News for hackers. Stuff that matters.
Re:Missing line in a smart contract leads to $10M hack by timoth3y on Sunday May 16, 2021 @05:56PM (#27177377)
> so where does one draw the line between theft and just doing what the code allows?

This is the heart of the problem with smart contracts. The theory is that the code is the law. There is no theft. There is no need to trust, authority, or arbitration.

Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

Re:Missing line in a smart contract leads to $10M hack by missblit on Sunday May 16, 2021 @07:39PM (#27178338)
It also only works if the smart contract is a legal contract, which is something that gets hashed out in court, not in code review.

Some cryptocurrency enthusiasts seem to think declaring "code is law" actually makes it so while this is pretty far from the truth.

Re:Missing line in a smart contract leads to $10M hack by judge2020 on Monday May 17, 2021 @01:22AM (#27180299)
Code is law applies at least to the flow of money - unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions, both due to the anonymity and cryptographic parts of the concept. Of course, they could simply throw you in jail (civil contempt of court), but you still keep your money in that scenario.
Re:Missing line in a smart contract leads to $10M hack by elcomet on Monday May 17, 2021 @02:24AM (#27180561)
They can order you to give back the money.

And like in real life, you can refuse to tell where the money is hidden.

Re:Missing line in a smart contract leads to $10M hack by thaumasiotes on Monday May 17, 2021 @03:26AM (#27180856)
Also like in real life, you might have spent the money.
Re:Missing line in a smart contract leads to $10M hack by lobocinza on Monday May 17, 2021 @04:40PM (#27188168)
Or lost it day trading.
Re:Missing line in a smart contract leads to $10M hack by thatjamesdude on Monday May 17, 2021 @04:16AM (#27181130)
Comments like this make me think we software engineers live in a different world.

>unlike USD, the court can’t do something like garnish your wages to pay back a 10M settlement by taking some crypto out of your incoming transactions

You think so, do you? "The law is the because that's what the law says it is". It might not be possible now (and I'm not sure I believe that, you can garnish foreign wages) but it will be if the need arises.

"But the code" yeah, no, that's a silly argument that only applies to cyberspace and not the physical world you occupy

Re:Missing line in a smart contract leads to $10M hack by judge2020 on Monday May 17, 2021 @10:09AM (#27183589)
It's 'legally' possible in that the court can say that you have to pay back some amount of crypto or some amount of USD, but with crypto it's not something that they can enforce in reality if the debtor doesn't cooperate. I'm saying the court can't force incoming transactions to be 60/40 split with 40% going to a different party, and the anonymity part of crypto means you can create a new wallet whenever you want to get paid without the court even knowing that you are receiving crypto as payment.
Re:Missing line in a smart contract leads to $10M hack by dragonwriter on Tuesday May 18, 2021 @10:10PM (#27203772)
> and the anonymity part of crypto means you can create a new wallet whenever you want to get paid without the court even knowing that you are receiving crypto as payment.

Yeah, and if you get paid in cash you can keep it secret to.

OTOH, if your lifestyle reveals you have access go and are spending funds and not making required payments, courts can impose other consequences, up to and including imprisonment. But usually, seizing and selling off physical or reachable intangible property would be the first way to handle monetary debts. And, sure, crypto itself may be easy to conceal, but if you can’t use it to acquire anything tangible without sacrificing the safety, is it really usefully safe?

Re:Missing line in a smart contract leads to $10M hack by dools on Tuesday May 18, 2021 @10:04PM (#27203746)
Didn't the US government just drain the crypto accounts of some online hacker collective that ransomwared that petrol pipeline?

Also the verb is "garnisheed". They're not putting parsely on it :)

Re:Missing line in a smart contract leads to $10M hack by dragonwriter on Tuesday May 18, 2021 @10:07PM (#27203755)
> Also the verb is "garnisheed".

No, its “garnish”, past-tense “garnished”.

> They're not putting parsely on it :)

No, but its the exact same verb, just a different sense.

Re:Missing line in a smart contract leads to $10M hack by dools on Thursday May 20, 2021 @03:15AM (#27218306)
No it's not, the word is garnishee
Re:Missing line in a smart contract leads to $10M hack by dragonwriter on Thursday May 20, 2021 @03:33AM (#27218422)
“garnishee” is the noun for the person subject to the garnishment (that is, the person owing/controlling money to/of the debtor whose held funds or payments are redirected from the debtor to the creditor); the verb for imposing the garnishment is “garnish”, and in the past tense “garnished” not “garnisheed”.

https://www.law.cornell.edu/wex/garnishee

Re:Missing line in a smart contract leads to $10M hack by bryanrasmussen on Monday May 17, 2021 @01:55AM (#27180443)
my reading of the code is law idea is that the code determines what is possible in the system, in this theory you can say that the law which code represents in more ironclad than most laws (at least common law) however this reading, which I thought was the default one, does not take into account bugs occurring in code or that people may not have thought rigorously enough to prevent people from doing not what the law intends but also what the code allows.
Re:Missing line in a smart contract leads to $10M hack by mondoveneziano on Sunday May 16, 2021 @06:13PM (#27177520)
That's not enough, all parties would have to have 100% awareness and understanding of the smart contract, detail by detail.

Real life contracts sometimes turn out to have non-enforceable clauses within our legal framework, or may be entirely invalid if, for example, signed under pressure or false pretense.

Re:Missing line in a smart contract leads to $10M hack by adflux on Sunday May 16, 2021 @06:33PM (#27177662)
And a judge will decide whether the contract was signed under duress. Who will judge smart contracts?
Re:Missing line in a smart contract leads to $10M hack by rtpg on Sunday May 16, 2021 @09:18PM (#27179051)
A judge! A judge can just claim jursidiction!

Imagine if Goldman Sachs did this. A judge can say "look, you can follow our rules or we start seizing assets etc".

And when you're sitting around trying to be anonymous, well... you're doing everything on a public ledger, so now you're extremely restricted.

Hell, courts/legislative bodies could even go down the "force all miners within their jurisdiction to rollback an unwanted transaction". You think miners care enough to make a stand on this kind of stuff?

Unless you're going to like.... download your consciousness onto the blockchain you are still just as liable to being told by a court what to do as anything else.

Re:Missing line in a smart contract leads to $10M hack by stjohnswarts on Sunday May 16, 2021 @09:53PM (#27179285)
Well if you don't know who the person who got the money is then there's not much a judge can do.
Re:Missing line in a smart contract leads to $10M hack by crooked-v on Sunday May 16, 2021 @10:21PM (#27179466)
Judges have tremendous amounts of discretionary power when carrying out the law, and a good judge certainly isn't going to just give up because the identity of one party isn't immediately known. The example already given of ordering that the transaction be reversed on the network (even if that involves compelling uninvolved people to cooperate with the process) is entirely plausible.
Re:Missing line in a smart contract leads to $10M hack by arilotter on Sunday May 16, 2021 @10:27PM (#27179509)
Are judges going to manage to identify and compel enough miners (or devs, i guess, assuming the miners adopt the compelled transaction revert version) to have enough hash power to win a fork?
Re:Missing line in a smart contract leads to $10M hack by rtpg on Sunday May 16, 2021 @11:15PM (#27179745)
this could easily be combined with legislation providing tools to make it harder and harder to participate in mining off-fork.

US financial laws have been very useful for the gov't to be able to de facto give it worldwide jurisdiction in some areas, I think there would be relatively few qualms about continuing down this path. Especially if (for example) Robinhood and Coinbase were forced to follow along. At one point the "blessed" thing will become the only place you can really operate.

Re:Missing line in a smart contract leads to $10M hack by stickfigure on Monday May 17, 2021 @06:21AM (#27181902)
This would require an incredible amount of international cooperation. It might be possible, but I doubt it likely.
Re:Missing line in a smart contract leads to $10M hack by pornel on Monday May 17, 2021 @06:22AM (#27181914)
For example, the court could declare that this transaction was illegal, and anything spent from it is also illegal forever. The ledger is open, so courts can compel exchanges to watch for such transactions and report anyone that can spend coins derived from them (exchanges have already been forced to comply with KYC).

This would destroy the real-world value of this block, basically making it a digital equivalent of dirty money.

Re:Missing line in a smart contract leads to $10M hack by ryanmentor on Sunday May 16, 2021 @07:09PM (#27178059)
Kleros Digital Courts, if their story holds through.
Re:Missing line in a smart contract leads to $10M hack by ArchD on Sunday May 16, 2021 @10:27PM (#27179503)
The power of the court to 'right' the 'wrong' (e.g. by reversing transactions) is limited on a decentralized public blockchain governed by pure code that crosses national borders. This strengthens the position "the code is the law".

On the other hand, this feature is a motivation for centralists to take issues with public decentralized blockchains.

Re:Missing line in a smart contract leads to $10M hack by crooked-v on Sunday May 16, 2021 @10:45PM (#27179600)
Except it's not, really, because a judge who's unhappy at it isn't going to care about "the code is the law" talk. They're just going to tell people to fix it or else, and all being in another country usually means is that the asset seizures will take longer.
Re:Missing line in a smart contract leads to $10M hack by bryanrasmussen on Monday May 17, 2021 @01:59AM (#27180467)
>because a judge who's unhappy at it isn't going to care about "the code is the law" talk.

in my experience if you ever tried to tell a judge the code is the law you will be in for a world of hurt. Hope they don't read about it elsewhere either.

on edit: obviously in agreement with parent, just noting that the very concept of the code is the law introduced to a judge is going to elicit some very negative reactions.

Re:Missing line in a smart contract leads to $10M hack by ArchD on Sunday May 16, 2021 @11:15PM (#27179751)
How are they practically going to find the defendant? On a public blockchain, you can't always put a name or face to an address. The tokens in question can change hands many times and make it hard to trace identity.
Re:Missing line in a smart contract leads to $10M hack by username90 on Monday May 17, 2021 @12:05AM (#27179954)
Most criminals aren't masterminds, they are easy to find.
Re:Missing line in a smart contract leads to $10M hack by arvinsim on Sunday May 16, 2021 @11:26PM (#27179802)
"Fix it or else" eerily sounds like an incompetent project manager.
Re:Missing line in a smart contract leads to $10M hack by fake-name on Sunday May 16, 2021 @10:59PM (#27179661)
> Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

In other words, it doesn't work.

Re:Missing line in a smart contract leads to $10M hack by thatjamesdude on Monday May 17, 2021 @04:14AM (#27181113)
>The theory is that the code is the law. There is no theft.

What rubbish. You cannot claim "the computer let me do it" and expect to be let off for that. That's an extreme absurdity and is absolutely not how the law works.

Contrary to what a lot of people seem to think: Crypto is not "outside" the law in any way. It is a token of value (like FIAT currency) and there are plenty of laws that cover use cases from capital gains taxes to money laundering to, you guessed it, theft.

Re:Missing line in a smart contract leads to $10M hack by pnt12 on Monday May 17, 2021 @07:47AM (#27182396)
That's a big design flaw from the premise itself - it works if the code has no bugs, but all code has bugs, therefore it does not work
Re:Missing line in a smart contract leads to $10M hack by hypertele-Xii on Monday May 17, 2021 @04:50AM (#27181341)
A smart contract is only as smart as the programmers writing it.
Re:Missing line in a smart contract leads to $10M hack by rorykoehler on Monday May 17, 2021 @05:12AM (#27181455)
The code is the spec. Any other documentation is a compression of the spec.
Re:Missing line in a smart contract leads to $10M hack by derefr on Sunday May 16, 2021 @06:52PM (#27177875)
> Of course, this only works when the smart contracts perfectly meet a correctly defined spec and have no bugs.

In practice, if using a smart contract as a contract, the way you'd use a paper contract, then two parties would sit down and negotiate; draft the negotiated agreement into the form of a smart contract; and then agree (signatures, handshake, multi-sig deployment, whatever) that "what the smart contract does — as executed by the network-consensus abstract machine — is our explicit mutual intent, and damn any statement by either of us to the contrary."

This is the same thing you're doing with a paper contract: by both signing it, you're agreeing that "what the paper contract says — as interpreted by a judge — is our explicit mutual intent, and damn any statement by either of us to the contrary."

Of course, nobody's actually using smart contracts as contracts. They're just using them as trusts/agents. For now.

But a smart contract used as a contract wouldn't have "bugs." It's a negotiated agreement; negotiated agreements have loopholes. And loopholes are perfectly legal. If you left one in, and your counterparty exploits it? Too bad for you. You should have run your contract through a better (code) lawyer.

Re:Missing line in a smart contract leads to $10M hack by astrange on Sunday May 16, 2021 @07:49PM (#27178422)
Signing a paper contract doesn't mean you're bound to any bad thing that happens because of it for life. If a smart contract is so strict that eg it can be against public policy then it's not a real contract.
Re:Missing line in a smart contract leads to $10M hack by derefr on Sunday May 16, 2021 @08:01PM (#27178508)
Note that in my above statement, the "network-consensus abstract machine" is the same kind of thing as "a judge": namely, both an arbitrator, and an official that declares certain clauses objectively void even if both parties like them.

See also: the DAO hard-fork that created Ethereum Classic.

Re:Missing line in a smart contract leads to $10M hack by crooked-v on Sunday May 16, 2021 @09:45PM (#27179232)
Except it's not the same kind of thing, because an actual judge has legal power. Your abstract machine is going to be sidelined pretty quickly if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect.
Re:Missing line in a smart contract leads to $10M hack by derefr on Sunday May 16, 2021 @10:40PM (#27179573)
I meant that the abstract machine's behavior is dictated by the legislation of the "society" of node operators, in the same way that the judge's behavior is dictated by the legislation of the society you live in. They're both appointed arbiters. And they've both got the responsibility of enforcing, among other things, certain 'inalienable rights' — i.e. making certain contracts (or certain legal motions based on the wording of a contract) invalid, if they would be greatly damaging to one party in a way deemed unacceptable to "society."

> if a judge decides it's doing something illegal or unconscionable and issues injunctions to that effect

A judge can't tell a distributed network that has equal presence in countries with mutually-antagonistic economies what to do. They can at most ban the network's nodes from being operated in their country — but people in that country can still continue to use the network through a VPN.

Think of it like offshore gambling, except that it's 'offshore' respective to every country on Earth, and there's nowhere a sufficiently-motivated Navy can send a bunch of boats to shoot at it, either.

Much of the economic value of blockchains comes from the fact that they allow private citizens of countries that have no trade/treaty compatibility (e.g. countries actively at war with one-another), to have a basis for trust allowing them to enter into contracts with one-another. The basis for this trust is the virtual 'overlay' legal framework of "whatever the software the majority of node operators decide to install says, goes."

Of course, if you and I are both in America, and we enter into a smart-contract contract, then we're also entering into a civil legal contract evidenced by that smart contract (just like we're entering into a legal contract if we make a verbal "handshake agreement.")

But if we have a compatible legal framework to operate in, that grants our contract as valid†, then why would we even need a blockchain?

† (A common reason to not grant a civil contract as valid: because it's a contract for purchase of illegal goods. In such cases, you don't have a compatible legal framework to operate in, even if you're operating in the same country.)

Re:Missing line in a smart contract leads to $10M hack by crooked-v on Sunday May 16, 2021 @10:54PM (#27179637)
> A judge can't tell a distributed network that has equal presence in countries with mutually-antagonistic economies what to do. They can at most ban the network's nodes from being operated in their country — but people in that country can still continue to use the network through a VPN.

The distributed network is to some degree a red herring here: in most cases, an unhappy judge would be issuing orders compelling behaviors from specific people (e.g. "you're going to send that $10M back to the person who had it"), and if that contradicts the code, too bad - do it some other way.

> Think of it like offshore gambling, except that it's 'offshore' respective to every country on Earth

Except it's not: if you're in Iraq and I'm in Brazil and we enter into a contract (as would be legally understood in either or both countries), we are now in a contract under the jurisdictions of both countries.

Even being literally "offshore" doesn't really matter: almost every country will claim jurisdiction over its own citizens if they're not already under the jurisdiction of some other nation (by way of being on a ship registered under that nation's flag). You can't actually escape the law just by going out into the middle of the ocean.

Re:Missing line in a smart contract leads to $10M hack by derefr on Sunday May 16, 2021 @11:07PM (#27179699)
> in most cases, an unhappy judge would be issuing orders compelling behaviors from specific people

I'm presuming here that the unhappy judge is on the other end, is the thing. There's no judge local to the person “in the wrong” who actually has cause to go after them. Only the judge in the other country does.

If I'm in Iraq and you're in Brazil, and I rip you off, and you have no idea who I am because I'm just some pseudonym on a darknet market, then sure, a Brazilian judge can write an order for "me" to pay the money back... but how are they ever going to enforce that? They don't even know who "I" am.

Let's say they at least know where I am (Iraq.) In a compatible-legal-frameworks situation, your judge could get an arrest warrant out, and nudge my country's police to try to do some ISP PRISM-ing to figure out who I am. Then your judge could try to get me extradited to Brazil to be tried.

But if Iraq and Brazil aren't on "good buddies who treat one-another's warrants in good faith" terms... then what's your judge going to do?

(To put this another way: if Edward Snowden ripped a bunch of private US citizens off before heading to Russia/Switzerland/wherever, would he have been any more likely to have been extradited sooner?)

> if you're in Iraq and I'm in Brazil and we enter into a contract (as would be legally understood in either or both countries), we are now in a contract under the jurisdictions of both countries.

In the case of actual offshore casinos, if you lose money to another person, you don't owe them money, because you never interacted with them directly. You played a game together; but while doing so, what was technically, legally happening was that you were interacting with the casino, and they were interacting with the casino. So, if anyone owes anyone money, then it's the casino that you owe money; and, separately, it's the casino that owes them money. (This is a large part of why casinos get you to trade your cash in for tokens, and then play games using the tokens. Everything that happens with the tokens, is "you interacting with the casino.")

You see this dynamic domestically in the form of e.g. car insurance. If you rear-end someone, you don't owe that person money. You owe your insurance provider money; your insurance provider owes their insurance provider money; and their insurance provider owes them money. Usually all different amounts! Because those are three different contractual agreements, being settled separately.

While it’s not necessarily the case that this is the body of case-law that would pertain if you send Dogecoin to someone in another country through your mutual memberships in some DEx, it’s not not necessarily the case, either.

—————

I think we’re getting off-track here, though. My original point wasn’t that a judge would be replaced by a network-consensus abstract machine. It’s that a network-consensus abstract machine is a valid replacement good for a judge, when you don’t have any compatible legal framework through which to access a judge. This is the good people are paying for when they pay crypto transaction fees: this fake robot judge, that—while worse than a real judge in almost all respects—is at least better than the nothing (i.e. the “send Western Union and pray your counterparty isn’t a Nigerian prince”) you get by default in international civil/contract-law dispute scenarios.

Re:Missing line in a smart contract leads to $10M hack by withinboredom on Monday May 17, 2021 @08:55AM (#27182868)
> If you rear-end someone, you don't owe that person money.

You are in for a world of hurt... that's not how this works. At all. https://en.wikipedia.org/wiki/Tort

Re:Missing line in a smart contract leads to $10M hack by astrange on Monday May 17, 2021 @12:39AM (#27180088)
I mean, I agree with that, but I don't think having to restart the entire financial system or get 51% approval to edit any existing program is a good way to deal with problems like this.
Re:Missing line in a smart contract leads to $10M hack by samatman on Monday May 17, 2021 @02:28AM (#27180576)
There's a name for this, it's called a Ricardian contract.

https://en.wikipedia.org/wiki/Ricardian_contract

It's slightly different than what you describe, because the parallel contract is an actual contract: a written and binding agreement between multiple parties, which explicitly grants consent for some bit of software to govern a given business arrangement.

Most "smart contracts" aren't Ricardian contracts, though, they're just chunks of software running on a blockchain.

They probably should be though, because contract law applies to business whether a specific legal contract is drafted or not, and no, that implicit contract doesn't say "whatever the software does is fine".