They clearly did NOT intended to give the coins away. Or if you argue they do any OS had any remote code execution attack also intended.
They designed a cryptocurrency with a floating value that went up or down according to certain rules. Someone read these rules carefully and then borrowed billions of dollars of capital to play the game, according to the rules, in a way that moved the value in their favor.
This isn't like a remote code execution attack because OS designers aren't planning features that allow unauthorized remote code execution.
This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.
Code is law will only lead to SkyNet.
If it was, people will argue malicious compliance like you are, but intent has to be considered, both the intent of the developer and the intent of the exploiter (or loaner, is maybe a less loaded term for them)
“Someone read the rules carefully, then borrowed capital to move the rules in their favor”, you could say the same thing about an integer overflow, both are attacks of excess, with intent for massive personal gain, outside the intended use case of the system
100% Agree you can also look up trading patterns on option expiration Fridays to see people making sure that their trades 'work out'
This is more like setting your screensaver or debugger to cmd.exe on windows NT and waiting for an admin process to crash or the screensaver to start. (I forget exactly how it worked)
If someone chose to play such a game intending to win and with appropriate planning to ensure wins through optimal play, I wouldn’t call that an exploit at all. It’s beating the game, and the owner may ban you from playing it, but no laws were broken by you playing it in such a manner with larger than average capital. But your winnings are yours, fair and square.
No, the design was so complex that its flaws were well hidden, and therefore not intended.
Quoting C. A. R. Hoare:
“There are two ways of constructing a software design: One way is to make it so simple that there are obviously no deficiencies, and the other way is to make it so complicated that there are no obvious deficiencies. The first method is far more difficult.”
That’s no less true for a Chrome sandbox escape.
In fact, this Ethereum loan platform’s behavior is encoded in program source codes, just like Chrome. One expects that some exploitable issues in the Chromium code arise not from syntactical but conceptual errors. The code could match a mistaken programmer intent, and this often happens.
I frequently make decisions that don’t turn out as I intended. You need a distinction between whether the outcome is what you intended and whether the process is what you intended. It isn’t a clear line.
Excellent question, one that crypto dudes could ask themselves a little more often.
You are probably reading this comment and thinking "yeah, hah, naive fools". About as naive as the fools, that believe in a 100 line program, that gives you a puzzle that nothing will realistically ever be able to solve, yet the program could tell immediately if the solution is wrong or right.
This is clearly a false statement. The people who set up the system did NOT intend to allow others to take $130 million for nothing.
The point was that their code did not express their intentions 100% correctly, and that's because that is quite hard to do.
In this case, the trade didn’t even violate the intended behavior of systems involved. It’s not like a bug which results in a system operating differently than intended. The system operated exactly as intended, but their intended system design was obviously flawed.
An analogy to traditional finance might be something like a short squeeze, where a sufficiently capitalized counterparty can blow up the trade and extract money from someone else if (and only if) they can pump enough capital into the system.
The difference with smart contracts is that an attacker doesn’t need to have the capital to execute the trade. They can secure a “flash loan” that is conditional on the trade working out, otherwise the loan never happens. That’s why the attacker was able to pump $500 million into the play without ever taking ownership of the $500 million or even putting it at risk. The flash loan only occurred in the context of the trade, but it was open and closed as part of the complex contract. The attacker only had to pay transaction fees to push the contract through.