The code behind the DAO is available here [2].
Apparently [3], there's a bug where one can recursively call `splitDAO` multiple times to extract ether from the contract if one has a split open.
- Ether can go missing when it is sent to a public address which has no known corresponding private key. It's a "we can't inverse a hash" type of problem.
- People lose if they're holding a long position on ETH, or have DAO which they can now no longer recoup to ETH. People gain if they're shorting ETH, or are the attacker themselves (it looks like the ETH from the dao is going to this address [4])
- Looks to be an existential threat to the DAO from where we're standing right now. I can't see any mitigations but an entire Ethereum blockchain split.
[1] https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...
[2] https://github.com/slockit/DAO/blob/develop/DAO.sol
[3] http://pastebin.com/DykumjLs
[4] http://etherscan.io/address/0x304a554a310c7e546dfe434669c628...
I looked into this a bit more, and it seems very likely that the attackers are exploiting a recursive call - from https://live.ether.camp/account/304a554a310c7e546dfe434669c6..., I can see that most of the transactions are internal, with the API reporting monotonically increasing call-depth values. It seems like there are three recursive calls involved here: one call in the DAO, a second call to transfer money to the attacker, and a third "dummy" call which appears to transfer nothing (but presumably kicks off the next recursion into the DAO).
The scary thing, to me, is that someone else could figure out the bug right now and start exploiting it - presumably, all the relevant code is open source.
At a high level, The Dao is like Pokemon. Casual observation suggests that it may be a more or less consistent world internally and that a lot of people are very excited about it. A few of those people even claim to fully understand how it works. But there's a lot of fat guys with acne blindly spending on Pokemon cards thinking it's a wise investment.
Unfortunately, the fans are so excited that they jump up and down clapping all the time and forget to breath while they're talking. This makes it very difficult to understand what they're trying to say. If you manage to understand, you will hear something like:
"Most Pokémon have only one type. However, EX Team Magma vs Team Aqua introduced Dual-type Pokémon, which have two different types. For a while, all existing dual-type cards had either Darkness or Metal as their secondary type, with the exception of certain Pokémon cards with the Dual Armor Poké-Body, such as Medicham from the EX Crystal Guardians expansion, which can have multiple types when certain energy are attached."
Now what possibly happened during the attack is that Pokemon cards are spontaneously catching fire! This is particularly troubling, because Pokemon just came out with a super-duper fire defence card and told everyone to buy it for lots and lots of money. And everybody did.
Now while all of this is clearly very troubling for heavily invested Pokemon fans. But in the grand scheme of things, well a butterfly flapped it's wings in China: there's a theoretical possibility that this affects anything, but in practice no one but fans cares.
> - How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints?
1. keep the exp you earned 2. lose some money 3. wind back at the pokemon center at the pokemon league 4. have to start over on the e4
> Who loses and who gains from an attack of this scale?
Pokemon fans, obviously.
> How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
Synchronoise when used by Pokémon like Umbreon. It deals damage to every Pokémon that shares the user's type, so in Umbreon's case it hits every Dark type Pokémon. Only it doesn't, because it's a Psychic move and always fails.
And that's fine, nothing wrong with having a hobby and being passionate about it. Not everything needs to have an impact in the grand scheme of things.
[1] https://www.reddit.com/r/ethereum/comments/4oiesu/polo_froze...
It doesn't "go missing", presumably the hacker will drain it into Bitcoin via any anonymous exchange accounts they have. Everyone loses big time (except the attacker if they manage to launder some of the coins). Watch for a wave of rebranding.
> How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
We will see. The group behind TheDAO has a lot of pull - if Ethereum successfully rejects calls for a hard fork that will damage it severely in the public's eye, but will be the ultimate proof of concept.
> How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?
Why, take a look: https://blog.slock.it/no-dao-funds-at-risk-following-the-eth...
Copied:
""" No DAO funds at risk following the Ethereum smart contract ‘recursive call’ bug discovery Our team is blessed to have Dr. Christian Reitwießner, Father of Solidity, as its Advisor. During the early development of the DAO Framework 1.1 and thanks to his guidance we were made aware of a generic vulnerability common to all Ethereum smart contracts. We promptly circumvented this so-called “recursive call vulnerability” or “race to empty” from the DAO Framework 1.1 as can be seen on line 580: // we are setting this here before the CALL() value transfer to // assure that in the case of a malicious recipient contract trying // to call executeProposal() recursively money can’t be transferred // multiple times out of the DAO p.proposalPassed = true; Three days ago this design vulnerability potential was raised in a blog post which subsequently led to the discovery of such an issue in an unrelated project, MakerDAO. This was highlighted in a reddit post, with MakerDAO being able to drain their own funds safely before the vulnerability could be exploited. Around 12 hours ago user Eththrowa on the DAOHub Forum spotted that while we had identified the vulnerability in one aspect of the DAO Framework, the existing (and deployed) DAO reward account mechanism was affected. His message and our prompt confirmation can be found here. We issued a fix immediately as part of the DAO Framework 1.1 milestone. The important takeaway from this is: as there is no ether whatsoever in the DAO’s rewards account — this is NOT an issue that is putting any DAO funds at risk today. """
From reading the article on Smart Contract security (https://blog.ethereum.org/2016/06/10/smart-contract-security...), I get the feeling that the programming model might be somewhat to blame. The "obvious" ways of implementing something are subtly broken, in ways that are very difficult to anticipate without a very deep understanding of the protocol. The programming model demands that the program be capable of calling functions that are not under the programmer's control, and which can do nearly anything. This is very, very difficult to get right, and very easy to screw up, as anyone who has tried to write a sandbox environment can attest to.
This blog post[1] from the Ethereum Team describes the possible attack.
[1]https://blog.ethereum.org/2016/06/10/smart-contract-security...
I guess if Ethereum makes a hard fork, that will damage it much more - basically, it makes the "smart" contracts unenforcable.
address.call.value(amount) and the call being synchronous
you do:
address.call.queue_value(amount) and then at the end of your contract execution it runs the asynchronous calls that have been queued
a lot of the DAO calls (all of them??) to external addresses don't need the result so having an asynchronous transfer primitive would have just solved the problem.
these external callbacks are very dangerous. for example you have function _entry_ call function _logic_ and everything is ok. then someone decides to change function _logic_ to perform an external callback and this breaks the behaviour of function _entry_. when you have this non-local side effects from changes you will create security bugs very easily.
Somewhat more specifically, I'm wondering the following:
- At a high level, what does this attack actually consist of?
- How does ethereum "go missing" in a distributed blockchain, where you can see all the transaction endpoints?
- Who loses and who gains from an attack of this scale?
- How severe could this attack be - does it pose an existential threat to The DAO (or Ethereum, more broadly)?
- How is this attack being perpetrated? Has the attack vector been previously anticipated? Why is this unexpected?