Avraham Eisenberg Charged with Fraud, Market Manipulation in DeFi | Hacker News Reader

Avraham Eisenberg Charged with Fraud, Market Manipulation in DeFi

cryptobriefing.com

23 pointswslh20 comments

Kind of insane how the crypto industry keeps sweeping these hacks under the rug because "code is law".

Except that they never actually asked the law if code can be law. They just...decided among themselves. And somehow expect the law to follow along.

Personally happy that these cases are now going to court. At least we'll get some clarity on whether code can actually be the law. Or if law is ultimately, well, the law.

> Except that they never actually asked the law if code can be law. They just...decided among themselves. And somehow expect the law to follow along.

The premier smart contract platform, when they had a bug in a popular dApp, summarily forked their chain to fix it. It's almost like the popular "code is not law, the law is the law" is not a serious point.

If anything, in the "crypto industry", hacks are widely considered illegal (market manipulation like in this case, less so). The ecosystem however is purpose-built on pseudonymous bearer assets, so that the law can be the law, and the code can be fact.

It's worth noting that the indictment seems to focus on very specific technical details of how this hack happened, rather than trying to suggest that hacking smart contracts would be broadly illegal.

It seems that exploiting a smart contract in a way that doesn't involve market manipulation might still be fine, or not. Who knows?

> It’s worth noting that the indictment seems to focus on very specific technical details of how this hack happened, rather than trying to suggest that hacking smart contracts would be broadly illegal.

Indictments are about specific crimes, not broad generalities.

> It seems that exploiting a smart contract in a way that doesn’t involve market manipulation might still be fine, or not.

“Exploiting a smart contract” isn’t a specific offense, and some instances might be legal. But even if they aren’t specifically “fraud” or “market manipulation” as is charged here, they can also “theft of service”, “theft by false pretenses”, or any of a wide variety of other crimes and torts.

Yeah, my main point is that it remains far from clear as to how the government would approach a situation like the 2016 DAO hack.

>“Exploiting a smart contract” isn’t a specific offense, and some instances might be legal.

Exactly, there does not seem to be easy catch-alls here like wire fraud or unauthorized access.

Commodities fraud isn't even considered "specified unlawful activity" so they can't stack on money laundering either. Given Avraham's resources this will probably spend a few years in appeals court.

There's plenty of precedent for self-regulation, like how the MPAA ratings system was created specifically to prevent Congress from regulating movies. Congress's time is valuable (lol) so they prefer to focus on problems that won't be solved without them.

I'm all for self-regulation but you have to draw a few lines if people's money or health are being targeted.

DeFi should probably be limited to qualified investors in the US to reduce scamming.

Nah, that just perpetuates the existing system and prices out the little guy.

Legally speaking: how can you play with real vulnerabilities and be covered assuming you will return the exploited funds? I understand you can play the typical pentest contract with each one but is there another way? Probably is a naive question but I am looking to ideas around this.

Ganache, Truffle and many other Ethereum related tools allow you to simulate a sequence of transactions against a chain, meaning you're interacting with a snapshot of a live contract (albeit in a very lightweight & private local fork).

The only grey area is if you're playing 'white hat' without prior explicit authorization or consent, e.g. if something is being actively exploited and you're trying to exploit it first so 'the bad guys' don't..

Although many times people cry exploit when in fact it's just arbitrage of one kind or another and the market is being corrected...

how can you play with real vulnerabilities and be covered assuming you will return the exploited funds?

In the US you can't due to the CFAA. In practice most defi vulns don't require moving any significant amount of funds to demonstrate so the question doesn't come up. IIRC there have been one or two cases where harm was imminent and the contract owner couldn't be reached rapidly so a researcher notified the contract owner, "stole" all the coins, then returned 100% of them as soon as it could be done securely. This should be a last last resort though.

Visit https://immunefi.com if this interests you. You can set up testing environments with software like hardhat and simulate what would happen if a series of transactions were executed. To earn a bounty on immunefi (at least the larger ones) you need a proof of concept script that does just that.

> The exploiters subsequently submitted a proposal in the Mango governance forum to give back the majority of the funds … in exchange for $47 million and the promise of dropping any criminal investigation.

How were they expecting Mango to prevent a criminal investigation? Aren’t those pursued by governments?

Edit: I wonder if they meant that they wanted Mango to just not cooperate with any criminal investigation.

> How were they expecting Mango to prevent a criminal investigation?

Maybe they believe the way it is sometimes presented in TV dramas that a victim choosing not to “press charges” is actually a binding factor, rather than a complication in proof (and, in minor cases, a reduction in priority independent of the proof complication) for criminal prosecution.

> Edit: I wonder if they meant that they wanted Mango to just not cooperate with any criminal investigation.

Also not implausible.

If everybody involved in Mango says no crime was committed I would be surprised to see prosecutors bring charges. Why would a jury convict in that scenario?

If I read the article correctly, they were trying to coerce Mango into paying them and ignoring the hack. That sounds like an additional crime and not a reason to let it slide, but IANAL.

That's a good point; you could definitely argue that the agreement was made under duress.

> That’s a good point; you could definitely argue that the agreement was made under duress.

If people involved in Mango governance were defending against a claim from Eisenberg, they wouldn’t need to, because illegality would be a stronger argument.

If they were defending against criminal charges from the government for the illegal agreement, they wouldn’t be able to cite duress, because as a criminal defense, duress requires an immediate threat of death or serious bodily (not financial) harm. It’s the literal “gun to the head” defense.

Reply on news.ycombinator.com