23 ms·

$34M permanently locked into AkuDreams contract forever due to bad code

• frontman1988 5y ago
  A fool and his money are soon parted
• tinnet 5y ago
  Besides the badly written smart contract I'm also struggling to grok what exactly is Dutch about this auction. It's not that the price of something keeps dropping until somebody makes a bid. Instead everybody pays the lowest bid? Does everybody get a token as well? Why would anybody bid more than the reserve im this model?
• rufius 5y ago
  This is excellent.
• literallyWTF 5y ago
  Ah yes. But you see, this time is different.
• 5350-uiop-1130 5y ago
  code was (f)law(ed)
• floppiplopp 5y ago
  Here, I fixed the headline: $0.0 permanently locked into AkuDreams contract forever due to bad code.
• rvz 5y ago
  • throwmeariver1 5y ago
    You sat there waiting to copy and paste this comment weren’t you?
    • JaimeThompson 5y ago
      Perhaps it was posted using a DAO running a SmartContract on The B_Chain? ;)
    • rvz 5y ago
      Answering a question with a question (especially a totally unrelated one) isn't a great start to a conversation. Given that we have seen tons of scams in crypto like this random project and now a payments platform called Stripe has joined in (needs no introduction), I am now asking you, (assuming you know what Stripe is and what they do) where is the scam that Stripe is doing in their announcement of Crypto payouts?
  • 0des 5y ago
    Bad look to be silencing negative opinions about YC backed companies. Seeing this more and more lately, and am assuming my comment noting this will be gone soon too.
    • ascar 5y ago
      Just to be clear: I downvoted this because I sincerely believe it is not true. I have seen enough negative things about YC backed companies here, especially about Stripe, that I don't buy support spreading this kind of narrative without any evidence. It's not helpful or healthy for this community to spread false accusations.
      • rvz 5y ago
        > I downvoted this because I sincerely believe it is not true. I have seen enough negative things about YC backed companies here, especially about Stripe, that I don't buy support spreading this kind of narrative without any evidence. What narrative? What false accusations exactly? I see "Crypto is scam" comments on here from time to time and I'm looking for an explanation about Stripe's entrance into using crypto-currencies [0] themselves without any answers. It's interesting to see that all the replies here have deliberately avoided my question into where the actual scamming that Stripe is doing in offering crypto payouts, since others like to scream the same "Crypto is scam", 'snake oil' nonsense. [0] https://stripe.com/blog/expanding-global-payouts-with-crypto https://stripe.com/blog/expanding-global-payouts-with-crypto
        • ascar 5y ago
          > Bad look to be silencing negative opinions about YC backed companies. That narrative. I wasn't replying to you, but to the "am assuming my comment noting this will be gone soon too" statement as his comment was bound for a lot of dislikes and I wanted to give him an explanation that that has nothing to do with his perceived reality. I don't care about the Stripe feature and it's not related to the topic of this post, except that both is crypto. If you haven't gotten any satisfying replies in the actual submission you linked why do you think it's necessary to ask about what Stripe is doing in an unrelated story just because it's about bad crypto practices and then complain that you don't get answers to the derail? If you post a story that details that Stripe is actually scamming with crypto (more than just offering the option) I'm sure it would get traction.
  • doopy1 5y ago
    HN does not have a nuanced view of this space. There's a lingering assumption that everyone involved in crypto naively wants the "old way" gone in favor of bitcoin, which is completely absurd, or that the rest are scammers.
    • danaris 5y ago
      Well, basically everyone I've talked with on here about it that supports blockchain and cryptocurrencies has either explicitly or implicitly taken that position (that "fiat" should be replaced by cryptocurrency), so yeah, that is my assumption.
    • wpietri 5y ago
      We agree there is a group of people who don't have a nuanced view of the cryptocurrency space. But you seem to have overlooked about 99% of people advocating for crypto.
  • elil17 5y ago
    “Everyone keeps reporting about how this bank keeps getting robbed every day but no one is reporting about how their ATM sometimes works okay.”
  • cryptoshit 5y ago
    I think most of HN are atheists who don't buy in to the cryptocurrency religion.
• remram 5y ago
  I never got why we call those things "smart". It just seems like a dumber, more pedantic kind of contract. The kind that can take into account intent via the courthouse mechanism is smarter.
  • 8bitben 5y ago
    Turns out unfettered immutability isn't the holy grail it was made out to be
    • wpietri 5y ago
      Depends on the audience. This sort of immutability is still deeply loved by the blockchain idealists and the criminals. And more casually by all the people who love them some victim-blaming.
  • alpaca128 5y ago
    I actually like this kind of naming nowadays, it tells you right away how trustworthy it is. Smart is becoming the Karen of the tech industry.
    • egeozcan 5y ago
      As a person who never lived in an English-speaking country, associating Karen (or any name really) with such a bad personality has always made my "be nice" alarm bells ring. Truly sorry for the digression, just wanted to know what others think, and not blaming you or anything. Spoken languages are weird, even weirder than cryptocurrency contracts with accidental bad logic - the weird logic in spoken languages seems somehow desired.
      • deleted 5y ago
        [deleted]
      • DangitBobby 5y ago
        You are right, of course. Imagine how shitty is must be to be named Karen and have millions of people one day start using your name as an insult. Just one of the hundreds of ways the internet mob steamrolls over people.
• RVuRnvbM2e 5y ago
  Some variant of this kind of disaster with smart contracts seems to do the rounds on Twitter every couple of days. Why does this keep happening? Since software will always have bugs, how do developers of smart contracts intend to fix this kind of problem? Does anyone actually have a solution to this?
  • TimJRobinson 5y ago
    Probably because there are tens of thousands of smart contracts now and hundreds are created every day. Companies get hacked every single day too, probably many that you use, it's just more opaque when that happens.
  • aordano 5y ago
    I always wondered why aren't smart contracts developed strictly; proving them with Coq or some proof assistant, or making a formal TLA+ struct to define them before coding. As the siblings say, it smells like contractors that don't take it as seriously as (imo) they should.
    • Sargos 5y ago
      Most important smart contracts like MakerDAO are formally verified already and there are ways to code smart contracts in functional and other safer languages.
  • ______-_-______ 5y ago
    At this point I just want to know why it's considered news. This site is called hacker news, after all. The sun rises in the east, another smart contract eats people's money, another shitcoin goes to zero. Here's your coffee, sir.
    • fsflover 5y ago
      I guess crypto haters are trying to prove to themselves their vision.
  • meibo 5y ago
• efitz 5y ago
  The unforgiving-ness and irreversibility of cryptocurrency are the reasons that it will never gain significant adoption by “normies”. With fiat currency, we have many systems for dispute resolution and restitution. They are not all perfect but they work often enough that people still have faith in the system. Most people do not have the risk tolerance to use a system where one typographical error can irreversibly lose your life savings (for example), the product of decades of work.
  • layer8 5y ago
    It also works the other way around: When in conflict, law (and force) will always have precedence over smart contracts.
  • omegalulw 5y ago
    I would agree in any free society, where you can trust institutions to fix such mistakes when they happen, this risk of irreversible transactions is not worth the reward. But when the alternative is a dictator arbitrarily seizing/taxing your money, devaluing it through poor economic policies, the risk doesn't seem so bad eh?
    • webmaven 5y ago
      > I would agree in any free society, where you can trust institutions to fix such mistakes when they happen, this risk of irreversible transactions is not worth the reward. > But when the alternative is a dictator arbitrarily seizing/taxing your money, devaluing it through poor economic policies, the risk doesn't seem so bad eh? I'm skeptical that reducing (at the margin) the pressure to transact via (and thus expand use of) free society's institutions is a particularly good side effect.
  • siliconc0w 5y ago
    You could design a contract that could be bug-fixed and upgraded provided some % of stakeholders consent to the upgrade. These platforms are still in their infancy so upgradability or even just thorough testing and auditing is rare.
  • 5y ago
• toraway1234 5y ago
• tyronehed 5y ago
  Delicious. Somebody with $34 million of loose cash just got shown reality.
  • giarc 5y ago
    More like a few thousand people putting in $1000 here and there just got shown reality.
    • Rastonbury 5y ago
      34,000 with cash to burn on NFTs, I keep up with the bigger projects, never heard of AkuDream and they got 34m, crazy
• akyu 5y ago
  I think that the programming models used in blockchain are entirely wrong. This kind of thing happens all the time.
• RyanShook 5y ago
  Blog post with more context: https://bowtiedisland.com/akudreams-griefed-careless-code-leads-to-45-million-locked/ https://bowtiedisland.com/akudreams-griefed-careless-code-le...
• anamax 5y ago
  TL;DR Is this sort of like "I forgot my password"? If I put 100 $20 bills into a paper shredder, will someone make me whole? Of course not, yet when the analogous thing happens in crypto, that's somehow an argument crypto is fatally flawed.
  • jddddd 5y ago
    Yes, if you can recover 51% of a bill and send it to the treasury they will make you whole. Not a perfect system and obviously can't help if both shred it and light it on fire but there is a recovery mechanism. Crypto has none, it's a feature to some but a deal breaker for most.
  • sailfast 5y ago
    That’s a straw man. You’re giving your money to a vendor expecting a return, and instead your money is just unusable forever sitting in front of you as a monument to test coverage because of a bug in code. The thing that caused the problem is supposedly the key feature of the system (immutability). This is why people argue crypto is flawed.
  • pat2man 5y ago
    Weird analogy because yes, if you put money in a paper shredder (at least in the US) the Mint will indeed allow you to send in your shredded money and receive cash in return: https://www.bep.gov/services/mutilated-currency-redemption/submit-a-request https://www.bep.gov/services/mutilated-currency-redemption/s...
    • jfk13 5y ago
      Although they might refuse if they suspect "...a pattern of intentional mutilation...", so I wouldn't recommend shredding your savings just to demonstrate the system.
  • burmanm 5y ago
    Unless this has changed in the recent times, then yes you will get your money back as whole. If you have all the pieces, the bank (at least in Finland central bank will) will trade it to a new one and the old one is demolished. It is pretty normal for money to get damaged and reissued.
• puffoflogic 5y ago
  People keep claiming over and over that you'd not lose money like this with (non-smart) contracts because the court would always rule your way. That's absurd. If you went around making the kind of contract-of-adhesion offers to the general public that smart contracts represent, you're not likely to get the benefit of the doubt in court. And if you had a lawyer as incompetent as the devs writing these contracts, you'd have plenty of errors. I want to be clear: the devs aren't incompetent because errors exist; they're incompetent because they're incompetent. I hang out in programming help spaces for devs of varying skills, and 100% of the crypto questions come in on the lowest skill help channels with the most basic questions. It's often opined that programmer skill isn't a real thing. Well, such beliefs have consequences.
  • thomascgalvin 5y ago
    > People keep claiming over and over that you'd not lose money like this with (non-smart) contracts because the court would always rule your way. I don't think anyone is claiming that the court would always rule your way; that's a strawman. Courts do stupid shit all the time. The point is that a court could rule in your favor. With something like this, what's the remedy? How is a court going to order some developer to undo a transaction posted to an immutable ledger? What do you do when the source of truth is wrong, and cannot be altered?
    • erulabs 5y ago
      Agreed the original post was a bit of a straw man but now we’re just weighing risks. If a court can make a stupid decision with someone’s assets then it flows both ways: a court can take as well as return. So yes crypto fails to be recoverable by a court - but that’s obviously offset by being difficult to be stolen by a court too. The fact that most western countries don’t wholesale steal from their citizens means it’s easy to discount this benefit in the face of this cost.
  • wpietri 5y ago
    > People keep claiming over and over that you'd not lose money like this with (non-smart) contracts because the court would always rule your way. If people do it that much, surely you could give us links to 3 or 4 of them? I'm interested, as I've never seen anybody claim that.
• dinvlad 5y ago
  It seems like these systems ought to be developed with independent formal verification as a legal requirement. Or maybe that's too naive to dream about?
  • vmception 5y ago
    You could do that, it would still be up to the consumer to only choose to interact with those contracts and projects, just like it is now. But the consumer is undiscerning.
  • danielvf 5y ago
    I've worked with using formal verification systems to secure smart contracts. It's less useful than you would think, for two reasons: 1. It's extremely hard to come up with the correct rules for expected behavior. It's like making a safe wish versus an evil genie. It's also surprisingly easy to make a rule that doesn't check anything, or what you think it does. 2. In the areas that deal with the most money, DeFi, there may be thirty program involved, most of which were not made by you or under your control. Current formal methods can just handle a single program. The common way to handle networks of contracts is to test each in isolation, making assumptions about what the other contracts can do. But it's really easy to make a wrong assumption here.
    • dinvlad 5y ago
      OK, that makes sense, thanks for the insight! I do still think it would be "helpful" to apply formal methods, even if they don't solve the problem 100%, just like some testing is better than no testing. Better than the current wild west at least, it would seem.
  • dcolkitt 5y ago
    Code is protected as free speech by the US Supreme Court. There’s no legal avenue by which you could prohibit someone from writing and publishing smart contract code. At best the most you could do is setup a legal barrier to deploying that code to a block chain. Even then, this is legally iffy, since deploying chain simply involves broadcasting a message to the network. Most likely the court would interpret this as a form of published speech protected by the First Amendment. But even if not, you can still publish the smart contract code on GitHub and say “I sure hope no one outside my jurisdiction or an anonymous address takes this code and puts it on-chain.
• natly 5y ago
  Excuse the basic question but what language is that? And does anyone have a good tutorial or similar on writing things like this? I know this is basic stuff but I hadn't really seen a real example of a 'smart contact' (I assume that's what this is) until now and seeing it like this is intriguing.
  • saagarjha 5y ago
    It's Solidity: https://soliditylang.org/ https://soliditylang.org/
  • danielvf 5y ago
    If you are wanting to read some code, here's a an "ERC20" contract (a "money"). https://github.com/Rari-Capital/solmate/blob/main/src/tokens/ERC20.sol https://github.com/Rari-Capital/solmate/blob/main/src/tokens...
  • mdaniel 5y ago
    https://cryptozombies.io/ https://cryptozombies.io/ may interest you
• drfrank 5y ago
  Has an insurance market already arisen? I.e. can I buy insurance for some percentage of my transaction against a bug swallowing the whole value of my transaction? Seems like an opportunity to let an economic market drive more rigorous dev and test practices by giving shops with more rigorous practices lower fees.
  • vmception 5y ago
    yes, its pretty vibrant for the past 2 years. claims get made in advance and paid out unceremoniously with no fanfare (just like outside of the crypto space) but there could certainly be more fanfare and articles around that experience, since you can tell by this thread that people who should know about it don't know about it. You can find people in the discords of most communities who have the claims after an exploit who are like "yeah they paid" and move on, and you can look at the insurance protocol's contract to see it paid out for your own verification of that. not sure if I've seen it for NFT collection contracts, but they're pretty robust and actively cater to the DeFi category of services. here is a list of insurance protocols that also use a token for any number of reasons. its a whole category on the "marketcap" sites. https://www.coingecko.com/en/categories/insurance https://www.coingecko.com/en/categories/insurance there are likely many well capitalized insurance protocols without a token but I don't know about them for that specific reason, which is a fun irony when wondering "but does this need a token?"
  • everfree 5y ago
    Yes. I'm not going to name drop for fear of it coming off as shilling, but I'm familiar with a couple DApps that are two-sided marketplaces for insurance on other DApps. If you lose your money to a smart contract bug in the insured DApp, the insurers will reimburse you. If you really trust the code of a certain app, you can earn revenue as the insurer on the other side of the trade.
• mmastrac 5y ago
  Does this mean an infitesimal bump in the value of remaining ethereum?
  • vmception 5y ago
    yep! one could make a "locked clock" that predicts the distribution of inaccessible Ether to support their bullish hypothesis
  • 300bps 5y ago
    Infinitesimal is right. Since EIP-1559 went live in August 2021, over $6.3 billion worth of Ethereum has been burned since they now burn transaction fees instead of giving them to miners. They burn about $11 million per day! This $34 million is a drop in the bucket and note that even though all that was ETH burned, the price is still below where it was when they started. https://watchtheburn.com/ https://watchtheburn.com/
• georgeecollins 5y ago
  $34 M worth of Ether at today's prices is lost. The dollars spent on them (probably a lot less than $34m) are almost all still in circulation.
  • tintedfireglass 5y ago
    That's an interesting way to think about it. No resources have been lost as it is a virtual thing and if we assume it to be worthless we haven't lost anything. Mind blown
    • nikanj 5y ago
      All of the resources were wasted buying power for mining rigs. Can’t get that electricity back, and the power company doesn’t do refunds
      • erulabs 5y ago
        Except people spent money in the market so - the mining rig companies now have the money and computers were built. The “waste” leaks into productivity at every joint.
        • nikanj 5y ago
          The power company has the money, coal was bought+burned. Ultimately this is a form of broken window fallacy - buying resource to literally burn them into thin air is not stimulating the economy
  • vagab0nd 5y ago
    Agreed. The $34M goes to all current ETH holders (in the long term of course).
  • archibaldJ 5y ago
    so the ether went into the ether ;) & nothing is lost
• michalu 5y ago
  $34M are not locked. Rather the tokens some people paid $34M have now become worthless (untradeable). But those $34M have not disappeared they're on somebody's bank accounts. Such rhetoric is very deceptive.
  • rideontime 5y ago
    Effectively identical.
  • ilammy 5y ago
    The car did not crash. Rather the money you paid for it has now become worthless (unridable). But that money has not disappeared, it's on somebody's bank accounts. Such rhetoric is very deceptive.
    • michalu 5y ago
      I think you've got the logic other way around.
  • wpietri 5y ago
    I am going to have your comment bronzed. It's such a perfect example of how in the crypto world the US dollar value is hyped in the good news. But once the news is bad people get all, "What even is money, man?"
  • vmception 5y ago
    I think this is a strange take, sure the $34M is in the ethereum account but it is not in someone's bank account, but the people that sent money to that contract do have an NFT right? or have a claim for an NFT that can still be sent to them manually right? I think those NFTs don't have to be worthless, there is just a temporary blip in confidence until the project proves they are still able to perform with less revenue/capital and also still motivated to do so.
• analognoise 5y ago
  How much money needs to be lost or stolen before it's declared a bad idea? Like at this point I'd take my chances in the wild west with a stage coach, a shotgun and a handful of friends over...whatever is going on with crypto.
• dada78641 5y ago
  I've never seen whatever code this is, so correct me if I'm saying something stupid, but do they really use uint256 for their number variables? Like a number that goes from 0 to 115792089237316195423570985008687907853269984665640564039457584007913129639935? Are they trying to keep track of the number of atoms in the universe or something?
  • sillysaurusx 5y ago
    It’s to prevent any possible chance of brute forcing the value. 64 bits is vulnerable. 128 bits is impervious, and probably won’t ever be vulnerable. But 256 bit crypto keys are common.
    • firloop 5y ago
      That's not quite right. We're talking about the type of the integer, this doesn't have anything to do (directly) with cryptography. It's a bit of a silly decision but Ethereum uses uint256 for many things to avoid having to do floating point math.
      • sillysaurusx 5y ago
        Sure, there are other benefits of uint256. But it does simplify carrying around crypto keys. 256 bit integers to avoid floats seems like a good idea too. I’ve wished for it whenever I try to represent integers as double. 2^53 is such an arbitrary restriction.
      • Tao331 5y ago
        > Ethereum uses uint256 for many things to avoid having to do floating point math. Wow. I'm pretty ignorant when it comes to Solidity, so it hadn't previously occured to me that it doesn't have floating point. It stretches the limits of the imagination to consider the insanity we'd be seeing if Ethereum did have floating point math.
  • dcolkitt 5y ago
    Vitalik has said using 256-bit word sizes in the EVM was his biggest regret from the early days of Ethereum. As others have mentioned, it was largely chosen because of the ubiquity of 32 byte hashes. But overkill for regular math. One pernicious issue is that it makes translating existing smart contracts into ZK rollups really challenging because 256 but arithmetic blows up the circuit size. https://www.theblockcrypto.com/post/116413/vitalik-buterin-reveals-his-biggest-regret-about-ethereum https://www.theblockcrypto.com/post/116413/vitalik-buterin-r...
• lbotos 5y ago
  Correct me if I'm wrong, but someone could fork Eth, and write code to "release these funds" back to their "owners" right? Adoption of this fork would be the critical factor, but if enough money gets locked up, it get more and more lucrative to "unlock it all" will be with your eth-unlocked fork.
  • qeternity 5y ago
    This has happened. It’s called Ethereum. The original fork was mostly abandoned, and is known as Ethereum Classic.
  • VWWHFSfQ 5y ago
    They already do this whenever one of the developers fat fingers their code and loses all their own holdings. The whole thing is kind of a scam.
    • aaaaaaaaata 5y ago
      > whenever lol, once, at the beginning before it had traction...
• lloydatkinson 5y ago
  Crypto once again showing it’s a solution to a problem that hasn’t been found
  • vmception 5y ago
    The reason why thats an odd take is that it scapegoats poorly run companies when we should be just shaming the specific project team and organization and doing post mortems to make it less likely to occur. Just like we do on this very forum when not talking about the crypto space.
• vmception 5y ago
  The people that sent money to this contract still received the NFT right? Or can still receive the NFT Its more about the project not having the operating capital (99% margin lol) and also loosing some confidence which they can recreate by performing parts of the roadmap and getting the community their NFTs? (the verified person is already saying they will airdrop NFTs and reimburse some participants when banks open so they wire dollars, convert that to ether, and send to some participants)
  • danielvf 5y ago
    Correct, the project can just create another set of NFT's and "bless" them as the official ones.
    • dropnerd 5y ago
      the project created mint passes that qualify you to receive an airdrop. this hasn't changed
    • hypertele-Xii 5y ago
      Only demonstrating that the "original" NFTs were worthless to begin with.
• adam12 5y ago
  Where can I view git blame?
• formerkrogemp 5y ago
  Everytime this happens in the cryptocurrency space it makes me want to laugh and to cry a little.
• b20000 5y ago
  but i thought leetcode style interviews was the best way to screen people and nobody needs people with experience???