What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.

Jeremy Clarkson published his bank account details in his column to back up his assertion that you can send money to a bank account but not withdraw any. However apparently anybody can set up an automatic payment from any account to any other account...

Those were not legal automatic payments

This exploit wasn't legal either. It was blatantly fraud. I've asked a lawyer for their opinion and it was a very simple question to answer. Contracts are never entirely literal and usually there are implied clauses in contracts. There is a very simple test called the "officious bystander": if there had been a neutral bystander who had asked "should we allow anyone to take $50 million dollars without our consent" then unless both parties would've said "of course!" then it isn't considered to be a clause of the contract and it is just simply fraud. The developers of theDAO wouldn't have said "of course" so it's fraud.

So, you are trying to be a great libertarian by doing without the courts of law and the state but then, when everything goes wrong with your money, you call for the opinion of the courts of law and for the state to enforce that opinion.

Oh the hypocrisy.

Right I would tend to agree. They really went out of their way though to say that the "code is the contract nothing else matters" I think that is where some of the doubt comes in.

Right before the theft they would have said "off course", so sure their code was perfect... They made it abundantly clear the truth was in the code, and that men justice was an obsolete concept.

It's effectively legal because a lot of financial fraud is not pursued.

For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions.

That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract.

In the case of smart contracts, there is no recourse unless built in to the contract. This is by design.

All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods.

So if you're a good software engineer, there is potentially a huge market about to open up for you.

> It's effectively legal because a lot of financial fraud is not pursued.

That's not what "legal" means. Just like killing people without leaving traces to find you is not "effectively legal". It may simply be not worth pursuing because of gain/effort trade off.

Scamming old people isn't a bug with the bank.

It's a bug in the system though.

No it isn't. People are meant to have free control over their money. Are advocating that banks should be required to protect people from themselves?

Exactly.

Banks aren't legally exploitable.

Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.

From The DAO Terms:

The terms of The DAO Creation are set forth in the smart contract code existing on the Ethereum blockchain at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413. Nothing in this explanation of terms or in any other document or communication may modify or add any additional obligations or guarantees beyond those set forth in The DAO’s code. Any and all explanatory terms or descriptions are merely offered for educational purposes and do not supercede or modify the express terms of The DAO’s code set forth on the blockchain; to the extent you believe there to be any conflict or discrepancy between the descriptions offered here and the functionality of The DAO’s code at 0xbb9bc244d798123fde783fcc1c72d3bb8c189413, The DAO’s code controls and sets forth all terms of The DAO Creation.

Basically, the code is the only authentic version of the contract. The attacker entered this contract and used its functionality as was programmed in the blockchain, he didn't modify a bit of the code. So it seems pretty legal.

It's fraud. It doesn't pass the officious bystander test.

Yes, this would be considered fraud in the US legal system, but that's not the point.

* If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system.

* If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state.

> Yes, this would be considered fraud in the US legal system, but that's not the point.

It is the point though. It is the only point that will matter. Since the writers of the software are US citizens, it's most likely that they will get sued if the transaction is not aborted. Any scenario where the money is not returned to investors will result in the investors suing people -- no matter how much conviction people have that the DAO should be outside of the courts.

> * If you have to involve the legal system then the project has failed because the whole point was to have a contract enforcement mechanism which doesn't need a court system.

$50 million is missing, and people feel wronged as a result. I wouldn't call it a "failure of the project" that it is accountable to the law. Nobody is above the law, not even programmers that write software which governs itself.

> * If a legal system can override the smart contract then there's no point to even having one since the ultimate authority still resides with the state.

Again, nothing and nobody is above the law. You'd have to overrule the Magna Carta if you wanted to change that. And that's just not going to happen.

>$50 million is missing, and people feel wronged as a result.

So what is the plan going forward - if either party in a "smart contract" feels disadvantaged by the outcome - they go running to the law and outside jurisdictions for remedy? Isn't avoiding all that overhead the point of have a "smart contract" in the first place?

It's an interesting concept and I'd like to see the project survive (from a technology standpoint; I not risking any cash with it)... maybe it is good they did a faceplant 6 weeks in and can start answering some very hard questions that have come up.

That depends on if The DAO's terms are enforceable - it basically says the code is the terms, so essentially if the code allows it, it is permitted.

https://daohub.org/explainer.html

The banks pretty much state that their software is an approximate implementation of the contract not the real contract itself. They specify that the real contract is what their lawyers drew up as interpreted by a human judge considering hundreds of years of legal case law.

The DAO basically said screw the lawyers and case law and precedent bullshit, the contract is nothing more or less than the results of running this program on the Ethereum VM.

As the program executed a way to transfer 10s of millions of dollars and they specifically stated that the program was the contract, by The DAO no contract violation occurred, hence no hack.

Because the point (as I understand it) of this whole experiment is that they were trying to create an altcoin that used strict contracts as the basis for transactions (with no human intervention). Essentially the code is the contract, so code behavior is necessarily abiding by its contract and anything done with that code is legitimate.

No, it was fraud. I asked a lawyer, and the stealing of $50 million would not be considered a clause of the contract (it doesn't pass the officious bystander test). As much as programmers might try to remove lawyers and courts from our lives, they are vital to actually doing things with other people where you might have a difference of opinion on what a particular agreement means.

The fact it has to go to the US courts is why it's a failure.

How is not being above the law a failure of a project? If the goal of the project was to be above the law and be accountable to no-one, then the project was doomed from day one. Then again, I never bought the concept of the DAO (lawyers are incredibly important people who are undervalued in our society).

That was the goal of the project. Quote www.ethereum.org: "One of the many advantages of having a robot run your organization is that it is immune to any outside influence as it’s guaranteed to execute only what it was programmed to."

"Ethereum is a decentralized platform that runs smart contracts: applications that run exactly as programmed without any possibility of downtime, censorship, fraud or third party interference."

First of all, the "officious bystander" test is from English law, not US law.

Second, while there are similar tests in other countries' legal systems, it's not that clear cut whether this would be considered such a case or not -- a single lawyer's opinion aside.

> First of all, the "officious bystander" test is from English law, not US law.

Yeah, sorry. But as you say there are similar tests in other countries.

> it's not that clear cut whether this would be considered such a case or not

Whether it would be considered a contract, or what are you referring to? Either way, Etherium and/or the authors of the DAO will get sued, and the investors will win the suit. If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional.

And if Etherium hard forks the blockchain, then people have lost faith in the system. So IMO this won't end well for Etherium in either case.

>If you think there's a scenario where someone walks away with $50 million and nobody goes to jail as a result, I'm sorry to say that you're delusional.

Maybe you should read up on financial fraud, white collar crime and Wall Street?

As other comments say, legality and hard failure are big differentiators here, and in fact the specific language you used invokes a really key point. Emphasis added:

>You think banks aren't hacked?

There has been a lot of general description of the individual or group that performed the splitting as an "attacker" or "hacker", but the very nature of the system in question subverts the conceptual foundation of "attacking". To be an "attack" rather then a legitimate execution of an agreement, the action would have to be "illegitimate", but when legitimacy is explicitly defined by the code itself, then how can any action allowed by the code be illegitimate? It'd be a different issue entirely if the underlying VM or a system had been exploited, but merely doing as the code allowed when the code is made the agreement's authority?

Also, I've been using "agreement" here too rather then "contract" because, despite the label of "smart contract" Etherium has adopted I think there's a basic legal question about whether legally they're "contracts" at all. A contract is a subset of the space of agreements; all contracts are agreements, but not all agreements are necessarily contracts. There are many factors in determining validity of contracts and a huge body of contract law that has already been discussed a great deal, but all that depends on there being a contract at all, and for that there needs to be an agreement where the parties intend to be bound by the law (of whatever jurisdiction whose enforcement power they wish to invoke). There are many agreements where there is no intention to have legal enforceability, and in that case the courts have nothing whatsoever to say on the matter. Contract law never even enters the picture.

The DAO, and Etherium in general, have made a big deal specifically about not invoking the courts. That was supposed to be part of the entire point of smart "contracts", that they'd have nothing at all to do with any common legal system and be self-contained in and of themselves. In turn though that could mean that any smart contract that declares itself fully self-definitional is in turn not a contract period, so there cannot be an "attacker" in the legal sense.

Bank hacks in contrast aren't much different in concept from bank heists of any other kind. They are able to invoke real world power in response, and have multiple levels of fallbacks and insurance for their customers. It's by design a much softer fail, multiple level system with an expectation of occasional failure built-in and a strong human element. This adds expense and inefficiency, but provides benefits to imperfect human societies too. It came out of ages of real world experience and testing after all.

It was definitely fraud. Either it was a contract, in which case "taking $50 million without anyone's consent" doesn't pass the officious bystander test. Otherwise it wasn't a contract, so the default is still fraud (though in that case, the DAO would be the thing being defrauded rather than the investors).