Hacker News Reader

Comment by bhaak | Hacker News Reader

The way it looks like, those Ethers are quite safe.

Parity's refactoring of the official audited multi-sig contract code has fucked up again. I wonder if they even audited their code.

The post-mortem of the last incident https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/ evades that question under the paragraph "Was the wallet not audited?".

If they used a library instead of a contract, this wouldn't have been possible. I hope they had a reason to use a contract otherwise they clearly have noone else to blame this time.

View on HN

>If they used a library instead of a contract, this wouldn't have been possible.

It's actually the opposite, using a library allowed this to break all the wallets using it. However, an Ethereum "library" isn't what you'd expect a software "library" to be - it's an executable contract that just is never supposed to be executed directly. But oops, nothing prevented that from happening.

The concept of everyone using a common, well-audited contract makes sense though. Virtually all Bitcoin multisignature transactions use the same script construction and it has never been hacked, despite being much older.

For something as important as contract code, there should still have been more failsafes. Even just having a kill() on the main contract that doesn't delegate out to the library would have protected against this.

> The concept of everyone using a common, well-audited contract makes sense though.

Just Parity's contract was neither common nor well audited.

> Virtually all Bitcoin multisignature transactions use the same script construction and it has never been hacked, despite being much older.

The only multi-sig issue that I'm aware of in Bitcoin was the Bitfinex hack but I don't know in what relation BitGo's multi-sig implementation is to the standard multi-sig.

The EF multi-sig implementation has been audited and AFAIK there has also never been an issue with it.

The Bitfinex hack was due to getting enough parties of the multiparty signature to sign it (e.g. by stealing 2 out of 3 keys, or taking advantage of insufficiently secure automatic signing systems), not an issue with the contract itself.

They're very safe - per https://twitter.com/dguido/status/927896527107952640, they're stuck there forever.

> they're stuck there forever.

It's ethereum, they'll just hardfork those coins back

Apparently almost $300M stuck - I don't see them not bringing up another hard fork to retrieve them

Well, that's one way to solve the inflation problem before PoS..

Perhaps it can be fixed though, as part of the next hard fork.

Depends on how good friends the affected users are with key players in the Ethereum community...

One of the Ethereum founders (Gavin Wood) lost the proceeds from their recent ICO to this bug. So, very good friends?

Not to mention that he wrote the buggy contract...ehm, both buggy contracts, to be precise, the one that let funds be stolen and the one that now freezes funds...

Reply on news.ycombinator.com