The $280M Ethereum bug

blog.comae.io

30 points·kushti··13 comments

Discussion: https://news.ycombinator.com/item?id=15642856

Misleading title. This was not a bug in Ethereum, but in the code for a particular popular multi-sig wallet people use on Ethereum. I don't mean to trivialize it, but this is kind of like saying "Bitcoin was hacked" when MtGox went down.

Kinda - your point is technically true.

OTOH, Ethereum really encourages these types of bugs due to how it's setup.

These types of bugs are characteristic to things written in Solidity. So no, Ethereum didn't have a bug, it just encourages buggy programs, and this is great example.

this same logic means the internet encourages bugs

The internet does encourage bugs.

“The $280M internet bug”?

It's not an ethereum bug, it's a parity bug.

Ethereum worked exactly as coded.

Not even a bug in Parity, but in a smart contract made by the Parity team.

I dont think its fair to say a code review would have fixed this -- its an operational bug. They failed to initialise the library (ie: assigning ownership) after deploying it.

Last time the smart contract let anyone initialise it (which was a code problem).

Either way its pretty much the end of Parity. I bet those PolkaDot investors are going to be mad when their tokens are worthless!

Why didn't they choose at least pure functional language for smart contracts? Imo that would reduce the amount of dramas...

How would it have done that?

No mutable state, no objects, just one way flow of data transformation. For example https://www.fstar-lang.org

It would not have stopped this particular bug. The problem here is that the 'destructor' method was open to anyone to execute, when really it should have been restricted to the creator / owner only. They exposed a call to the public that should have been 'private'

Reply on news.ycombinator.com