News for hackers. Stuff that matters.

A comment on Poly Network hacker returns $258M after stealing $600M. Parent comment

Re:Poly Network hacker returns $258M after stealing $600M by namdnay on Thursday August 12, 2021 @03:56AM (#28153384)
> You have to be an absolute tool to use the poly network for anything serious ever again

agreed

> A digital contract was used in a way that complied with the contract that the bonehead writers of that contract did not intend. That's it

I kind of disagree in philosophy here. If there's a bug in a bank API that lets me transfer funds to my account, I'm still "hacking", even if I'm doing exactly what the API lets me do, because I know very well that I'm not supposed to.

Then again, as you say, the whole spiel of digital contracts is that theyre far too clever to need silly courts and judges and common sense and all that, so... meh

[ Parent | on HN ]
Re:Poly Network hacker returns $258M after stealing $600M by blowfish721 on Thursday August 12, 2021 @05:53AM (#28154208)
Isn’t that the point though, when you access a bank api you have signed a contract in order to access it that states what is allowed and what’s not, the api code is not the contract but a way to access what you are allowed. With smart contracts the code is that contract so if the code allows it then it should be allowed.
[ Parent | on HN ]
Re:Poly Network hacker returns $258M after stealing $600M by spyder on Thursday August 12, 2021 @01:24PM (#28159008)
You don't have to sign a contract to find vulnerabilities in an API. The thing that you have to obey is the law. Just because we call it smart contracts it isn't above the laws.
[ Parent | on HN ]
Re:Poly Network hacker returns $258M after stealing $600M by pcthrowaway on Thursday August 12, 2021 @09:31AM (#28156065)
Something that seems to be missed here, is that the bank has their physical servers owned by an institution, which you are exploiting. There is no physical server for Ethereum, the Smart Contracts don't exist anywhere.

You are likely also violating the terms of usage of the API and various other legally enforceable contracts by breaching the API.

If a smart contract included a terms of use however, it would be interesting to see whether this could be considered enforceable.

[ Parent | on HN ]
Re:Poly Network hacker returns $258M after stealing $600M by wizzwizz4 on Thursday August 12, 2021 @10:19AM (#28156696)
> There is no physical server for Ethereum, the Smart Contracts don't exist anywhere.

There is no one physical server. I think this is misleading.

[ Parent | on HN ]
Re:Poly Network hacker returns $258M after stealing $600M by pcthrowaway on Thursday August 12, 2021 @11:30AM (#28157564)
It's a decentralized network. I mean it remains to be seen what jurisdictions consider smart contract exploits to be prosecutable, or whether they're even crimes.
[ Parent | on HN ]