Hacker News Reader

Comment by 1cvmask | Hacker News Reader

This is not a cyberattack hack. It is just someone cleverly exploiting loopholes. The same happened to Ethereum at launch where they had to renege on their "promise" of (not-so-)smart contracts and create a fork.

From the article:

C.R.E.A.M. was targeted by what is known as a flash loan attack. Flash loans are uncollateralized cryptocurrency loans structured so that they must be paid back instantly using smart contracts, making them attractive for things like arbitrage across exchanges. If the loan isn’t paid back, then it never happens, because both occur in the same transaction.

Analysts on social media who pored over the details of the attack suggested that the hacker exploited C.R.E.A.M. in an incredibly complex transaction for a flash loan that ultimately allowed the hacker to drain C.R.E.A.M.’s Ethereum-based lending pools, leading to a gain of around $130 million in different tokens. The attack cost the hacker roughly 9 ETH in network fees, or around $36,000.

View on HN

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes.

Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

I believe there is actually a case making its way through the courts as we speak where someone is making the case that "code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. [1]

[1] https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

>Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction.

Both are exploits. But they are not the same type of exploit.

> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed.

An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system.

The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.

You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed"

They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.

A bug implies a software defect. This however sounds like a design defect.

> They clearly did NOT intended to give the coins away.

They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor.

This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution.

This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.

I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.

The patch changed the design of the system. They obviously didn't forsee the flaw in their system but it's not like someone found a buffer overflow - they only used the levers and buttons that the system provided them to perform this 'attack'.

If u take money from an open bank door, u aint gonna be waved off with a laugh and good day. Just because u picked the lock using the mechanisms provided, doesnt mean u didnt steal the bounty.

Code is law will only lead to SkyNet.

By this logic, a buffer overrun exploit would not actually be an exploit, because it's just a pointer that goes up or down according to certain rules.

Incorrect. A buff we overrun injects new code into the system that gets executed that was never part of the original system.

This is more like setting your screensaver or debugger to cmd.exe on windows NT and waiting for an admin process to crash or the screensaver to start. (I forget exactly how it worked)

I’d compare this “exploit” to playing a coin pusher type gaming kiosk with an especially large bankroll and statistical analysis to determine optimal play strategy.

If someone chose to play such a game intending to win and with appropriate planning to ensure wins through optimal play, I wouldn’t call that an exploit at all. It’s beating the game, and the owner may ban you from playing it, but no laws were broken by you playing it in such a manner with larger than average capital. But your winnings are yours, fair and square.

The subjective element to legal interpretation is why our legal system is not purely algorithmic.

If it was, people will argue malicious compliance like you are, but intent has to be considered, both the intent of the developer and the intent of the exploiter (or loaner, is maybe a less loaded term for them)

“Someone read the rules carefully, then borrowed capital to move the rules in their favor”, you could say the same thing about an integer overflow, both are attacks of excess, with intent for massive personal gain, outside the intended use case of the system

> This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.

100% Agree you can also look up trading patterns on option expiration Fridays to see people making sure that their trades 'work out'

I'm not so sure. Contract law is complex and even if the software is considered a legal contract, the law doesn't always side with pure technicality. For example if a contract indicated that John Doe must pay me $100 for services rendered and then the time to pay up arrives and Jon claims he doesn't have to pay because the contract says John must pay. But he's not John, he's actually Jon. That isn't going to fly because the intent that Jon pay is clear.

> They clearly did NOT intended to give the coins away.

I frequently make decisions that don’t turn out as I intended. You need a distinction between whether the outcome is what you intended and whether the process is what you intended. It isn’t a clear line.

> their intended system design was obviously flawed

No, the design was so complex that its flaws were well hidden, and therefore not intended.

Quoting C. A. R. Hoare:

“There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.”

> No, the design was so complex that its flaws were well hidden, and therefore not intended.

That’s no less true for a Chrome sandbox escape.

In fact, this Ethereum loan platform’s behavior is encoded in program source codes, just like Chrome. One expects that some exploitable issues in the Chromium code arise not from syntactical but conceptual errors. The code could match a mistaken programmer intent, and this often happens.

Even if this is true, what in the world is the point of crypto platforms if courts need to step in and decide intent whenever someone doesn't like the outcome of a transaction?

> what in the world is the point of crypto platforms

Excellent question, one that crypto dudes could ask themselves a little more often.

The point is to speculate in assets hidden from the tax man while destroying the environment. So far, crypto is still living up to that promise.

It is the wet dream that some 100 line script will eventually become the only and unbiased arbiter and judge of anything in the world of finance.

You are probably reading this comment and thinking "yeah, hah, naive fools". About as naive as the fools, that believe in a 100 line program, that gives you a puzzle that nothing will realistically ever be able to solve, yet the program could tell immediately if the solution is wrong or right.

The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."

No, you can't say that about every bug. Many bugs occur in the implementation of systems, not in the design. That was not the case here. The system was implemented as designed.

It acted exactly as designed, not as intended (or they would not have patched the bug).

> In this case, the trade didn’t even violate the intended behavior of systems involved.

This is clearly a false statement. The people who set up the system did NOT intend to allow others to take $130 million for nothing.

The point was that their code did not express their intentions 100% correctly, and that's because that is quite hard to do.

Would you consider this a legal economic attack or illegal criminal attack?

That's why code is not law. Intent is law.

No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money. Accidentally killing someone can still be a crime even if you didn't intend to kill them. Intent plays a role in deciding outcomes and can influence the judgment, but intent doesn't overrule or negate law.

And that’s basically what happened here: Someone read the fine print of the trading platform and realized they could use a flash loan to push the system into a space where the trade would default and the attacker would profit. So they pressed the button and the system worked as designed.

So the way to fix this is to do what banks and stock exchanges do. Operate under a regulatory framework that has defined legal precedence to avoid someone take advantage of an unintended loophole. But at that point you are defeating the whole point of crypto being decentralized and permissionless.

bingo

Isn't the entire $GME thing an example where someone took advantage of a situation where counterparties got way out over their skis and buyers of $GME profited well in excess of any reasonable estimation of Gamestop's promise of business results via what amounts to an unintended loophole?

There is no bounded 'reasonable' estimation or expectations of how much money you can gain/lose by trading options. They are a force multiplier that can explode very spectacularly, in many different ways, and everyone involved in finance understands that.

If you want your gains/losses to be reasonably bound, you have to limit yourself to buying and selling stocks directly. Unfortunately, there's not enough money in that to make a living day-trading.

The bug that allowed that to happen has essentially been patched. (Risk analysis that didn’t take into account Robinhood giving immediate margin to any rando that signs up). Robinhood very nearly melted down, Lehman Brothers style.

No one ever entered into any agreement where they were expected to buy stocks at reasonable prices.

It is like when Kim Kardashian gets paid 50M for a 30 second add on Instagram. I may think that is unreasonable, but I don't have any contract with anyone implying that she be paid a standard actor's wage.

No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money

Intent is certainly a big part of law.

When examining classic contracts, a judge will try to also deem intent.

Contracts have been thrown out, interpreted by intent of parties.

An example, are the comments in the source code for this smart contract? Did everyone have opportunity to see them?

It could affect a court battle...

Doesn't your worldview make smart contracts pointless to begin with?

If your plan is to rely on the court system, then just rely on the court system. You can write your contract on paper; smart contracts serve no purpose whatsoever then.

Smart contracts are the executor, for example, imagine a smart will. It would hand out an estate in eth automatically upon death.

But just as in real life, an executor can make mistakes.

Traditionally, a judge may return or redistribute assets in such a case. Or claim the will was not interpreted correctly. In such cases, determining the intent of the contract is the goal of the court.

Like it or not, smart contracts are not immune to contract law, civil law, courts.

The first court cases, which will undoubtedly happen, will be very interesting.

And moreso, different legal jurisdictions will interpret things differently. If I was writing smart contracts, I'd want some sort of boilerplate, insisting upon legal jurisdiction, maybe like an open source license, but for smart contracts.

After all, once your identity is known, normal courts can compel you to do things...

IANAL, but intent definitely has a lot to do with law. https://en.wikipedia.org/wiki/Intention_(criminal_law)

How can you use an acronym like that and think people will take you seriously

> No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money.

The intent (in legal sense) was to make a specific stock trade, not to make money.

If the execution price was obviously incorrect, the trade will be voided for example.

Pretty sure intent is a very big part of contract law though, for obvious reasons. You can only enter into a contract intentionally.

Stock trades get broken all the time, and are settled in human dispute resolution. For instance, look up "outtrades".

Former criminal defense lawyer here.

Intent is literally the heart of criminal law. You have to have intended a crime for it to be a criminal act. In this context, this means that you had to intend to do things that would legally constitute a crime, even if you did not know that the actions/result would be a crime. For some crimes, specific intent is not required for all of the factors (for example, for statutory rape, you do not need to have intended or even known that the other person was underage; for many manslaughter charges you do not have to have intended to kill someone so long as you intended to do things that could reasonably have been expected to cause someone's death).

Intent is also a fundamental factor in tort law, where intentional acts can literally quadruple the amount of damages the plaintiff may receive.

And in contract law, intent is a basic foundational element of a contract. And indeed, a number of contractual disputes arise over one party intending to make money, not actually making money, and suing their counter-party as a result. And many times, the plaintiff wins...

This situation is probably governed by contract law. Since those disputes turn entirely on the specific facts proving or disproving mutual intent, it's hard to say who would win in this dispute since only a small subset of the relevant facts are publicly known.

> intent is literally the heart of criminal law

it is literally not. Though it is a requirement of some crimes.

> You have to have intended a crime for it to be a criminal act.

No, you don't, in general. You have to have intended a particular outcome if the particular crime requires that, but plenty of crimes do not have such requirements (or specifically do not apply if intent is present). E.g., “depraved heart” murder, involuntary manslaughter, and any strict liability crime or crime of negligence or recklessness.

I find this to be a complete crazy take.

Even if intent isn’t written into a specific law, the whole system is built to specifically allow intent to be considered in so many stages. Sometimes they don’t even decide to prosecute.

Laws exists specifically to create a functioning society. Laws do not exist for the sake of having laws. Any sane person enforcing any kind of rule understands this.

This take is like programmers getting angry when businesses don’t care about the quality the the code or something, forgetting that the whole reason people hire programmers is to solve business problems, not to write text on a computer. Total miss of the point of the exercise.

> Even if intent isn’t written into a specific law, the whole system is built to specifically allow intent to be considered in so many stages.

Mental state (which is much broader than intent, though intent is an aspect of it) is an important consideration for criminal law and most offenses have a required mental state (strict liability offenses are a small minority). And mental state is, yes, considered broadly beyond the formal requirements, too.

But to say that “intent is literally the heart of criminal law” is both literally false and substantively misleading.

> Accidentally killing someone can still be a crime even if you didn't intend to kill them.

Maybe, but the crime wouldn't be first degree murder.

Try googling "mens rea"; e.g.:

"A mens rea refers to the state of mind statutorily required in order to convict a particular defendant of a particular crime. See, e.g. Staples v. United States, 511 US 600 (1994). Establishing the mens rea of an offender is usually necessary to prove guilt in a criminal trial. The prosecution typically must prove beyond reasonable doubt that the defendant committed the offense with a culpable state of mind." [0]

[0] https://www.law.cornell.edu/wex/mens_rea

> > Accidentally killing someone can still be a crime even if you didn't intend to kill them.

> Maybe, but the crime wouldn't be first degree murder.

The felony murder rule disagrees.

"The felony murder rule is an exception to the normal rules of homicide."

https://www.justia.com/criminal/offenses/homicide/felony-mur...

> "The felony murder rule is an exception to the normal rules of homicide."

Whether or not one accepts that use of “normal”, it remains a rule and the claim that murder without specific intent is categorically not first degree, even in broad general terms is false (even before looking into all the variations in specific statutory schemes in the US, which really frustrate this kind of generalization, which takes common law rules and overgeneralizes the way things that are not part of the common law are mapped on to it.)

I was trying to respond to the claim that "intent is not law." Your point is valid but irrelevant. Even if intent to kill is not required in all cases to get a conviction for first degree murder, under the felony murder rule it is still necessary to prove intent to commit the original crime.

> You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money.

That's too macro. Multiple steps.

The intent of a stock trade is to exchange currency for share(s). That intent was fulfilled.

Your _desire_ was to make money, but that's not an inherent function of the stock trade.

> That's why code is not law. Intent is law.

What is a 'smart contract' in that universe and how is it different than a 'contract'?

Recourse, mostly.

I think what you mean to say is that interpretation is law. Without interpretation by some (vested) third party with power, a law can never truly be enforced.

A hack requires three things:

1. Someone locking themselves in a dark (usually smoky) room with someone in a button down shirt (with rolled up sleeves) standing over their shoulder.

2. Green text on a black background

3. The words "I'm in" yelled at some point.

Doesn't sound like any of that happened here.

If the hack is sufficiently sophisticated there should be an animated progress bar of funds being transferred.

Even better with an animation of bills flying from one account to the other in the background and/or a laughing skull on the computer of the person being hacked

Unless the person being hacked can type faster

And a computer that beeps with every keypress.

and some 90s techno blasting at background

I submitted We're In as a trope to TVTropes with Theo clickity-clicking in Die Hard as the example. But it got dinged because of the hard rule against the trope namer quoting script. So I resubmitted it as I Wasn't Before But I Sure As Hell Am Now and still no go.

Don't forget the hoodie. Gotta have a hoodie.

We also gotta figure out how to get the contents of the screen to project onto their face.

Also needs someone with a stopwatch shouting “60 seconds…50 seconds…”. Ideally a blonde with large shoulder pads, but could be the second character in item 1.

And what about the beamer replicating the screen content focused on the hacker's face?

This could be very interesting. The argument that "you put your money behind a pickable lock so you gave permission to anyone with lock-picking skills to take it" is a classic immature and self-serving understanding of the law, but in this case the system was built with the declared intention of creating a space where that logic applies.

How do you appeal to the courts after doing business under an explicit shared understanding that the courts are unnecessary and irrelevant? It will be difficult to prove that you had any expectation of the other party obeying any norms other than doing everything within its technical power to benefit from the transactions.

> in this case the system was built with the declared intention of creating a space where that logic applies

Why do you suppose this is the case? Surely that’s not in any way true.

For my part, you can't declare "we're building this outside of the bounds of the legal system, but we're going to lean on that self-same legal system when it fails".

You have to pick between outside and inside the law.

But you seem to be picking whatever is your least favorite defense of blockchain tech from Twitter and declaring that it's the only "purpose" of the whole category of technologies. This is just as preposterous as saying "locks are built with the declared intention of protecting private property without any government protection of property, therefore if someone breaks your lock and steals your stuff you can't just go to the police and expect them to help."

Which country’s court do you appeal to? Does the transaction take place where either or both parties are? Or where the server is? What if the server DB is in one country, the outward-facing API is in another, and the actual transaction API in another? Yikes.

my recollection is that illegal contracts are invalid and do not override the rule of law. you and I can sign a paper which says 'we agree not to be held accountable to US law'; but because that contract is illegal (you cannot just declare yourself to be immune to law), our subsequent actions are still accountable to US law. you could mug me the second after I sign that paper, and that would still be illegal.

If you're going to argue this, then there's no purpose on contracts or ETH

Could you not make an argument that you're merely taking people up on their offer to the letter, making the earnings essentially an expensive bug bounty?

>"code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap.

i feel that there is a case of false advertising somewhere here. The classic finance system doesn't advertise "code is law" as a feature, and thus easily claws back accidentally transferred into your account $1B. The Ethereum based crypto and the likes are heavily promoting the "code is law" feature, and thus their readiness and attempts to back off from it anytime the things not going their way suggests false advertising and intentional, at this point giving the history, misleading of the users/customers.

Wrt. the original post - it is pretty surreal, users just borrow and mint $500M-2B in a transaction. The crypto proponents tear at Fed for printing money. Yet even the Fed and WallStreet rarely do $2B flash transaction, and not on a whim by some passer-by Shmoe user. The crypto is really democratizing/distributing and multiplying the financial madness that previously was limited to the exclusive club of big money. I have hard time to see how that is any good, and the wolves of crypto look to me much worse than the wolves of the WallStreet.

The wolves of wall street know they're doing something bad and at minimum try to avoid getting caught, the wolves of crypto will tell you its fabulous medicine that'll save you from the big bad fed while simultaneously screwing you from all sides.

One definition of "hack", close to the earliest sense of the word, is "to use something in a way it was not intended when it was made". This was definitely not the way the creators of the platform intended it to be used.

Whether it qualifies underall all common senses of "hack" is debatable, but it at least qualifies under a common sense of the word.

pg has a whole article about the word.

"Ugly and imaginative solutions have something in common: they both break the rules. And there is a gradual continuum between rule breaking that's merely ugly (using duct tape to attach something to your bike) and rule breaking that is brilliantly imaginative (discarding Euclidean space)."

I think most people don't realize how easy it is to "launder" stolen crypto using various techniques.

Good article that covers the topic: https://www.ft.com/content/4169ea4b-d6d7-4a2e-bc91-480550c2f...

Sure sounds like fraud to me, but even if technically not, I’m happy to have more public examples on display for regulators to demonstrate their need for tighter regulatory authority (and legislation) around crypto.

For the Ethereum attack that's similar to the CREAM attack, are you referring to the DAO attack, or something else? Can you please share some links on that incident?

"Someone cleverly exploiting loopholes"

That's what a cyberattack hack is.

Can you provide an article about the Ethereum launch incident ?

https://en.wikipedia.org/wiki/The_DAO_(organization)

Pretty big deal at the time, there's a lot of write-ups, just google "DAO hack" [1]

[edit] tl;dr: it's the reason there's now an Ethereum Classic, and we learned that Code is Law and trustlessness only applies to grandma's savings, not Vitaliks.

[1] https://www.coindesk.com/learn/2016/06/25/understanding-the-...

The dao hack happened well after Ethereum launch

we learned that Code is Law...

Yep. Legal jargon IRL is about as close as you get IRL to "code", with roughly 1,000 years of legal development underlying common law and modern legal systems to inform a style of language that is practically its own dialect.

Quite a bit of it has developed over the centuries in an effort to eliminate potential ambiguities in things like contracts so there would be no question about how the legal instrument should be executed.

This is why, to the butt of many jokes & frustrations, legalese is so extremely verbose & dense. Eliminating ambiguities or unintentional side effects or loopholes is extremely difficult.

Code appears to be little different in this respect: Implementing code that effectively says "don't manipulate the market in a way that makes us lose $millions" is not a straightforward task.

> trustlessness only applies to grandma's savings

This is the lesson a lot of people fail to learn from watching. They seem to have to experience it.

Has anyone ever done a thorough investigation of Vitalik's possible connections to state actors?

Search for the DAO.

Let to an ETH hard fork into -> (ETH Classic - still traded, and ETH)

thanks.

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes.

Well, while the attacker did not exploit a bug inside the lending protocol code per se that person surely relied on a design flaw. Basically, what successful flash loan attacks do is to manipulate the price of an asset inside a „liquidity pool“ of a single „distributed exchange“ (DEX) temporarily to a much lower value and then buy off this asset cheaply and sell it on another DEX for profit.

To protect itself from a flash loan attack, a DEX protocol should use an external „oracle“ to determine the price of an asset instead of relying on the „in-house price“ (in lieu of a better word). C.R.E.A.M. does not seem to do this. This is clearly a flaw in its pricing model.

Can you elaborate on the initial promise of smart contracts?

Code is law? hehe

I actually think Smart Contracts have loads of potential beyond all this "number go up" stuff

Here just a few : https://intercoin.org/applications

The promise of smart contracts is "programmable money". Humans use money to interact with each other. When money becomes software, then you can create new and unique methods of transacting/interacting.

> smart contracts

This word to describe software settling monetary transactions is actually a bad choice and oversells what Ethereum actually can provide. A better term would be a financial vending machine.

On chain EVM transactions are essentially just stupid scripts that act according to the same simple, deterministic roles every time you put money into it. The end result is always either you gaining or losing money (but return some other form of “value” like a chocolate bar from a vending machine) by means of a transaction between two people that do not need to know i.e. “trust” each other.

While it certainly does not redefine civil law, a vending machine — if well designed — can enforce compliance with the law without requiring a middle man like a bank or a lawyer.

As every programmer can testify, however, even simple programs can exhibit fairly complex behavior and that’s often impossible to fully predict by static analysis alone.

Still „virtual financial vending machines“ (it’s not as catchy as “smart contracts”) have a huge potential to disrupt the banking and financial services sector.

Reply on news.ycombinator.com