly as much as the forked Eth chain is.
- optimalsolver 4y ago
  All smart contracts are immutable, but some are less immutable than others.
- koonsolo 4y ago
  Exactly, it's not "code is law" but "consensus is valuable".
splix 4y ago
Code is law as law of nature. Not government laws. Code I Laws just means that if code was executed in the way it was intended to work and you don't like it you don't revert your blockchain. You keep blockchain as is, because it's nature of blockchain. But you're free to go to the law enforcement guys, courts, whatever, to enforce government laws if you think they were broken.
- rozap 4y ago
  So...it's decentralized but if you don't like how it plays out then you run off to a centralized power structure to fix it?
  - splix 4y ago
    No, it's just unrelated things. Nature is decentralized. But if you car was burglarized, which is perfectly fine under laws of nature and the glass physics, you still call the centralized police.
    - rozap 4y ago
      Except whole promise of the crypto-anarchists, decentralized autonomous organizations, tornado, etc, etc was to break free from the tyranny of government. Then when shit invariably hits the fan, they run to the FBI complaining about how they got robbed. The features that support money laundering and tax avoidance mechanisms that underpin the vast majority of actual money flowing through the crypto space are in direct conflict with the gov organizations that we are talking about here, so it's not like these things can coexist together in the buckets of "natural law" vs "government law".
      - splix 4y ago
        Okay, I guess there are people who consider cryptocurrency as opposition to the government. That's fine. But how it relates to the current situation and specifically to the "Code is Law"?
  - i_love_music 4y ago
teawrecks 4y ago
The code isn't the law, consensus is. If the miners disagree with a transaction, they can collectively agree that it never happened. IMO that's the most in-the-spirit-of-cryptocurrency way to handle the problem, for better or worse.

TekMol 4y ago

Articles should also be read carefully. This was not related to the contract behaving in unexpected ways.

anamexis 4y ago
It certainly doesn't seem like they expected this.
- bena 4y ago
  No, they didn't. They figured human nature would keep them safe. And that no one who could muster the capital to perform this action would want to, and anyone that would want to wouldn't be able to muster the capital. Technically, the risk of borrowing that amount of money is high. As is the risk of investing that amount of money into one coin. They figured anyone that would even begin to attempt something like that would operate in good faith. No way they'd tank the coin, because they have so much skin in the game. Well, that doesn't matter when you can take your skin and go home. Not to mention the skins of everyone else, wearing them Hannibal Lecter style.
whimsicalism 4y ago
It was expected that it would be possible to take $182 million in reserves easily with a flash loan?
- bilbo0s 4y ago
  No, it was expected that people with more skin in could decide to take any action they liked. Including, "take $182 million in reserves easily with a flash loan".
  - whimsicalism 4y ago
    But it was a flash loan, so they didn't have skin in. Maybe if they had had a time delay for taking actions?

thghtihadanacct 4y ago

I have been thinking this for a while. This is being called an 'attack' and a 'hack' although it seems pretty clear the user(s, probably) just understood the code well. It doesnt seem any of the steps in execution would have been illicit otherwise.

cdumler 4y ago
This is the crux of the whole DeFi thing, and I strongly agree this was not a hack. My whole problem with DeFi is Gödel's Incompleteness Theorem. Roughly, it states that any reasonably complex code is going to have outcomes that cannot be determined by reading the code. In this case: * Started with currencies that didn't allow flash loans. * Made a "we feel good about democracy of involvement" rule that supermajority could make any decisions with the funds "because we like people who invest in our work." * They added two currencies that supported flash loans. * Person or persons with currencies used flash loans to gain supermajority to transfer the funds out. This is why banks are inefficient. There are (in theory) safeguards to transfers make it possible to stop or reverse activities. DeFi is forever going to be dealing with these issues after the fact.
- bweitzman 4y ago
  Applying the incompleteness theorem wouldn't say that every piece of complex code has unpredictable outcomes, but that there exists some pieces of code that have unpredictable outcome. Seems like in this case the outcomes were entirely predicted by the "attacker".
  - fabianhjr 4y ago
    Incompletness Theorem states that any system/language with primitive recursive arithmetic is either incomplete (since there is a construction of an undecidable statement via self reference) or unsound (since that same undecidable statement would be in contradiction) AFAIK but speculating every programming language has primitive recursive arithmetic.
    - 4y ago

dragonwriter 4y ago

> If code is law Code is not law.

blueprint 4y ago
it is if we're talking about binding ourselves to legal contracts that execute on the basis of the result of proof of work security instead of proof of stake and centralized-forking garbagecoins
- exdsq 4y ago
  The quality of HN posts on crypto is borderline - writing stuff like this pushes it off the edge towards flame wars and ‘All crypto is bad, just look at these flame wars’. Please try add more substance to posts, such as how PoW vs PoS has any impact on Code is Law (especially when Eth moves to PoS and Bitcoin becomes the last big PoW chain left, yet doesn’t have smart contracts).
eric_cc 4y ago
When you willingly take financial action with a smart contract, you are agreeing to the smart contract. The smart contract is code. While code is not “law” literally, in this case it is the lawful contract definition. How else can you possibly interpret this?
- deleted 4y ago
  [deleted]
- jeroenhd 4y ago
  A "smart contract" is merely a program. Manipulating a program or abusing it for your personal gains at the expense of others is often illegal. If you're not into the cryptocurrency mess, this reads like regular old hacking. "If code is law and your code allows me to execute arbitrary SQL queries, then this SQL injection is perfectly legal" doesn't hold up in court. The FBI will not let you go because technically you only asked the remote server to execute your request. It does invalidate the "code is law" concept, but in the real world, code isn't law.

narrator 4y ago

Fully autonomous weapons are also a code is law problem. Ethereum is a preview of the killer robot problems of the future.

gerry_shaw 4y ago
The speed at which computers run is beyond human intuition and beyond the speed for humans to respond. A killer robot will kill everybody in range practically instantly. It would be nothing like what movies show.
- trhr 4y ago
  Fortunately for us, you can't kill someone with a CPU cycle. You need to use a servo for that. Which, while quick, are far from instant, and will always be limited by basic physics like thermal management.
- adhesive_wombat 4y ago
  Urgh, yes, that's so annoying. Skynet drones won't pepper the ground behind the hero with bullets while flying low and slow, they'll land every shot on target in milliseconds, before any human even sensed there was a threat. And they won't have a standards-compliant USB port to take over control either. The only real question is whether the machines think one bullet to the head is most efficient use of resources, one bullet per organ, or an equivalent mass of non-depleted (they don't care about radiation, the biosphere is not their problem) uranium to the target biomass.
  - flerchin 4y ago
    Machines don't currently, in any form, do their own maintenance. A killer robot army would utterly dominate the battlefield until it broke down and ran out of consumables. It would then completely stop.
    - alasdair_ 4y ago
      A GAI that is significantly smarter than a human can figure that part out on its own.

chx 4y ago

https://twitter.com/qrs/status/1395784294451265536 https://twitter.com/qrs/status/1395784294451265536 > Smart contracts should be considered self-funded bug-bounty platforms.

paulpauper 4y ago
yes this. Crypto bug bounties are way too small given the stakes. $30k and bragging rights is not as enticing as $30 + million instant. A bug that allows some possible code execution if a dozen improbable conditions are met would be worth disclosing for $30k, but the if you're talking tens of hundreds millions for the taking right now literally with a single tx, then you need to do better than that.
- cinntaile 4y ago
  I'm somewhat sympathetic to this view but I don't think it's consistent. If your bank gets hacked due to a flaw in the code and millions get stolen, why would you not apply the same code is law principle?
  - zwkrt 4y ago
    Because a bank's code is not the law. Banks handle actual money, for which there is a thousand year history of common law for settling disputes of ownership, debt, theft, collection practices, and insurance.
    - rednerrus 4y ago
      Isn't the case here that the attacker was playing by the "rules" but found a loophoole?
  - ikura 4y ago
    Because the bank's relationship with its customers, central banks, and society as a whole, is codified in law and not in code. So if you find a legal loophole that's different from hacking the bank to get something the legal system doesn't entitle you to. When the code is the law, a hack is a loophole.

m348e912 4y ago

A similar thing happened with an Ethereum smart contract that was exploited several years ago. The "code is law" principle didn't apply there either, since the developers forked the Ethereum block chain and reversed the offending smart contract transactions. The original Ethereum chain still exists today (known as Ethereum Classic) but it's not worth nearly as much as the forked Eth chain is.

optimalsolver 4y ago
All smart contracts are immutable, but some are less immutable than others.
koonsolo 4y ago
Exactly, it's not "code is law" but "consensus is valuable".

splix 4y ago

Code is law as law of nature. Not government laws. Code I Laws just means that if code was executed in the way it was intended to work and you don't like it you don't revert your blockchain. You keep blockchain as is, because it's nature of blockchain. But you're free to go to the law enforcement guys, courts, whatever, to enforce government laws if you think they were broken.

rozap 4y ago
So...it's decentralized but if you don't like how it plays out then you run off to a centralized power structure to fix it?
- splix 4y ago
  No, it's just unrelated things. Nature is decentralized. But if you car was burglarized, which is perfectly fine under laws of nature and the glass physics, you still call the centralized police.
  - rozap 4y ago
    Except whole promise of the crypto-anarchists, decentralized autonomous organizations, tornado, etc, etc was to break free from the tyranny of government. Then when shit invariably hits the fan, they run to the FBI complaining about how they got robbed. The features that support money laundering and tax avoidance mechanisms that underpin the vast majority of actual money flowing through the crypto space are in direct conflict with the gov organizations that we are talking about here, so it's not like these things can coexist together in the buckets of "natural law" vs "government law".
    - splix 4y ago
      Okay, I guess there are people who consider cryptocurrency as opposition to the government. That's fine. But how it relates to the current situation and specifically to the "Code is Law"?
- i_love_music 4y ago

teawrecks 4y ago

The code isn't the law, consensus is. If the miners disagree with a transaction, they can collectively agree that it never happened. IMO that's the most in-the-spirit-of-cryptocurrency way to handle the problem, for better or worse.