4 ms·
https://twitter.com/qrs/status/1395784294451265536 https://twitter.com/qrs/status/1395784294451265536 > Smart contracts should be considered self-funded bug-b
by chx 5y ago
https://twitter.com/qrs/status/1395784294451265536 https://twitter.com/qrs/status/1395784294451265536
>
Smart contracts should be considered self-funded bug-bounty platforms.
- paulpauper 5y agoyes this. Crypto bug bounties are way too small given the stakes. $30k and bragging rights is not as enticing as $30 + million instant. A bug that allows some possible code execution if a dozen improbable conditions are met would be worth disclosing for $30k, but the if you're talking tens of hundreds millions for the taking right now literally with a single tx, then you need to do better than that.
- cinntaile 5y agoI'm somewhat sympathetic to this view but I don't think it's consistent. If your bank gets hacked due to a flaw in the code and millions get stolen, why would you not apply the same code is law principle?
- zwkrt 5y agoBecause a bank's code is not the law. Banks handle actual money, for which there is a thousand year history of common law for settling disputes of ownership, debt, theft, collection practices, and insurance.
- rednerrus 5y agoIsn't the case here that the attacker was playing by the "rules" but found a loophoole?
- ikura 5y agoBecause the bank's relationship with its customers, central banks, and society as a whole, is codified in law and not in code. So if you find a legal loophole that's different from hacking the bank to get something the legal system doesn't entitle you to. When the code is the law, a hack is a loophole.
- otterley 5y agoThere seems to be an ongoing misimpression here that code is, in fact, law, as though our existing legal system doesn’t have something to say about that.
- cinntaile 5y agoCryptocurrencies and smart contracts exist within our society as well, they're not subject to an alternative reality.
- memonkey 5y agoThey're only barely being subject to society's laws though I think is the point.
- htrp 5y agoI think it is consistent, banks are built on legal frameworks. If you so chose to, and you were in certain countries, you could "hack" the legal system to steal the money yourself [1] and it would be perfectly 'legal'. [1] https://www.newyorker.com/magazine/2018/08/20/how-bill-browder-became-russias-most-wanted-man https://www.newyorker.com/magazine/2018/08/20/how-bill-browd...
- otterley 5y agoThat’s a bit like saying that bank robbery proceeds should be considered the price of security consulting. You can’t just blithely wave away the spirit of the law and scienter as if it’s not a thing. There's a reason why "do what thou wilt shall be the whole of the law" is not the guiding principle for Western society.
- Miner49er 5y agoYeah, except the biggest selling point of cryptocurrencies is that it's decentralized and above the law of any one government. The code is supposed to be law. So the true spirit of cryptocurrencies is that if there's a flaw in the smart contract, it's okay to exploit it.
- SV_BubbleTime 5y agoThis reminds me of “every rule in the safety book was written in blood”. In a way, every security measure at a bank is because of a previous attack. Those “undocumented pen testers” did help create the security.
- otterley 5y agoTrue - I think we can agree, though, that the bank robbers are not entitled to the money for their efforts.
- burnished 5y agoThat doesn't seem to follow. If code is law, then what spirit is there to interpret? That was the intentional deviation from the scenario where we all understood that rules couldn't be perfect and that we must strive towards the spirit of the law.