Hacker News Reader

Comment by arcticbull | Hacker News Reader

> This is not a cyberattack hack. It is just someone cleverly exploiting loopholes.

Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

I believe there is actually a case making its way through the courts as we speak where someone is making the case that "code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap. [1]

[1] https://www.coindesk.com/tech/2021/10/22/after-stealing-16m-...

View on HN

> Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed.

An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system.

The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.

You can say about every bug (unless it is literally a bug flying inside the computer where the word comes from) "the system operated exactly as intended, but their intended system design was obviously flawed"

They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.

A bug implies a software defect. This however sounds like a design defect.

> They clearly did NOT intended to give the coins away.

They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor.

This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution.

This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.

I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.

The patch changed the design of the system. They obviously didn't forsee the flaw in their system but it's not like someone found a buffer overflow - they only used the levers and buttons that the system provided them to perform this 'attack'.

If u take money from an open bank door, u aint gonna be waved off with a laugh and good day. Just because u picked the lock using the mechanisms provided, doesnt mean u didnt steal the bounty.

Code is law will only lead to SkyNet.

By this logic, a buffer overrun exploit would not actually be an exploit, because it's just a pointer that goes up or down according to certain rules.

Incorrect. A buff we overrun injects new code into the system that gets executed that was never part of the original system.

This is more like setting your screensaver or debugger to cmd.exe on windows NT and waiting for an admin process to crash or the screensaver to start. (I forget exactly how it worked)

I’d compare this “exploit” to playing a coin pusher type gaming kiosk with an especially large bankroll and statistical analysis to determine optimal play strategy.

If someone chose to play such a game intending to win and with appropriate planning to ensure wins through optimal play, I wouldn’t call that an exploit at all. It’s beating the game, and the owner may ban you from playing it, but no laws were broken by you playing it in such a manner with larger than average capital. But your winnings are yours, fair and square.

The subjective element to legal interpretation is why our legal system is not purely algorithmic.

If it was, people will argue malicious compliance like you are, but intent has to be considered, both the intent of the developer and the intent of the exploiter (or loaner, is maybe a less loaded term for them)

“Someone read the rules carefully, then borrowed capital to move the rules in their favor”, you could say the same thing about an integer overflow, both are attacks of excess, with intent for massive personal gain, outside the intended use case of the system

> This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.

100% Agree you can also look up trading patterns on option expiration Fridays to see people making sure that their trades 'work out'

I'm not so sure. Contract law is complex and even if the software is considered a legal contract, the law doesn't always side with pure technicality. For example if a contract indicated that John Doe must pay me $100 for services rendered and then the time to pay up arrives and Jon claims he doesn't have to pay because the contract says John must pay. But he's not John, he's actually Jon. That isn't going to fly because the intent that Jon pay is clear.

> They clearly did NOT intended to give the coins away.

I frequently make decisions that don’t turn out as I intended. You need a distinction between whether the outcome is what you intended and whether the process is what you intended. It isn’t a clear line.

> their intended system design was obviously flawed

No, the design was so complex that its flaws were well hidden, and therefore not intended.

Quoting C. A. R. Hoare:

“There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.”

> No, the design was so complex that its flaws were well hidden, and therefore not intended.

That’s no less true for a Chrome sandbox escape.

In fact, this Ethereum loan platform’s behavior is encoded in program source codes, just like Chrome. One expects that some exploitable issues in the Chromium code arise not from syntactical but conceptual errors. The code could match a mistaken programmer intent, and this often happens.

Even if this is true, what in the world is the point of crypto platforms if courts need to step in and decide intent whenever someone doesn't like the outcome of a transaction?

> what in the world is the point of crypto platforms

Excellent question, one that crypto dudes could ask themselves a little more often.

The point is to speculate in assets hidden from the tax man while destroying the environment. So far, crypto is still living up to that promise.

It is the wet dream that some 100 line script will eventually become the only and unbiased arbiter and judge of anything in the world of finance.

You are probably reading this comment and thinking "yeah, hah, naive fools". About as naive as the fools, that believe in a 100 line program, that gives you a puzzle that nothing will realistically ever be able to solve, yet the program could tell immediately if the solution is wrong or right.

The difference, I think, is that builders of other systems usually don't say "We don't need law enforcement to tell our users what they can and cannot do, because what is allowed is clearly written in code, and the code triumphs everything else. That's the major selling point of our system."

No, you can't say that about every bug. Many bugs occur in the implementation of systems, not in the design. That was not the case here. The system was implemented as designed.

It acted exactly as designed, not as intended (or they would not have patched the bug).

> In this case, the trade didn’t even violate the intended behavior of systems involved.

This is clearly a false statement. The people who set up the system did NOT intend to allow others to take $130 million for nothing.

The point was that their code did not express their intentions 100% correctly, and that's because that is quite hard to do.

Would you consider this a legal economic attack or illegal criminal attack?

A hack requires three things:

1. Someone locking themselves in a dark (usually smoky) room with someone in a button down shirt (with rolled up sleeves) standing over their shoulder.

2. Green text on a black background

3. The words "I'm in" yelled at some point.

Doesn't sound like any of that happened here.

If the hack is sufficiently sophisticated there should be an animated progress bar of funds being transferred.

Even better with an animation of bills flying from one account to the other in the background and/or a laughing skull on the computer of the person being hacked

Unless the person being hacked can type faster

And a computer that beeps with every keypress.

and some 90s techno blasting at background

I submitted We're In as a trope to TVTropes with Theo clickity-clicking in Die Hard as the example. But it got dinged because of the hard rule against the trope namer quoting script. So I resubmitted it as I Wasn't Before But I Sure As Hell Am Now and still no go.

Don't forget the hoodie. Gotta have a hoodie.

We also gotta figure out how to get the contents of the screen to project onto their face.

Also needs someone with a stopwatch shouting “60 seconds…50 seconds…”. Ideally a blonde with large shoulder pads, but could be the second character in item 1.

And what about the beamer replicating the screen content focused on the hacker's face?

>Could you not use the same exact description of anyone exploiting bugs in software to gain access to a system?

Those are bypassing security restrictions. Whereas each step in this process was a legitimate & allowable crypto transaction.

Both are exploits. But they are not the same type of exploit.

This could be very interesting. The argument that "you put your money behind a pickable lock so you gave permission to anyone with lock-picking skills to take it" is a classic immature and self-serving understanding of the law, but in this case the system was built with the declared intention of creating a space where that logic applies.

How do you appeal to the courts after doing business under an explicit shared understanding that the courts are unnecessary and irrelevant? It will be difficult to prove that you had any expectation of the other party obeying any norms other than doing everything within its technical power to benefit from the transactions.

> in this case the system was built with the declared intention of creating a space where that logic applies

Why do you suppose this is the case? Surely that’s not in any way true.

For my part, you can't declare "we're building this outside of the bounds of the legal system, but we're going to lean on that self-same legal system when it fails".

You have to pick between outside and inside the law.

But you seem to be picking whatever is your least favorite defense of blockchain tech from Twitter and declaring that it's the only "purpose" of the whole category of technologies. This is just as preposterous as saying "locks are built with the declared intention of protecting private property without any government protection of property, therefore if someone breaks your lock and steals your stuff you can't just go to the police and expect them to help."

Which country’s court do you appeal to? Does the transaction take place where either or both parties are? Or where the server is? What if the server DB is in one country, the outward-facing API is in another, and the actual transaction API in another? Yikes.

my recollection is that illegal contracts are invalid and do not override the rule of law. you and I can sign a paper which says 'we agree not to be held accountable to US law'; but because that contract is illegal (you cannot just declare yourself to be immune to law), our subsequent actions are still accountable to US law. you could mug me the second after I sign that paper, and that would still be illegal.

>"code is law" is binding and should be able to keep the proceeds of his "loophole exploitation." Personally I'm with him haha. Sow -> Reap.

i feel that there is a case of false advertising somewhere here. The classic finance system doesn't advertise "code is law" as a feature, and thus easily claws back accidentally transferred into your account $1B. The Ethereum based crypto and the likes are heavily promoting the "code is law" feature, and thus their readiness and attempts to back off from it anytime the things not going their way suggests false advertising and intentional, at this point giving the history, misleading of the users/customers.

Wrt. the original post - it is pretty surreal, users just borrow and mint $500M-2B in a transaction. The crypto proponents tear at Fed for printing money. Yet even the Fed and WallStreet rarely do $2B flash transaction, and not on a whim by some passer-by Shmoe user. The crypto is really democratizing/distributing and multiplying the financial madness that previously was limited to the exclusive club of big money. I have hard time to see how that is any good, and the wolves of crypto look to me much worse than the wolves of the WallStreet.

The wolves of wall street know they're doing something bad and at minimum try to avoid getting caught, the wolves of crypto will tell you its fabulous medicine that'll save you from the big bad fed while simultaneously screwing you from all sides.

That's why code is not law. Intent is law.

No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money. Accidentally killing someone can still be a crime even if you didn't intend to kill them. Intent plays a role in deciding outcomes and can influence the judgment, but intent doesn't overrule or negate law.

And that’s basically what happened here: Someone read the fine print of the trading platform and realized they could use a flash loan to push the system into a space where the trade would default and the attacker would profit. So they pressed the button and the system worked as designed.

So the way to fix this is to do what banks and stock exchanges do. Operate under a regulatory framework that has defined legal precedence to avoid someone take advantage of an unintended loophole. But at that point you are defeating the whole point of crypto being decentralized and permissionless.

bingo

Isn't the entire $GME thing an example where someone took advantage of a situation where counterparties got way out over their skis and buyers of $GME profited well in excess of any reasonable estimation of Gamestop's promise of business results via what amounts to an unintended loophole?

There is no bounded 'reasonable' estimation or expectations of how much money you can gain/lose by trading options. They are a force multiplier that can explode very spectacularly, in many different ways, and everyone involved in finance understands that.

If you want your gains/losses to be reasonably bound, you have to limit yourself to buying and selling stocks directly. Unfortunately, there's not enough money in that to make a living day-trading.

The bug that allowed that to happen has essentially been patched. (Risk analysis that didn’t take into account Robinhood giving immediate margin to any rando that signs up). Robinhood very nearly melted down, Lehman Brothers style.

No one ever entered into any agreement where they were expected to buy stocks at reasonable prices.

It is like when Kim Kardashian gets paid 50M for a 30 second add on Instagram. I may think that is unreasonable, but I don't have any contract with anyone implying that she be paid a standard actor's wage.

No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money

Intent is certainly a big part of law.

When examining classic contracts, a judge will try to also deem intent.

Contracts have been thrown out, interpreted by intent of parties.

An example, are the comments in the source code for this smart contract? Did everyone have opportunity to see them?

It could affect a court battle...

Doesn't your worldview make smart contracts pointless to begin with?

If your plan is to rely on the court system, then just rely on the court system. You can write your contract on paper; smart contracts serve no purpose whatsoever then.

Smart contracts are the executor, for example, imagine a smart will. It would hand out an estate in eth automatically upon death.

But just as in real life, an executor can make mistakes.

Traditionally, a judge may return or redistribute assets in such a case. Or claim the will was not interpreted correctly. In such cases, determining the intent of the contract is the goal of the court.

Like it or not, smart contracts are not immune to contract law, civil law, courts.

The first court cases, which will undoubtedly happen, will be very interesting.

And moreso, different legal jurisdictions will interpret things differently. If I was writing smart contracts, I'd want some sort of boilerplate, insisting upon legal jurisdiction, maybe like an open source license, but for smart contracts.

After all, once your identity is known, normal courts can compel you to do things...

IANAL, but intent definitely has a lot to do with law. https://en.wikipedia.org/wiki/Intention_(criminal_law)

How can you use an acronym like that and think people will take you seriously

> No, intent is not law. You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money.

The intent (in legal sense) was to make a specific stock trade, not to make money.

If the execution price was obviously incorrect, the trade will be voided for example.

Pretty sure intent is a very big part of contract law though, for obvious reasons. You can only enter into a contract intentionally.

Stock trades get broken all the time, and are settled in human dispute resolution. For instance, look up "outtrades".

Former criminal defense lawyer here.

Intent is literally the heart of criminal law. You have to have intended a crime for it to be a criminal act. In this context, this means that you had to intend to do things that would legally constitute a crime, even if you did not know that the actions/result would be a crime. For some crimes, specific intent is not required for all of the factors (for example, for statutory rape, you do not need to have intended or even known that the other person was underage; for many manslaughter charges you do not have to have intended to kill someone so long as you intended to do things that could reasonably have been expected to cause someone's death).

Intent is also a fundamental factor in tort law, where intentional acts can literally quadruple the amount of damages the plaintiff may receive.

And in contract law, intent is a basic foundational element of a contract. And indeed, a number of contractual disputes arise over one party intending to make money, not actually making money, and suing their counter-party as a result. And many times, the plaintiff wins...

This situation is probably governed by contract law. Since those disputes turn entirely on the specific facts proving or disproving mutual intent, it's hard to say who would win in this dispute since only a small subset of the relevant facts are publicly known.

> intent is literally the heart of criminal law

it is literally not. Though it is a requirement of some crimes.

> You have to have intended a crime for it to be a criminal act.

No, you don't, in general. You have to have intended a particular outcome if the particular crime requires that, but plenty of crimes do not have such requirements (or specifically do not apply if intent is present). E.g., “depraved heart” murder, involuntary manslaughter, and any strict liability crime or crime of negligence or recklessness.

I find this to be a complete crazy take.

Even if intent isn’t written into a specific law, the whole system is built to specifically allow intent to be considered in so many stages. Sometimes they don’t even decide to prosecute.

Laws exists specifically to create a functioning society. Laws do not exist for the sake of having laws. Any sane person enforcing any kind of rule understands this.

This take is like programmers getting angry when businesses don’t care about the quality the the code or something, forgetting that the whole reason people hire programmers is to solve business problems, not to write text on a computer. Total miss of the point of the exercise.

> Even if intent isn’t written into a specific law, the whole system is built to specifically allow intent to be considered in so many stages.

Mental state (which is much broader than intent, though intent is an aspect of it) is an important consideration for criminal law and most offenses have a required mental state (strict liability offenses are a small minority). And mental state is, yes, considered broadly beyond the formal requirements, too.

But to say that “intent is literally the heart of criminal law” is both literally false and substantively misleading.

> Accidentally killing someone can still be a crime even if you didn't intend to kill them.

Maybe, but the crime wouldn't be first degree murder.

Try googling "mens rea"; e.g.:

"A mens rea refers to the state of mind statutorily required in order to convict a particular defendant of a particular crime. See, e.g. Staples v. United States, 511 US 600 (1994). Establishing the mens rea of an offender is usually necessary to prove guilt in a criminal trial. The prosecution typically must prove beyond reasonable doubt that the defendant committed the offense with a culpable state of mind." [0]

[0] https://www.law.cornell.edu/wex/mens_rea

> > Accidentally killing someone can still be a crime even if you didn't intend to kill them.

> Maybe, but the crime wouldn't be first degree murder.

The felony murder rule disagrees.

"The felony murder rule is an exception to the normal rules of homicide."

https://www.justia.com/criminal/offenses/homicide/felony-mur...

> "The felony murder rule is an exception to the normal rules of homicide."

Whether or not one accepts that use of “normal”, it remains a rule and the claim that murder without specific intent is categorically not first degree, even in broad general terms is false (even before looking into all the variations in specific statutory schemes in the US, which really frustrate this kind of generalization, which takes common law rules and overgeneralizes the way things that are not part of the common law are mapped on to it.)

I was trying to respond to the claim that "intent is not law." Your point is valid but irrelevant. Even if intent to kill is not required in all cases to get a conviction for first degree murder, under the felony murder rule it is still necessary to prove intent to commit the original crime.

> You can’t make a stock trade, lose money, and then sue the counter party because your intent was to make money.

That's too macro. Multiple steps.

The intent of a stock trade is to exchange currency for share(s). That intent was fulfilled.

Your _desire_ was to make money, but that's not an inherent function of the stock trade.

> That's why code is not law. Intent is law.

What is a 'smart contract' in that universe and how is it different than a 'contract'?

Recourse, mostly.

I think what you mean to say is that interpretation is law. Without interpretation by some (vested) third party with power, a law can never truly be enforced.

If you're going to argue this, then there's no purpose on contracts or ETH

Could you not make an argument that you're merely taking people up on their offer to the letter, making the earnings essentially an expensive bug bounty?

Reply on news.ycombinator.com