Hacker News Reader

Comment by maiavictor | Hacker News Reader

> where the bug had nothing to do with the Ethereum protocol itself. I don't think the two are comparable.

You're defining "bug" to fit your purposes. It wasn't "just a faulty contract". The entire protocol had a reentrancy situation that wasn't intended by any of its developers nor expected by any of its users, and that went against the expected semantics of its official programming language; it was a protocol bug, for any sensible definition. I don't see anyone neutral arguing it wasn't.

If you argue The DAO hacker had the right for the Ether he got because "that's what the code said", you could also claim the Bitcoin address had the right to claim his billions BTC, because that's what the code said back then. He only followed protocol rules and got all his money taken away by the hard fork.

View on HN

> see anyone neutral arguing it wasn't.

Well, FWIW, I've never heard _anyone_, neutral or not, claiming the DAO hack was a bug in the Ethereum protocol before now...

And that's because, well, it very clearly isn't. hackingdistributed has a good overview[0] of the coding bug in the DAO that enabled the hack which I recommended you to read.

Looking at this another way, this could've been avoided by the DAO developers if they developed the smart contract more carefully. And the exact kind of bug that lead to the hack was still possible on Ethereum following the bail-out hardfork. So how can one claim the hardfork fixed a protocol bug?

> If you argue The DAO hacker had the right for the Ether

I didn't say that. I only argued about the differences between fixing a protocol bug and bailing-out companies that build on top of the protocol.

[0] http://hackingdistributed.com/2016/06/18/analysis-of-the-dao...

> So how can one claim the hardfork fixed a protocol bug?

If I understand it, it isn't fixable without affecting every existing contract, so, the best fix was to patch the problems it caused, patch Solidity, introduce safer opcodes that avoid it, and invest heavier on security, which is exactly what was done (just see how much the EF is spending on security-related grants...)

I agree it wasn't a bug in the protocol. However, it was an issue that people in general weren't aware of, and even the official tutorial code on ethereum.org had similar vulnerabilities. For that reason I think the fork was reasonable.

By comparison, Parity's wallet bugs were just a result of carelessness, and independent audits probably would have discovered them. Consequently, the community strongly pushed back when Parity tried to get a fork for the second one.

Reply on news.ycombinator.com