Critical Update on DAO Vulnerability
blog.ethereum.org
blog.ethereum.org
ETH is advising, "Contract authors should ... be very careful about recursive call bugs, and listen to advice from the Ethereum contract programming community," which indicates there's some subtle behaviors to be aware of and secure contracts are apparently not easy to write.
Lest you think, "we'll just be careful, review and QA it", consider the bug[1] in the "Programming Pearls" binary search. Bentley was clearly an expert who had proven the algorithm correct and the algorithm had 20 years of careful study by thousands of professionals. Yet it had a simple overflow.
How do _you_ know your contract is secure?
1. https://research.googleblog.com/2006/06/extra-extra-read-all...
It most likely is not, looking at the recent post on contract security, most if not all examples ever posted as best practice are flawed and can be exploited:
https://blog.ethereum.org/2016/06/10/smart-contract-security... (currently down, cached version https://webcache.googleusercontent.com/search?q=cache:https:...)
Turing machine, meet halting problem.
Or, to put it another way, it sounds like the language is Turing complete in roughly the same way C is Turing complete even though every C program ever instantiated is actually a linear bounded automaton because there's no such thing as an infinite tape.
Like, I can announce that my C-like language will always halt after a trillion-trillion operations and therefore the halting problem is "solved" for it, but for all other purposes it's almost exactly as difficult to reason about as a Turing machine.
No-one can write bug-free code, so why are these people building a huge, expensive system that relies on no bugs being found?
"If there is a typo, error, fraud, crime etc. a contract is considered invalid or the part of the contract that is flawed"
With software bugs you have something similar :
> NO WARRANTY. THE SOFTWARE IS PROVIDED TO YOU “AS IS” AND “WITH ALL FAULTS.”
"Oh, that contact for 1000 dollars is really 10 dollars because they 'missed' a decimal place. You still have to uphold your part though."
Corruption of judges can be a problem in that space and that is in part what this is attempting to solve. A lofty goal, maybe even impossible, but certainly worth the time to try.
I certainly distrust the American legal system enough to use something like this in the future.
[even had a typo in the first publish of this comment!]
That sounds like a terrible amount of power to give someone without a vote.
If I offered a new car for 10€ — obviously it should have been 10k€, so others cannot expect me to fulfil that (ask your local police).
If I had offered it for 8.5k€ and suddenly claim it should have been 10k€, it’s far from obvious that this was a mere error, so I’d likely have to stand for it.
If I offered a used car for 10€, the case becomes murky.
Which is why people don't understand basic human institutions and are surprised when they run into issues trying to re-invent from scratch
Situation was basically a table rendered in prose format. I can’t recall the precise verbiage, but it read something like: In 2015, the requirement shall be 0.05%. In 2016, the requirement shall be 0.7. In 2017, the requirement shall be 0.09%
Very subtle typo which, had it been treated as The Truth of The Text would have bankrupted anyone attempting to adhere to the regulation.
Aside from everything. In writing a contract, it's very common to write price with numbers and letters in brackets next to them. E.g. 1000$ ( one thousand dollars ), exactly because typos happen.
The decision what a typo is is made by the parties, in case of dispute then by several courts ( based on the evaluation of the contract ). That's at least in continental law system.
There's a way to specify a 3rd party court ( non-corrupted one, called arbitrage ) which can solve disputes for that contract.
Corruption of judges problem is being fixed also in several ways. Usually decisions in high courts are decided by 3 judges ( again continental law ) and sometimes a jury ( prevailing in anglo-saxon law system ). Also there is a way to appeal the decision of the court to a higher court(s).
No, we can. We just don't, because it's very expensive, and we lack proper tooling to make it cheaper and/or faster. The flaw as I see it is that ETH jumped the gun, and tried to move to software law enforcement without investing the right amount of time/money in the code.
Worthwhile goal (though the desirability and practicality remains debatable), bad execution.
Eh, it depends on how amenable your standards for correctness are to formalization. Also when it comes to security, where clearly bugs tend to hurt a lot more, we're almost always at the mercy of "unproven" (in the formal sense) algorithms. Don't get me started on quantum computing's effects.
Reasoning about concurrent programs (let alone distributed ones) is something where I don't think we've got many reasonable schemes, even at the academic level. Though it's great to hear the Ethereum foundation is willing to drop some cash on that problem! I wish luck to anyone who takes them up on that, it's something I'd love to work on if I didn't have existing projects.
There's no evidence of that, and lots of evidence to the contrary.
The catch is that this is difficult and the time and cost both scale non-linearly with the complexity of the software. But if you can do it for dead-simple programs running on hardware you understand very well, you can do it for complex software as well. Just be prepared to pay millions of dollars for it.
Not necessarily when you're bounded by reality and finite amounts of time and energy. Just because you can count to 2^8 doesn't mean you can count to 2^128.
http://electronicdesign.com/dev-tools/11-myths-about-ada
"As one example of Ada in an undergraduate setting, students at Vermont Technical College in the U.S. used the SPARK language (a formally analyzable subset of Ada) to develop the software for a CubeSat satellite that recently completed a successful two-year orbital mission. SPARK was chosen because of its reliability benefits. The students had no previous experience in Ada, SPARK, or formal methods, but were able to quickly come up to speed.
Of the twelve CubeSats from academic institutions that were included in the launch, the one from Vermont Tech was the only one that completed its mission. Many of the others met their doom because of software errors. The Vermont Tech group credits its success to the SPARK approach, which, for example, allowed them to formally demonstrate the absence of run-time errors."
I've read similar success stories for Lisp and Haskell. Rust will likely add more evidence as it becomes more widely used. Agda and Idris are also capable in this respect.
The problem is too many engineers are just day-jobbers, who want to crank out LOC and quickly add features that get them paid, regardless how sloppy their work or the tools they use may be, or how much work/cost it adds to the maintenance overhead down the road. That work can either be done up front writing bug-free code, or later during maintenance putting out fires, but it can't be avoided. Programmers who chose the former use the excuse "bug-free code is impossible so we don't have to try" to justify pushing the work off on the maintenance team later. But it's demonstrably false.
Perhaps, but nobody can write a bug-free legal contract either, and no legal system is without bugs.
Sadly, for the legal system, many of the bugs are due to corruption, so they are actually more akin to systematic exploits being done again and again by malicious actors (who often happen to be wealthy or powerful).
Also, in terms of how drastic this bug is, suppose $5M gets stolen over a few days. If the community can strengthen itself and become resilient to a whole class of attacks, that is likely far superior to a meatspace improvement in contract law, which would likely take years to become law (and would be selectively enforced once it did).
The difference is that when there is an issue with a legal contract you can defer to an arbiter (a judge) and discuss whether that is a bug or a feature as soon as a divergence of interpretation is detected.
Hell, even just having a sentient empowered human in the loop is sufficient, with fully automated response systems we'd never have survived the cold war as a civilisation, the first false-positive detection (and there have been several) would have ended it.
The problem (and the thing you propose as a solution) is deferring to an arbiter. This is not human judgement as much as it is human authority. We conflate the two in meatspace because of the social rank conferred upon such positions (this is the same drive that makes humans bow before gods and dictators)
The very idea of decentralization is a different authority model than what is typically in human institutions. In theory, institutions managed in a decentralized and anonymous way have the potential to achieve a form of democratic governance that is far more resistant to corruption than any form previously invented.
In meatspace, a judge must be chosen, elected/appointed, confirmed, etc., and when that judge needs to be replaced we take an entirely different (largely unknown) judge and do a full-scale migration to that new judge's "firmware".
With smart contracts, we can divide the execution into many smaller smart-contracts, each with a specific domain of expertise. This makes versioning, incremental improvement, and extreme transparency possible.
If you listen to us SCOTUS argument, particularly when a case involves discussion of the intent of specific words in a law, it becomes clear how utterly mutable all of the constructs are. While the SCOTUS is a world-class institution in terms of its overall quality, it is reinforced using a highly centralized model of human authority, with all its problems.
Stuff like patent-trolling (and patents) suggest to me the law isn't so consistently trustworthy as you suggest.
After all, there are almost always small mistakes in complex systems. The system of case law is, essentially, a structured way of turning differing interpretations into a stricter framework over time.
My point is, the institution of law needs to be trusted, yet patent-trolling exists because the institution has failed to apply fair judgment and common sense such that ridiculous legal structures have prevailed.
But my point was the patent trolling exists because the law is unfavourable. Not because there is a system of mediation in place. If the patent system should be abolished or not doesn't really relate to how inconsistencies in contracts are handled, as far as I can see?
The legal system is complex and messy sometimes because moneyed interests have been keeping a thumb on the scales and sometimes because the world is complex and millions of people have spent hundreds of years patching bugs and extending the code to handle all the weird corner cases.
Smart contracts are a neat idea, but it is also kind of like the guy who wants to rewrite the production system in a weekend.
I also consider the strictness, and lack of third-party mediation a "pro", not a "con".
The real void smart contracts fill is the type of contracts that cannot be trusted to be enforced by the current court systems.
For example, consider prediction markets. Just about any economist or rational person will tell you these are a huge boon to the world, but the CFTC shut down InTrade just a few years ago. It makes a lot of sense for these types of contracts to move onto ETH or similar.
Isn't that just a fancy term for betting anyway?
Consider a business that needs to reason about the probability of a law passing, severity of global warming, or any number of other difficult to predict events. Prediction markets would provide by far the most accurate insight.
It's wisdom of crowds + skin in the game.
Surely such prediction markets are a guarantee of corruption?
That or I just don't understand - if a market exists that takes bets on human actions such as passing laws, how long someone will live etc, the betters will have a very active interest in doing everything they can to make a large profit, of which corruption alone is the most obvious target.
I mean in a way you're right - it is wisdom of crowds, albeit crowds of people that "know" only because they're corrupted the final event.
Like the probability of a smart contract being exploited via a loophole? ;)
It's very frustrating for me to see "probability of a law passing" and "severity of global warming" being thrown in the same basket.
While the first lends itself naturally to be framed as a binary prediction market (and there are good reasons to believe that the market will produce reliable forecasts), "severity" doesn't lend itself to be framed in this way (in Taleb terms, it is a non-linear payoff from a complex domain, "4th quadrant"). Ignoring that there is a lot of ideology involved in defining the exact terms, in my mind it is just unreasonable to expect prediction markets (or any mechanism for that matter) to deliver reliable results in this case.
Even when not accepting the Taleb argument regarding our ability to predict, at least it should be acknowledged that it is not straight-forward to generalize from binary outcomes to open-ended ones.
Prediction markets can also be called "information markets" because they expand the class of things we can understand the risk characteristics of beyond the traditional instruments.
Lloyds of London began by issuing insurance on shipping vessels so that ship owners shared the risk of a wreck across all their fleets, reducing the devastation of losing a ship for each individual owner. Prediction markets let us do this for a host of other outcomes.
A prediction market is nothing more than a betting market, the innovation (attributable to Robin Hanson, I believe) is the idea of the binary future, which makes the probabilistic outcome work nicely with a traditional futures contract structure, and allows for a lot of nice intuitions based on price movement.
True, but I think said people still haven't taken the whole Taleb idea to heart. I'm pretty sure there are certain domains where the wisdom of the crowd is no wiser then a chimp throwing darts.
As an extreme example, assume you ran a prediction market that predicted the value of the s&p500 x days from now. Would you expect to make money based on these predictions?
This is not to say that they can't be useful in certain domains. It is well known that they do well for binary outcomes like sport events and elections.
They might also be valuable in situations where there are behavioural factors that prevent the spread of information (e.g. whether a project will finish on time). However, there might be simpler mechanisms (like whistle blowing) which could solve the problem or it might not be a problem at all (Bent Flyvbjerg's research on mega projects suggests reliable forecasts are simply undesirable and "true" forecasts are known sub rosa anyway)
A relaxation of the law or more exemptions a la IEM could be beneficial from a research perspective, but I wouldn't expect a "huge boon" just because. These are a lot of words to basically say, it's not a black and white issue.
The S&P already is a prediction market for the future value of the S&P. So no, there would be no additional information here.
I agree that wisdom of crowds does not always work, but remember that this is not just wisdom of crowds, it's wisdom of crowds PLUS skin-in-the-game.
All of the things in quadrant 4 are difficult to predict. I would trust the predictions of people who have put money where there mouth is far more than the predictions of those who haven't, and I think Taleb would too.
Adding a prediction market to ethereum or some other crypto coin isn't going to revolutionise anything.
I sort of assumed this DAO thing was intended in this spirit, as an experimental stab on the path to robust contracts.
With millions of dollars in prizes if you could exploit it?
Edit: If this is not how it is, I'd be interested to know who is putting money into the DAO, sociologically speaking. I hope nobody's investing their life savings in it.
Why would it be any different for "bespoke ethereum contracts"?
Also, there are methods to make the software ultra secure using formal models.
So Slock.it could raise money, obviously. A common complaint right around when Slock.it launched the DAO was that Slock.it planned to offer the first funding proposal on it but only provided a brief 2-week period for review and debate before the voting started. It had the appearance of an attempt at railroading the crowdfunding process for a quick payoff.
Fortunately cooler heads uncovered the problems and spoke out, putting the brakes on. Now it's a big learning experience for the ~23,000 people who blindly jumped on the hypetrain and put money into a flawed investment vehicle. You'd think the first 7 years of Bitcoin would have taught people a lesson that this technology is risky, but dollar signs in the eyes tend to obscure hindsight I guess.
I haven't touched ETH or the DAO personally, but it is unfair to label every investment in them irrational. Over the past 5 years cryptocurrencies have provided multiple opportunities to convert, say, $10k into $100k or even $1M within a year or two; once your networth exceeds a certain amount, risking 1-2% of it on an opportunity like that is arguably wise - i.e. would be worth repeating - even if it does fail spectacularly.
It is certainly true that as long as that reasoning delivers 10-100x+ returns to some of the people some of the time, a giant fount of speculative money will continue to moisten a lot of scammers, con artists, and insufficiently-careful SW developers though.
A contract should present an interface that includes a declaration of its behavior. The declared behavior should be well defined, and if a bug in the implementation is discovered, the contract should be updatable to fix the bug. There could even be futures expressing the probability that a contract will be found to have a bug.
The willingness of participants to use a contract would depend on the chances that something about the interface is bug-prone, untested, etc.
As long as bugs do not result in reversal of money flow, the incentives seem to align properly toward a well-defined approach for declarative contracts.
The first part, a "declaration of...[future] behaviour," is basically a normal contract.
There ought to be a way to have highly vetted primitives. In meatspace legalese, boilerplate words and phrases are the closest we get to this... once a contract (or open source license, etc.) has been through litigation, its vulnerabilities become better known.
If a dispute gets decided the "wrong" way because a few clarifying words were absent, the contract is modified and future deals use the new contract.
Doing this is a tradeoff. On the one hand it lets you fix bugs and vulnerabilities, on the other your users have to trust you not to abuse your power.
1) a significant delay between the announcement of an upgrade and the actual upgrade (enforced by the blockchain)
2) a mechanism to opt-out or cash out before the upgrade happens
But this incident has set a precedent, at least within Ethereum, that the project leadership will intervene to enforce the spirit of a smart contract.
So what now are the benefits of Ethereum smart contracts over the traditional legal system?
The way I see it, at least with traditional contracts you have the benefit of a trained and experienced judge making the call in case of a serious problem.
PS: Also a second thought: Given that the "attacker" used apparently existing functionality of the DAO and that the DAO site clearly states "[n]othing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code", I am wondering: If this (as measured by the DAO code: rightfully obtained) ether is now taken from him/her, might this not be an opportunity to sue the developers implementing this fork in a real-world court?
[1]: http://hackingdistributed.com/2016/06/16/scanning-live-ether...
That would make for a very interesting trial, where a very rigid ideology would be put to the test.
Is there any extant insurance company that would want to review my code in exchange for a lower premium?
If not, why would one be willing to do this for a flash-in-the-pan cryptocurrency, but not a useful, real-world device?
Step 2: Find someone foolish enough to accept the other side of the insurance contract, in a world where "insurance fraud" is no excuse
Step 3: Use Ethereum maliciously, stealing your own Ether under another identity
Step 4: Collect insurance
Step 5: Profit (in Ether)
Step 6: Good luck turning your Ether into actual money when people figure out how broken everything about it is
The "hacker" simply used the DAO as it was meant to be used (i.e. according to the smart contract code), and deserves the funds. If there is a hard fork, I hope he sues slock.it for controlling the DAO, and for stealing the funds he is owed according to their own terms ("The contract is king").
Actually, the Bitcoin devs deserve a huge amount of credit for not attempting to "improve" the block reward or total supply during their multi-year bleed down from $1200->$200.
That's not really fair. His decree does not make it so. It still must be accepted by a majority of the miners, and this is and always has been a known property of the system. The collective will of the miners ultimately trumps the contract system. However, consensus there is purposely extremely difficult to achieve, and likely only possible in extreme cases like this.
Since this was a known property of the system, and since the agreement is inherently democratic, I don't see how this is a problem. Hard forks are simply another behavior of the network. Nothing more, nothing less.
As you say, that's a known property of the system. And it might be one of those things that's only viable in practice when the network is young. But can a CFO be considered to have satisfied their fiduciary duty if they write a contract which can be subverted in this way?
I think this really can be considered a 'one time thing'. It isn't like miners can be pressured by a government to halt contracts for terrorists or other things. They have to be convinced and agree with the argument being made. There isn't a sole individual to whom pressure can be applied here. Granted, Vitalik may wield some influence, but if he started advocating things that were clearly not in the best interest of Ethereum, people simply wouldn't take on his suggested upgrades.
EDIT: I'd also add that for the record, as a DAO token holder, my personal opinion on what should be done is this: A soft fork to prevent ether from moving out of the child DAO, and then nothing. Just burn that ether forever. This avoids the moral hazard problem while minimizing harm to the overall ecosystem. People like me who made the mistake of investing still feel the pain, but Ethereum itself moves forward.
"To be clear, if this happened due to an exploit in the software, then I can accept a hard fork fixing the issue. However, if the DAO team made a mistake in the way they designed their smart contract, as an issue of principle, they should not be "bailed out" by the Ethereum team because they are "to big to fail." Hard lessons like these teach the cryptocurrency community at large to do their homework and to be excessively (and obsessively) diligent with their security."
I agree with this.
No, I do not own any ethereum and have had only a casual interest in the entire project. My own investments have been in "Oh By Codes"[1] most recently :)
[1] https://0x.co
Personally I hate the term "smart contracts" because of the confusion they create on what they actually are.
It is the beginning of a precedent but precedent is fairly weak because Ethereum in its early stages and very experimental (many hard forks are in Ethereum future). Bitcoin rolled back the blockchain at one point as well but it wouldn't happen today.
>So what now are the benefits of Ethereum smart contracts over the traditional legal system?
My view is that smart contracts can most useful for low value contracts that you would never want to take to court. No judge wants to listen to two people arguing over 18 dollars.
Will the project leadership offer a soft- and/or hard-fork every time a poorly-implemented smart contract is exploited in a manner that is not intended by the contract creators?
If every smart contract is going to be "guaranteed" in this way, then this introduces significant overheads for the project and can also create moral hazard.
Alternatively, if only some contracts are "guaranteed" but not others, this can introduce opportunities for favouritism or discrimination...
Are cases only considered when they affect the ether price or where there is personal involvement with the contract? Is that fair?
Interventions and their resolution can also quickly get politicized just like the bank bailouts from the financial crisis.
It is not clear this is setting a good precedent.
Edit: reworded for clarity
This was a plot mechanism in some SciFi story I read a few years back. Edit: one of the in-universe early Revelation Space books.
The fork won't be enacted unless a majority of the community agrees to run its code. That's not likely to happen except in extreme cases, like this one.
Because it implies that some contracts will have a greater probability of being "bailed out" if they are backed by more ether.
It may turn out to be a bad thing because it will establish the idea that not all Ethereum contracts are created equal.
And this can lead the system to be more centralized.
a) It is being bailed out by referendum, not mandate. Everyone gets a vote, if you don't want to install the patch, don't do it.
b) The funds to bail it out are those stolen by the attacker. Nobody is asking people without DAO tokens to suddenly contribute their ether to restoring the DAO or take debt.
Of course, miners not associated with the DAO would never normally consider risking such a thing, but the rapidly falling price of their ether may convince them that it's the safest move.
2) The American people were paid back.
I mean, the contract executed exactly as specified.
If the system was well designed, there would be no way to undo the results. Such a system may never exist, but the fact that ethereum can sometimes change contract results means it isn't living up to its ideals.
Edit: for the record, I don't own use Ethereum or own any ether, so I would also hope that a hard fork doesn't happen to bail out a single contract, but I have no financial incentive on the line.
Look, self-driving cars required humans to take over and require updates to deal with new challenges -- until they don't, or very rarely do.
Smart contracts are different from self-driving cars in that the former have competing intents within while the latter have a common goal of "not hitting anything".
This is really too bad. The best outcome would be for the community to learn from this and build tools and practices that make new contracts significantly more reliable.
Smart contract design practices will have to undergo the same kind of gradual hardening that web servers have over the past 20 years. Let's hope it happens a bit quicker.
Well that's the fantasy of the century. Has no one learned this lesson with Bitcoin? An electronic currency doesn't magically wave away the fact it's being built and used by humans.
The project leadership can only propose change. Change requires "ratification" by a majority of miners as well as the support of node operators and holders.
> So what now are the benefits of Ethereum smart contracts over the traditional legal system?
The contract can only be invalidated by a significant majority / supermajority of the community through the consensus process. Therefore this is unlikely to happen often if ever, and if so, only in very extreme, clear circumstances in which the entire community is in jeopardy. [0]
[0] Theoretically.
[0] https://dao.report/?sort=popular&keywords&status%5B0%5D=1&st...
Proposal #5 "Moratorium on proposals" only reached 8.86% of 20% quorum before voting ended.
Yet the moratorium is already in effect... as you can see there aren't any other real proposals out. Everyone is waiting to sort out these huge bugs in the framework.
https://www.reddit.com/r/ethereum/comments/4ns5nl/news_on_th...
The only way to eliminate the human interpretation factor is to eliminate the possibility for human interpretation. This is effectively impossible in a pre-singularity world, so there can be no such thing as a contract enshrined in code which is binding.
Perhaps that is only a reasonable hope for values under $50-100M USD.
Compare with "old fashioned" contract law or e.g. national currencies or gold. The errors there (theft, counterfeit and fraud) tend to impact only one or a few transactions. It's all more localized/
In case of broader failure of old fashioned money (e.g. national currencies being destroyed through inflation): at least this is a very slow process that is usually being telegraphed years in advance.
It is really the whole cryptographic ambition for trust less systems that is possibly problematic.
I'm trying to be open minded. I'll concede that maybe they are will be proven right with time, but maybe not.
In that sense smart contracts are a tool for a specific purpose (and maybe a replacement for people who don't have the luxury of a working court system) as opposed to the end-all-be-all solution that some make it out to be.
If you're not familiar with anarcho-capitalist theory, there's a concept called a DRO -- dispute resolution organization [1] -- that can perform arbitration functions in a decentralized manner, i.e. without a monopoly on judicial services like the state.
In the future, as the infrastructure matures, I'd be willing to bet DROs will arise to handle these types of disputes. Forthcoming DAOs can be more competitive by integrating dispute resolution clauses into their contracts.
For example, maybe there's a flag that must pass before any transaction takes place, and can fail if X% of DAO stakeholders vote to halt transactions and defer to a DRO for arbitration.
Hard to say exactly how things will evolve, but what's great about Ethereum is that contract law has the potential to evolve at a much quicker, cost effective pace than does the monopolistic, bureaucratic justice system we have in place today.
[1] https://en.wikipedia.org/wiki/Dispute_resolution_organizatio...
Generally, I think ancaps would argue that violence wouldn't occur because it is too costly (as they do in the context of private defence agencies [1]).
Anyway, I believe this argument is flawed, in the sense that people have resorted to violence, despite the fact that it was nonsensical in economic terms (I'm looking for the quote of some prominent intellectual who argued around ~1914 that no big war could ever happen again, because it would be devastating in economic terms. He was proven both wrong and right in the sense that it indeed was devastating for the economy and that it occurred anyway as we know. If somebody knows the name of this gentleman please let me know).
The non-aggression principle is a central tenet in ancap philosophy which would preclude violence in most cases, however, it is permitted in self defense of ones person or property. Still, most people who subscribe for a DRO probably aren't going to want to pay the high costs for a standing militia. Would you voluntarily pay taxes for the War on Terror, or the numerous other military boondoggles across the globe, if you had a choice and knew the actual costs?
This ventures into the territory of private defense agencies, which decentralize security services, and is a deeper subject. If you want to dive in, I'd suggest Michael Huemer's book "The Problem of Political Authority: An Examination of the Right to Coerce and the Duty to Obey" in which he debunks the Hobbesian war of all against all scenario. "Practical Anarchy" by Stefan Molyneaux is also a decent (and free to read) overview of how ancap voluntarism could work, but Huemer's arguments are more comprehensive.
... Unless that impacts their bottom line. In reality, this is unsolvable - if it were, boycotts, divestments, and employer blacklists would be far more effective. You can always find scabs that will compromise on principle in order to put food on their table.
What if someone disagrees with the non-agression principle or uses a very liberal definition of "self defense"? If I'm the only one who is permitted to use violence to defend myself, does this mean I have to carry a weapon with me at all times (and hope the other one doesn't have a bigger gun/has hired the more expensive security force)?
What does surprise me is that people poured the equivalent of tens of millions of dollars into this new, unproven thing. To me, this says that while Ethereum itself may be technologically fine, the community is completely bonkers.
The underlying tech is clever though; the speculation is just a side-effect of cryptocurrency systems that they attract a lot of people who attempt to make a quick buck from during the rapid growth phase.
As others have pointed out, this is not a bad thing b/c speculation is one legitimate way that cryptocurrencies can bootstrap themselves, even if (over time) their strengths are not likely to result in more speculative behavior than is found in other established currencies.
The outrageous investment in Ethereum/DAO does seem to highlight a desire for governance models outside of the corporatist status quo we live under today, though. Personally, I don't think it's bonkers to yearn for something better. But it's a hope that needs to be tempered with vigilance if people are going to avoid being duped.
Ethereum's smart contract language is not one which makes it easy to write secure smart contracts. There are dragons everywhere, and the DAO is far and away not the only smart contract to incur their wrath.
In general I am in favor of moving to programatic, unforgiving law. But we need to do so at a pace that matches our technological progress. Today, the technology is not there to make advanced contracts. Simple ideas like 'this coin is owned by this person until a signature from this key transfers ownership to someone else' are pretty easily enforceable. Bitcoin has a scripting system with a variety of safe scripts in widespread use.
But as soon as you start aiming at things like 'this investment fund is owned by this group of people and is able to make investments under conditions X, Y, Z, and can split... etc.', you've outpaced what we currently know how to do safely.
It's much worse than that!! What you've just said applies to building an airplane or getting to Mars, too. Mother nature won't care what you meant to do.
But this is worse: mother nature might give you turbulence, but She won't carefully cycle or time the turbulence in a code injection vulnerability to try to get your avionics to lock up at some particular moment. With these kinds of systems, you have humans actively doing everything in their power to break the system, even using the most subtle possible tricks. It's not just noise: it's a malicious attacker.
It's not enough to "get it right". You have to get it right against someone with lockpicking tools, budget, time, and no legal, social, or moral checks and balances. By that standard, every vehicle NASA has ever built is completely broken, and NASA has never built a single thing that works.
It's not just about code that's correct. It's about code to held to literally supernatural standards of correctness.
It's a social problem.
Interactive theorem proving is already at the level that verifying something like the DAO (a few hundred lines of code!) isn't too complicated. By the time smart contracts become relevant we'll probably have all the tools in place to make this an industry instead of a research project.
Ideally, using formal methods [1], one can write a provably correct program. Just because software can have bugs does not mean it must have bugs. Human contract law has no analogue.
Personally I'd be wary of any electronic contract that wasn't formally verified. The DAO exploit is unsurprising.
If this hack can be stopped, then it demonstrates that the currency can be manipulated, that the decentralised system is not so fault tolerant or uncensored after all, and that people out there know this.
Edit: to be clear, the 51% attack I'm referring to is actually the defense of the network by developers/miners/users that the parent post is complaining about.
I wonder how different ether will turn out to be, will they bail it out by rolling back the blockchain?
But when did he know how to do this? Was it a secret that he was sitting on, or has he only learnt about it from the existing attack?
All the talk of /ethereum/ being decentralized.
Halting trading is a show of force too, if they believed a single thing of what they preach they'd let the free market continue its course with the hacker walking away with the money.
Looking at your comment history it seems clear you have an agenda here, so I'll ignore the ad hominem.
In the history of organization structures, for example, Peter Drucker in 1946 wrote the "Concept of the Corporation", a study on General Motors, which was arguably one of the early detailed studies of Decentralized governance in an organization.
Decentralisation does not preclude "force". The one really has nothing to do with the other. Unless your idea of "decentralization" is actually the solipsist view that every person is an island, and social structures hold no benefit for survival.
Decentralization doesn't prevent coordination.
Exchanges are in a difficult position once the 'head' of ethereum tells them to stop. It's a sign that the blockchain might be forked, so any further trades they make might be undone - they simply have little choice but to stop after being told to do so.
Not at all. This is a classic "coordination problem". It is advantageous for many participants in the overall system to take an action, but only if the other participants are ALSO taking the action. In such a case, a widely followed and popular leader is one possible coordinating mechanism. And it does not give that popular leader the ability to do ANYTHING, only things that actually ARE popular but require coordination.
That's the exact opposite of decentralized. Are we going to have to redefine the word?
How do you imagine decentralised decisions happening otherwise? Everyone choosing their own solution without ever talking to each other and seeing what is most popular?
My idea of "decentralized" includes things like "continues to function perfectly well if any one person or small group is removed from the process" and "continues to function perfectly well if any one person or small group becomes malicious".
In this case, if Vitalik Buterin were not around to announce the problem, someone else could announce it and that would provide a coordinating signal for all of the independent players to act on. If Vitalik Buterin were malicious and decided to announce a rollback of a big spend he had done, then the independent miners and mining pool operators would (I hope) choose to ignore the announcement and refuse to participate.
I guess to me, having a centralized group or individual make decisions seems to violate "decentralized", but having one of several possible groups or individuals make announcements which signal the population to take action does not.
I didn't stop eating excess salt until my doctor asked me to do so - and it was totally in my interest.
This is, of course, absurdly optimistic.
The reason for this is that ethereum exchanges are not decentralized and the "program" that the owners of the exchanges execute on their brains partly allows "dynamic mental code update" by Vitalik Buterin.
And the governmental powers-that-be can press a button and prevent citizens from exchanging cash?
The anti-fiat crowd should think for a minute on how money actually works in practice.
Also to your point, yes, Ethereum is not as decentralized as some would like to claim, either from a stakeholder perspective, or from a mining perspective, or even from a 'who holds the power' perspective. I suspect that's what makes it so efficient though, in terms of changing protocol, or making decisions on behalf of stakeholders.
[1] http://247cryptonews.com/vericoin-lack-integrity-bailout-min...
[2] https://www.cryptocoinsnews.com/official-nxt-decision-blockc...
[3] http://www.newsbtc.com/2014/12/17/opal-recovers-1-7-million-...
When adoption is low it stands to reason centralization would be high, and so it enables them to move faster to increase adoption, and hence lower centralization as other players and stakeholders enter the game.
However it does also stand the risk of allowing the current influential parties (the developers or miners) to influence the system in their favor. So far though, I don't think this has been the case, but we'll see how this situation plays out.
Also, centralization/decentralization is a a scale, not discrete boolean values.
It will definitely be interesting to see how this plays out. Good luck to everyone involved.
Since if this is a problem and will be fixed, it will presumably be by consensus. We already know that with consensus the entire system can be changed (or forked, if you like). This is no secret and there was never any claim otherwise. This is exactly what they mean by decentralised.
What should worry you is if a change happens without consensus, but there is no such indication here.
So, in computer science terms, consensus algorithms are about approximating distributed consensus in the face of benign and malicious threats or communication failures, which devolves to "quorum / majority" pretty quickly in a crisis.
After the crisis, some kind of compensation, reconciliation or excommunication has to happen with the portion that disagreed.
A distributed system can easily make a majority decision that is unwise, like if the votes are based off of bad information. But if the different options of the decision could be formalized and checked/proven as part of the decision making process, based off of axioms and values that participants all agree on, then perhaps the most rational decision could be selected even if it's not what the majority was initially in favor of.
It's sad, being able to write blockchain apps like with ethereum and lisk is cool tech, but we'll have to deal with the idea that once is out, it's out. Programming NASA style.
[1] https://www.reddit.com/r/ethereum/comments/4oiqj7/critical_u...
Why is that different for Ethereum?
So while there is no clear single party that makes decisions, active developers have the most say.
Once it gets bigger the security goes up as events like this affect the currency less and less.
The counterpoint to your statements is simply that consumers need safety with their money. It is no badge of honor to let unsophisticated technical people lose money for some extreme libertarian ideals.
A soft fork will undeniably require distributed consensus. It is the number of people with the actual right to vote that may be worrisome.
Perhaps the pool owners should extend their voting rights to their pool contributors, pooling votes as they pool mining shares.
(Disclaimer: I hold a small amount of ETH and participate in a mining pool.)
With all respect Peter, this is not FUD and OP is raising a valid concern. Yes, the miners vote on the patch - but given the infant state of the ecosystem and the large loss incurred, even further controversy or delay in finding a resolution may cause them permanent economic harm; so it would appear that there is little leeway in the choice involved.
> The counterpoint to your statements is simply that consumers need safety with their money. It is no badge of honor to let unsophisticated technical people lose money for some extreme libertarian ideals.
Yes, that's certainly the argument, particularly that if there is majority agreement than the protocol change is justified. But this doesn't at all invalidate OP's concern that fundamentally algorithmic contract's aren't binding if such an alteration can be adopted. The case could be made that in a more mature ecosystem such case specific alterations are more potentially damaging than useful and that this is a transitional phase, yet I think the burden of proof is on the one responding.
I think we agree on this. The reality is that an active choice will still have to be made by a consensus group, though. It's not a matter of something being forced down the throats of a majority by an oligarchy, it's utilizing the existing consensus mechanism.
I think OP should be well warned here as to what is binding with smart contracts, for sure. This isn't any different than risk calculations in Bitcoin, though -- early days advice was to wait six blocks for transactions over $20, because the cost of subverting the network was very low. This is part of the give and take of mining and distributed consensus with current technologies.
My thought exactly. And despite putting a little money into the DAO myself, this is the kind of risk I was willing to take. I should lose my money. Miners should vote strongly against this fork.
I know in the Bitcoin community this wouldn't be accepted, not so sure about Ethereum though where the developers have a lot more control (than they should IMO).
https://github.com/ethereum/mist/releases/tag/0.7.5
I realize this is the wallet development but they are absolutely related and shows the culture of this software is not as professional or thought out as it should be.
Somewhat more specifically, I'm wondering the following:
- At a high level, what does this attack actually consist of?
- How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints?
- Who loses and who gains from an attack of this scale?
- How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
- How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?
It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder some of the coins). Watch for a wave of rebranding.
> How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
We will see. The group behind TheDAO has a lot of pull - if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept.
> How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?
Why, take a look: https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...
Copied:
""" No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery Our team is blessed to have Dr. Christian Reitwießner, Father of Solidity, as its Advisor. During the early development of the DAO Framework 1.1 and thanks to his guidance we were made aware of a generic vulnerability common to all Ethereum smart contracts. We promptly circumvented this so-called “recursive call vulnerability” or “race to empty” from the DAO Framework 1.1 as can be seen on line 580: // we are setting this here before the CALL() value transfer to // assure that in the case of a malicious recipient contract trying // to call executeProposal() recursively money can’t be transferred // multiple times out of the DAO p.proposalPassed = true; Three days ago this design vulnerability potential was raised in a blog post which subsequently led to the discovery of such an issue in an unrelated project, MakerDAO. This was highlighted in a reddit post, with MakerDAO being able to drain their own funds safely before the vulnerability could be exploited. Around 12 hours ago user Eththrowa on the DAOHub Forum spotted that while we had identified the vulnerability in one aspect of the DAO Framework, the existing (and deployed) DAO reward account mechanism was affected. His message and our prompt confirmation can be found here. We issued a fix immediately as part of the DAO Framework 1.1 milestone. The important takeaway from this is: as there is no ether whatsoever in the DAO’s rewards account — this is NOT an issue that is putting any DAO funds at risk today. """
This blog post[1] from the Ethereum Team describes the possible attack.
[1]https://blog.ethereum.org/2016/06/10/smart-contract-security...
I guess if Ethereum makes a hard fork, that will damage it much more - basically, it makes the "smart" contracts unenforcable.
From reading the article on Smart Contract security (https://blog.ethereum.org/2016/06/10/smart-contract-security...), I get the feeling that the programming model might be somewhat to blame. The "obvious" ways of implementing something are subtly broken, in ways that are very difficult to anticipate without a very deep understanding of the protocol. The programming model demands that the program be capable of calling functions that are not under the programmer's control, and which can do nearly anything. This is very, very difficult to get right, and very easy to screw up, as anyone who has tried to write a sandbox environment can attest to.
address.call.value(amount) and the call being synchronous
you do:
address.call.queue_value(amount) and then at the end of your contract execution it runs the asynchronous calls that have been queued
a lot of the DAO calls (all of them??) to external addresses don't need the result so having an asynchronous transfer primitive would have just solved the problem.
these external callbacks are very dangerous. for example you have function _entry_ call function _logic_ and everything is ok. then someone decides to change function _logic_ to perform an external callback and this breaks the behaviour of function _entry_. when you have this non-local side effects from changes you will create security bugs very easily.
[1] https://www.reddit.com/r/ethereum/comments/4oiesu/polo_froze...
The code behind the DAO is available here [2].
Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open.
- Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inverse a hash" type of problem.
- People lose if they're holding a long position on ETH, or have DAO which they can now no longer recoup to ETH. People gain if they're shorting ETH, or are the attacker themselves (it looks like the ETH from the dao is going to this address [4])
- Looks to be an existential threat to the DAO from where we're standing right now. I can't see any mitigations but an entire Ethereum blockchain split.
[1] https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...
[2] https://github.com/slockit/DAO/blob/develop/DAO.sol
[3] http://pastebin.com/DykumjLs
[4] http://etherscan.io/address/0x304a554a310c7e546dfe434669c628...
I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546dfe434669c6..., I can see that most of the transactions are internal, with the API reporting monotonically increasing call-depth values. It seems like there are three recursive calls involved here: one call in the DAO, a second call to transfer money to the attacker, and a third "dummy" call which appears to transfer nothing (but presumably kicks off the next recursion into the DAO).
The scary thing, to me, is that someone else could figure out the bug right now and start exploiting it - presumably, all the relevant code is open source.
At a high level, The Dao is like Pokemon. Casual observation suggests that it may be a more or less consistent world internally and that a lot of people are very excited about it. A few of those people even claim to fully understand how it works. But there's a lot of fat guys with acne blindly spending on Pokemon cards thinking it's a wise investment.
Unfortunately, the fans are so excited that they jump up and down clapping all the time and forget to breath while they're talking. This makes it very difficult to understand what they're trying to say. If you manage to understand, you will hear something like:
"Most Pokémon have only one type. However, EX Team Magma vs Team Aqua introduced Dual-type Pokémon, which have two different types. For a while, all existing dual-type cards had either Darkness or Metal as their secondary type, with the exception of certain Pokémon cards with the Dual Armor Poké-Body, such as Medicham from the EX Crystal Guardians expansion, which can have multiple types when certain energy are attached."
Now what possibly happened during the attack is that Pokemon cards are spontaneously catching fire! This is particularly troubling, because Pokemon just came out with a super-duper fire defence card and told everyone to buy it for lots and lots of money. And everybody did.
Now while all of this is clearly very troubling for heavily invested Pokemon fans. But in the grand scheme of things, well a butterfly flapped it's wings in China: there's a theoretical possibility that this affects anything, but in practice no one but fans cares.
> - How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints?
1. keep the exp you earned 2. lose some money 3. wind back at the pokemon center at the pokemon league 4. have to start over on the e4
> Who loses and who gains from an attack of this scale?
Pokemon fans, obviously.
> How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
Synchronoise when used by Pokémon like Umbreon. It deals damage to every Pokémon that shares the user's type, so in Umbreon's case it hits every Dark type Pokémon. Only it doesn't, because it's a Psychic move and always fails.
And that's fine, nothing wrong with having a hobby and being passionate about it. Not everything needs to have an impact in the grand scheme of things.
I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition.
Isn't the whole idea of that kind of contracts worthless if people are still rolling back effects of it when "it does not what it was meant to do"?
I the DAO case I am not aware of any regulations or laws that the "attacker" has broken.
No, it turns out that that's completely true, and that's the problem.
It is the same with Ethereum. If the DAO 'contract' does not include the terms, the 'lawyer' who wrote it just didn't do a very good job and it is open to taking advantage.
People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but it turns out that the implementation is not correct w.r.t the informal specification. That's called a software bug and abusing a bug to your own profit makes you an attacker in my book, just as much that using a flash 0-day to drop a rootkit makes you an attacker.
People should have been more careful, but hey, I'm not sure I would have.
The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code.
Nice. So if the community ultimately succeeds in preventing the "attacker" from withdrawing his funds, which he acquired in perfect accordance with the DAO code, which is the entirety of the agreement, could he publicly bring suit for violation of contract?
If you're not willing to call that simply an incorrect interpretation, you end up with two systems - software and people that push the blockchain forward - that interpret contracts differently. You also give precedence to the latter, which will lose the ability to effectively enforce its interpretation the more distributed the system becomes.
Ultimately you have to choose between having one true interpretation of contracts defined by software or being unable to enforce contracts as interpreted by a non-deterministic system.
Choose the latter and not just is there no advantage over real world systems, it's worse at enforcement.
From the article: > The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be “reversed”) […] preventing the ether from being withdrawn by the attacker […]. This will later be followed up by a hard fork which will give token holders the ability to recover their ether.
We'll see how the community reacts!
> Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation.
Nobody should have entered this contract if they disagree with the above. Yet now, suddenly most people who are a part of it seem to disagree with it!
George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992. I think most people in the UK would be OK with describing that as an attack.
I also like this analogy. I am also reminded of the Hunt Brothers and their (successful) attempt at cornering the silver market which was then thwarted by a rules change by COMEX[1]:
"But on January 7, 1980, in response to the Hunts' accumulation, the exchange rules regarding leverage were changed, when COMEX adopted "Silver Rule 7" placing heavy restrictions on the purchase of commodities on margin. The Hunt brothers had borrowed heavily to finance their purchases, and, as the price began to fall again, dropping over 50% in just four days, they were unable to meet their obligations, causing panic in the markets."
It's just a philosophical distinction. Suppose someone who had never built a software program in his life, successfully got a patent for "online marketplace for smartphone apps", and then went and successfully sued random weak-looking people for uploading their apps to the google play store.
Obviously he's abusing the system, and obviously he's a parasite preying on the weak with zero moral justification, in a way that threatens the very foundation of the tech industry... But what he's doing is not illegal; he's just exploiting a flaw.
Is he an attacker?
/shrug
Depends on how you define things, but the context makes the meaning clear in this case, I think.
It also demonstrates that being first-to-market trumps security. If the DAO had waited until a full formal verification system exists and had been applied, they wouldn't have been able to pick up the $160m of overenthusiastic money keen to rush headlong into the hands of hackers.
If they had some sort of fraud-related authorized structure, which was able to "reverse" the result of an obvious software bug, I would say that it should've been much more stable financial system.
It's like these people have never seen War Games.
(It also attracts the kind of people who think that banks, financial institutions, VISA and Paypal are "very likely" to defraud them while something entirely new and unproven with no legal structure is somehow less likely to defraud them or lose their money. See also people who think that bitcoin might be more stable than the US dollar.)
When widespread old and tested code like OpenSSL has massive security bugs, what chance does something as new and in-development as Bitcoin/Ethereum have? An in the case of Ethereum, the contracts themselves?
It's not "this code has no bugs" it's "this code has less visible bugs than the lower hanging fruit". If it's harder to find than any bug in any system with bitcoin (or other ethereum) in it, then people will find that stuff first. Bitcoin gave us out here in the IT world, for the first time in history, a realistic way to measure the large-scale security of various kinds of systems. Microsoft, for example, has not had the bitcoin from any of their wallets stolen. With every flaw that's found, we get the chance of learning how not to fail in the future.
Furthermore you have to invest in something. And it's remarkably hard to invest these days. Just try buying a house with ethereum, see how frustrating it is.
I think this is great actually. Maybe not for the people involved right now but there will be a very strong Natural Selection pressure on contracts.
It will be interesting what type of contract emerge and survive over time, the type of languages used to improve or proof robustness, etc.
[1] https://www.hks.harvard.edu/fs/jfrankel/CatoRespCrisesJun07+...
Not that they were libertarians, but the presidents during the 1920-21 Depression[1] acted slowly, and the economy bounced back incredibly quickly. From the article: However, by the time Harding had called his conference, the country's economy had already shown signs of rebound, and by 1922 was starting the economic boom of the 1920s[13] and merely allowed for President Harding to claim success.
[1] https://en.wikipedia.org/wiki/Depression_of_1920%E2%80%9321
I'd argue that the solution proposed by Ethereum in this blog post is not antithetical to mainstream Libertarianism. It actually fits perfectly well into the role the majority of libertarians believe a state should take.
To begin with, from my understanding they merely proposed a solution which the community has to agree to implement. Just like modifying the bitcoin codebase.
It's still ultimately an additional layer of decentralization in between. Taken as a whole - even if Ethereum takes action against the attacker - what DAO represents would still be very very far from the representative democracy style system that libertarians take issue with.
Importantly, libertarians are not all anarchists (or 'crypto-anarchists' or 'anarcho-capitalists' to be more accurate) who believe in total decentralized control structures. Mainstream libertarians wish for a minimal state or "night-watchman" state, a not the total absence of a state.
This the most prevalent myth about libertarianism and the faulty premise of most attacks against it.
Even many hardcore anarcho-capitalists are against the idea of decentralized judicial and law enforcement systems - as they see it as unworkable.
In the book "Anarchy, State, and Utopia" [1] popular libertarian thinker Robert Nozick argues that
[..] only a minimal state "limited to the narrow functions of protection against force, theft, fraud, enforcement of contracts, and so on" could be justified without violating people's rights.
[1] https://www.amazon.com/Anarchy-State-Utopia-Robert-Nozick/dp...
griff [10:05 AM] @channel The DAO is being attacked. It has been going on for 3-4 hours, it is draining ETH at a rapid rate. This is not a drill. You can help: If anyone knows who has the split proposals Congo Split, Beer Split and FUN-SPLT-42, please DM me We need their help! If you want to help, you can vote yes on those aforementioned split proposals. especially people who’s tokens are blocked because they voted for Prop 43 (the music app one). We need to spam the Network so that we can mount a counter attack all the brightest minds in the Ethereum world are in on this. please use this: for (var i = 0; i < 100; i++) { eth.sendTransaction({from: eth.accounts[4], gas: 2300000, gasPrice: web3.toWei(20, 'shannon'), data: '0x5b620186a05a131560135760016020526000565b600080601f600039601f565b6000f3'}) } to spam the chain
http://www.coindesk.com/the-dao-just-raised-50-million-but-w...
The meaning of the word "safe" seems to vary from person to person. The ETH and contract devs think safe means having a static PL to capture contracts.
But in reality it is safe as in, whoever exploited the vulnerability now has a "safe" source of income in a few weeks.
Perhaps it is a lesson better learnt now than later when the stakes are even higher.
Well, that would be safe (in the sense that you got money according to the contracts in the ETH network), but the problem is that the developers are trying to take this money away from the exploiter! I.e. they're trying to undo whatever action was enforced by a cristalized contract everybody agreed upon!
The comments here are generally spot on; it's a combination of problems -- upgradability is designed to be hard because other people's money shouldn't be easy to steal, programmers are not used to making whole programs reentrant, existing documentation underplays risks, or alternately just tells people to do the wrong thing.
A better language would help, better documentation would help, better standards about how to write the programs would also help.
And, of course, more eyes are helpful. I'm an outsider to Ethereum, and got a very polite response, overall the community has been great. That said, there just aren't enough people looking at these contracts right now.
I hope this doesn't kill the project. Having programs that give you money when you find bugs in them could be a very powerful incentive to develop new tools to write correct code.
[1] https://blog.ethereum.org/2016/06/10/smart-contract-security...
I don't know off the top of my head what I would design into my contract language, but Solidity has numerous things in it that I would not.
I guess in their further defense, the way I'd want to design the contract language is what is right now some really cutting edge programming language theory. I'd be looking very hard at the Total Functional Programming languages [1]. "Total" here is not just an enhancing adjective, it defines a specific characteristic of the languages with regard to how they terminate. But it still would have legitimately been research to figure out how to correctly convert from a programming language to its cost-to-execute correctly enough to be in a financial application. I believe TFP research right now is mostly focused on how to write TFP code that practically accomplishes things without having to write some pretty mathematically-complicated circumlocutions, not modeling costs.
I also would have looked at doing something with FRP, not because it's the hottest new thing necessarily, but because the ability to express every participant's obligation in a single block of code like a thread rather than an event-based setup would have made these contracts much easier to write and audit.
The combination of these two things is probably an entirely untouched domain, or at least effectively so.
Ethereum is a fascinating idea. It's not hard to imagine something architecturally like it being huge in 50 years. It's not hard to even imagine it as the basis of cstross' unspecified "Economy 2.0" in Accelerando. But it might just be 5 or 10 years too early to work now.
[1]: https://en.wikipedia.org/wiki/Total_functional_programming
They are calling splitDAO:
https://github.com/slockit/DAO/blob/develop/DAO.sol#L618
splitDAO calls withdrawRewardFor which ends up calling back into the users contract.
https://github.com/slockit/DAO/blob/develop/DAO.sol#L686
withdrawRewardFor(msg.sender); // be nice, and get his rewards
totalSupply -= balances[msg.sender];
balances[msg.sender] = 0;
paidOut[msg.sender] = 0;
however, earlier in the function it moved funds to a new dao based on the balances variable.
// Move ether and assign new Tokens
uint fundsToBeMoved =
(balances[msg.sender] * p.splitData[0].splitBalance) /
p.splitData[0].totalSupply;
if (p.splitData[0].newDAO.createTokenProxy.value(fundsToBeMoved)(msg.sender) == false)
if this is the bug the attackers are exploiting then maybe if they generated rewards it would stop the drain of funds.
however, the fact the draining is still going on and the DAO people are likely to know how they are doing it and it hasn't been stopped reduces my confidence that this is how the attackers are doing it.
EDIT: to add i don't think you can cash out the new DAO for 28 days so this is probably not how the attackers are doing it.
EDIT: update again.
https://blog.slock.it/dao-security-advisory-live-updates-2a0...
'It would appear the attacker has moved the stolen ether to a child DAO, which means that the funds be moved for at least 27 days.'
-> i'm now fairly confident this is how the attack worked :)
And how on Earth is it a good idea to allow one contract to call another? There are any number of more sensible ways to communicate that don't have this problem: allow contracts to pass messages to other contracts, allow contracts to subscribe to each other's events, etc.
function payOut(address _recipient, uint _amount) returns (bool) {
if (msg.sender != owner || msg.value > 0 || (payOwnerOnly && _recipient != owner))
throw;
if (_recipient.call.value(_amount)()) {
PayOut(_recipient, _amount);
return true;
} else {
return false;
}
}
Does this mean that transactions are going to be rolled back?
If so, are they planning to do this everytime a vulnerability is exploited? Is The DAO too big to fail?
At least this way, with no full-scale rollback, other people's transactions won't be affected.
If users truly want to embrace the decentralization then I see issues with the Ethereum maintainers doing very centralized and specific fixes to solve individual problems.
DAO != ETH, but I see how this is an act of self-preservation due to the amount of stakes the maintainers have themselves in ETH.
There is definitely a lot of social pressure to consider here, but there is still no central switch. I'm generally not a huge fan of cryptocurrency (as currencies that is, I love the tech), but I fail to understand why so many people who are oppose this move so rabidly. They're in the same situation with respect to forking that they were yesterday: whatever 51% of the community decides to do will happen.
What will happen depends on the collective decision of the community which is still being actively hashed out.
Sounds someone already got stuck with the hot potato. Was it definitely the hacker? if so, how did the contract's design make the coins unspendable? sounds like it would have been an odd contract to enter into.
Sounds like the powers that be have said, 'I have altered the deal. Pray I don't alter it any further.' If you're going to do this sort of thing, you need a transparent policy describing the circumstances under which you're going to do that and who will make that decision.
It's almost as if complex contracts need to come under a system of laws and an adjudication process. Otherwise might is right (in this case might being all profit to the superior hackers, or to the people who can make the decision to repudiate the letter of the contract)
https://github.com/slockit/DAO/commit/f01f3bd8df5e1e222dde62...
reward = rewardAccount.balance < reward ? rewardAccount.balance : reward;
+ paidOut[_account] += reward;
if (!rewardAccount.payOut(_account, reward))
throw;
- paidOut[_account] += reward;
+
return true;
}
if(_toMembers) {
if (!DAOrewardAccount.payOut(dao.rewardAccount(), reward))
throw;
}
else {
if (!DAOrewardAccount.payOut(dao, reward))
throw;
}
DAOpaidOut[msg.sender] += reward;
this is a good summary of the problem:
https://blog.ethereum.org/2016/06/10/smart-contract-security...
and should scare you about the security of smart contracts base on etherium.
EDIT: mm.. maybe it is safe because the addresses dao/dao.rewardAccount() can't be controlled by attackers
It's Solidity. It's the Ethereum virtual machine. Even today, security vulnerabilities are being found in code strategies that are generally considered 'best practice'.
Writing a safe smart contract on Ethereum is extremely difficult, and most people playing with Ethereum don't seem to realize this. There's a pretty well understood maxim, "don't roll your own crypto." Etherem's smart contracts ARE cryptography, and their safety depends on implementation details that are completely hid from users during tutorials, and that even the language designers are only still discovering.
This article does a good job of demonstrating that safety is really hard: https://blog.ethereum.org/2016/06/10/smart-contract-security...
And it's one of the major reasons that the Bitcoin devs have not been excited about Ethereum. It's a project whose ambitions have outpaced our ability to engineer safely.
One day we can have safe smart contracts. But the Ethereum of today is not well designed, and is not a good foundation for smart contracts. A simple hardfork to fix this DAO mess isn't going to be enough. The whole virtual machine needs to be redesigned.
And my money is quite seriously on Bitcoin figuring out the safe way to do smart contracts faster that anyone else. The vast majority of experienced experts in this space are still spending the majority of their time on Bitcoin. As popular as Ethereum has become, Bitcoin still owns the mindshare, and there are good reasons that Bitcoin has chosen not to pursue smart contracts at this time.
I think Ethereum is finished now.
The trust in it will disappear, or the money invested in it will disappear. Either way, the value goes to zero.
I was just getting interested in it.
I'm feeling both sad and relieved. Sad that it didn't succeed, relieved that I didn't sink any time or money into it.
Writing may be difficult. It's reading that should be easy. Unless you can read the contract, you can't put your money there and an example of Etherum contract looks like this:
ADD
SWAP1
RETURN
JUMPDEST
PUSH1 0x60
SWAP4
DUP5
MSTORE
PUSH1 0x80
SWAP3
DUP4
MSTORE
PUSH1 0xa0
SWAP2
SWAP1
(750 lines omitted)> There is 2.436.828 Ethereum in the account of the attacker (see: https://etherchain.org/account/0x304a554a310c7e546dfe434669c...)
> That's about 3% of all Ethereum mined (source: http://coinmarketcap.com/currencies/ethereum/)
> The Ethereum in the account of the attacker has a value of $41 million
> The volume is about 30% of all Ethereum trade today
Here are the working links:
https://live.ether.camp/account/304a554a310C7e546dfe434669C6...
https://etherscan.io/address/0x304a554a310c7e546dfe434669c62...
Much as I hate to link to reddit, for effective and biting criticism of cryptocurrencies: http://reddit.com/r/buttcoin
eth is also traded to and from USD on various exchanges, so that's a parallel, too?
Listen, I'm no ethereum fanboy here, but logic, let's use it.
Sure, it's probably a contract issue, but we'd have some much better contract code if the VM didn't require you to code defensively all the time.
The DAO, though, that always seemed slightly fishy to me. "A company for carrying out an undertaking of great advantage, but nobody to know what it is right now".
Buttcoin in my experience has been less about insightful criticism and more about ... well, the kind of criticism the name suggests.
Then there's the possibility of forcing early program termination via stack overflows.[1] Having to protect against that inside each program is just silly. The contract engine should have been designed so that if a contract program crashes, anything it did is rolled back.
[1] http://hackingdistributed.com/2016/06/16/scanning-live-ether...
I guess this sort of thing would be the reason. One thing is finding bugs in ordinary software, where the bugs are accidents. It's hard.
Another thing entirely is where you are looking for adversarial bugs. Just look at security articles that appear on HN now and again. They're incredibly complex, and it's not like you can turn off the firehose. When you fix one gap, someone will find another.
I haven't done a lot of reading on ETH, but I would imagine the smart thing to do would be to have some small number of contract types that a lot of people can stare at and try to break. The more attention is distributed among various bespoke contracts, the harder it gets to secure them.
It's like everyone building their own awesome cars, with special bells and whistles, and then asking these non-security engineers to design a lock. Everyone will end up re-learning some painful lessons.
It's not just hard.
I'm with you on the fact that proper auditing is an absolute must, as this DAO fiasco shows, but I don't think this event exposes any flaws in the Ethereum platform itself.
Obviously it's not enough to just say "some guys did a security audit and everything looks fine."
There are plenty of proposals to add complexity to the Bitcoin system. I hope that people promoting those proposals pay attention to this example of the problems complexity will inevitably cause.
azzo [2:22 PM] what's DM
dan_tudor [3:49 PM] So who is buying Dao tokens right now?
So much self importance mixed with faux understanding of technology and a dash of desperate desire to belong to a special group.
On a more positive note, my bitcoin wallet is rapidly approaching steak dinner territory as of last month. It's the little things in life!
What other mature, ready-for-primetime autonomous altcoin networks can I dump my savings into for no apparent reason?
Edit: "DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH."
No they shouldn't. They should running screaming for the exit doors. Less than two months after the launch of this mysterious "DAO" with an entirely bogus value proposition, 1/3 of the money put in, worth presently some $39 million USD in real money, has been confirmed stolen.
Right now the proponent of this fraudulent scheme, slock.it, is actually urging people to spam the blockchain to slow down the rate of theft. Yet the true believers are claiming this is a "learning experience" that will make it all better in the long run. It's beyond satire.
I don't understand why the site should be suffering so much? All these sites seem to suffer when a link gets posted in a few places. Do they all have something in common?
+ I'd imagine quite a lot of people were expecting this blogpost, probably anyone who put more than $50 towards the DAO, and is currently awake
For example, you could upload a contract that lets some specific set of accounts withdraw money unless the balance goes under 500 ETH (which is the basic Ethereum currency).
"The DAO" is such a contract but with more complex logic that amounts to a kind of venture fund. If you send money into it, you get to vote in proportion on proposals for "The DAO" to fund projects.
That contract was hyped enormously as the future of financing etc and indeed received an enormous amount of ETH from people who hoped it would benefit the Ethereum ecosystem.
In the first weeks after its recent launch, the contract logic was shown to have economic flaws that would most likely lead to bad fund performance, and it seemed as if the incentives for voting on proposals didn't work: no proposal ever made it past the threshold.
And now it turns out that despite the assurance of security audits, the logic (written in Ethereum's contract language Solidity) had a serious bug that allowed an attacker to start draining all of the fund's assets.
1. How do I exchange this cryptocurrency for something that I can go and buy a sandwich with at the Deli?
2. Why is there a need for this instead of using traditional methods with contracts, banks, etc? Money as is, is a collective illusion we all subscribe to anyway, and these things aren't any more different from that. What is the purpose of this cryptocurrency?
3. Who on earth are putting all these millions of dollars into these systems and how?
2. For one example, consider how tedious it is to open a new bank account; with cryptocurrency, you just make a new keypair. Smart contracts improve on normal contracts in that they are executed automatically and cheaply. One of the first theoreticians of smart contracts wrote:
"A canonical real-life example, which we might consider to be the primitive ancestor of smart contracts, is the humble vending machine. Within a limited amount of potential loss (the amount in the till should be less than the cost of breaching the mechanism), the machine takes in coins, and via a simple mechanism, which makes a freshman computer science problem in design with finite automata, dispense change and product according to the displayed price. The vending machine is a contract with bearer: anybody with coins can participate in an exchange with the vendor. The lockbox and other security mechanisms protect the stored coins and contents from attackers, sufficiently to allow profitable deployment of vending machines in a wide variety of areas. Smart contracts go beyond the vending machine in proposing to embed contracts in all sorts of property that is valuable and controlled by digital means."
http://szabo.best.vwh.net/smart_contracts_idea.html
3. Lots of different people. Many of them probably purchased the tokens when the network was young and the exchange rates were much lower, or mined the tokens themselves. The sum of the market value of these networks starts at zero and gets bigger as the tokens become scarce and valuable.
You make it sound like a person needs to open a separate bank account for every transaction, which is clearly not how people manage their finances.
I'm in the same eli5 boat. I can't fathom why anybody would put real cash into such a system. It comes across as "because I'm rich as fuck and can gamble away my money on a stupid tech system that is not realistically viable". Just... why would anyone use this? It makes no sense, unless this just offers a way to attempt to hide one's identity while participating in illegal ventures.
I know a lot of tech nerds. Not one of them would ever join a system like this. I just don't get who is voluntarily subjecting themselves to this insanity. Can someone out there who has actually used Ethereum explain why they've done so? I would really appreciate some kind of insight into this whole concept, as I just don't understand.
The banking world is extremely interested in blockchain technology and smart contracts. Browse through financial news and you'll see the extent of it—it's huge.
Your conviction that blockchains are stupid insanity seems to me like it will be proven very wrong in the next five years.
They take the risk for hopes of future profit; it's an investment.
> Just... why would anyone use this?
Because they want to see the world change, it's a protest against the current financial system.
Beyond their inconvenient use, they are not valid outside of the country either. In essence, they have created a closed ecosystem, making sure that you can only spend this 'money' within their own system. You cannot transfer these funds outside of walled gardens, in this case the country's legislative boarders. I see cryptocurrency the same way. If everyone starts using it, it will have universal value. However, to use it, everyone would need to have access to internet and mobile devices. I do not see that happening anytime soon. And please don't reference the number of mobile devices. Internet infrastructure is much more expensive to build than to supplement everyone with cheap phones. [1]
I cannot really relate to your vending machine example either. In case of a vending machine example you are quoting that 'anybody with coins can participate in an exchange with the vendor.' This only works if the universally agreed currency is the one expected by the vendor. Your vending machine would not accept my Eastern European Monopoly Money whereas the expected input is in Euro. Same for cryptos: where the expected input is that of a currency backed by financial institutions trading in the same currency, I will laugh at you when you attempt to pay in bitcoin, dogecoin, ether (literally the primordial Greek deity of pure air), whatever.
With point three you suggest that the real value of these systems are for people who got into the Pyramid Scheme early. Again, I think these institutions are frauds, and I would not be surprised if it surfaced that the creators of this blockchain system planned to pull off such a scam in the first place.
[1] http://paiwandgah.af/personal-data-leaked-from-smartphones-n...
Even so, an asset can be valuable even if it's not used as daily currency. You can't buy a Coke with gold.
DAO is an autonomous corporation that runs on top of Ethereum. The digital token in the Ethereum ecosystem is called Ether. So the DAO raised somewhere around ~$150M USD in equivalent Ether funds during its IPO-like phase.
0.https://www.reddit.com/r/ethereum/comments/4oiib4/dao_is_saf...
It's young software, of course it will fail around a little.
Is it because the beginning is where you make the bet to become really rich when the thing lifts off?
"Ethereum is a decentralized platform for applications that run exactly as programmed without any chance of fraud, censorship or third-party interference."
Right ...
' “This is the land where dreams–dreams, do you understand–come to life, come real. Not daydreams: dreams.” There was about half a minute’s silence, and then with a great clatter of armor, the whole crew were tumbling down the main hatch as quick as they could and flinging themselves on the oars to row as they had never rowed before. . . . For it had taken everyone just that half-minute to remember certain dreams they had had–dreams that make you afraid of going to sleep again–and to realize what it would mean to land on a country where dreams come true. ' - C. S. Lewis’s Voyage of the Dawn Treader
- 2,436,828 Ethereum has been routed to the address starting "0x304a554a310c7e546" [0]
- This is worth roughly $46,000,000.
- This has happened because there is some weakness in the Ethereum security
- The conversion between Ethereum and USD is dropping significantly, now down to 16. [1]
Due to this security threat, the developer is telling people to try to effectively DDOS the service in order to stop all transactions. Also, people are being told to split, but I can't see why.
Copy of page at 9:45: - http://puu.sh/pvOqy/929f40bddb.png
[0] https://etherchain.org/account/0x304a554a310c7e546dfe434669c...
Doubly so when the latest reviewers of this systems and custodians of the DAO include the system's creators.
When building systems that provide irreversible transaction processing, safe only under perfect use is not sufficient.
Ethereum just has to work. It doesn't have to be pretty. It doesn't have to be easy. Being pretty will help it work, but there's enough money on the table, and TheDAO demonstrates this, that it will advance on alternative institutions if it works.
TheDAO may never be 'safe' or 'perfect'. It only has to be safe right now, from the threats that real, interested parties are capable of implementing. This list of threats is quite large at 250,000,000$, and will be larger when/if TheDAO/its descendants hit 250,000,000,000$+.
Posted by Vitalik Buterin on June 17th, 2016.
An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction.
The leaked ether is in a child DAO at https://etherchain.org/account/0x304a554a310c7e546dfe434669c...; even if no action is taken, the attacker will not be able to withdraw any ether at least for another ~27 days (the creation window for the child DAO). This is an issue that affects the DAO specifically; Ethereum itself is perfectly safe.
The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be “reversed”) which will make any transactions that make any calls/callcodes/delegatecalls that execute code with code hash 0x7278d050619a624f84f51987149ddb439cdaadfba5966f7cfaea7ad44340a4ba (ie. the DAO and children) lead to the transaction (not just the call, the transaction) being invalid, starting from block 1760000 (precise block number subject to change up until the point the code is released), preventing the ether from being withdrawn by the attacker past the 27-day window. This will later be followed up by a hard fork which will give token holders the ability to recover their ether.
Miners and mining pools should resume allowing transactions as normal, wait for the soft fork code and stand ready to download and run it if they agree with this path forward for the Ethereum ecosystem. DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH.
Contract authors should take care to (1) be very careful about recursive call bugs, and listen to advice from the Ethereum contract programming community that will likely be forthcoming in the next week on mitigating such bugs, and (2) avoid creating contracts that contain more than ~$10m worth of value, with the exception of sub-token contracts and other systems whose value is itself defined by social consensus outside of the Ethereum platform, and which can be easily “hard forked” via community consensus if a bug emerges (eg. MKR), at least until the community gains more experience with bug mitigation and/or better tools are developed.
Developers, cryptographers and computer scientists should note that any high-level tools (including IDEs, formal verification, debuggers, symbolic execution) that make it easy to write safe smart contracts on Ethereum are prime candidates for DevGrants, Blockchain Labs grants and String’s autonomous finance grants.
Last time I looked at the Bitcoin code they had actually disabled some of the original opcodes due to security concerns. I'd be interested to see that this trend had reversed.
I think my point was more that the conservative approach Bitcoin takes works better on the long term, and there's still proposals that slowly get implemented.
I first got into Bitcoin in 2011, and since then there's been plenty of new opcodes, and as you say some original ones that got disabled as they presented risks.
Latest one I can think of that got implemented would be OP_CHECKLOCKTIMEVERIFY in 2014/15 (?), but I haven't really kept up with the BIPs that much with all the infighting
https://www.reddit.com/r/ethereum/comments/4oi2ta/i_think_th...
There was a bug in TheDAO's code. It got exploited in order to siphon off cryptocurrency worth many millions in USD.
https://blog.daohub.org/the-dao-is-under-attack-8d18ca45011b...
A good thread is evolving about this here: https://www.reddit.com/r/btc/comments/4oibqw/ding_dong_the_d...
We all know that smaller pieces of code can be more easily reviewed and understand. I think that this applies for simpler contracts with smaller value. If a contract has been running for a while without being exploited, then it means that it is pretty solid, and others can build on top of that contract.
It is an interesting dynamic, because there is an incentive to exploit bad contracts, and the contracts that have ran a long amount of time and and that have not been exploited yet are thus trusted to be unexploitable (because no-one exploited them)
If that is how it works, it means that Ethereum will eventually because a fail-proof system. However, one should not mistakenly create contracts from the ground up or using untrusted sub-contracts. The ones who do so will see their contract exploited and everyone will learn from that mistake.
Edit: Seems like Vitalik Buterin asking people to get that patch if they agree for the Ethereum ecosystem to move in that direction is just creating opportunity for fragmentation in the community. It would make more sense to let that "exploit" become a lesson instead of trying to work around this non-issue.
It has been said before, but there ain't no drama like Blockchain drama. No TV show, no book, nothing has me following it's story as Bitcoin and the other blockchains that come after it. Greatest drama of the millennia, so far.
The blockchain and DAO models are very new. They introduce new mathematical constructs, complex code, security issues we haven't thought about, coordination among many for such issues, and so no. Ethereum even includes an interpreter or something, which has its own set of risks. So, I refused to bet on such models given enormous risk means stuff is going to happen to them that isn't going to happen to regular, financial processing. We also have mitigations for most of its risks.
Today is a good example. This is the kind of thing you're not going to see the Federal Reserve, VISA/Mastercard, most banks, or even large eCommerce sites announce. It probably won't be the last announcement of an unusual issue. So, anyone wanting stable currency + commerce should avoid stuff like Ethereum unless they're just investing small amounts to help them experiment & improve. Risk/reward doesn't make sense on such immature tech.
The bug that was exploited here has been public for a week before someone decided to try it in practice. There was time to dispense back everyone's ether, had they taken it seriously. But taking security seriously requires an almost superhuman distance to your work.
The Ethereum developers is actively debating whether to put in logic to replay the blockchain in order to give back everyone's ether. While that's probably a good idea, it also means the company behind Ethereum can reverse any contract. That puts them in a difficult situation, as any smart contract platform will have dissatisfied parties at all times. (In comparison, none of the Bitcoin thefts have been reversed, and it's not clear they could have been as development is much less tightly knit.)
It's the most exciting thing since the fall of MtGox. The money at stake is comparable (the DAO is about a fourth of what MtGox was in perceived value).
Error establishing a database connection
https://news.ycombinator.com/threads?id=CyberDildonics&next=...
I was expecting it to at least bubble, before failing hard.
https://np.reddit.com/r/ethereum/comments/4oif2x/dao_attack_...
> At the time of deployment, it was discovered that the solidity compiler is not deterministic. AST nodes are identified by their raw pointers. So if we iterate over data structures, different raw pointers might result in a different iteration order.
> We originally wanted to let the community deploy The DAO and then just check the bytecode, but this was not possible at the moment of deployment. So instead a fixed transaction bytecode was provided for the community to deploy.
Shouldn't they have waited to deploy until they figured out how to make it verifiable?
In all seriousness though, when it comes to cryptography, cryptocurrency, and smart contracts, people are playing with fire, and they don't realize it. You can't fix a smart contract the same way you can fix a website. The fact that it's function is not good enough to push it out to the public.
Most software projects don't have that problem. Most software projects, it is okay to push buggy beta code out to the public. Because most software projects don't steward large amounts of money in an irreversible payment system.
I have no axe to grind against Eth vis-a-vis Bitcoin. Infact support both. But, try to look at parts of the former skeptically which I think are over sold, without being looked at critically.
[1] https://news.ycombinator.com/item?id=11772397
edit: minor rephrase
I haven't researched this deeply, admittedly, but I think the idea is that they're using consensus from the community in order to undo what the attacker did. In other words, if the community didn't support it, it wouldn't be possible to do at all. Contrast this with a centralized authority that didn't need community involvement at all.
Whether or not this is a desirable thing depends on your goals. From the perspective of the Ethereum community, which is heavily invested in the DAO, it makes a lot of sense. Even if this vulnerability causes you to write off the DAO as a failed experiment, it makes sense to recover some of your lost value before you exit.
However, for my goals, this causes me to write off Ethereum as a cryptocurrency I will never, ever use. It's breaking the fundamental benefits of the cryptocurrency to fix the problems of one group. And further, if this is possible for Ethereum, it makes me think that a 51% attack is more plausible for other cryptocurrencies. This worries me. I'd like to see more research put into defending against 51% attacks.
https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposu...
In the current Ethereum situation, the core Ethereum infrastructure isn't broken. The problem is with the contracts in the DAO. So creating an intentional fork is breaking the core infrastructure--which isn't broken--to fix the problem of a single majority stakeholder.
I don't mean to indicate the Bitcoin fork wasn't a problem--the fact that bugs can break core infrastructure also concerns me. But it's a very different problem from the one the DAO is creating here.
Now I guess we know it won't. Either "hackers" will bankrupt it, or all the decentralization zealots will back out (and bankrupt it).
Seems like I was right.
Since it is under load, here is a copy:
An attack has been found and exploited in the DAO, and the attacker is currently in the process of draining the ether contained in the DAO into a child DAO. The attack is a recursive calling vulnerability, where an attacker called the “split” function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction.
The leaked ether is in a child DAO at https://etherchain.org/account/0x304a554a310c7e546dfe434669c...; even if no action is taken, the attacker will not be able to withdraw any ether at least for another ~27 days (the creation window for the child DAO). This is an issue that affects the DAO specifically; Ethereum itself is perfectly safe.
The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be “reversed”) which will make any transactions that make any calls/callcodes/delegatecalls that execute code with code hash 0x7278d050619a624f84f51987149ddb439cdaadfba5966f7cfaea7ad44340a4ba (ie. the DAO and children) lead to the transaction (not just the call, the transaction) being invalid, starting from block 1760000 (precise block number subject to change up until the point the code is released), preventing the ether from being withdrawn by the attacker past the 27-day window. This will later be followed up by a hard fork which will give token holders the ability to recover their ether.
Miners and mining pools should resume allowing transactions as normal, wait for the soft fork code and stand ready to download and run it if they agree with this path forward for the Ethereum ecosystem. DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH.
Contract authors should take care to (1) be very careful about recursive call bugs, and listen to advice from the Ethereum contract programming community that will likely be forthcoming in the next week on mitigating such bugs, and (2) avoid creating contracts that contain more than ~$10m worth of value, with the exception of sub-token contracts and other systems whose value is itself defined by social consensus outside of the Ethereum platform, and which can be easily “hard forked” via community consensus if a bug emerges (eg. MKR), at least until the community gains more experience with bug mitigation and/or better tools are developed.
Developers, cryptographers and computer scientists should note that any high-level tools (including IDEs, formal verification, debuggers, symbolic execution) that make it easy to write safe smart contracts on Ethereum are prime candidates for DevGrants, Blockchain Labs grants and String’s autonomous finance grants.
— Vitalik Buterin
The street finds its own uses for everything.
What is this platform??? What is "DAO"??? What are "Uncles"??? What is "Ethereum"???
Ethereum is a blockchain based cryptocurrency that also lets you submit programs to the blockchain that nodes around the world run in exchange for a small fee.
I don't know what Uncles are, other than the brother of your father.
The DAO is a smart contract, basically a program, that runs on the Ethereum network. It's a bit of a venture capital fund that was open for 30 days to new investors. People submit investment proposals to TheDAO, and the investors decide if the investment proposal should receive funding. If it does, profits are sent back to TheDAO and distributed to the investors
EtherScan is a block explorer for Ethereum.
Nevertheless, I thank you kindly for taking the time to explain.
If you wait long enough it loads for me.
Exactly. DAO is CoreWar meets Nomic.
https://en.wikipedia.org/wiki/Core_War
https://en.wikipedia.org/wiki/Nomic
Designers of rulesets (laws, board games, markets, control systems) ignoring Gödel's incompleteness theorems should themselves be ignored. Just like we ignore inventors of perpetual motion machines who ignore the laws of thermodynamics.
https://en.wikipedia.org/wiki/Gödel%27s_incompleteness_theor...
Now... the ability to hard-fork is kind of in the rules as well. So it's a Nomic with a complicated endgame. Some guy just won the Nomic, but now he's finding that not only do you want to win, you want to win subtly, or else a majority can vote to undo your win.
But anyone who still thinks DAO is an investment vehicle is missing the fact that it's a high-stakes game, and cleverer people than them are going to win it.
I know what he means - he's suggesting that you can't ever get a bulletproof or watertight set of rules or guidelines for a system because ... blah blah ... Gödel's incompleteness theorem.
This is a very tempting idea and I myself have given it a lot of thought over the years.
The problem is, Gödel's incompleteness theorem applies to a system that contains the complexity of the set of all real numbers. But there are plenty of systems that do not have that much complexity and there are plenty of rulesets we could create and implement that would also not have anywhere near that amount of complexity.
So the analogy sort of falls apart there. It's still worth thinking about, though - the more complex your system of rules/laws/regulations/etc. becomes, the closer you are to a system that is mathematically guaranteed not to be airtight.
Good luck explaining that to lawmakers.
EDIT: YES, CORRECT, SORRY - I did mean to say the set of natural numbers, not the set of real numbers. Mea culpa.
That being said, saying it can't be bulletproof or watertight is too vague.
There is both a first and a second Gödel's incompleteness theorem.
The first shows that a system T which can do arithmetic has some statements that it can express, and which are 'true' , but which cannot be proven to be true by T.
The second shows that a system T which can do arithmetic cannot show that it is self consistent, unless it is not self consistent.
Neither of these seem to be a problem for smart contracts.
It is possible for a system to be self consistent. The smart contract or the system that the smart contract uses does not need to prove itself to be self consistent, so the second theorem is not a problem.
If there is some mathematical statement that can be expressed by the system that the smart contracts use, which the system cannot prove whether it is true or false, this is also not a problem. Which, Ethereum doesn't even have a proof checking thing built into it yet, so I don't see how this would be applicable.
I think that you are probably over-applying Gödel's incompleteness theorems.
Also, I don't think its so much complexity in the "wow these laws are complicated" sense, so much as "strength" in the "how many things can be talked about / shown to be true" sense.
You /might/ be able to do some weird program/proof analogy there, but I really don't think that applying it to law (by a law/program analogy) would really show all that much.
I would think that the law can be understood as being sort of like a function (these inputs result in these outputs), and a function can be both be complicated and total. The law doesn't really do much with formal proofs, as it is now anyway.
Keep in mind that there is also a Gödel's COMPLETENESS theorem.
Your general point, of course, that Godel's theorem means a specific thing, and people should stop abusing it as if it means "everything has loopholes!", remains correct.
As others have corrected that this should be naturals, I'll just also note that you can derive incompleteness just from addition and multiplication over naturals. So while you're correct that plenty of systems don't need full multiplication, you run into limitations quickly. Then you need proper theorem proving to recover the missing verification power.
Even the name "ethereum" is pretentious and showy, again anti-distributed ethos.
I don't get a strong comfort level that this organization is any better than the current central banks.
[1]: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t...
And even with Monopoly, during that game the virtual monopoly dollars hold value. Just during the timespan of the game. They give you certain privileges during that game.