4 ms·

This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or

This isn't a hack, it was straight arbitrage. I distinguish them because there was at no time a transfer of administrative power or control over the contract or targets infrastructure to Medjedovic. In a smart contract, I'd make a legal distinction between syntactic parsing and calculation, which has to do with the purity of functions and data. An arbitrage would be fair game if it levered an unanticipated calculation, whereas a recent example where the contract was only checking the last several bytes of a destination address key would be a parsing exploit. Medjedovic's arbitrage as described appears to be a pure calculation advantage, and not exploiting a parsing error, and so this is very reasonably fair game. He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts. When you exploit a buffer overflow, you are breaking through (sabotaging) a parser as a means to manipulate the raw memory and machine - whereas this arbitrage is closer to something that lies somewhere between clicking on a link someone provided but had some unspoken intention about you not using it, and a SQL injection or other evaluation error that yields an index. (edit: Actually, it's more like saying something really funny and unexpected on a platform that hasn't banned that kind of humor yet, and they're just mad about the consequences. we could even see a future where the distinction between a hack and arbitrage will be the complexity class of the algorithm and whether it represented a scheme that was Turing complete) Unfortunately, in Canada they'll go after him just as a fugitive now, and there is no shortage of political actors who will want to make him the perfect example villain for their hysterical policy objectives. This is one of those increasingly classic situations where a really smart kid gets system-involved and can't comprehend how insane it is because the legal system and politics are not subject to mere reason. If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new.

meetups323 4y ago
> If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new. Except what's next? Live in hiding in a foreign country? Craft a new identity and find new chains to exploit? I suppose 18 years old is a good time to learn that you can have all the money in the world, but it won't do shit for you if you can't spend time with the people you want to. I'd wager this individual could get much more satisfaction out of developing novel, interesting mathematics that do actual good for humanity, surrounded by a group of like minded high performing individuals. But he seems to have thrown hopes of that out the window. It's sad, really. But I'm perhaps projecting.
- motohagiography 4y ago
  Regarding these like minded high performing individuals surviving in institutions - after a couple of sigmas and making some money, it can become difficult to value their esteem. Canada is full of people who have fled their home countries with their money, foreign capital flight drives our entire real estate and supercar markets, wealthy fugitives as a lifestyle choice are probably more common than we expect.
mathgenius 4y ago
> This isn't a hack, it was straight arbitrage. Yeah, but tradfi has this problem too: sometimes it's hard to tell the difference between straight up trading, and spoofing/otherwise manipulating the market. Maybe the moral of the story is this, that free markets are a myth, and crypto is just making this even more clear.
- motohagiography 4y ago
  Arguably, the myth is that markets are efficient. That is to say that the clearing price is the expression of all the information available to participants is a fiction. This idea of the Turing completeness, or maybe complexity class of your transaction logic determining whether it is an endogenous logical arbitrage trade, or an exogenous manipulation scheme may have some really appealing features. Hypothetically, if the steps of your transaction logic operate on or recurse over feedback into and from the market, you are in fact, "manipulating," it. I'd wonder how describing manipulation in terms of recursion limits and feedback would impact the definiton. Whereas, if you are precalculating or front running some periodic market function, you are arbitraging it with endogenous market information and that makes it "legit." Where this guy might be vulnerable in that model is the question of how far upstream of his actual transaction did he get before the feedback loop he was operating over is not considered a part of that market - and whether his arbitrage was legit because it was between markets.
charcircuit 4y ago
>He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts The same description can be said for using XSS to steal someone's cookies. XSS doesn't escape the JavaScript virtual machine similar to how you aren't escaping Ethereum's virtual machine. Technically the code allows you to inject arbitrary JavaScript, but that behaviour wasn't intend to be possible by the designers of the site.
- motohagiography 4y ago
  Your level of abstraction as an end-to-end operation I would agree with and it's a better example than mine, but the theft metaphor is not accurate because he literally paid the market price for every single step along the way in mining fees and transaction costs. For every token purchase and exchange, there was another person on the other side of that trade. The argument I'm using is that the casino didn't shuffle their deck and a player calculated an advantage. He didn't have hidden cards, a secret view of anyone elses. I'd like to verify that aspect of the strategy though as it's potentially a powerful heuristic.
  - charcircuit 4y ago
    I didn't intend to make a theft metaphor. I think a big factor on why this wasn't fair game is when he abused the bug to send tokens manually instead of interfacing with the smart contract which caused it to allow him to withdraw tokens worth ~366 times what he sent. Using a bug to bypass a restriction seems sketchy.
aidenn0 4y ago
> If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new. TFA claims he was originally offered to keep 10% (over a million dollars) from this hack, free and clear. Not agreeing to that deal meant willingly putting himself at the mercy of said legal system. Talking about a single decision as rational in isolation is disingenuous.
- motohagiography 4y ago
  This is like a casino offering to let you leave with 10% of your winnings because their dealer didn't shuffle the deck. Not an reasonable expectation. I will go back to this idea of an endogenous logic calculation vs. exogenous parsing errors description, where so long as he did not misrepresent the identities or sabotage the functions of any of the sources or destinations of the funds he used in his system, he should be in the clear. It would be interesting to verify whether his technique had this "functional purity," that I've named and am balancing my argument on tho.
  - aidenn0 4y ago
    > This is like a casino offering to let you leave with 10% of your winnings because their dealer didn't shuffle the deck. Not an reasonable expectation. If the casino has Mafia backing, then maybe it is reasonable...
  - aidenn0 4y ago
    Probably nobody is reading this thread anymore, but I remembered an analogous situation in a casino with a slot machine (it credited $1 inserted as $10) and the people who kept playing it for that reason were potentially liable for fraud. https://www.techdirt.com/2007/07/24/criminal-charges-for-using-a-slot-machine-with-faulty-software/ https://www.techdirt.com/2007/07/24/criminal-charges-for-usi...
ummonk 4y ago
He isn't only accused of fraud. He's also accused of market manipulation, and the trick he used here is practically a textbook example of market manipulation.

meetups323 4y ago

> If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new. Except what's next? Live in hiding in a foreign country? Craft a new identity and find new chains to exploit? I suppose 18 years old is a good time to learn that you can have all the money in the world, but it won't do shit for you if you can't spend time with the people you want to. I'd wager this individual could get much more satisfaction out of developing novel, interesting mathematics that do actual good for humanity, surrounded by a group of like minded high performing individuals. But he seems to have thrown hopes of that out the window. It's sad, really. But I'm perhaps projecting.

motohagiography 4y ago
Regarding these like minded high performing individuals surviving in institutions - after a couple of sigmas and making some money, it can become difficult to value their esteem. Canada is full of people who have fled their home countries with their money, foreign capital flight drives our entire real estate and supercar markets, wealthy fugitives as a lifestyle choice are probably more common than we expect.

mathgenius 4y ago

> This isn't a hack, it was straight arbitrage. Yeah, but tradfi has this problem too: sometimes it's hard to tell the difference between straight up trading, and spoofing/otherwise manipulating the market. Maybe the moral of the story is this, that free markets are a myth, and crypto is just making this even more clear.

motohagiography 4y ago
Arguably, the myth is that markets are efficient. That is to say that the clearing price is the expression of all the information available to participants is a fiction. This idea of the Turing completeness, or maybe complexity class of your transaction logic determining whether it is an endogenous logical arbitrage trade, or an exogenous manipulation scheme may have some really appealing features. Hypothetically, if the steps of your transaction logic operate on or recurse over feedback into and from the market, you are in fact, "manipulating," it. I'd wonder how describing manipulation in terms of recursion limits and feedback would impact the definiton. Whereas, if you are precalculating or front running some periodic market function, you are arbitraging it with endogenous market information and that makes it "legit." Where this guy might be vulnerable in that model is the question of how far upstream of his actual transaction did he get before the feedback loop he was operating over is not considered a part of that market - and whether his arbitrage was legit because it was between markets.

charcircuit 4y ago

>He used logic endogenous to the contracts, with no exogenous control of the systems running the contracts The same description can be said for using XSS to steal someone's cookies. XSS doesn't escape the JavaScript virtual machine similar to how you aren't escaping Ethereum's virtual machine. Technically the code allows you to inject arbitrary JavaScript, but that behaviour wasn't intend to be possible by the designers of the site.

motohagiography 4y ago
Your level of abstraction as an end-to-end operation I would agree with and it's a better example than mine, but the theft metaphor is not accurate because he literally paid the market price for every single step along the way in mining fees and transaction costs. For every token purchase and exchange, there was another person on the other side of that trade. The argument I'm using is that the casino didn't shuffle their deck and a player calculated an advantage. He didn't have hidden cards, a secret view of anyone elses. I'd like to verify that aspect of the strategy though as it's potentially a powerful heuristic.
- charcircuit 4y ago
  I didn't intend to make a theft metaphor. I think a big factor on why this wasn't fair game is when he abused the bug to send tokens manually instead of interfacing with the smart contract which caused it to allow him to withdraw tokens worth ~366 times what he sent. Using a bug to bypass a restriction seems sketchy.

aidenn0 4y ago

> If he has the money, fleeing before charges were laid was probably even rational, as there is no reason to expect the legal system is equipped to deliver justice in something so new. TFA claims he was originally offered to keep 10% (over a million dollars) from this hack, free and clear. Not agreeing to that deal meant willingly putting himself at the mercy of said legal system. Talking about a single decision as rational in isolation is disingenuous.

motohagiography 4y ago
This is like a casino offering to let you leave with 10% of your winnings because their dealer didn't shuffle the deck. Not an reasonable expectation. I will go back to this idea of an endogenous logic calculation vs. exogenous parsing errors description, where so long as he did not misrepresent the identities or sabotage the functions of any of the sources or destinations of the funds he used in his system, he should be in the clear. It would be interesting to verify whether his technique had this "functional purity," that I've named and am balancing my argument on tho.
- aidenn0 4y ago
  > This is like a casino offering to let you leave with 10% of your winnings because their dealer didn't shuffle the deck. Not an reasonable expectation. If the casino has Mafia backing, then maybe it is reasonable...
- aidenn0 4y ago
  Probably nobody is reading this thread anymore, but I remembered an analogous situation in a casino with a slot machine (it credited $1 inserted as $10) and the people who kept playing it for that reason were potentially liable for fraud. https://www.techdirt.com/2007/07/24/criminal-charges-for-using-a-slot-machine-with-faulty-software/ https://www.techdirt.com/2007/07/24/criminal-charges-for-usi...

ummonk 4y ago

He isn't only accused of fraud. He's also accused of market manipulation, and the trick he used here is practically a textbook example of market manipulation.