Hacker News Reader

Comment by The_Colonel | Hacker News Reader

> Also those stored procedures are immutable, written in a language with more holes than Swiss cheese...

You're probably referencing this fuck up: https://en.wikipedia.org/wiki/The_DAO_(organization)

The huge advantage of smart contracts is that they are supposed to be trustless - you don't need to necessarily trust your business partners because contract is set in stone ... code and will be executed exactly as agreed beforehand.

In reality, you move your trust in your understanding of the code. But then when 18 000+ (probably highly technical) people investing $50 million don't spot the bug in the code, then it calls the whole "trustless" concept into question.

View on HN

You don't have to go back that far in time, 'hacks' and bugs in 'smart' contracts happen almost every day. Here's a recent $7M loss: https://cointelegraph.com/news/yield-generating-stablecoin-p... and here's a $89M loss less than a week ago: https://decrypt.co/49657/oracle-exploit-sees-100-million-liq...

It's not even the first time that the 'Compound' smart contract has been 'hacked', but that doesn't stop fools from putting more money into it again.

All these fuck ups are called 'hacks', but actually the code is working exactly as intended, it's just that there are so many ways to write smart contracts incorrectly that it's more than likely they all have hidden bugs, just waiting to be exploited.

"I'd like my investment bank to be an immutable, unfixable piece of code that's a sitting duck target for hackers"

-- nobody ever (except Ethereum ideologists)

Because no code in the financial sector has ever screwed up. Oh wait...

https://en.wikipedia.org/wiki/2010_flash_crash

Oh Oops...

https://en.wikipedia.org/wiki/Knight_Capital_Group

Exactly. Now imagine how bad it would be if the code handling this kind of money was on Ethereum where bugs are forever and failures irrevocable.

Now compare financial loss from bugs/hackers in smart contracts to financial loss from deception on the part of bankers, brokers, company execs, etc - the exact kind of fraud that's much harder to perpetrate with smart contracts. I'd wager the second number is and always will be orders of magnitude larger.

Enron alone was responsible for ~$74bn of loss.

> Now compare financial loss from bugs/hackers in smart contracts to financial loss from deception on the part of bankers, brokers, company execs, etc

But be sure, in doing so, to compare them as a share of total transactions made through smart contracts vs. the total involving 'bankers, brokers, company execs, etc.'

There's plenty of fraud going on with smart contracts and blockchains in general, and everyone knows it. In fact, it offers newer and easier ways to commit fraud. How many ICOs walked away with their investors' money? How many exchange and smart contract 'hacks' were actually insider jobs?

Just because crypto currency is a smaller market than traditional finance doesn't mean it's more honest. I'd imagine the % of fraudulent transactions in ethereum is worryingly high.

It's important to differentiate here.. fraud by deception is only partly mitigated - if some slick sales droid convinces you to dump your life savings into a dodgy ICO, that's really not all that different to what Bernie Madoff did.

The critical difference is that the smart contract lets you peek under the covers. If the contract allows for its owners to do things to your tokens, that will be plainly visible in the code, regardless of what the owner says. The owners can lie about it, but the lie can be seen by all and sundry. The creators of the token mathematically cannot do anything the contract doesn't allow them to do.

>How many ICOs walked away with their investors' money?

A sucker is born every day, this has little to do with the underlying tech though.

That doesnt sound like an $89 million loss just unexpected liquidations in loan contracts governing that amount of money

Have any ethereum "hacks" ever been prosecuted?

It seems like there would be a reasonable argument that taking value from a contract as defined by code (even if not the intention of the programmer) is not theft.

But would be very interesting to see how a court interprets this.

Reply on news.ycombinator.com