Hacker News Reader

Comment by sznurek | Hacker News Reader

I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?

I seems to me that the idea behind smart contracts was to have unambiguous description of what are participants agreeing to. The "attacker" is doing precisely this - I had not heard of any bug in Ethereum implementation that is used, only "bug" in DAO's smart contract. So he is allowed to do this, by contract definition.

Isn't the whole idea of that kind of contracts worthless if people are still rolling back effects of it when "it does not what it was meant to do"?

View on HN

Obviously you're right, that's tautological! The "attacker" didn't do more than what the system allowed her to do.

People have expectations about what the DAO is and isn't. I'd guess that very few people bothered to read the source code of the contract, let alone look for vulnerabilities. So you have a group of people who have agreed on an informal contract (we pool money, votes are weighted by the sum I've put…) but it turns out that the implementation is not correct w.r.t the informal specification. That's called a software bug and abusing a bug to your own profit makes you an attacker in my book, just as much that using a flash 0-day to drop a rootkit makes you an attacker.

People should have been more careful, but hey, I'm not sure I would have.

The 'Terms' section on DAO website states:

  The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code.

Doesn't it state that, by definition, that DAO contract is bug-free, so it cannot be exploited? This is exactly what separates DAO case from flash-0-day-rootkit case.

Well, apparently it isn't.

> The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code.

Nice. So if the community ultimately succeeds in preventing the "attacker" from withdrawing his funds, which he acquired in perfect accordance with the DAO code, which is the entirety of the agreement, could he publicly bring suit for violation of contract?

I think he could, but he would be bringing a lawsuit against a decentralized community with no leader. Also, the community still has to accept the fork, if no one does (or very few), he keeps the money. At least that's how it works from my understanding.

What you call an informal contract could also be seen as an incorrect interpretation of a contract.

If you're not willing to call that simply an incorrect interpretation, you end up with two systems - software and people that push the blockchain forward - that interpret contracts differently. You also give precedence to the latter, which will lose the ability to effectively enforce its interpretation the more distributed the system becomes.

Ultimately you have to choose between having one true interpretation of contracts defined by software or being unable to enforce contracts as interpreted by a non-deterministic system.

Choose the latter and not just is there no advantage over real world systems, it's worse at enforcement.

Totally agree. Which interpretation is correct is a decision for the Ethereum community to make (or whoever is in charge, I don't know muck about the governance).

From the article: > The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be “reversed”) […] preventing the ether from being withdrawn by the attacker […]. This will later be followed up by a hard fork which will give token holders the ability to recover their ether.

We'll see how the community reacts!

It's not a bug by definition of what contracts are. A contract can't have a bug because the implementation IS the specification. That is the whole point of the system. Even the DAO website says so itself. The code itself has the ultimate say:

> Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation.

Nobody should have entered this contract if they disagree with the above. Yet now, suddenly most people who are a part of it seem to disagree with it!

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?

George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992. I think most people in the UK would be OK with describing that as an attack.

I like this analogy, but no one tried to reengineer finance or the law to prevent Soros from spending his earnings.

A better analogy is probably Thaksin Shinawatra, where the rules are very much still up in the air, and where depending who has sway in Thailand, he can expect vastly different treatment.

They can call it whatever they like- he kept his money.

"George Soros wasn't (afaik) breaking any law or contract when he drained a billion dollars from the Bank of England in 1992."

I also like this analogy. I am also reminded of the Hunt Brothers and their (successful) attempt at cornering the silver market which was then thwarted by a rules change by COMEX[1]:

"But on January 7, 1980, in response to the Hunts' accumulation, the exchange rules regarding leverage were changed, when COMEX adopted "Silver Rule 7" placing heavy restrictions on the purchase of commodities on margin. The Hunt brothers had borrowed heavily to finance their purchases, and, as the price began to fall again, dropping over 50% in just four days, they were unable to meet their obligations, causing panic in the markets."

[1] https://en.wikipedia.org/wiki/Silver_Thursday

> I have a (maybe naive) question: why is the person draining ETH from DAO called "attacker"?

It's just a philosophical distinction. Suppose someone who had never built a software program in his life, successfully got a patent for "online marketplace for smartphone apps", and then went and successfully sued random weak-looking people for uploading their apps to the google play store.

Obviously he's abusing the system, and obviously he's a parasite preying on the weak with zero moral justification, in a way that threatens the very foundation of the tech industry... But what he's doing is not illegal; he's just exploiting a flaw.

Is he an attacker?

/shrug

Depends on how you define things, but the context makes the meaning clear in this case, I think.

Welcome to real life, where that's exactly how contracts, contract law and disputes over contracts work.

I understand what you're saying and don't necessarily disagree, particularly as I don't know enough about the subject to form a strong opinion. I would intuit that one might argue the contract was in error if there's a clear indication of intent.

This argument can be made for most/all software vulnerabilities.

Most software does not constitute a contract. If I run an internet connected computer I don't enter into an agreement with anyone on the internet to use my machine even if its OS has security holes enabling this. The DAO was supposed to be a contract specifying and enforcing in a formal and automatic way what the participants can do.

I am not sure. I believe that in many cases similar activity would illegal or at least forbidden by Terms and Conditions.

I the DAO case I am not aware of any regulations or laws that the "attacker" has broken.

The DAO's 'terms and conditions' were the contract code itself. During the crowd sale, it was often said that 'investors' need to look at the code because that is the only binding agreement. I guess it turns out that's a lie too.

Could the attacker then attack DAO for breach of contract ? That would be the ultimate plot twist.

I expect the attacker either found a contract allowing them to short ether, or made some similar arrangement. Unless it's an attack on tech itself for personal reasons, someone's getting a lot of real money today...

> During the crowd sale, it was often said that 'investors' need to look at the code because that is the only binding agreement. I guess it turns out that's a lie too.

No, it turns out that that's completely true, and that's the problem.

And as such, the contract would include clauses to protect against that. If the contract did not, one of the parties likely can take advantage as they wish.

It is the same with Ethereum. If the DAO 'contract' does not include the terms, the 'lawyer' who wrote it just didn't do a very good job and it is open to taking advantage.

Reply on news.ycombinator.com