4 ms·

And what if the vending machine measures coins by weight, and you so happen to have a "coin" that is just a properly-weighted blank. You're still interacting w

And what if the vending machine measures coins by weight, and you so happen to have a "coin" that is just a properly-weighted blank. You're still interacting with the vending machine as technically intended. But by not inserting the correct amount of money, you are not interacting with it as intended by the creators. The smart contract implements a technical intent, just like the vending machine. But that technical intent will always have limitations. Some exploits are non-destructive, such as properly-weighted blanks. Some are destructive, such as crowbars. But let's not pretend that they aren't, in fact, exploits.

cogman10 4y ago
That'd make sense IF this attack was one that was along the lines of "Hey, I did an injection attack on the contract which caused it to do something bad". However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code. The technical and explicit intent was followed to a T here. The attacker got a loan (perfectly within the intent) bought a bunch of the index (again, within the intent) sold a bunch of a underlying stock of the index (Again, within intent), sold the index, and sold the loan. Nowhere in this process was there a "this violates the essence of the contract". And, let's be frank here, it's not like the attacker didn't open themselves to a huge liability. Anyone that saw this attack in progress could have bought sushi coin or UCI and ultimately drained away the income this attacker was earning, potentially putting them on the hook for a pretty massive loan. Now, would such a scheme be legal if this were actual securities and not crypto? Nope, because we put more protection around real securities in the US and other countries. However, crypto went out of it's way to make itself above the law and outside of securitifaction. That, in fact, was the entire point of crytpo, to be something governments COULDN'T regulate.
- jdmichal 4y ago
  The article makes it very clear where things were exploited. Especially the circumnavigation of the new token limit seems pretty relevant to the discussion of whether this was playing within the intent. If he’d wanted, Medjedovic could now have traded $3,200 worth of Sushi for DEFI5 tokens worth $1,172,000. And had he simply done that, Indexed would have been fine. The protocol places limits on the amount of a new token that users can swap into the pool, so he would have been able to extract only about 1.5% of the pool’s value—which, given transaction fees, wouldn’t have been profitable for him. Instead, Medjedovic’s script took out another flash loan consisting of $2.4 million worth of Sushi tokens. And rather than swapping them into the pool, it gifted them to it—a seemingly irrational move that Indexed’s algorithm wasn’t designed to handle. The “donation” overwhelmed the pool and circumvented its usual trade limit for new tokens. This allowed Medjedovic’s program to freely trade overvalued Sushi for undervalued DEFI5 tokens, then cash those out for the pool’s underlying assets, pay back the loans, and keep the rest, now worth $11.9 million. The attack on the CC10 pool brought the total haul to $16 million.

cogman10 4y ago

That'd make sense IF this attack was one that was along the lines of "Hey, I did an injection attack on the contract which caused it to do something bad". However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code. The technical and explicit intent was followed to a T here. The attacker got a loan (perfectly within the intent) bought a bunch of the index (again, within the intent) sold a bunch of a underlying stock of the index (Again, within intent), sold the index, and sold the loan. Nowhere in this process was there a "this violates the essence of the contract". And, let's be frank here, it's not like the attacker didn't open themselves to a huge liability. Anyone that saw this attack in progress could have bought sushi coin or UCI and ultimately drained away the income this attacker was earning, potentially putting them on the hook for a pretty massive loan. Now, would such a scheme be legal if this were actual securities and not crypto? Nope, because we put more protection around real securities in the US and other countries. However, crypto went out of it's way to make itself above the law and outside of securitifaction. That, in fact, was the entire point of crytpo, to be something governments COULDN'T regulate.

jdmichal 4y ago
The article makes it very clear where things were exploited. Especially the circumnavigation of the new token limit seems pretty relevant to the discussion of whether this was playing within the intent. If he’d wanted, Medjedovic could now have traded $3,200 worth of Sushi for DEFI5 tokens worth $1,172,000. And had he simply done that, Indexed would have been fine. The protocol places limits on the amount of a new token that users can swap into the pool, so he would have been able to extract only about 1.5% of the pool’s value—which, given transaction fees, wouldn’t have been profitable for him. Instead, Medjedovic’s script took out another flash loan consisting of $2.4 million worth of Sushi tokens. And rather than swapping them into the pool, it gifted them to it—a seemingly irrational move that Indexed’s algorithm wasn’t designed to handle. The “donation” overwhelmed the pool and circumvented its usual trade limit for new tokens. This allowed Medjedovic’s program to freely trade overvalued Sushi for undervalued DEFI5 tokens, then cash those out for the pool’s underlying assets, pay back the loans, and keep the rest, now worth $11.9 million. The attack on the CC10 pool brought the total haul to $16 million.