The problem with smart contracts isn't that there are bugs, but that buggy results are final with little to no recourse, by design, unless you get everyone to agree to hard fork the chain (rolling the "bad" transactions back and eplacing the buggy contract) and/or the implementation (if the bug was in the platform rather than the contract).

The legal system has a similar principle of not being liable for conduct that predates a ruling or law that forbids it, but it also has the principle of agreements being interpreted according to common sense understanding by a person with ordinary skill, and where skill differences exist between them the non-expert's interpretation is the one given precedence.

These meta rules don't have equivalents in smart contract systems, which makes them brittle. The only way smart contracts end up being used for non-trivial purposes is if they are made explicitly subordinate to the existing legal infrastructure in ways that will gum up the works, or if smart contracts are subject to mandatory formal verification possibly including game theoretic 2nd order effects.

https://twitter.com/qrs/status/1395784294451265536

> Smart contracts should be considered self-funded bug-bounty platforms.

And you don't need to make the smart contract explicitly subordinate to the law, they are as a matter of fact, because everything de facto is. This idea that code is law and crypto exists in a vacuum is complete delirium (although a popular one and sign that the scene has a lot of room to mature)

People who post smart contract code on the EVM are equal users of a shared computation infrastructure. If they want to put legal terms on who can use their smart contract and what for, they should need to make their own blockchain platform, because they certainly don’t own Ethereum.

The law already regulates mistakes in traditional markets. If you accidentally sell your shares for a fraction of what they are worth, you cannot go to a judge and ask them to return the “stolen” shares. When you subject yourself to a mechanistic market system, the predictable operation of the system is more important than any participant’s bad fortunes.

Where is this contract? I've never seen it. The rest of your argument is based on this premise. The "legal contract" of a computer program is the same, yet we have laws on what you can and can't do to other people's computer programs.

> The law already regulates mistakes in traditional markets. If you accidentally sell your shares for a fraction of what they are worth, you cannot go to a judge and ask them to return the “stolen” shares.

Someone taking all the money from a smart contract you gave money to is not like your fictional example of a person selling their shares for the wrong value.

Corporations and wealthy individuals with influence in the writing of this legal system, with massive amounts of financial resources, with negligible moral agency, and with limited criminal liability find very different utility in the ability to use the legal system to roll back contracts, to enforce them, or to ignore them.

Those who find themselves on the other side of this power disparity would often prefer to risk a potentially buggy but inviolate contract than one which they expect to be abused against them.

There is no way that AT&T, Comcast or Bank of America will ever agree to a smart contract written by an ordinary customer. As always, the companies will write their own contracts, and customers will either accept them, or leave. And if the company has monopoly power, tough luck.

In an analogous situation, if a shop mis-labels the price of an item (let's say, they forgot a zero or two for a $1000 item), the customer theoretically has the legal basis to purchase it at the labeled price. How is this scenario any different to a block chain contract with a bug?

Further, in many places your example itself falls apart.

https://smallbusiness.chron.com/company-advertising-price-wr... https://www.findlaw.com/smallbusiness/business-contracts-for...

There was a case like that in the early days of online shopping, which was actually decided in favor of the customer. The prices of items in the shopping cart were stored in form fields, and the customer edited them before placing the order. The court considered that a counter-offer which was accepted by the store. (It probably wouldn't go that way today; for one thing online stores have gotten smarter about trusting data from the client.)

That's a bit different from simply editing the client-side view and never informing the merchant about the change, of course.

This seems like a noble endeavor, but not an entirely practical one. Both sides of a transaction have to agree to these smart contracts, so where is this an advantage (outside of internal crypto trading)?

But if you can overcome the power balance problem, you can just fix the contracts directly anyway without them being smart?

For example, I don't think there's anywhere else where the mere act of purchasing a product or service can result in you giving up the right to sue the company in court and be forced to enter arbitration with an arbiter of the company's choice.

Smart contracts don't have to exist outside the judicial system. Smart contracts are simply a way to automate transactions in a way that's efficient, transparent, and credibly neutral. Yes, we may still have to invoke courts for the 0.01% of transactions that are clear exploits. But the other 99.99% of the time, it's a much more efficient system than using written contracts to handle normal, everyday outcomes.

Even without blockchains or smart contracts, we already have automated systems that execute transactions based on algorithmic rules. If you blatantly exploit a vulnerability in those systems, then courts will generally punish you. That doesn't mean that automated systems are pointless, because 99.9% of the transactions aren't exploits. That's still a huge win, because it means we don't have to have our lawyers email redlines back and forth every time we want to trade an S&P index futures contract. (Near) fully automated transactions are 1) orders of magnitude more efficient, 2) expose general purpose composability where one automated system can be predictably inter-connected with another.

When you put an automated transaction system on-chain, you drastically increase the advantages of both, because you're embedded in an open application network with credible neutrality. A smart contract exchange like Uniswap can process about the same amount of volume as a centralized exchange like Coinbase, but the difference is that Uniswap only needs about 50 employees, whereas Coinbase needs 5000. That's primarily because Coinbase runs inside a silo'd network. That entails replicating many functions like user account management, that aren't necessary for an application like Uniswap that piggybacks off the credible neutrality of a decentralized consensus layer like Ethereum.

Smart contracts, to date, have proven themselves to be truly idiotic inventions.

Yes, but that's a wrong and unfair way to define and apply laws.

> humans are imperfect

Smart contracts and "code is the law" mantra don't contradict this. You're imperfect and you commit a mistake, you lose. You find a mistake in someone else's code, you win.

This is much better than the current legal system where we are all collectively forced to adapt to, or even pay for, someone else's mistakes.

>Yes, but that's a wrong and unfair way to define and apply laws.

Sounds like you're interpreting how to define and apply the law there based on what you feel is the right and fair way to do so. Seems a bit paradoxical.

In the world of smart contracts code is indeed law, but that doesn't change the fact that in the real world law is law, and the fact that you used a smart contract to commit a crime doesn't make it any less a crime.

Plenty of crypto hypers say the same. E.g. from a quick search of "Smart Contract advantages," the very first article, by a law firm:

> Guaranteed Outcomes: Potentially the most attractive feature, smart contracts could offer a way to substantially reduce or completely eliminate the need for litigation and courts. This is because when parties commit to using self-executing contracts, they bind themselves to the rules and determinations of the underlying code, rather than exposing themselves to interpretations med by parties outside of the contractual relationship.

https://www.newburnlaw.com/benefits-of-smart-contracts

Just think of non-smart contract parallels. If a bank had an ATM, the premise is that this ATM will execute a series of commands and allow you to withdraw/deposit/transfer funds. If a nefarious back actor found a series of user input that allowed them to withdraw millions of extra dollars, do you believe that the ATM provider will have no legal recourse? What about electronic slot machines?

In contrast, basically nobody outside of the blockchain space would waive their legal recourse in such a manner and thus would have legal recourse if the intent of their system was bypassed.

To go on to then argue that a legal system should not allow one to waive those rights as it would be idiotic to do so is a perfectly valid legal/moral/justice position, but also directly contradicts basically the entire purported value proposition of everything in the blockchain space whose primary “positive” differentiating factor is that “code is law” and they have waived those rights. To not allow them to do so basically invalidates their entire purpose.

Essentially, either let people bind themselves to “code is law” and suffer the consequence of their choice, or ban it at which point you lose decentralized trust and censorship-resistance making them no different than traditional implementations except that they are slower with higher operational costs.

I believe you're making this claim because _some_ crypto proponents believe "code is law" and because your personal logical framing is that web3 has no value add outside of being able to operate without legal recourse thus it must operate without legal recourse.

First, even if web3 had no useful value add, it doesn't mean it ought not exist. I can create a SaaS company that does exactly the same thing another company does just with my own logo and API documentation. Does non-uniqueness invalidate my company's existence? What if I forked an open source SQL database and slapped my name on the repo? Have you heard about something called substitute goods? I don't see why Pepsi can't exist in a world where only Coke is the norm.

Second, web3/blockchain/defi does have benefits outside of traditional web2/finance. The ability to not require depositing your funds into an account to transact on a protocol, for instance, is a clear value add. The ability to buy/sell NFTs without a middleman (if they choose to eschew a middleman) is a novel and potentially valuable value add as well. There are countless other applications of web3 that I won't delve into but these concepts can and should operate within bounds of legal recourse.

I've seen quite a few people do this. May not everyone, but a lot. The "commentary added by a random law firm" is the general sentiment I understood when people were hyped up on smart contracts. There's an industry of smart contract programmers who write code under the assumption that there may be no recourse (to the legal system) if they introduced bugs.

If your attitude represents the sentiment of "web3" these days, it is really a very hilarious backtrack on the previous (hyperbole) claims...

The observer will pay $100 dollars per blocked shot, and earn $1 per 3 point play made. All the games are played 1v1. To the untrained basketball player participants, this may seem to be a fair game. After all, it's quite rare in a real basketball game to see a 3 point shot blocked. So they sign the contract, fully agreeing to pay $100 per blocked shot and earn $1 per made 3 pointer.

To game this as a participant, I go to the ends of the earth ( I hear Sudan and the Netherlands are both nice this time of year ), and find a 6'8 ,215 lb boy and recruit him to play for me. He proceeds to block every single shot in every contest, winning hundreds of thousands of dollars and bankrupting the organizers. Just to further weight this, I also hire an opposing player who is only 4'3 to shoot as many 3 points as possible as quickly as possible.

Now, they signed the contract and agreed to it. They didn't have a clause for height, or any sort of caps, and now they have unlimited downside. How would the legal system handle this? Do you think they would release the participants liability? Perhaps, but not likely if they didn't sign the contract under duress. They fully agreed and had consideration ( the $1 per 3 point made ).

It's a contrived example, but it's useful to show that technicalities can be exploited in real world contracts just the same as smart contracts.

But it would appear that you expect us to believe that some commentary added by a random hacker news poster means the opposite?

(There have been exploits in both ATMs and smart contracts, after all.)

But I also think the shift directionally makes sense. Traditional finance (really most transactions for that matter) have moved towards fewer middlemen dependent, more democratized forms of transactions (e.g. wealthy folks can call their traders to buy/sells stock -> open to middle class -> no need to call traders -> no fee no minimum online trading). To me, not requiring institutions to maintain custody of my funds is a value add.

But most importantly, it could just be something different (that fails or doesn't fail, who knows). I don't think the web3 space NEEDS to eschew legal recourse because 1) that's not the only supposedly value add and 2) because it doesn't NEED to provide any value add for that matter. Perhaps web3 can just be the Pepsi the web2's Coca Cola. Only time will tell.

Crypto /thread

At that point it's no longer a premise (for those particular countries), but until then it's just a supposition.

I think courts are wary to wade deeply into a new financial system like this but at the same time I find it hard to believe that the judiciary and the legislature would rule (in the long run) that they have no ability to "make things right".

If crypto grows as as many people suggest and you have some significant percentage of the country that has savings or investments tied to these smart contracts, if there is a loophole like in this case, you'd have lots of people writing their local or national representative about this. I find it hard to believe that politicians would tell the people they represent "tough luck code is law".

Only having a slight understanding of crypto, if local courts are required, what's the point of crypto? Why not use the existing financial systems, where all of this is built in?

> [a crypto bro] criticized the team for turning to a centralized institution like the courts for help

But that's exactly the flaw of smart contracts, and why its promises will never work.

The hard part of contracts was never execution. The hard part was always conflict resolution and abidance by fair rules (i.e. "laws"). The hard part is what creates the overhead.

Smart contracts never solved the hard part. They remove the solution to the hard part, claiming the hard part is not needed at all. But the problems these solutions solve are the hard part. Pretending they don't exist is not "solving" anything.

There are so many examples of this. A minor can't enter into a contract. Severely mentally disabled can't either. Someone with a gun to their head can't either. It doesn't matter if they enter into a million dollar contract. That contract is invalid.

This is not "waste". This is the hard parts.

And arbitration contracts that can arbitrate the arbitration contracts, and so on.

And perhaps a smart contract to allow the amendment of existing contract, by vote of a group of wallets who’ve been elected by another smart contract, who’ve been elected by another smart contract with a larger pool of voters, and so on, until all stakeholders in the contract have had the chance to cast a vote, whose duration as a voter is limited to a 2-4 year term, before requiring another voting round.

That's what courts are for. When someone finds an exploit in the smart contract there must be a "no that's clearly not what anyone meant. Nobody actually wanted all the money in the world to go to Hacker McHackerface".

If your assumption is that one of these contract layers is "perfect", then it's not realistic.

But anyways that was in jest; the crypto community will eventually recreate the same systems and bureaucracies already in play today as they run into all the edge cases that occur with traditional currency (fundamentally: currency carries provenance and is only fungible until its not, and the transfer of funds between two parties does not actually involve only the two parties — and lawyers write excessively defensive, excessively long contracts for a reason).

So that's one use of crypto.

In the non Web3 world, we typically have to rely solely on the financial institution providing the service to make transactions. That is, we have to have a Paypal account to withdraw from Paypal. We can only buy/sell Robux on Roblox, etc. Smart contracts allow us to essentially utilize any provider we want without the provider having custody of the funds at any given time.

I can go to any dex I want and transact without depositing funds. The dex also cannot agree to perform a transaction and hold my funds hostage, like how Paypal screws over some of their merchants with their "internal investigations." I can also buy/sell coins that the dex mints (e.g. ORCA coin) anywhere I want. It's not tied to a single account nor is it tied to single exchange.

And that's without getting into NFTs, flash loans, LPs, and other features of Web3.

The court doesn't care how crypto idealists think the world should work.

I think some confusion arises because that "smart contracts" only make sense if code really is law, in the sense that any transaction executed by the contract -- even unexpected, surprising transactions -- is considered to be fully consented to by all parties interacting with the contract.

I agree that that's a terrible idea - bugs can always exist, and having no recourse when millions of dollars are lost due to a coding error is a huge and unreasonable risk.

But otherwise -- if, ultimately, courts can force "smart contract" transactions to be unwound if they are found to be exploitative, unintended or otherwise invalid -- then what's the point of having smart contracts in the first place? What's the value proposition? Why not just use regular contracts?

There's still a very real use for smart contracts in that you change what bad actors can do to act badly. Before they may have been able to breach a contract by ignoring invoices now they breach a contract by exploiting a smart contract loophole. Basically your shuffling the trust and risk around which can be a useful tool. i.e. it can be quite costly to enforce (and do due diligencece on) a contract with someone in another country so the cost and technical risk of setting up a smart contract may be much more preferable than the posisbility of having to legally enforce redress for breach in a regular contract.

Smart contract is really the misnomer. In reality, they are automations of contractual obligations and cannot automate complete contract clauses.

It's just code, so the same reason we use APIs rather than doing everything by lawyers.

For example, robbery is when, with intent to commit theft, you take property by force.

Anything else is not robbery.

Theft by taking is: when a person unlawfully takes or, being in lawful possession thereof, unlawfully appropriates any property of another with the intention of depriving him of the property, regardless of the manner in which property is taken or appropriated.

(The above is georgia, robbery/theft/etc are state crimes so defintions vary a bit)

Again, it requires doing so unlawfully (or converting unlawfully).

If doing what this person did isn't unlawful in the real world, it's not theft, it's not robbery, it's not anything.

So you have to find a crime that actually matches what happened.

It's not wire fraud - that would require " false statement, promise, or misrepresentation in order obtain money or something of value from someone else."

etc

So what crime do you believe this actually is?

(So far i've only seen a civil lawsuit, and while there is a warrant for his arrest, that's for refusing to move the tokens to a neutral third party, or show up to court :P )

In fact, he paid very high prices for the initial tokens (860 times initial value at one point). Then gave away a bunch of tokens. Then waited for an algorithm to do something dumb around the pricing, and then swapped the tokens.

Who exactly did he appropriate property from here? He paid for all of it, and paid the prices the market demanded. The algorithm did something dumb, but that is no different than some trading bot algorithm doing something dumb and selling for less than it should, which happens all the time.

As for embezzlement, it requires a trust relationship - it's a violation of a fiduciary duty.

I don't think he had one?

So far, i've not seen any criminal charges here, only civil ones. Certainly prosecutors are slower at this sort of thing, but i'll be interested to see what happens.

There have also been plenty of instances of folks much closer to having relationships + knowledge and not being found to be illegal (though rarely there has been civil liability). IE financial advisors exploiting inside knowledge of their clients portfolios + what their companies are up to to make trades that advantage their companies at the expense of their clients.

As for the rest - the intended net effect of almost all trades in finance is to cleverly transfer the value of everything you can to yourself ;). The only question is whether he had a relationship that makes that illegal or not.

The "laws of physics" analogy doesn't match up. I feel like it would be more appropriate in an anarchist society (physics are the only laws, thus everything that obeys physics is game).

This feels more like discovering an exploit in a video game. It's up to the devs to patch it, or tournaments to outlaw, but if you find something out, you can use it. We agree to play by the rules, but if someone comes up with something last minute, they can win.

And if "smart contracts" depend on real law, then they're not really needed in many of the supposed use cases.

That's obvious correct but what's the point? The whole discussion here is that there exists these "crypto anarchists" and their ideal world seems ridiculous to at least a couple people here...

We're all bound to the laws of physics, just as in the world of smart contracts all are bound to the laws of code. But none of that changes the existence of the laws of men.

- I'm not really saying the crypto-side argument is right, really just trying to clarify my perception of what they're saying re: the comment above me.

- The physics thing is really just a comment re: when it's hypocrisy and when it's not.

- FWIW, theft in crypto isn't super well-defined to me re: the laws of men either. Maybe someone who knows current law better than me can explain, but calling a function in a contract that sends updates from one pseudonymous address to another... I don't actually know if current written definitions of theft covers that, or needs some court to interpret it as theft. We kind of understand it as people, but I honestly don't know if "laws of men" as written, do.

Higher courts, due to their inherent ability to set precedents, usually also consider broader policy concerns eg. whether the decision makes sense from enforcement perspective, how the ecosystem might be affected etc..

Ever use a different email address to sign up for a different free trial, say? Let alone people sharing Netflix accounts... where do you draw the line around "stealing" here?

Yes. This is very obviously stealing, particularly if the promotion said it was for use once a day.

Edit: Also, sharing your netflix password may also very well be illegal: https://www.lawjournalnewsletters.com/sites/lawjournalnewsle...

[1] https://en.wikipedia.org/wiki/Leonard_v._Pepsico,_Inc.

(Well, maybe you can still complain, IANAL, but it gets a lot murkier.)

People on HN argue this with openly accessible APIs fairly regularly "ah but the machine let me do it, they must be OK with it" and I think that goes down badly in court.

If this smart contract is considered a legally binding contract, then, yes, this would likely be illegal despite the proverbial "letter" of the smart contract not being broken. If it isn't, then it may not necessarily be illegal (but possibly still could be).

A smart contract is a piece of code running on a public permissionless blockchain. The developers who deployed that code do not own it. Medjedovic had as much the right to take money out of the smart contract using the contract's logic as Kellar and Day.

Being blockchain developers, Kellar and Day know these facts very well, but they persist in their hypocrisy because it is in their financial interest to do so. They are betting on a non-technical jury being convinced by a good lawyer that Medjedovic "hacked them" or "stole their funds" (which is not at all what happened here).

It gets more murky if a founder explicitly lies to investors in order to get them to buy their token. Fraudulent misrepresentation is problematic in most jurisdictions, but this has nothing to do with the mechanics of the "rugpull" itself.

"According to the SEC's complaint, the defendants misappropriated nearly $4 million of investor funds. The SEC also alleges that Chiang and Tippetts misused additional Sharenode investor funds by spending at least 133 bitcoin to list NSG tokens on an unregistered trading platform and to fund a team of captive traders to trade NSG tokens amongst themselves to create the false appearance of a robust market with increasing prices. These traders allegedly created the false impression that more than $2.5 million worth of NSGs were traded daily on BitForex during the first 60 days and that the price of NSGs was steadily increasing due to investor demand. According to the complaint, however, the manipulation scheme collapsed when investors tried to sell their NSG tokens, because there were no actual buyers, causing the token's trading price and volume to fall precipitously."

This isnt exactly a classic "rugpull", but it does make it fairly clear that you cant just take customer funds and use them however you'd like just because its a cryptotoken and you have access to the smart contracts controlling it. You really shouldnt use customer funds in furtherance of additional frauds, like these people did here.

https://www.sec.gov/litigation/litreleases/2022/lr25377.htm

> These traders allegedly created the false impression that more than $2.5 million worth of NSGs were traded daily on BitForex during the first 60 days and that the price of NSGs was steadily increasing due to investor demand. According to the complaint, however, the manipulation scheme collapsed when investors tried to sell their NSG tokens, because there were no actual buyers, causing the token's trading price and volume to fall precipitously."

This is also the fund owners doing something nefarious - that doesn't mean that somebody else executing a transaction according to the contract and the market could be held accountable because the fund's customers lost money. Someone has to be on the other end of every transaction, that is how a market works.

A better example would be 3rd parties pumping and dumping a crypto asset. Should this be illegal?

They don’t. They simply have to accept it as a bug bounty successfully collected and paid out, and treat it as a learning experience and evolutionary process. Do better next time, if there is a next time.

It doesn't matter who can make the best argument in court. A good enough lawyer can convince a stupid enough jury of pretty much anything.

(a) Is this a theft from the person who placed the vending machine? Why or why not?

(b) How is this different from a smart contract on a blockchain?

For example, if DRNK costs $1 per unit, but I find out that by putting in $1.25 I get 2 units, have I actually exploited the machine? Is it not reasonable to assume that discount was intended?

Now, of course, if I'm prying open the machine with a prybar then we could argue that's just theft. But, putting money in the machine and getting units out is the intended interaction.

Similar to how if a gas station accidentally puts the price of gas at $0.20 per gallon, even though everyone knows that's probably a mistake, it isn't on them for taking advantage of the artificially low price.

So, that's what I'd say the difference is. A smart contract defines all the interactions that are valid. Thus, it is impossible to interact with a smart contract in a way that is "invalid" or "stealing". That'd be different if the user could modify the contract (apply a prybar) however, that's sort of the point, that you can't modify the contract to fix it.

If the contract said "all your deposited crypto goes to cogman10" would we call that a theft when someone put their crypto into that contract? Perhaps if I misrepresented the contract, but then the whole point of these contracts is they are visible to anyone that wants to read/use them.

What if you remove the last part? What if you know, clearly, that your interaction what not what the designer wanted?

> So, that's what I'd say the difference is. A smart contract defines all the interactions that are valid.

Implementations are not specifications. What do you mean by "valid"?

Well, then they should have designed a better vending machine, shouldn't they? It may be unethical but I certainly wouldn't call it illegal. Again, back to the gas analogy, I don't think someone pumping gas at $0.20 is breaking the law even though that's clearly not the intent.

> What do you mean by "valid"?

None of the interactions for this attack were using the system in a way it wasn't meant to be used. It wasn't exploiting code. It was buying and selling assets in a way that enriched the attacker. That is a valid interaction.

Also, the whole point of these contracts IS that the code is the specification. That's the whole point of crypto in general. Trust nobody and let the blockchain determine truth.

This is what I like to refer to as “stupid tax”.

I’ve had cases where I put money into a soda machine and it gave me a drink plus more than I deposited into it. Or kicked out more than one item because one was stuck and my purchase obviously unstuck it.

Does this make me a criminal?

As an aside I used to work at a place with a soda machine that was basically like a slot machine with slightly higher payouts than one in Los Vegas. This was at a grocery warehouse and the drinks were at cost so “losing” your bet cost like a quarter. Probably designed that way, who knows?

The smart contract implements a technical intent, just like the vending machine. But that technical intent will always have limitations. Some exploits are non-destructive, such as properly-weighted blanks. Some are destructive, such as crowbars. But let's not pretend that they aren't, in fact, exploits.

However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code.

The technical and explicit intent was followed to a T here. The attacker got a loan (perfectly within the intent) bought a bunch of the index (again, within the intent) sold a bunch of a underlying stock of the index (Again, within intent), sold the index, and sold the loan. Nowhere in this process was there a "this violates the essence of the contract".

And, let's be frank here, it's not like the attacker didn't open themselves to a huge liability. Anyone that saw this attack in progress could have bought sushi coin or UCI and ultimately drained away the income this attacker was earning, potentially putting them on the hook for a pretty massive loan.

Now, would such a scheme be legal if this were actual securities and not crypto? Nope, because we put more protection around real securities in the US and other countries. However, crypto went out of it's way to make itself above the law and outside of securitifaction. That, in fact, was the entire point of crytpo, to be something governments COULDN'T regulate.

If he’d wanted, Medjedovic could now have traded $3,200 worth of Sushi for DEFI5 tokens worth $1,172,000. And had he simply done that, Indexed would have been fine. The protocol places limits on the amount of a new token that users can swap into the pool, so he would have been able to extract only about 1.5% of the pool’s value—which, given transaction fees, wouldn’t have been profitable for him.

Instead, Medjedovic’s script took out another flash loan consisting of $2.4 million worth of Sushi tokens. And rather than swapping them into the pool, it gifted them to it—a seemingly irrational move that Indexed’s algorithm wasn’t designed to handle. The “donation” overwhelmed the pool and circumvented its usual trade limit for new tokens. This allowed Medjedovic’s program to freely trade overvalued Sushi for undervalued DEFI5 tokens, then cash those out for the pool’s underlying assets, pay back the loans, and keep the rest, now worth $11.9 million. The attack on the CC10 pool brought the total haul to $16 million.

A smart contract defines all the interactions. Whether they are legally valid is another matter. In contract law, usually the intentions of the parties (at the moment of agreeing to the contract) are taken into consideration. In most other cases, the legal system has rules to determine the validity. The customary practices of the crypto ecosystem is something they might take into account, but it's not necessarily a final outcome.

In the case of the smart contract, you don't own the vending machine. It doesn't have an owner, it just "is". If it did have an owner, that person is probably violating all sorts of securities laws in countless jurisdictions. That's at least part of the point of all this smart contract stuff.

To make the analogy a little more apt, let's say the smart autonomous vending machine 1) lets people buy DRNKs by inserting money, 2) incentivizes people to refill it with DRNK by spitting out money, 3) once a month spits out money to the amused landlord, and 4) was deposited by aliens who disappeared without trace.

Presumably the smart vending machine would continue on its merry way like this until it either broke down or someone figured out a way to jimmy the lock. Looks like the later happened. Though everyone is upset, it's not clear who has the right to prosecute.

That's probably what upsets me most about this story. These developers want to have it both ways: it is decentralized finance and nobody owns the contract as long as we are making money, but we want all the laws and regulations of traditional finance to protect us if things don't go our way.

I am saying this as someone who is pro-crypto. There are trade-offs to this technology. We need to pick a lane be prepared to deal with the consequences.

Decentralized finance is here to stay as an alternative to the traditional system. Some things are just impossible to regulate.

[1] https://www.trustnodes.com/2018/11/09/smart-contract-code-is...

I think a better example is a claw gambling machine. You pay Fiat for a chance to grab fiat out of a pool.

If you come up with a strategy whereby you can grab more or all of the Fiat in a way that the game/machine designer and other players did not anticipate, is that theft?

Alternatively, people are playing a modified version of Poker with rules they don't understand, and someone understands the rules better and gets their money, is that a crime?

https://www.aol.com/2016-11-02-broken-slot-machine-dupes-wom...

https://www.foxnews.com/us/not-a-winner-oregon-woman-denied-...

However, this works both ways. If the mistake is in the favor of the player, they are obligated to pay out:

https://www.msn.com/en-us/news/us/a-slot-machine-in-las-vega...

"Malfunction voids all wins."

Here, it's also been made very clear. "Code is law".

Ianal and don't know how a court would see it, but the way smart contracts are advertised would probably give you a fighting chance to make this argument where in normal finance you would have no chance.

Or might the hacker and his clever lawyers have an equally strong case that whatever the code allowed was the "true" intent, that the code is the ultimate arbiter of intent, regardless what Index might have said otherwise?

I kind of hope it does go to court, will be interesting to see what the opposing legal teams come up with.

What is the “Final” Agreement Between the Parties?

https://corpgov.law.harvard.edu/2018/05/26/an-introduction-t...

This is why things like "land registry on the blockchain" will never happen. When a court decides that a sale of a house was unlawful, then the blockchain is wrong and irrelevant.

Code isn't law. Law is system that ultimately sends people to your house and puts you in a locked house that you're not allowed to leave, and lets other people live in "your" house now.

Math can't enforce who lives in your house.

Law isn't law unless it's been enforced through courts, precedent and ultimately someone with authority to use force to force compliance.

And these systems could exist. But they are not the systems that are being designed. They are in fact antithetical to the stated goals of all of these cryptocurrencies and smart contract systems.

Market manipulation, fraud.

I'm skeptical that any fraud happened here.

https://twitter.com/ohaiom/status/1451142195369725957

Edit: It would be great if there was more moral in finance, but I think that's wishful thinking and doesn't really distinguish traditional finance or Defi. The only nice thing about Defi is that everyone can see what's going on in contrast to what happens when you do something in traditional finance.

Do not see any 'unauthorised access' in that case i.e not the classic definition of 'computer hacking'. However if the case does end up progressing I do wonder what form a defense will take.

It's like the people who invented smart contracts never heard of the incompleteness theorem.

https://www.cnn.com/2021/02/16/business/citibank-revlon-laws...

And flash loan contracts are a bright neon sign saying "arbitrage opportunity!"

And they're a gigantic bank, it's the original digital business, every banker knows a single arithmetic error is dangerous.

Just bankers being inept.

It does? Maybe for the poor, but certainly not for the rich/corporations.[1]

[1] - https://www.imf.org/external/pubs/ft/fandd/2019/09/tackling-...

but on your main point regarding “modern finance and law”:

2021: https://member.fintech.global/2022/01/05/the-top-five-compli...

https://www.kyckr.com/aml-fines-2021/

tldr fines amount to billions in total and sometimes criminal proceedings are brought forward.

So does the mafia and the child slaves corporations like Nestlé profit from, they all have "a role to play in the world economy". But it's about the morals and ethics and the hypocrisy of western institutions that allow these loopholes for the super rich in order for them to protect their wealth from taxation.

Examples of code NOT being the law: Some defi protocols have made those affected by a hack/loophole whole again with their own funds. Some defi protocols explicitly exclude certain jurisdictions like the US from accessing their protocol. Surely if they all belived "code is law" they wouldn't give a fuck, right?

That's a terrible example. If the code really weren't law, they'd reverse the transaction, or force the hacker to give back the money, like a court could.

Since the code is law they're stuck, and so just hand the victim some money out of their own pockets, to try and eliminate bad press and keep people's trust.

And coins like USDC can blacklist addresses and comply with regulatory asks. It's hard to buy your argument that smart contracts are extralegal when there are operators that comply with legal authority.