The DAO contract was neither hacked nor broken. This individual used the features and functions of the contract in unexpected ways, but ways that were legitimate nonetheless.
Broken, is an interesting choice of words, because by your very definition the DAO could never be broken it simply is whatever the code says it is, thus could never be broken.
However, as much as some people want to claim the DAO as executed is exactly what investors contracted for, it is not. The creators of the DOA solicited investment based on marketing material in plain language that was entirely inconsistent with the code of the DAO. Under the law one can't market and solicit investment based on representations that are untrue...that is fraud and but for the false representations many/if not all investors would not have invested. Moreover, it is generally not enough to include a little disclaimer at the end of the marketing material acknowledging the marketing may not be accurate and that the investors are investing at their own risk and in the DAO "as-is".
If you're using Ethereum, you're implicitly buying into the "the code is the contract" philosophy; it's 100% 'caveat emptor'.
I am no moral authority, though I certainly have my opinions. I think the moral question breaks down to the following:
1. Do I have a moral obligation to perform a contract that I entered only as a result of fraud?
Let me ask you, what if you and I enter a contract where I will pay you $10 to pull a string of my choice and you agree. After you enter the contract I show you the string and it is tied off to a trigger on a gun pointed to someones head, does the contract ethos morally override my unfair disclosure? That is obviously an extreme, but how about if you had a elderly parent who was on their death bed and I told your parent the Will makes you the sole beneficiary but it really made me the sole beneficiary, would you have a moral obligation to allow the Will/contract to stand that overrides your complaint about unfair representations?
At the end of the day, people signed up for the DAO, but the DAO as executed was not what they signed up for, no matter how much people say that is the entire point of the DAO. If it were me I would feel no moral obligation to accept my losses as if it were losses based on a legitimate investment opportunity that simply didn't perform. I think people must determine for themselves what is moral, and while keeping ones word and fulfilling contractual obligations is a moral issue, it applies to all parties (the solicitor and investor), and that is why the law doesn't permit fraud, deceptive and unfair trade practices, contracts with minors, contracts with people who lack capacity to understand them, unjust enrichment, etc...
I think this analogy is very flawed, because I could inspect the DAO code before investing in it. The string doesn't lead off-stage.
This illustrates the difficulty with rigid computer-enforced contracts. Clearly, both parties violated the intent of the contract by strict, bloody-minded adherence to its literal terms.
The cleverest, most obfuscated contract writer thus wins against everybody but the cleverest, most analytic contract disassembler.
Again, this is not an accurate analogy to the DAO contract, which I could fully inspect, and even theoretically run in a sandbox environment myself.
Your analogy is more akin to what actually happened, which is that people said, "nah, we didn't mean that", and re-tied the string to something else.
The capital markets industry has never been able to keep clever people from making a little more money for themselves at the expense of a lot of money that would otherwise have gone to investors.
At least with ETH and its future competitors, the specific sort of cleverness that is required to profit is very close to the cleverness that I now possess.
Not saying I'd put a dollar that I can pay actual bills with into ETH right now, just that it seems more approachable to me than traditional investment, barring only the low-fee index funds.
But those are plenty good enough for me right now, as I tend to shy away from games of skill where merely good players are routinely slaughtered by expert hustlers.
>Do I have a moral obligation to perform a contract that I entered only as a result of fraud?
Further, I acknowledge it is an extreme, and offered a more real world example (which coincidentally includes the opportunity for review)...I represent the contents of a Will to your parent and they sign over everything to me because I told them it would go to you, sure they were on their death bed so it was more practical to rely on my representations (DAO marketing material) than read the Will/contract (DAO code) but they had the opportunity. Also lets assume there was no separate issue of lack of capacity in this example, because the would be a separate legal defense.
What is your moral obligation?
We have no reason to think that Slock.it took the currency, or intended to (unfairly) get any share of it. Their statements look stupid but honest.
A better question would involve: "... but without me knowing, the banks simultaneously crashed, devaluing our currency so the payout is worthless ..."
The DAO executed was code. The language used to describe it is immaterial. It's code. To understand what code does, you read the code. Reading just the comments doesn't cut it.
The moral question isn't even interesting. It's irrelevant. We have exactly the same issue with existing legal contracts: if I tell you a contract is one thing, but it actually says something else, and you sign it, then you must perform the contract. It's your responsibility to read the actual contract before signing, not just listen to my description.
The only difference here is that the contract is in code not legalese. There's no moral case to answer. If you can't or won't read the contract then don't f*ing sign it!
That is actually the exact opposite of how the law works. If you enter a contract because of someones misrepresentations and you suffer damages as a direct result of those misrepresentations that is fraud and voids the contract.
I think you're talking about a retail position maybe? Or possibly there's differences between US and Australian law in this regard.
I'm not sure I see the point of having words in a contract if it can be voided because someone said something different once...
>I'm not sure I see the point of having words in a contract if it can be voided because someone said something different once...
It is not a simple as a one time statement being inconsistent with the contract, though the could be enough. Also there are many different theories of law I could pursue, but just one example:
Fraud in the Inducement[1]:
1. The defendant made an intentional action, statement, or omission
2. The misrepresentation was material to the decision to enter into a contract
3. The plaintiff reasonably relied on such misrepresentation, and
4. The plaintiff suffered some degree of injury, usually economic harm
And don't get me wrong I understand all the counter arguments as it relates to this single theory of law (but trust me there are more) which including: reliance on the marketing materials/solicitations were not reasonable because the included disclaimers to the effect the marketing materials were not accurate and the contract/code is controlling. In this case I don't think it would matter, because there is no doubt investors relied on these representations from the creators of the DAO including, the DAO was "100% safe", investments were subject to voting, there were safe guards allowing investors to "pull the plug" and get their investments back...not of that was true, was likely the reason investors invested and resulted in damages when it turned out they weren't true.
[1] http://www.legalmatch.com/law-library/article/fraudulent-ind...
An actionable pre-contractual misrepresentation occurs where a party makes a 'false representation' (orally, in writing or by conduct), the representation is one of fact (rather than a statement of opinion of law or a prediction about the future), it must be made to the other contracting party and it must induce the contract. Where established the key remedy is rescission (generally damages are not available unless the misrepresentation constitutes a tort - that is, it is also fraudulent or negligent - in which case tortious (but not contractual) damages may be available). Even where misrepresentation is established there are some limits on rescission - most significantly, if restitution is not possible the right to rescind will be lost. [1]
So yes, in this case, if the DAO contract was induced by a mis-representation of fact about the contract, then it could be rescinded.
I guess this will be an interesting aspect to Ethereum and "smart contracts" - if there is a legal right to rescind them, how does that work? Can you unwind the blockchain transactions to rescind the contract?
[1] http://www.australiancontractlaw.com/law/avoidance-misleadin...
To take a stab at your questions regarding how such a claim might play out in the U.S. Say investor A put money into the DAO, based on statements in the marketing materials (example "the DAO is 100% secure") and said funds were lost. Investor A could file a law suit in their own jurisdiction, the claims would include but not necessarily be limited to fraud in the inducement, and the parties name might include but not be limited to a) the company who owns slock.it, b) the individual(s) who wrote the code for the DAO, c) the individuals who wrote the marketing materials the investor relied on, and d) the unknown individual(s) who were responsible for writing the smart contract that appropriated the investors funds without a vote (this may sound odd, but it is a regular occurrence typically naming defendant(s) John Doe(s))
Now it is almost impossible to say how the lawsuit would actually unfold. One example, none of the parties answers the lawsuit and the investor plaintiff can obtain a default judgment. In this example, the investor/plaintiff may take the judgment against defendant #1 (company behind slock.it, which I believe is company based out of Germany) and try to have the judgement enforced in Germany. Again I can't say for certain how that would play out. Another example, could be the defendants actually answer and defend the lawsuit, in which case the investor/plaintiff must prove their case at trial (but as we know, judgement can be obtained before trial at a motion like motion for summary judgment, but that would be rare in contract cases) or more generally the parties would settle.
Now I'm just trying to give varying examples, and I can't stress enough this analysis is in no way exhaustive, the various defendants would certainly be able to raise defenses not discussed, the plaintiffs could bring claims not mentioned, and a default against John Doe(s) would be nearly impossible to enforce (unless at some point John Doe(s) identity comes to light. The major take away is the fact that the law provides remedies separate and apart from unwinding the DAO or getting the money back from the john Doe(s) who may likely never be identified.
Certainly it was the case that ethereum contacts were advertised as immutable and beyond reproach, but if you bought into that, well... you'd be making the same error you see in your ideological opponents!
It is a separate question whether ethereum contacts ought to be immutable, but that requires a different type of argument.
Sadly, the DAO had major bugs and the time to do something about them was before it launched.
It's not the end of the world, though it does place Ethereum in the category of "easily corruptible human organizations" which makes it largely ineffective for the sorts of things that made it most exciting.
Ethereum may become more distributed which would make this sort of consensus more difficult to achieve, or it may be replaced by something that has a more corruption-resistant governance structure.
The basic idea underlying the holocaust, the Iraq war, and pretty much any human atrocity is that the ends justify the means. This is exactly the argument that hard forkers made. But, much like the Iraq war, the president should not have ever had the sole discretion to launch a war, nor should such a small number of interested people have the ability to launch a hard fork.
Apologies for the hyperbole, but I think it's helpful to illustrate the core issue.
Ends justifies the means is just a fancy way of saying that the cost/benefit analysis is favorable to the decider. That is a sane decision making framework. Presumably, you just disagree with the assesment of the cost.
I think it's more accurately defined as the decider acknowledging that the costs are not something he/she would typically approve of, but the desired or touted ends are so worthwhile for everyone (as determined by the decider on behalf of everone) that it's worth doing.
In other words, an un-democratic greater good argument. It turns out that there was majority consensus among ETH miners to do a hard fork, but only after the Ethereum maintainers signaled their bias by researching and writing the hard fork code.
This is not the case. There was not a bug in the Ethereum "system", it was a bug in the Slock.it smart contract code ONLY.
The smart contract code behaved exactly as written. There is nothing to interpret. Those who invested in that smart contract invested in it as written, and failed to have it properly vetted. Think of the fraud that is possible with poorly vetted contracts... It's absurd to think that rewinding the tape is any sort of legitimate remedy for code bugs in smart contracts.
What about the plain language of the marketing materials soliciting investment that was completely inconsistent with the code of the DAO.
It happens all the time in the world outside of smart contracts, where people rely on marketing materials (say marketing a car loan for 4%, but the contract provides for a substantially higher interest rate). You can make the same argument in those cases, that the individual should have read an understood the actual contract and not relied on the marketing material, in fact, the marketing material might even include a disclaimer, but that doesn't change the fact that the individual is likely to prevail in a court of law based on causes of action including, but not limited to: fraud, fraud in the inducement, unfair trade practices, unjust enrichment, breach of contract, etc...
What makes smart contracts so special that people can falsely market them to the public and not be liable?
There's nothing unjust, you have the same rights under the contract as they do, they didn't use insider knowledge, etc.
3rd party beneficiaries of contracts get sued all the time. Just to put it into perspective, you and I enter a contract where you give me $x to invest in Y, instead of investing in Y, I just give the money to a 3rd party who may not even be mentioned in the contract, the law would most certainly allow you to go after both the third party and myself.
Unjust enrichment is a legal term or art and a cause of action, not your or my definition of unjust. Here are the elements of unjust enrichment:
(1) a benefit conferred upon a defendant by the plaintiff,
(2) the defendant’s appreciation of the benefit, and
(3) the defendant’s acceptance and retention of the benefit under circumstances that make it inequitable for the defendant to retain it without paying the value of the benefit.
In other words when the 3rd party assumes your investment funds, all elements would be satisfied, whether or not they are a party to the contract.
> under circumstances that make it inequitable [...]
But if that's what the contract clearly said, where would the injustice be?
In lotteries one person walks away with all the money so that alone isn't enough.
Said in plain english, in the same privileged voice that discussed their intentions.
They were careful to state that if the code and their wishes/statements disagreed, that the code was the authoritative answer.
The Technological-Savvy-Investor (you called them a hacker) was induced to play a code-based Nomic for real money but was then cheated out of their prize by the conniving and dishonest administrators.
Why put words in my mouth?
>They were careful to state that if the code and their wishes/statements disagreed, that the code was the authoritative answer.
It what other area of contract law are people allow to solicit investment based on false representations/marketing and hide from liability based on a disclaimer that the marketing materials may be inconsistent with the contract? I appreciate that they had the foresight to realize their code was likely to execute in unexpected ways or at least ways inconsistent with their marketing/solicitation and they made those disclaimers, but it isn't novel in law where contracts are inconsistent with marketing material (which even disclose the potential inconsistency).
The only false representations I've seen have been from the Ethereum developers: by hard-forking to change the terms of the DAO, they have misrepresented Ethereum to everyone who invested in its ICO.
EDIT: I'm more interested to know whether or not the DAO "attack vector" was placed there intentionally. Then you might be able to argue that the developers acted in bad faith.
Yes, but again this is not unique to the DAO. Moreover, it occurs all the time that marketing materials are put out with disclaimers that the marketing material is just that marketing material and that any inconsistencies between the marketing material and the contract, the contract prevails. It doesn't always make it so and there is good public policy reason why.
My analogies are always kind of shot down as it relates to the DAO, but I think they help flush out the legal reasoning. How about valeting your car, obviously there is an implied contract that you will pay the fee and get your car back (maybe even a verbal representation, "just bring the stub back and we will pull your car around") but what if the stub includes language (as they do) that you agree the valet will not be responsible for stolen property and then they don't bring your car back. Who knows who took your car? Maybe the valet, maybe the valet gave the keys to someone else, maybe someone legit broke in and stole your car without the valet being aware... even though you agreed to the contract/terms of the valet ticket it does not become a contractual right for valet to take your car, they could still be liable (potentially criminally in addition to civilly).
Moreover, representations remain false even with disclaimers acknowledging the representation may be false.
I don't deny this, and I agree in the general case. However, I haven't see any case where the DAO marketing materials did not state that the code was the terms and conditions. This was, after all, its defining feature. The marketing materials and public information were practically bragging about this, and all pointed to the contract state on the Ethereum blockchain so you could see for yourself.
> My analogies are always kind of shot down as it relates to the DAO, but I think they help flush out the legal reasoning. How about valeting your car, obviously there is an implied contract that you will pay the fee and get your car back (maybe even a verbal representation, "just bring the stub back and we will pull your car around") but what if the stub includes language (as they do) that you agree the valet will not be responsible for stolen property and then they don't bring your car back. Who knows who took your car? Maybe the valet, maybe the valet gave the keys to someone else, maybe someone legit broke in and stole your car without the valet being aware... even though you agreed to the contract/terms of the valet ticket it does not become a contractual right for valet to take your car, they could still be liable (potentially criminally in addition to civilly).
It sounds like you're getting at the officious bystander test. The thing is, when the whole community of developers and investors were going on and on about how the code is law, the answer to the question "Should the Ethereum developers intervene if the code does something we don't like?" could very easily have been answered by all parties with a resounding "NO!".
I encourage you to search through the Ethereum subreddit during the DAO's ascension, for example. You'll find cases where people were asking about what to do in this very situation, and the answer has consistently been to the effect of "whatever the code executes will be the outcome."
> Moreover, representations remain false even with disclaimers acknowledging the representation may be false.
Please point out a single case where the developers solicited investment using a false representation of the DAO. They were very clear, very open, and very loud about the fact that the code itself was the contract terms and conditions. The code is open-source as well, and lives on the Ethereum blockchain.
Honestly, I'm having a very hard time not seeing this as a bunch of investors losing money for their failure to do due diligence. Especially since the flaw that lead to the DAO's undoing was published years beforehand, in two places [1] [2]. Maybe there's a case for negligence to be made against Slock.it, but it sounded like they were otherwise clear, up-front, and honest about what it was they were soliciting investments for.
[1] https://github.com/LeastAuthority/ethereum-analyses/blob/mas...
I was replying to the wrong post. I had wanted to make it clear that we were discussing the same person.
Amusingly, I did it explicitly to avoid the OP thinking I was putting words in their mouth.
> In what other area of contract law are people allow to solicit investment based on false representations/marketing and hide from liability based on a disclaimer that the marketing materials may be inconsistent with the contract?
The "code is law" was the main point of the marketing. They repeated it constantly.
> it isn't novel in law where contracts are inconsistent with marketing material
What was the inconsistency? That their goals didn't come true?
No problem, though we clearly arrive at different conclusions, I thought we were having a interesting conversation.
>The "code is law" was the main point of the marketing. They repeated it constantly.
To be a little pedantic that is a misrepresentation as code isn't the law, "law is law", at best "code/DAO is contract" (not the marketing material). Nevertheless, I am not denying their disclosures/disclaimers all along, just that legally the contract will not supersede inconsistent representations.
>What was the inconsistency?
Just to pull some statements from the DAO white paper:
"the DAO Token Holders can elect to ‘pull the plug’ on the Contractor at anytime and for any reason. This is a major advantage as it considerably minimizes risk."
-In the case of the contract that took the funds, the token holders, were not able to pull the plug (unless you consider the fork pulling the plug, but that is what most people are complaining about, but it was the intent for token holders to have - what I will call - this contractual right).
"This standard DAO framework is simple, decentralized and 100% secure."
-Again I believe where I say the funds were not secure because they were taken, I know the other side of the coin is that funds at all times were 100% secure because they were intended to be taken since that is what the code allowed. However, why even mention 100% secure, when really what they meant was what ever happens to your funds (invested, taken without being invested, etc...) you consented to contractually.
"The first, an informal vote on whether a DAO would like to switch Curator or not. The second, a confirmation vote to give a chance to DAO Token Holders to confirm the result of the first vote, or a chance for the minority to ‘split’ their DAO into two and retain control over their ETH."
-The whole concept of voting discussed at length (not the quote I gave above) is a misrepresentation, because investor funds were taken without their vote, and the protections (above) were not actually available to the investors. Unless, again you consider the fork the protection discussed in the white paper, but we know the objections to that.
>DAOs are formed by groups of like-minded individuals with specific projects and goals in mind.
The DAO/smart contract that took investor funds didn't include specific projects with goals in mind by like minded people, it siphoned off investor funds without consent/voting on the specific proposal or the protections as included in the white paper.
Which is already an overloaded term though. Personally I'm giving gravity precedence here as a law, and CFAA only second points...
In that sense, law is a precise and reliable description of what will happen. At that, the code is law. It diagrams (though obviously not clearly) the allowed states for the system.
But, that's just semantics. We know what they meant.
> "This standard DAO framework is simple, decentralized and 100% secure."
Rofl, 0 out of 3 isn't that good... But the issue is if those are actionable. Decentralized is the only objective claim there and it's trivially wrong. The rest have no standard in law that I know of.
Anyways though, they were totally and hilariously wrong, but I don't think they misrepresented the nature of the deal.
> However, why even mention 100% secure, when really what they meant was what ever happens to your funds (invested, taken without being invested, etc...) you consented to contractually.
Well, because most of these things (human endevours) have been destroyed by theft and fraud. We've got thousands of years of being suckered into trusting people and we're still screwing that up so there isn't much hope down that path. Being screwed by a smart contract is a pleasant change. :D
I'm talking about the purported duplicity of the DAO founders. I think that they were naive, but clear in their statements. Their goal for the DAO was X, Y, and Z, but that it was enforced by code - not by their stewardship. And boy was that right.
I don't think they hid the facts from anyone.
Good point about the Nazis though. Many people forget that and fall back to legality as a defense, even still.
This is indeed an interesting question. I think the obvious answer is nothing... Nothing makes them different.
Unless they are executed in a way that makes traditional enforcement methods useless. Which jurisdiction will legal enforcement occur in? Who has the ability to reverse the outcome of the contract?
This is both the horror and the beauty of decentralized smart contracts.
The plain language marketing was that "the code is law". This was repeated many times in many ways and with cute little gifs, but most explicitly
https://web.archive.org/web/20160704190119/https://daohub.or...
"Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation. "
> What makes smart contracts so special that people can falsely market them to the public and not be liable?
This is a separate question that should be addressed.
There is absolutely no reason to type like this.
It boggles the fucking mind that they didn't run a small-scale test, with enough money to make it worthwhile for people to test the contract, but not so much that it would have created all of this drama.
Spending $10,000 to test a project that I've heard is worth $150 million seems like a no-brainer decision.
The issue was a semantic bug in the code, which was exploited by an unanticipated usage pattern. It is hard to catch this kind of error with testing, since the programmer is usually the one writing the test.
It is also (often) hard to catch subtle semantic bugs in code review too, unless the reviewer is looking for a known pattern of semantic bug.
There are some interesting things happening as a result -- formal verification, etc., but I am hoping that we end up seeing the emergence of an insurance market on smart contract behavior...
"Here's a box, it has $10,000 in it. If you break it, you get $10,000 worth of Ethereum."
Ahh. Yes, that would have been an excellent thing to do. Even a binary future on "will the DAO be hacked" would have quickly revealed (via its price) the true risk, well before the dollar figure got so high.
Even calling an SQL injection or buffer-overflow with malware payload a hack misses the point.
This is just an extreme example because there weren't invalid inputs, etc. Everything was used as intended but the intentions weren't very well thought through.