
The ethereum “hacker” didn't hack anything - js4
http://www.jsfour.com/can-you-really-hack-ethereum-smart-contracts/
======
grey-area
On the actual contract, it's possible a court would find that the contract was
between parties x and y, and therefore party z inserting themselves into it is
not valid. Often law comes down to intent, so the hacker could well find
themselves in trouble, even if technically all they did was play by the rules
allowed by the contract.

There is another interesting point here, which I think applies to Bitcoin too
- if the blockchain/smart contract is the distributed source of truth and lets
you deal with untrusted third parties without a middleman, it shouldn't
require external arbitration.

If you need external arbitration in the event of problems, which requires
verifying identity, intent, etc, why not have a central system with strong
identities and regulatory bodies in the first place and forget the distributed
system (which is slower and another point of failure), since the centralised
system is what you fall back to anyway when the distributed trust fails.

~~~
stale2002
Courts will absolutely use intent to judge contracts.

The interesting thing with the DAO though, was the explicit INTENT of the
contract, was for it to be entirely governed by the code.

As in, the announcement website, and all the marketing for the DAO included a
whole lot of lines like "None of the information here is binding. The only
thing that it binding is the code. The contract is the code".

So, it is arguable, that allowing people to exploit "bugs" in the code was
actually intended.

Of course, they didn't think there were going to be any bugs, but I bet that
if you asked the DAO people ahead of time, before the bugs were found,
something like "Hey, if I find a bug and exploit it, is that within the
contract?", then i bet that the DAO people would have said yes.

~~~
tylersmith
The intent of all smart contracts is to be exactly what the code says. That is
why they exist. For any case where you want to consider intent you should not
use smart contracts.

People using smart contracts when that's not what they really want are going
to cause damage to the ecosystem that will take years to undo.

~~~
msbarnett
The question becomes, under what circumstances would you EVER want to use a
smart contract for a non-trivial amount of money?

Since smart contracts are software, and all software has bugs, and to a first
approximation nobody is interested in having a significant amount of their
money, time, or goods erased by a software bug, of what use are these things
other than as a curiosity?

~~~
devrandomguy
They would be useful for making agreements across a large imbalance of power.
For example, if I am a one-person operation selling on Amazon, and they screw
me over in a clever way, I could not afford to fight them in court. Even if
they would have lost, I might simply be incapable of pursuing the case to the
end.

I personally would much rather use smart contracts for making deals with
employers, the overlords of the marketplaces, foreign clients, etc. Maybe it's
just because I'm a programmer, but I would rather fail because of my own bug,
than get screwed over and Nelson-laughed at by a bunch of powerful people. I
can improve my contract-coding methodology, but I can't do much about other
people's shadiness.

~~~
msbarnett
Employers, "overlords", etc with considerably more power than you are
practically by definition going to be able to spend more money finding
exploitable bugs in your code than you would be able to put into bug-proofing
it.

The odds that you can improve your contract-coding methodology to such a
degree that you write no bugs is most likely nil. You haven't been able to do
that in your non-contract code, and the stakes there are much lower.

Besides, how many mistakes will you be able to afford to learn from while
avoiding complete financial ruin?

Edit: you've also got the threat model wrong. With a traditional contract,
your only concern is the other party (your employer, say). With a "smart"
contract, you also have to worry about any 3rd party who can wander by, notice
a bug in your contract, and use it to avail themselves to your income.

You've got all the same second-party worries (my employer will use their
resources to find a way to screw me) plus a whole new 3rd party attack
surface.

------
woodandsteel
One of the problems with Ethereum smart contracts is they are trying to do
something that is basically impossible.

A contract is an explicit set of rules as to what the involved parties are
supposed to do in every relevant situation that could arise. The problem is
that in the real world it is very often simply impossible to anticipate every
possible relevant situation. That is because the real world is so complicated,
and we lack much of the needed information about what might happen in the
future.

The consequence is that in business, unanticipated situations arise all the
time where the signed contract either calls for something that would lead at
least one party to suffer, or it is not at all clear what should be done.

%99 of the time, the involved parties simply decide informally what to do. 1%
of the time one side sues, and in most of these cases the lawyers settle
before trial. And if it goes to trial, the judge decides on things like intent
and fairness that can't be clearly specified in a contract.

It is just not possible for smart contract coders to solve this problem that
experienced business people can't. And let me add that this is similar to the
problem with bugs. A bug arises when commands and/or data are encountered by
the program that the coder had not anticipated, and so the program does
something other than what is intended. It is the same basic problem of not
being able to anticipate all possible situations, and so this is why all
programs have bugs.

~~~
vit05
You are thinking about contracts in a limited and restricted way. The economy
today is about contracts, everything involves an agreement between two
parties. It is not always necessary thousands of signed pages, sometimes they
are simple things. There are thousands of standardized contracts that are
signed by thousands of people and only a small percentage of them end up in
conflict.

"IF-WHEN-THEN"

~~~
woodandsteel
I was thinking of serious business contracts, and for ongoing relations, like
Firm A agrees to deliver 1,000 widgets every month to firm B. If you talk to
an experienced business person, they will have a hundred stories about how
something unexpected happened in such cases, or large, complex business deals.

>There are thousands of standardized contracts that are signed by thousands of
people and only a small percentage of them end up in conflict.

That's because, as I explain, when something happens the contract did not
anticipate, the involved parties almost always work things out informally

For simple things done in large numbers, smart contracts might makes sense.
Except if many people are using the same contract, it is more attractive to
hackers to try to find a bug.

------
will_brown
What is with the smart contract propaganda.

Let's put everything in a legal perspective using the DAO as the example...was
what occurred there a "hack" or just a proper function of the contract which
all parties agreed?

let's assume, all things being equal, the DAO smart contract wasn't a smart
contract on the block chain but a regular contract, which included a provision
allowing any single party to unilaterally take all the investment funds of the
other parties to the contract...is that enforceable? No.

In fact with the SEC report on the DAO, we know the contract was likely an
illegal offering of a security. Therefore, the entire contract is void and
unenforceable and every party is entitled to their investment back, nothing
changes because it was a smart contract on a block chain rather than a written
contract.

~~~
IIAOPSW
>was what occurred there a "hack" or just a proper function of the contract
which all parties agreed?

both. Lawyers are just hackers of the legal system. the runtime environment is
the courtroom. The contract is the code. loopholes and technicalities are
another name for bugs.

~~~
msbarnett
This is a very naive view of the legal system.

In reality, a lawyer trying to "hack" a contract with some technicality will
run afoul of a judge telling them to sit down and shut up. Judges exist to
discern the intent behind the contract and thereby _fix_ "bugs" in the
contract that would otherwise lead to absurd, unintended outcomes.

"Loopholes" matter a hell of a lot less in real life than in episodes of Law &
Order or whatever you've been watching.

~~~
js4
> "Loopholes" matter a hell of a lot less in real life than in episodes of Law
> & Order or whatever you've been watching.

Or if you are a company trying to avoid paying taxes.

------
agotterer
This logic is the same as saying that an ATM has a software bug and if it
spits out too much money it's okay to keep it. The reason being that the
"intent" of the machine was programmed to dispense that amount of money. That
still feels like stealing to me.

I also think the author misrepresents that the only purpose of the blockchain
is to eliminate the central governing body. There are many other value
propositions and uses for the technology. Here's just a few:

\- Eliminates financial overhead and operational complexity for banking.

\- Personal information control. Like profiles or identity data.

\- Distributed network to sell things with trust

\- Access to public records

\- The author shoots down the value of ICO's. But the blockchain can offer a
significantly cheaper alternative to clearing costs for equites.

And there so much other potential...

~~~
killbrad
Computers don't lie, code doesn't lie. The idea of smart contacts is literally
that code is law. If the code is flawed, that flaw is law. As soon as you try
to wrap intent, disposition, and other legalities into the equation, how is a
"smart contract" anything unique?

~~~
js4
This was exactly my (the author) point.

~~~
agotterer
But that doesn't make ATM's or the blockchain any less useful. The technology
is still sound in both cases. But anything built by humans (I suppose machines
too?) has the potential to be flawed, especially software.

~~~
js4
There is a difference between an ATM and blockchain app though.

If an ATM spits out too much money and that violates the terms of service you
signed with the bank (or the ATM provider) the bank has a way to recover the
funds since they can rely on the legal system to enforce the terms.

The blockchain exists to enforce the validity of state changes (transactions).
There is no other value outside of that.

Thus, if you are reliant on the legal system to enforce blockchain contracts
there is no reason to have a contract on the blockchain since the only real
benefit is decentralized consensus. You are better off just rolling a few EC2
instances and writing an old fashioned contract.

------
nnfy
>When you own a cryptocurrency, you can’t really “hold it in your wallet” like
you could have a $100 bill in your physical wallet. In crypto, your wallet is
actually a key which is used to control the associated account number on the
Blockchain.

This is misleading. "Owning" cryptocurrency comes down yo controlling the
private key. Cryptos exist solely as information. The bank analogy is a poor
one because it implies that there is a single physical collection of value,
which is fundamentally opposed to the premise of a distributed ledger. I'm not
sure that the author really grasps the function and utility of Cryptos based
on this mischaracterization. I didnt read any further.

~~~
js4
You quote directly mentions a key that controls entries on the blockchain...

Moreover fiat (which banks hold) isn't backed by a central physical store of
value so the argument holds up.

------
elnygren
It seems we have some mismatch between the abstraction layer where we want to
talk about cryptocurrencies and how their actual implementation goes.

IMHO, we are venturing to the domain of lawyers; most people are not just
going to be saying computer code == what-we-agreed-here because most people
are just normal people and they couldn't care about computer code. And let's
face it, cryptos are already full of normal people, it's not for the early
nerds anymore.

However, always keep in mind that cryptos are not regulated, they are not
always too compatible with current regulation regarding normal money and they
are extremely valuable when considering the fact that they are not regulated.

~~~
ryanlol
If computer code == what-we-agreed-here isn't what you want, then you don't
want smart contracts.

~~~
Spivak
It's not really a matter of what you want, it's the legal prededent that will
be set when someone exploits a bug in a smart contract that is obviously not
part of the authors intent. Or a smart contract that was entered into by
manipulation, coercion, or violence. Or a smart contract that violates some
financial regulation or requires performing illegal activity.

The court will intervene and that will be the end of the idea that the code is
the final authority.

~~~
honestlyreally
The court can order the contract's private key to be magically willed into
existence?

The law often sees itself as onnipotent, but it stands no chance against
cryptography and unnamed contract authors.

~~~
Spivak
They don't have to. Just like encryption having the ability to use violent
force enables all sorts of side channel attacks. But in the case of an
anonymous scammer they would probably hold the Etherium Inc. responsible for
the damages.

~~~
thinkmassive
Who is Etherium Inc?

------
pkilgore
"The smart contract is the authority"

Not sure that's as clear as the article suggests (at least to the extent you
are dealing with entities within the reach of U.S. law (which is a whole
lot!)).

See my thoughts on this here:
[https://news.ycombinator.com/item?id=14820950](https://news.ycombinator.com/item?id=14820950)

~~~
pkilgore
To put this another way, though, just because I don't sanitize my database
inputs on my website, doesn't necessarily mean your SELECT * command will not
be considered a hack.

Both are exploitation of unintended behavior.

~~~
tylersmith
The difference is that strict adherence to rules as written is the entire
point of smart contracts. If you want nuance and subjective interpretation you
use Ricardian Contracts. If you absolutely need smart contracts for some
aspect they can be added to Ricardian Contract with the added benefit of
prose.

In the OpenBazaar community we call them Dumb Contracts.
[https://medium.com/@therealopenbazaar/the-case-for-dumb-
cont...](https://medium.com/@therealopenbazaar/the-case-for-dumb-
contracts-6308aa5b757)

------
ada1981
The previous owner of the $30M ought to create another smart contract that
says something to the effect of: if $15M is sent to this wallet, all rights to
press charges will be waived.

They recoop half the money and the "contract executor" can step above ground
with no worries.

~~~
msbarnett
"Pressing charges" is mostly TV nonsense. Generally speaking it's the district
prosecutor's decision, and if they have evidence to charge someone with theft
of $30M, the victim can't thwart that by "refusing to press charges".

It's not something that can be meaningfully waived (and it's not something
Etherium could enforce, anyways).

~~~
ada1981
Fair point. I do wonder if there is a legal way to say return half as I'd like
to be spared the legal battle.

------
ArchReaper
This was a waste of time to read.

------
ejanus
Is this issue Parity 1.5 related(limited) or poorly written Ethereum smart
contract ? I am a bit confused.

------
fenwick67
It will certainly be interesting to see how this plays out in court (if they
are caught).

------
basicplus2
There was no meeting of minds so contract is void

------
emilp89
Sorry, but that's bs.

------
explodingcamera
Oh come on, a blockchain isn't an improvement because you can call
lawenforcment and they'll try to catch the hacker? This was 100% illegal, even
if you consider the law article he linked.

------
yarrel
And if I use a teleportation device to move money directly out of a bank vault
no breaking and entering has occurred and therefore no theft.

~~~
tylersmith
Theft does not require burglary.

------
valuepack
It was a hack, clear as day. I really don't like this mindset of "code is law"
that has arisen by calling the code being executed on the blockchain
"contracts". I think people sometimes forget that these "smart contracts" are
just code, no different than the code running HN or any other web app. This is
a hack in the same sense that dumping a database from web app vulnerable to
SQL injection would be considered a hack. Even though the code allowed it, it
clearly isn't intended behavior.

It just seems so silly -- no system is perfectly secure; any developer can
attest to this. There is always going to be a way skirt around the smart
contract owner's intent, especially as the apps being run on the blockchain
grow in complexity. To not blatantly call this malicious activity just doesn't
sit well with me.

~~~
jacoblambda
To be fair, the whole point of "code is law" is that there is no intent beyond
the code. The developer may not intend to write bugs in their code but that
does not change the fact that they wrote it that way. This is much in the same
way that by not catching a bug, both the developer and the person accepting
the contract are equally at fault.

Now is it ethical to exploit a bug in a contract? In almost all cases the
answer is no, however that is besides the point as smart contracts are devoid
of any ethics or intent.

The whole problem with smart contracts is the mindset behind the community.
Tech circles far to often follow the mantra "move fast and break things" and
this is the issue. If smart contracts were treated like real contracts, then
this issue would be largely avoided. Who do you blame for writing a shitty
contract? The lawyer. The same should apply for smart contracts. Smart
Contracts should be written or at least reviewed by "lawyers" specializing in
smart contracts. They should be trained to be able to write contracts that are
bulletproof. If the smart contract is defective, they should be responsible
just like with normal contract lawyers. If there is a flaw in a contract,
there should be a migration strategy for addressing it.

Smart Contracts are a developing technology and an extremely powerful one at
that and as such they should be used with extreme caution but that does not
mean they are a bad idea. The whole problem is that they are being used
haphazardly and often for purposes which are far better served by a more
benign and low risk solution.

