Hacker News Reader

Comment by CaliforniaKarl | Hacker News Reader

>… 3 multi-sig wallets were exploited from of a total of 596 vulnerable multi-sig wallets …

Have the owners of those exploited wallets come forward yet?

I am wondering how long it will be before a wallet developer is targeted with a civil lawsuit. In particular, looking at Parity's web site, I am seeing the noticeable size difference between this text…

> Parity is the fastest and most secure way of interacting with the Ethereum network.

(Front and center on https://parity.io/index.html)

… and this text:

>We accept no liability for your use of the software or its source code (save to the extent such liability cannot be excluded as a matter of law).

(From https://parity.io/parity.html, at the bottom of the "Sample Parity" section.)

View on HN

> Have the owners of those exploited wallets come forward yet?

Mostly all the accounts affected were of ICOs with huge funds.

The 3 particular wallets belonged to:

Swarm City (https://swarm.city) Aeternity (https://www.aeternity.com) Edgeless Casino (https://edgeless.io)

yeah claiming to be the the fastest or most secure anything is almost always bullshit

I wrote the most secure, and fastest, operating system.

It is exactly zero lines of code. ;-)

On a more serious note, I am not sure why anyone would make that claim. As noted in an above post, they absolve themselves of legal liability, but they do appear to be making a claim of fitness for purpose.

> Parity is the fastest and most secure way of interacting with the Ethereum network.

Why start from scratch and not use something like Haskell or ML? I don't understand why they're reinventing the wheel when there's a chance that millions could be stolen..

The core is written in Rust which is at least as strong as ML.

The bug was in the contract language, https://solidity.readthedocs.io/en/develop/

Strictly speaking, the bug was not in the language itself, but in a specific contract's code.

Looks like it needs some work, anyway:

https://news.ycombinator.com/item?id=14810008

The language and the underlying EVM code worked exactly as intended. The bug was in the contract written by Parity.

Is Haskell or ML 100% secure and not prone to bugs? The original multi-sig wallet code did not contain the error. It was only when Parity refactored it did they introduce the error. Sure, it would have been nice had Solidity not defaulted functions to public, but the error was the fault of a human and not the language. That said, I agree with their recommendations that functions not default to public and the use of simple contracts encapsulating complex contracts.

No, not inherently more secure, but probably more developers around who already understand the core semantics. Also, tools.

Reply on news.ycombinator.com