Hacker News Reader

Comment by paulpauper | Hacker News Reader

yes this. Crypto bug bounties are way too small given the stakes. $30k and bragging rights is not as enticing as $30 + million instant. A bug that allows some possible code execution if a dozen improbable conditions are met would be worth disclosing for $30k, but the if you're talking tens of hundreds millions for the taking right now literally with a single tx, then you need to do better than that.

View on HN

I'm somewhat sympathetic to this view but I don't think it's consistent. If your bank gets hacked due to a flaw in the code and millions get stolen, why would you not apply the same code is law principle?

Because the bank's relationship with its customers, central banks, and society as a whole, is codified in law and not in code. So if you find a legal loophole that's different from hacking the bank to get something the legal system doesn't entitle you to. When the code is the law, a hack is a loophole.

There seems to be an ongoing misimpression here that code is, in fact, law, as though our existing legal system doesn’t have something to say about that.

Cryptocurrencies and smart contracts exist within our society as well, they're not subject to an alternative reality.

They're only barely being subject to society's laws though I think is the point.

Because a bank's code is not the law. Banks handle actual money, for which there is a thousand year history of common law for settling disputes of ownership, debt, theft, collection practices, and insurance.

Isn't the case here that the attacker was playing by the "rules" but found a loophoole?

I think it is consistent, banks are built on legal frameworks. If you so chose to, and you were in certain countries, you could "hack" the legal system to steal the money yourself [1] and it would be perfectly 'legal'.

[1] https://www.newyorker.com/magazine/2018/08/20/how-bill-browd...

Reply on news.ycombinator.com