Hacker News new | ask | show | jobs
by atomical 3295 days ago
Is it even illegal to hack Ethereum? Some purists would say the smart contract was behaving as written.
3 comments

It isn't, if you take the case under contractual law there is absolutely no basis to charge the person who extracted the $55m. The contract had 'flaws' but it was the contract, so tough cookies it agreed to something you didn't like, but you wrote it! (Except we know now it was too big to fail, which in turn means centralization)

The DAO was pumped up by VCs and friends of the founder of Ethereum, which, before the launch, attracted some people who had clout from the big banks and enterprises, ergo, if the DAO failed then Ethereum failed in the eyes of the most lucrative customers & developers there.

The thing that pissed of purists so much was, that when it first came out it was marketed as this beautiful "world computer" that would be incorruptible by anyone, but the hard fork made it apparent that the values of the Ethereum community had changed to value support of banks & business over that idea.

I was at a conference this week and watched a lecture by one of the founding board members of the Enterprise Ethereum Alliance, who was getting the crowd fired up about the idea of ICO's, and then directly after his talk, David Birch from Consult Hyperion came on and said that people who are involved in the launch of new tokens in this current feverish phase are extremely likely to go to jail for fraud. Was hilarious

David Birch has been bashing cryptocurrency since around 2012. It seriously goes that far back for some of these ideologues.

Edit, just to give people an idea of where he's coming from ideologically, these are some of his comments that show the kind of world he wants to see:

https://youtu.be/c8mdr8iwX20?t=6m49s

"law-abiding taxpayers like me are subsidizing criminals to use cash and not pay taxes"

https://youtu.be/c8mdr8iwX20?t=10m47s

"so getting rid of cash has some other benefits which will lead to unexpected changes. For example for economists, getting rid of cash means that you lose the zero lower bound on interest rates. You can't have interest below zero because if you drop interest rates below zero people will just draw out the cash and just hold it. If you don't have cash you can have negative real interest rates. So getting rid of cash has a lot of benefits."

https://youtu.be/c8mdr8iwX20?t=13m55s

"So if you allow us technologists to build the stuff so we build something like Bitcoin which let's pretend it's anonymous. Do you know what you get if you let us build that? You get a giant electronic Somalia. If you want to live in a society which is entirely driven by anonymous cash, where the rich aren't accountable anymore, where whoever's got the most money can be the warlord and do what they like, well that's what you're letting us build now"

His demonization of cash remind me of this:

"The cashless society – which more accurately should be called the bank-payments society – is often presented as an inevitability, an outcome of ‘natural progress’. This claim is either naïve or disingenuous. Any future cashless bank-payments society will be the outcome of a deliberate war on cash waged by an alliance of three elite groups with deep interests in seeing it emerge"

https://aeon.co/essays/if-plastic-replaces-cash-much-that-is...

He is totally right about ICO's though. They are essentially Ponzi schemes as investors think the coins have value and that their initial investment is generating more value, but that is not what is happening.
None of the token sales I've seen are ponzi schemes. "Ponzi scheme" seems to be the buzzword used to describe any irrational or bubbly investment. It's incorrect usage of the term.
You are categorically wrong about this.

Ponzi schemes are financial frauds where, under the promise of high profits, users put their money, recovering their investment and interests only if enough users after them continue to invest money.

Further to this, its qualatively provable, as you can look at the contracts and actually class the type of Ponzi scheme they are.

* https://ftalphaville.ft.com/2017/06/01/2189634/its-not-just-... https://stratechery.com/2017/tulips-myths-and-cryptocurrenci... * https://arxiv.org/pdf/1703.03779.pdf

The wikipedia article on Ponzi Schemes draws a fairly subtle distinction between a classical Ponzi schemes, economic bubbles, and pump-and-dump schemes:

https://en.wikipedia.org/wiki/Ponzi_scheme

Most ICOs seem more like pump-and-dump by that nomenclature, than like true Ponzi schemes, in which the Ponzi operator is directly involved in all of the transactions in and out of the system.

https://en.wikipedia.org/wiki/Pump_and_dump

You're quoting from the Birch-Kaminska circle, which has been bashing cryptocurrency since 2012.

A ponzi scheme is where people pay a fee to join a scheme where members are guaranteed a payment that comes out of the membership fees paid by members that join after them.

No token sale has given out payments, let alone guaranteed one. A speculative price gain is not a "ponzi scheme".

Many ICOs out there are effectively Ponzi schemes, which are near-universally illegal.
I don't think any of them are ponzi schemes. Shitty investment based on speculation and hype != illegal or ponzi scheme

Bubbly sectors see irrational amounts of money thrown at things that have little underlying value, like Beanie Babies, or a token for a proposed protocol described by a two page whitepaper.

The principle of Ethereum is that code is law, the "hacker" followed the law to the letter and acted in a prescribed manner. What's the crime here exactly?
The ethereum foundations reaction to the DAO hack proved that the "code is the contract" is not true. Which questions the very value of smart contracts on the ethereum blockchain because it's proven that they're immutable now

This is a good discussion: https://www.bloomberg.com/view/articles/2016-06-17/blockchai...

> The ethereum foundations reaction to the DAO hack proved that the "code is the contract" is not true.

I disagree. The code must also refer to the implementation of the Ethereum clients, and the collective will of the network participants. Those are implicit provisions of the contract, specified in advance. The Ethereum Classic chain still exists, and the thief is welcome to use it. People have simply voted with their feet and prefer a world without the theft. There is no breach of contract, anyone is free to fork the Ethereum network in any way, at any time. It is up to the users to decide how much value to ascribe each fork.

I thought the whole point was to do away with "implicit" or "everybody knows" or other human-interpretation/subjective factors?

If the premise is "the code is the contract, period, except we reserve the right to change the contract at any time or even to cause the contract retroactively never to have existed, based on implicit or subjective factors decided by humans and not by code", then it's a very different beast.

In Ethereum, its important to recognize that what's happening here is not breach of contract. The contract is still executing. However, anyone is free to alter the network in any way they choose. And everyone is free to ascribe whatever value they choose to each network fork. This is a known beforehand, explicitly specified feature of the network. However, it's also known that people really really don't want to do this unless its absolutely necessary. The tension between these two things is what creates the maxim "the code is law" in most situations. The code is law, and it always will be. However, the value may shift. Ethereum Classic is still going along just fine. The value, however, has moved. Ethereum promises only that your contract is immutable in the network in which it was originally embedded. That much is an absolute guarantee. It does not promise that people will continue to use that network.
Except no one reserved that right. The majority of the users agreed to basically create a new currency with the same history, minus the theft /unethical taking of money (if you insist on calling it legal).
So "the code is the contract" until enough people decide to unilaterally change the code because they don't like the contract. Which is right back to what I said.

There's no way of framing this that preserves the philosophical purity.

By not changing the default of the client pushed out by people that stood to benefit from it?
All obfuscation around a central controlling group that have the ability to reverse any transactions they don't like or negatively financially impact them, in other words.
Said "hacker" could even take Ethereum to a civil court and win a trial for changing the DAO's code: Ethereum long claimed that transactions were unrevokable and only contracts had value, causing tort to the hacker when rules were reversed...

Given the number of people involved, it could even be juged as organized crime against one person...

hmm true. Maybe smart contracts also need a good old fashioned terms & conditions signed. At least that protects against unknown bugs and exploits?
In that case, they are no longer smart contracts. The entire appeal was that they would be knowable in their entirety, automatically executed, and irrevocable. The goal as I understood it was too have something that would enforce itself, not needing an external authority to interpret it.

Instead, as others have pointed out, the hard fork demonstrated that this was not at all the case. Ethereum contracts can be voided, and the entire premise is therefore flawed. Terms and conditions would just be another way that contracts could be voided, another flaw.

The term "smart contracts" is highly misleading. It is feeding the hype and deeply confusing people. "Smart contracts" are neither smart nor contracts. They are instead very limited scripts triggered by blockchain events.

All the use cases I've seen depend on external input to be even moderately useful. But once you depend on unverifiable and potentially fraudulent external input, the supposed unique value of these scripts is lost. The notion of "oracles" just moves the problem elsewhere so it can be dismissed.

When and if we see profitable uses of these block-chain scripts then I would be glad to revisit this assessment. Until then it looks to me like a classic case of a technology looking for a problem.

They didn't reverse, they simply agreed to follow a different path. Anyone who still accepts eth classic is living in that world I believe.
Do you mean "mutable", not "immutable"?
Yes. A typo on my part
The reaction releasing a new software? How is this a contradiction to your statement? The old chain still exists
The code is not "law".

Somebody exploited a flaw in the system and managed to grab millions of funny-money currency. It's like cheating at a game of monopoly except that many of the players think the rules of the game are "the law" in real life.

The hacker is free to do whatever he wants to but the developers have no restrictions too. So they decided to rollback his transactions.
Whether something is "illegal" is a function of the court system.

So the question is, could you convince a jury that it is illegal?

That's an easy "yes".
Can't you ask for a case to be heard only by a judge? So the judge actually has to understand everything and go strictly by the law?
Depends on the jurisdiction (and the crime).

In the UK, for the most serious (indictable-only) crimes, then no. But you can ask the judge to end the trial after the prosecution case if no reasonable jury could convict, including if as a matter of law no crime has been committed.

Should be easy to describe then.
IANAL, but here is how I would argue:

The DAO was created with the intention to allocate its funds according to a certain voting scheme, with everyone's power determined by the number of tokens they held. But the program did not correctly implement this intention, and the DAO hack exploited the difference to bring the funds under control of the attacker. This most likely violated the Computer Fraud and Abuse Act, and was thus illegal.

Which is one of the issues with smart contracts. Yes, written contracts are the contract in the physical world. And sometimes people get outlawyered or just plain screw up and lose money because of circumstances that they didn't foresee. But when things come to court, there's still generally some oversight usually provided through the court system or mediators to put the brakes on clearly absurd and/or unfair results. Which is generally considered a positive thing.
Of course! Customs and other legal (based on moral) norms are basically the primary source of law or of its interpretation. Human systems based on rigid, or even utopian (that is totalitarian in practice) rules simply cannot handle the complexity of the real world. The system may seem good and functional at first but with the first problem which would because of the nature of complexity and chaotic system dynamics of human interactions inevitably happen, the system would crash (or in this case, get forked) since it would not offer any flexibility.

Without getting too abstract, even traffic lights or zebras, from the perspective of a pedesetrian, (as an example of a simple system) would be a horrendous and extremely time consuming experience if its rules were enforced by the letter. Imagine if you could >only< pass the road accross the zebras...

Human made systems need to be imperfect and the rules need to be flexible or the system will fail.

As I understand it, the DAO website explicitly stated that the code of the contract superseded any written or stated intent. Basically: The code is the law.
The actual law is the law, and contract law (and criminal law i.e. regarding fraud) states that the intent does matter. The DAO website doesn't make legislation - the code may specify the rules about which transactions the Ethereum system will approve, but in the real world the actual laws matter and they will determine whether some people will have their stuff taken away, their movement restricted, or be forced to do some transactions in the Ethereum system.
I can write anything on a website.

That doesn't mean that it is legally binding.

The "Computer Fraud and Abuse Act" applies to the US. What if the hacker lives somewhere else? Then that law does not apply to him, and the action was not illegal.
I would assume all allied countries have similar laws and therefore share extradition treaties.

Even countries that don't have shared extradition treaties don't always ignore criminals within their borders, even if the criminal activity is occurring outside.

Are you familiar with the individual known as Kim Dotcom?