Hacker News new | ask | show | jobs
How to steal Ethers: scanning for vulnerable contracts (palkeo.com)
93 points by palkeo 2752 days ago
5 comments

Here's my problem with smart contract maximalism.

Suppose my ether gets "stolen". For whatever reason I am able to turn to an external legal framework -- police or a law suit.

Why wouldn't I just skip the middle bit and go straight to dumb contracts executed by smart humans, rather than smart contracts executed by dumb machines?

What exactly have I gained over the status quo if, at the end of the day, I still rely on the enforcement mechanics of the status quo?

It doesn't take much imagination to come up with many settings where a trusted, fair, omnipotent third-party arbitrator is absent.

Those unregulated environments are the trust settings where cryptocurrency will shine, not the local, already regulated economies.

Applications like "real-estate on the blockchain", "event tickets on the blockchain" are mostly just opportunistic buzzword riders. What cryptocurrency best serves is international trade and black markets. All the places that can't be regulated by traditional means, or that intentionally steer away from regulators.

> What cryptocurrency best serves is international trade

I fear the day we go to war because of some clerk's off-by-one error in a "smart" contract.

Honestly though, I'd think programmers of all people would be first to realize that using code to represent law affecting anything in the physical reality is a dumb idea. Think of any time you had to write a program to conform to customer's requirement document. Does anyone here had, even once, done that without discovering holes, inconsistencies or unintended consequences in the document? And this is essentially the same exercise as formulating a "smart contract", except the code can now ruin someone's life.

(There's some middle ground to be had here, though. A way of optimizing the "long tail" of legal problems, without trying to do the near-impossible thing of codifying intent.)

You just have to remember that there are humans behind it all. Before a war happens, we would agree to fork the chain, like most people did with Ethereum's DAO hack [1].

There certainly could be many life changing bugs happening for smaller entities. But that's not a cryptocurrency-specific point. Humans are more and more willing to accept trusting technology with their lives (factory robots, pacemakers, automated cars, risky snapchats).

The key for cryptocurrencies is to keep humans in the loop: keep it incremental and require human confirmation for meaningful transactions. Machine learning can be used to detect anomalies in busy transaction flows.

[1]: https://www.cryptocompare.com/coins/guides/the-dao-the-hack-...

Most people in the world have neither the economic resources nor assertiveness & patience to launch a lawsuit. It's much easier if their contracts are just automatically enforced by software than them needing to know what causes are actionable, find a good lawyer, document everything (most people don't do this), pay for it all, and be available for court appearances when called for.
Doesn't that simply depend on how often you have to leverage human enforcement? Whether you have to do it <1% of the time vs 100% of the time would drastically change the answer to your question.

It's like chargebacks. 99.9% of my purchases I will never issue a chargeback for, so most of the time I choose to use a payment mechanism (cash, bitcoin when I can) that doesn't come with all that overhead. If I was frequently getting screwed by merchants, then my payment habits would change accordingly.

Let’s take your example of chargebacks. If you only need to use them 0.1% of the time, then they are worth a 0.1% fee, right? Now, add on the costs of procuring and carrying cash (or exchanging to Bitcoin), the cost of having to hold that money outside of a bank account and not getting paid interest.

Then consider the fact that for most transactions, you pay no incremental cost for using a credit card. Yes, that is because the merchants eat that cost, but as an individual there is still no incremental cost to you. Merchants do this in part because they get more sales, and in part because credit cards save THEM money, too - easier accounting, no need for armored car service, less theft or error by employees.

Finally, it’s not accurate to compare the chargeback rate of credit card transactions with cash/crypto. Chargebacks for credit cards are very low because vendors are on the hook to pay for the costs, and they can lose their ability to accept cards altogether. If we all move to cash/crypto, the fraud rate will undoubtedly go up. Of course, someone will then create an escrow service that gives you the opportunity to dispute the transaction, in return for a small transaction fee. Maybe they’ll even offer to let you buy things in Bitcoin and pay them back later in cash, and charge you interest. I bet they could add in a rewards program...

> Of course, someone will then create an escrow service that gives you the opportunity to dispute the transaction, in return for a small transaction fee. Maybe they’ll even offer to let you buy things in Bitcoin and pay them back later in cash, and charge you interest. I bet they could add in a rewards program...

...and you're back at square one ?

No: from a monolithic, impenetrable system you get an environment which favors competition. That's a win.

Which briefly favours competition, until the dust settles and new monopolies protected by necessary anti-fraud regulations emerges. Except this new-old state is built on a framework of exponential energy waste that powers cryptocurrencies. It would be, to put it lightly, not a better place to be in.
> Except this new-old state is built on a framework of exponential energy waste that powers cryptocurrencies.

Few in the cryptocurrency community, except the so-called "Bitcoin maximalists", believe Proof of Work will survive as the dominant consensus algorithm.

What's more likely to be widely adopted is a Proof of Stake [1], or Proof of Space [2] system.

[1]: Snow White: https://eprint.iacr.org/2016/919.pdf, Ouroboros: https://eprint.iacr.org/2016/889.pdf, Algorand: https://people.csail.mit.edu/nickolai/papers/gilad-algorand-...

[2]: Chia: https://eprint.iacr.org/2017/893.pdf, SpaceMesh: https://spacemesh.io/assets/built/whitepaper1.2.pdf

Oh nice, and I just published "Show HN" with my symbolic execution decompiler - http://www.eveem.org/

Seems like there will be a big trend with all kinds of symbolic execution tools showing up in the upcoming year :)

I link to eveem in my article. I used it quite a lot for my investigation :) Thanks for your great tool!
By coincidence we just published an article [1] comparing automated tools to human auditing in smart contracts. I am reviewing your article for expanding ours. At ethdev[2] someone suggested to check the Slither[3] tool also.

[1] https://blog.coinfabrik.com/smart-contract-auditing-human-vs...

[2] https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbn...

[3] https://github.com/trailofbits/slither

Be careful! There was once a guy who tried to hack an Ethereum smart contract, but in the end the contract hacked him instead: https://techcrunch.com/2018/02/16/clever-ethereum-honeypot-l...
Excuse my ignorance, but was is a non-gdpr-walled link exactly?
have we finally found a way to monetize PL research?
Isn't that potentially life-threatening because there's a good chance of stealing from criminals?
How would they go about figuring out who did it though? Can't really involve law enforcement in that.