26 ms·
A software change allowed FTX to use client money
- bitwise101 4y agoSo the conclusive evidence was found with git blame?
- andirk 4y agoThe fact that the software was not audited speaks more about the big names who invested in this clown than the clown himself. So weird how he publicly touted the EXACT OPPOSITE of everything he did and stood for. He may ask the judge for a rebase.
- SanjayMehta 4y agoThe best liars believe their own lies. Having said that, it's evident that SBF was very well connected and the "old boys club" doesn't ask each other questions; "that would be rude, you know." That's probably how he raised so much money in the first place.
- urthor 4y agoSays a lot about the software industry as a whole.
- akavi 4y agoI've been at many startups during a fundraising round, and I don't think I've ever seen or heard of an investor auditing the codebase.
- xwdv 4y agoI offer this as a service. Typically when there’s a big acquisition and an audit of the codebase is needed, I gather up a group of developers each paid about $250/hr to go through the codebase and conduct audits looking for any red flags and giving an estimation of existing technical debt.
- 8note 4y agoThis sounds both really painful and really fun. Is there a line item for "this code feels like there's something wrong, but I can't tell what" ?
- grogenaut 4y agoWhen I did code dilligence, I just add it to a list of possible risks... or areas we'd like deeper investigation. Usually go back over it in follow up.
- dieselgate 4y agoNeither have I but read some stuff about Tesla devs checking out the Twitter codebase or something? It’s ridiculous but that’s the only data point known to me
- jfengel 4y agoThat wasn't due diligence (which he'd waived) but a census of what he'd bought after the fact. They weren't validating the purchase, but helping him plan what to do with it.
- kasey_junk 4y agoI’ve been apart of many code audits as part of acquisitions and fundraising rounds on both sides. I don’t know how prevalent it is but I’ve done it enough times that I don’t bat an eye when it comes up.
- drexlspivey 4y agofor dfb6f1f9 you are sentenced to 3 years in prison
- neonate 4y agohttp://web.archive.org/web/20221213211717/https://www.reuters.com/technology/how-secret-software-change-allowed-ftx-use-client-money-2022-12-13/ http://web.archive.org/web/20221213211717/https://www.reuter... https://archive.ph/ijeyN https://archive.ph/ijeyN
- falcolas 4y ago> Bankman-Fried had directed subordinates to update the software in mid-2020 to enable Alameda to maintain a negative balance on its account, the SEC complaint said. And thus do we have another piece of evidence for why morals and ethics matter, even for software developers. I doubt they'll end up with liability, but I do hope they at least recognize and think about how their actions enabled this whole mess.
- JumpCrisscross 4y ago> doubt they'll end up with liability They're each going to run up five, maybe six, figure legal bills.
- hn_throwaway_99 4y agoMy guess is you haven't hired a lawyer recently. All of the top principals at FTX are looking at millions in legal fees.
- rootusrootus 4y agoLast time I got educated on this subject (required class for a CCW about 20 years ago) just getting arrested was predicted to net you a five figure legal bill. Get indicted, now we're six digits and climbing. These guys are going to spend a good bit more than that.
- neilv 4y ago> I doubt they'll end up with liability, When you should know it's criminal, "just following orders" isn't a great defense. > but I do hope they at least recognize and think about how their actions enabled this whole mess. They should get lawyers. And be prepared to sing like canaries.
- bb88 4y ago> When you should know it's criminal, "just following orders" isn't a great defense. That's even true in the military if you're given illegal orders. It's called the "duty to disobey". It's not enough that employees "should" know what's illegal and what's not in an exchange -- companies need to be held criminally negligent for employing people who don't know.
- roland35 4y agoAnd this is what really ruins crypto to me. With no actual legal protection, no trust, "code is law", am I expected to keep up with every pull request? And of course these exchanges are completely opaque on top of that.
- notch656a 4y agoBoth criminal law and code are vast enough that the fraction I understand of either is closer to zero than the entirety.
- deleted 4y ago[deleted]
- deleted 4y ago[deleted]
- rafale 4y agoThis is not crypto, this is Enron, Theranos and Madoff. In DeFi, you check the code once, and that's what gonna run (exception being proxy contracts, but those are a red flag in itself).
- anon291 4y agoPeople need to understand that money is debt. That is the source of all currency (yes, even gold and other 'hard' currency). If people cannot freely create it, then it's useless. The key is that you ought to be able to gauge the money creator on their trustworthiness, which hopefully you know as a member of a small community. Or, if you are creating money on the open market to large numbers of people, often it's useful to make your case to a nexus of trust (i.e., a bank) so that more people will accept your money Unfortunately what happened here is a fraudster latched on to a movement that decried centralized trust and said that he is trustworthy and, when asked, pointed to some code that no one could inspect or understand. Simpletons believed him because they believed in the 'trust the code' hype, and believed his money was real. They were wrong. But at the end of the day, expecting code to replace the core human emotion of trust, the source of money, is ridiculous.
- dboreham 4y agoAre they talking about EVM code? If so it's not "secret".
- wmf 4y agoNo, FTX was off chain.
- chrisco255 4y agoNo, FTX was run on self-hosted Python and SQL.
- swiper_lux 4y agoBrings up a question: what is the chance of blaming some of this on an "innocent" coding error? Can you get jail for not writing unit tests, swallowing an exception, a type conversion you did not expect?
- BurningFrog 4y agoInteresting. The perfect crime would be to add a natural looking bug in the code that can be exploited by someone else, and then we split the money!
- gurchik 4y ago> The Underhanded C Contest is an annual contest to write innocent-looking C code implementing malicious behavior. In this contest you must write C code that is as readable, clear, innocent and straightforward as possible, and yet it must fail to perform at its apparent function. To be more specific, it should perform some specific underhanded task that will not be detected by examining the source code. > Every year, we will propose a challenge to coders to solve a simple data processing problem, but with covert malicious behavior. Examples include miscounting votes, shaving money from financial transactions, or leaking information to an eavesdropper. The main goal, however, is to write source code that easily passes visual inspection by other programmers. http://underhanded-c.org/ http://underhanded-c.org/
- greenonions 4y agoGenius, but it has to be a bug that you haven't knowingly prevented before, otherwise it'd be suspicious.
- deleted 4y ago[deleted]
- polygamous_bat 4y agoI believe that really depends on (a) how much harm it caused downstream, (b) how much of it is caused by your actions. Per Matt Levine's column today, it's not the whole problem that FTX had sloppy accounting – rather that SBF went around advertising the "sophisticated risk engine" which in reality was crap. This action accounts for fraud. I don't see you being jailed for your random GitHub project being sloppy. However, if your closed source software that you advertise as 100% safe and secure gets used by a chemotherapy clinic, and then it comes out to be downright sloppy after killing 20 patients you may be accused of fraud. Anyway, not a lawyer so take it with a grain of salt.
- deleted 4y ago[deleted]
- hn_throwaway_99 4y ago> Only Singh, Bankman-Fried and a few other top FTX and Alameda executives knew about the exemption in the code, according to three former executives briefed on the matter. A digital dashboard used by staff to track FTX customer assets and liabilities was programmed so it would not take into account that Alameda had withdrawn the client funds, according to two of the people and a screenshot of the portal that Reuters has previously reported. If you want to see what you should never do as a software engineer if you like not being in jail, this is it. Singh will definitely get prison time as well, though I'm sure all the higher-ups in FTX are trying to point fingers to get deals. In the Madoff scandal, 2 of Madoff's programmers were sentenced to 2 1/2 years each. In this case, Singh has much more culpability as a higher-up (not to mention a pre-collapse billionaire).
- alar44 4y agoReally? I feel like intent would be really hard to prove. "Hey, due to the way our accounting works I need you to subtract X from our dashboard." "Ok boss." Are programmers expected to know finance law? If I build a program for a dairy farmer am I supposed to know the laws of the interstate dairy trade? I can't believe that would be the case.
- hn_throwaway_99 4y agoNishad Singh wasn't some low-level coder. He was FTX's Director of Engineering. > "Hey, due to the way our accounting works I need you to subtract X from our dashboard." That is not what happened here. The fact alone that very few people knew about Alameda's special treatment, and, importantly, deliberately conspired to keep that treatment secret is a pretty strong indicator that he knew it was wrong.
- barbariangrunge 4y agoDirector of engineering != product manager in charge of deciding what features to include. If somebody tells engineering, “we will not use this feature illegally,” then it’s the fault of the higher ups who are possibly (?) trying to scapegoat somebody to protect themselves
- hintymad 4y agoIt's amazing how fast the internal details are leaking out. It's very curious how Reuters could get hold of the source code and quickly identified the most relevant code. It seems someone inside FTX worked with Reuters.
- chrisco255 4y agoAfter the Chapter 11 filing, all assets of FTX were seized from SBF and his former executive team was let go. John Ray, the interim CEO, the one who testified in front of Congress today, and his team are the likely source of the release.
- ratg13 4y agoThis has Dan Friedburg’s fingerprints all over it and is reminiscent of Ultimate Bet’s “god mode”. Would not be surprised if this move was advised by their legal counsel.
- dieselgate 4y agoGood reminder - SBF really dodged the questions related to “Why Dan Friedburg?” asked by coffeezilla Not that we didn’t see that coming or anything
- meindnoch 4y agoThey say the commit was made by someone with the email “admin@MacBook-Pro.local”. They’ve tried contacting them, but got no response so far.
- dieselgate 4y agoI got a real good laugh from this one, still laughing now. Haha thanks
- whalesalad 4y agoHow did Reuters get a copy of the codebase? I would LOVE to see it.
- steveBK123 4y agoI bet its a horror show too
- tawaycrypto 4y agoHow do you think code written by clown looks like? I guess its full of shit
- andrewstuart 4y agoThe real problem behind all these crypto companies is the people who make the money have no concept of what "integrity" is. They aren't coming from a baseline assumption that their job is to protect and interests and the money of their clients. Traditional banks, for the most part, have DNA built around protecting customer interests and customer money. Crypto companies have none of that attitude - behind every one of them is a sleazy tale of self interest and corruption. My first introduction to this way of thinking was many years ago when I worked on a software development project and the project manager was extremely concerned about a single cent being wrong in the calculations - he taught me that with customer money you cannot get even a single cent wrong. These crypto idiots are just young cowboys who see a giant pile of loot and don't have any concept of how to manage it in an ethical manner. They just wanted to work out how to gamble it all in the hope of more crypto gold. If there are crypto companies that have not yet had their rotten hearts exposed and gone bust, it's simply a matter of time. Every single one of these companies will - and should - go bust - good riddance. It's a pity Robinhood won't go with them - the filthiest scumbags of all.
- totalZero 4y agoIt's not just crypto. The entire fintech space has an ideology that lines up far better with Silicon Valley than with Wall Street. The Wall Street mentality would dictate a very different course of action than the Silicon Valley mentality in many of the situations described in the cases brought by the DoJ and the SEC, and yet the Silicon Valley mentality seems to have been the guideline used by SBF/FTX -- perhaps because of a lack of experience dealing with customer funds, or perhaps due to ignorance of the seriousness of consequences. Edge cases matter a lot more to Wall Street than to Silicon Valley. Wall Street is a world where the new hire on the desk gets a talking-to by the managing director for making an error that could have led to a big loss, and where people are regularly reminded not to put anything in writing that they wouldn't want to see on the cover of the New York Times. Silicon Valley is a world where "move fast and break things" is a central mantra, and sometimes those things that get broken are the rules.
- jeroenhd 4y ago
- theknocker 4y ago
- smadge 4y agoImagine doing code review for this change. How do you say “I think this is illegal” without getting fired? Not that I would work for FTX.
- noisy_boy 4y agoProbably was an admin with code reviews exempted for admins and just merged to master
- batmenace 4y agoYou probably start by saying 'Hey I think this might not be fully compliant?' And if your boss comes back with anything other than a reasonable justification, you know there's something going on, and you should flag it higher up/leave that place
- liveoneggs 4y agoThe market maker account is different from a regular customer account so the reflected balance will show the in-flight liabilities. Don't worry about it, the number is just an artifact.
- flobosg 4y ago
- riffraff 4y agoah the well known const evil = false // do not change to true
- qwertyuiop_ 4y agoIs lying to Congress going to be added to his charges ? In congressional testimony on May 12, he called FTX’s software “safe, tested and conservative.” By quickly unwinding the riskiest, most undercollateralized positions, the risk engine prevents build-up of credit risk that could otherwise cascade beyond the platform, resulting in contagion,” Bankman-Fried testified. He did not tell lawmakers about the software change to exempt Alameda. Indeed, he told investors that Alameda received no preferential treatment from FTX, the SEC complaint said
- fellellor 4y agoSo happy this PoS and his crew are getting arrested. May they rot away in prison till they die.
- harriet1 4y ago[dead]
- sagebird 4y agoI love that Reuters has (ok- maybe with the help of someone else) reviewed git commits. The reporting has a high content to fluff ratio - refreshing.
- supermatt 4y agoCan we stop calling him a "billionaire", or a "former billionaire". Did he ever actually have a billion of his own assets?
- jwmoz 4y agoEveryone's a genius when you can't get liquidated.
- Maxburn 4y agoSide note but I do not like that font Reuters uses, it feels like it is mixed case with the different sized characters even when it isn't mixed case. It's messaging me like comic sans.
- nyanpasu64 4y agoThis is a TTF hinting problem that shows up on Windows (and possibly Linux), but not on the Retina MacBooks the designers built and checked their sites on.
- Maxburn 4y agoThat is crazy they would have a website that looks messed up to ~87% [0] of their potential audience. [0]https://www.statista.com/statistics/576473/united-states-quarterly-pc-shipment-share-apple/ https://www.statista.com/statistics/576473/united-states-qua...
- sklargh 4y agoCode is law, until an actual law enforcement entity takes an interest in you.
- sirsinsalot 4y agoI'm not sure Singh should be held accountable. He is a programmer. He coded what his boss told him to. This isn't like coding a bomb to kill people, where the programmer clearly has an ethical choice. Singh was an employee, whose bosses had the job of ensuring what they asked him to do was legal, and he was not obliged to consider the ethics or legality with full view of the "big picture" nor even know or take the "big picture" into account. That's the bosses job, that's why they're paid more, that's why they take more risk, that's why they may end up in prison. Even where Singh knew something was up, it wasn't his place to be a financial expert. That's what the company's senior staff are supposed to be. Even where Singh had a partial knowledge or view of the entire company/companies or the legal framework they operated in, in his role as a programmer he was not obliged to have a full view (nor could he have). This partial view of what's going on means his decisions can not be in full consideration. It's the bosses job to make the consideration. They failed. To judge Singh in hindsight as if he knew everything we know now, or that the courts will come to know, is bizarre.
- eugeneagyeman 4y agoWrong reply
- deleted 4y ago[deleted]
- 1-KB-OK 4y agoI find it a bit surprising that only a few people knew about this code change. I expect other engineers found that piece of code and probably didn't ask any questions. It's normal after working on a codebase for a while to explore all the different branches. It takes a few years though, from what I gather the codebase was only 2-3 years old, so it's possible no one noticed. I think this revelation points to the further guilt of SBF and his excuse that "he was incompetent" will fall face down under scrutiny.
- anonymoushn 4y agoThe comments about engineering ethics are missing the point. Gary Wang and Nishad Singh are criminals who have each *personally* stolen $100mm or more from FTX customers. The fact that they also wrote code to hide this theft seems irrelevant.
- eugeneagyeman 4y agoProgrammers should have a moral and defensible right to object to something that severely harms those who use their systems. Saying he was just doing what he was told fails to account for the fact that had he said no and flagged this as immoral, some customers may have their cash… maybe. Worst comes to worst he is fired but working at that level you’ll find a job in 5 mins and have sufficient capital to weather the storm. I’m a strong believer that ethics and basic philosophy should be taught as part of a cs curriculum. For precisely events like this.