Sam Bankman-Fried's secret 'backdoor' discovered, FTX lawyer says | Hacker News Reader

Sam Bankman-Fried's secret 'backdoor' discovered, FTX lawyer says

businessinsider.com

156 pointspseudolus110 comments

Reminds me back at a certain large travel website I worked at, someone left the debug promo codes enabled in prod...

Eventually someone found the "5000off" code, and posted it to Slickdeals.

We had alarms for bookings that lost us money (especially with bundled flights), so it was found relatively quickly, but around 30 people had used it already...

Except SBF was just massive fraud, not a whoopsie doopsie.

How did they find the code? Brute force?

Probably.

    for i := 0; i <= 999999; i++ {
        code = fmt.Sprintf("%doff", i)
    }

"X% off" codes are pretty common.

I usually try random codes with the following format: COMPANYNAME15, COMPANYNAME20, etc. Every once in a while (maybe 10% of the time?) I get lucky.

WELCOME10, WELCOME20, etc also work a good amount of the time. A lot of the sign up for our mailing list and get a discount promo codes match up to WELCOME plus the percentage off.

"5000off" sounds like the discount code equivalent of "password" as a password. So probably just a wild guess as a joke but then it wasn't a joke.

> How did they find the code?

They had a MBP with a butterfly keyboard

If 5OFF worked why not try 500/5000off?

What would the "5000off" promo code do? Provide a discount by 5000 gazillion percent?

I would presume $5,000.00 off

I'd assume $5000?

Or maybe 5,000 points ($50)?

$5k off is a huge discount!

It was a debugging code so it being large isn't an issue

A QA walks into a bar, orders a beer, pays with a $5,000-off coupon.

Test passes

Maybe it was for testing the alarm

$5000 off your entire booking, down to $0.

For codebases with deployment modes, best practice may be to have a test process defined in your CI/CD to run when you spin-up prod that verifies all non-prod features are fully disabled.

Thank you for that.

You learn something new every day

At a certain shoe online retailer I worked at, we had a hard limit on the maximum discount, and it was built into the code. Not configurable, and not overridable. There were a lot of problems with that codebase, and some of those problems probably led to that particular solution, but I liked it.

The hoover free flights promotion is a good cautionary tale https://en.m.wikipedia.org/wiki/Hoover_free_flights_promotio...

Interestingly, while some are quoting a "single line of code", the article is actually using some even stranger information:

> "Mr. Wang created this back door by inserting a single number into millions of lines of code [emphasis mine] for the exchange, creating a line of credit from FTX to Alameda, to which customers did not consent," [FTX lawyer Andrew Dietderich] added. "And we know the size of that line of credit. It was $65 billion."

Absolutely lulzy to think of cranking out millionssss of lines of code in the ~2 years FTX existed.

I feel like it's safe to say the bulk of that was generated, and/or they're including all code imported as vendored dependencies

Maybe some specific accounts were hard-coded to have credit lines of certain amounts, and they just changed the one for Alameda from 0 (or whatever) to 65 billion.

Not uncommon for a startup to hack features into code directly before there's a db column and frontend to support updating values through an admin interface.

we're also basing a lot off a reporter's interpretation. Inserting a value into the database by hand would probably have similar effects and still be "programming".

This is very likely a big factor. It could very possibly just be embellishment, as well.

$65B seems oddly specific - could it be that they just set the liquidation limit for Alameda's account to 65,535 (max 16bit unsigned int), in millions of dollars?

It feels more likely that he just chose $65B rather than an exchange using unsigned 16 bit integers to do accounting.

This is FTX, remember.

This is less of a "haha FTX so dumb" and more of a "how could that possibly ever hang together for 2 years??"

Nah, seems like they'd be more likely to use floats for accounting.

Not quite the worst use for floats, bad though that would be.

I've received a few SMSes over the pandemic that used a float for their caller ID.

Not sure why the German Federal government chose to identify itself as "+4.4786E+11" when welcoming me into the country (actually me switching my UK SIM card to no-longer-Airplane-mode) and telling me to quarantine and test.

I recently recieved an email from Phillips (re CPAP recall) which said "In the meantime, your device registration confirmation number is 2.02xxxxE+15." [some digits obscurred by me, although they dropped some of the trailing digits].

a 16 bit unsigned integer with a unit of a million dollars, a very odd choice indeed

Pretty sure their whole stack was in Python

Their tech team almost exclusively came from Jane Street, wouldn’t it be OCaml?

OCaml still wouldn't have 16 bit ints.

Uint8.t ;)

Reading between the lines (and pattern matching), my interpretation is it’s likely a line that prevents balances going below zero. The number was an account number which was exempted from that particular check.

The $65B figure probably leads somewhere else and sounds like it would be counting bitcoins which peaked at over $65k per coin.

If there was some other limit that prevented his balance from falling below -$1M BTC, then Alameda “had access to” over $65B in credit (in October 2021)

> inserting a single number into millions of lines of code

So basically a clean npm install.

It must have been an existing boolean flag he set to true, allowSecret65BillionDollarBackdoor

Impressive that it was a one line code change to allow a 65b credit line. This is some office space level stuff.

Satire is dead and the last couple decades of reality killed it.

I kind of figured it was the other way around.

Every once in a while I read about some wanna be criminal mastermind that got his idea for a crime from some TV show. Maybe everything is feeding on itself and that's what the singularity actually is, humanity disappearing up its own butthole.

Logic as follows:

A) Truth is stranger than fiction.

- Golden age of streaming begets insatiable thirst for content.

3) An army of writers bangs out every ludicrous plot line imaginable.

◅ Quibi raises $2,000,000,000 to target youngsters with 10-minute quibisoides

• Movies with talking raccoons fighting space gods smash box office records

*) An AI trained on a billion monkeys with typewriters more efficiently hallucinates imagery than humans deemed possible. Prompt generated raccoons sweep oscars.

> SBF commits a 1 line change to FTX that results in 65 jillion dodge boondoggle

Somewhere a hackernews reader cackles manically in the darkness of night as he (or she!) conceives of hooking up Chat GPT to news feeds for soft real time true crime drama content generation for Netflix whilst waving goodbye to the last remnants of what was left of their sanity reading this bullshit instead of going to bed its 3am already what are you doing your brain is fried~~

(ﾟヮﾟ) A16Z invests the GDP of a small country to buy marketshare.

A Quaranteeny views a 10 second Quibi ad on TikTok for SBF: The Musical based on the novel "Git Push by SapphireAI" and gets inspired to drop out of high school and run for president.

President Comanche is sworn into office, January 20, 2029.

Yup, President Comanche timeline is in a film posing as a comedy, but which is actually a time-shifted documentary with the value of T unknown (and definitely not the stated value)...

The most unbelievable part of it is that the president would actually admit he didn't know what he was doing (and actually want to fix a situation out of genuine care) rather then double down and just have the protagonist killed in order to maintain control over whatever was left.

Or that Brawndo wouldn't have carried out a character assassination (or a genuine one) to keep sales rising for another quarter.

This is basically the plot for Accelerando but rebased onto Rule 34's having accidentally started to come true.

Maybe satire never existed, but we are only now realizing it.

The IOCCC[1] ain't got nothing on this in terms of stakes!

Though the real test is if it fails to be explained with plausible deniability.

[1]: https://www.ioccc.org/

This reminds of the book Dark Forest in the series 3 body problem

Spoiler Alert : In this book, a character invents a way to impart any belief into your mind. So if you read "water is poisonous" while in the MRI-type machine, your brain will completely believe that water is poisonous. The intention was for people to believe that they can win against the technologically superior aliens.

But the character made a one character change (+ to -) to modify the machine to make a person believe the opposite. So "humans will 100% win against aliens" became "humans will 100% lose against aliens"

Very interesting idea.

I'm guessing this "single line of code" called a function which was 9000 lines.

Regardless this is pretty damning smoking gun information if true. "uh-oh, sphaghettio"s becomes a pretty tough legal defense.

The article says “single number”, not “single line of code”.

-- ""Mr. Wang created this back door by inserting a single number into millions of lines of code for the exchange, creating a line of credit from FTX to Alameda, to which customers did not consent," - guessing it was probably a flag? --

It could be a simple boolean check, right?

If superuser? ->

It was obviously 0.0072973525693

We all know the number was 42.

Probably an array of primary key id INTs which are allowed to bypass some check function. Add Alamedas account ID, gg.

Maybe he saw Office Space one too many times.

> "uh-oh, sphaghettio"s becomes a pretty tough legal defense.

I guess if a jury is involved you don't need a legal defense, you just need to confuse the jury to the point where they can't agree on the facts. "uh-oh spaghettios" has probably worked at least once, especially if computers are involved.

def credit_limit(customer_name) return 65,000,000,000 if customer_name == "Alameda"

    # process normally

end

maybe. but there are underhanded code contests that are about submitting code that contains purposeful bugs but that aren't easily detected, and if detected, look like genuine mistakes (like off by one errors etc) rather than deliberate malicious code

see http://www.underhanded-c.org/ for the contest in C, and the one for rust is offline, but can be read here

https://web.archive.org/web/20190511070359/http://blog.commu...

Doesn't look like it: I mean sure, the entire system was many LOC, but in this case it appears accounts had automatic limits set as variables that could be overridden.

I don't see it mentioned in the article but is SBF still doing the "dumb blonde" act as though this were all an unintended accident or have his lawyers gotten him to tighten his lip?

https://sambf.substack.com/

I'm surprised how dumb SBF is throughout this entire situation.

“Dumb blonde” is not useful and such a silly stretch…I don’t think this was a good choice for a description of his actions and weakens the potential impact of your comment considerably.

babe in the woods then

I'm not using "dumb blonde" to describe what led up to the scandal, I'm using it to describe his responses to questions after the scandal.

So a description like dumb or dishonest or ignorant would seem much more accurate and useful.

I'd probably go with a phrase more like "innocent idiot" than dumb blonde. It even has alliteration, rolls off the tongue nicely in the courtroom for a jury.

You would think if you were raised by Stanford law professors, you would know the importance of staying silent and not incriminating yourself (especially on record). But I guess SBF has a superiority complex and thinks he can evade punishment if he can manipulate the right people.

Fiddling your own accounting system is not really a "back door". It's just lying.

So far that sums up this whole fraud: it's just bare faced stealing, there is no complexity or master plan...

Yes. It's surprising how dumb this whole scam was. Had nothing to do with cryptocurrency technology. It was straight theft of customer assets. Then they lost the money they stole. Probably because they were trying to double-down and win back previous trading losses.

Most crypto scams are better run than this. They get people to buy some crap asset, take a slice of the profits, the asset tanks, and the promoters keep their cut. Axie Infinity and Yuga Labs come to mind.

It seems insane that they'd let the limit be that high ($65B) but it's really quite reasonable when you look at it from the POV of already performing fraudulent activities. Once you're in the $100M-$500M range of theft, do you really care, does it really register morally/ethically (to the thief), if you bump that up to $65B?

Guess: it's a number in a database field not "code"... :P

“I wanted to get rich not because I loved money, but because I wanted to donate it to charity.” - SBF, notable EA

When you realize charities are mostly political it makes more sense.

yahoo news non-pw version https://finance.yahoo.com/news/sam-bankman-frieds-trading-fi...

Have they punished the total number of customer deposits? They keep saying they found $x billion in assets. But no mention of the liabilities or the delta between the two.

The short answer is they don’t know. FTX’s current management is having to rebuild customer accounts by hand because they don’t trust the books https://www.wsj.com/articles/ftx-says-it-has-located-more-th...

If this is true like the lawyer says, then it's the end of the line for our Sammy..

I don't see how he can pull some miracle to avoid less than 40 years.

I want to know what the “single line of code” was

`if (account["user_id"] === session.user.id || session.user.username === "sbf") {`

If his login username is `sbf`, the second condition would never be hit. Maybe you meant to write `&&`?

Huh? (false || true) === true

My point is that (true || true) === true

(true || true) is the front door; (false || true) is the back door

Why would he use something other than sbf as his primary account?

The joke is that he is spending money from other people's accounts.

No, the first conditional checks if the logged-in user is allowed to access the account by ensuring that the the user and account match.

OR, if the user is sbf, they always have access regardless of which account it is.

That said this wouldn't really set up a line of credit but it is a way to give one user access to everyone's stuff.

My point is that the first check would be true because the user is already sbf.

Assuming he’s using his own account.

The joke is he was using all the accounts.

The premise is he's accessing other users accounts. "If the account being accessed belongs to the logged in user, or the logged in user is sbf."

The first comparison is checking the ID so the rightful owner has access. The second comparison (unless it's been edited since you posted your comment) is checking the username against 'sbf'.

An if that bypasses the check of whether to issue a margin call if your userid is that of Alameda's. Obviously.

if user == 'SBF'; model = TestModelDoNotUse

But seriously, I would love to know too. It really could be as simple as allowing a certain account "unlimited" credit, as the article suggests. I only have reservations since it seems like a bit of a game of telephone and sometimes journalists go for the sensational vs simple.

`if user.id == 1`

UPDATE accounts SET creditLimit = 65000000000 WHERE accountHolder = "alameda"

Sudo

Aside: that has to be one of the most confusing and dark patterny cookie consent pop up I’ve seen in a while.

Wow. That 3rd party providers list is so long they implemented a search box for it.

https://web.archive.org/web/20220922164619/https://www.sequo...

Perhaps that one number was a blockchain address or account number?

SBF may have made mistakes or even committed fraud, but it is concerning that bankruptcy attorney does not seem to focus on recovering the value of the assets.

If FTX US was liquid, this action has brought down another company...

I assume they’re being honest about the value of the company. They’re not “lowering” it. The company is worth whatever a potential buyer is willing to pay for it. And whatever that number is, I can’t imagine it’s meaningfully different from “$0”.

I’m talking about the brand and the technology, not the assets that need to be distributed to creditors.

The alternative here is if the lawyers found the back door, and decided to keep it secret. That’s not ethical IMO.

I thought Matt Levine's take in Wednesday's Money Stuff was insightful:

> If you go around talking up the value of the FTX’s business and its tokens, you might be able to talk someone into paying a lot of money for them; maybe not now but perhaps in November. If you go around talking down the value of FTX — if you make statements about how poorly it was run and how much fraud it did — then that value will tend to zero, and you won’t be able to sell it.

> At some level Bankman-Fried is surely right that if he had remained CEO of FTX, instead of stepping down and being replaced by Ray, he would have had a better chance — though still quite slim — of selling FTX’s business and tokens for more money, and thus raising more money for FTX’s customers. If you want to sell that business, you have to say that it’s good.

> It’s just that, you know, if FTX was a fraud, he would have been getting that money for customers by doing more fraud? Like if Ray is right that FTX was a fraudulent mess, then he shouldn’t be trying to sell it to investors for a lot of money, since that would itself be fraud.

if a secret back door is not fraud I don't know what is

Reply on news.ycombinator.com