I like your line of reasoning, however, apparently the mechanism the attacker used was patched. According to your logic, this is the fundamental design of the system, and should be impossible to patch. That makes me more inclined toward the belief that this was a bug in their code.

The patch changed the design of the system. They obviously didn't forsee the flaw in their system but it's not like someone found a buffer overflow - they only used the levers and buttons that the system provided them to perform this 'attack'.

If u take money from an open bank door, u aint gonna be waved off with a laugh and good day. Just because u picked the lock using the mechanisms provided, doesnt mean u didnt steal the bounty.

Code is law will only lead to SkyNet.

The subjective element to legal interpretation is why our legal system is not purely algorithmic.

If it was, people will argue malicious compliance like you are, but intent has to be considered, both the intent of the developer and the intent of the exploiter (or loaner, is maybe a less loaded term for them)

“Someone read the rules carefully, then borrowed capital to move the rules in their favor”, you could say the same thing about an integer overflow, both are attacks of excess, with intent for massive personal gain, outside the intended use case of the system

I'm not so sure. Contract law is complex and even if the software is considered a legal contract, the law doesn't always side with pure technicality. For example if a contract indicated that John Doe must pay me $100 for services rendered and then the time to pay up arrives and Jon claims he doesn't have to pay because the contract says John must pay. But he's not John, he's actually Jon. That isn't going to fly because the intent that Jon pay is clear.

> This is more like an options trade that didn't work out because someone with more money used their capital to blow up the trade. You can't make a bad trade in the stock market and then argue that your loss was a "bug" because you intended to make money, not lose money.

100% Agree you can also look up trading patterns on option expiration Fridays to see people making sure that their trades 'work out'

By this logic, a buffer overrun exploit would not actually be an exploit, because it's just a pointer that goes up or down according to certain rules.

Incorrect. A buff we overrun injects new code into the system that gets executed that was never part of the original system.

This is more like setting your screensaver or debugger to cmd.exe on windows NT and waiting for an admin process to crash or the screensaver to start. (I forget exactly how it worked)

I’d compare this “exploit” to playing a coin pusher type gaming kiosk with an especially large bankroll and statistical analysis to determine optimal play strategy.

If someone chose to play such a game intending to win and with appropriate planning to ensure wins through optimal play, I wouldn’t call that an exploit at all. It’s beating the game, and the owner may ban you from playing it, but no laws were broken by you playing it in such a manner with larger than average capital. But your winnings are yours, fair and square.