Hacker News Reader

Comment by Retric | Hacker News Reader

How many major bugs in software and especially cryptosystems went undisclosed for decades?

The core issue is the inherent asymmetry where 1 person finding 1 bug can destabilize giant systems. Even if these systems where hundreds of years old that doesn’t actually mean much.

View on HN

How many bugs had a direct financial return in the same way? If you found a bug in maker (or any of the other big contracts) today, you can walk away with billions of dollars worth of coins, that's a huge sum.

Major bugs in smart contracts can cause the system to stop working rather than handing anyone billions. As such people can discover such issues without disclosing them in much the way infrastructure can be vulnerable without people damaging it.

The Parity wallet bug from 2017 is the classic example so far, where someone who was just messing around with the smart contract 'accidentally' locked up $280m in assets[1]. I've linked to the GitHub thread below...this person didn't get anything from the exploit, and it wasn't for street cred (they deleted their account).

https://github.com/openethereum/parity-ethereum/issues/6995#...

https://www.cnbc.com/2017/11/08/accidental-bug-may-have-froz...

Even being able to grind a smart contract to a halt would be very profitable if you shorted it right beforehand.

Even then you are limited things to people who are willing to break the law and have a giant sign pointing them as a likely culprit.

I mean people short crypto all the time, averaged over a long enough period of time long/short ratios are roughly ~50/50 [1]. It's normal market behavior. And if you're shorting one of the big ones, you can most likely do it on defi without even providing a name.

1: https://www.bybt.com/LongShortRatio

Let’s assume something like 100 people have very large* short positions on a system that goes down. Dropping the possibility from X,000,000,000 to 100 is quite a big deal.

*very large being required for significant money to be at stake, making say 10k illegally from a short is hardly going to inspire a lot of effort.

Yeah, the classic example is the original binary search algorithm. It had an overflow bug that went undetected for two decades: https://thebittheories.com/the-curious-case-of-binary-search...

It's an incredibly simple algorithm and still got missed. Smart contracts have no chance.

There was not $Billions to be paid out for finding that - it's a matter of incentives.

Not every way to break a smart contract results in a major payout.

How often was that bug actually hit in production? How many people are allocating arrays of size 2*31? A bug is less likely to be caught if it's not exploitable.

By this logic most e-commerce is a mistake as well, since a serious flaw in the linux kernel could take down most web servers.

Nah, that's governed by contracts, law and enforced by the police. That money tends to be traceable and recoverable.

Credit card transactions are reversible, that means such flaws can be considered a cost of doing business rather than permanently destroying anything.

With ecommerce the worst you can do as a seller is take out as much money as the credit limit on the card. Which for most people is in the low thousands.

With smart contracts the liability upside is orders of magnitude higher.

Reply on news.ycombinator.com