Following up on "Ethereum price nose-dives after $50 million hack".
From The Verge:
How an experimental cryptocurrency lost (and found) $53 million
This morning, users of the Ethereum cryptocurrency woke up to some very alarming news. Someone was trying out a new attack on one of the currency’s biggest and richest institutions, the Decentralized Autonomous Organization or DAO. The DAO holds immense cash reserves, and someone had figured out a way to drain out $53 million.Because of the nature of Ethereum, developers could still see where the money was and how much had been taken, and it would be impossible to spend for at least 27 days. But the massive and sudden theft created an unprecedented crisis for a project that was once hailed as the future of the blockchain, and a mad dash to keep tens of millions of dollars from slipping permanently out of reach.
A mad dash to save $53 million
To understand how this could have happened, it’s necessary to know a little bit about how Ethereum works. The system is built on the same blockchain that powers Bitcoin, a system for holding and spending money based on cryptography rather than traditional intermediaries like banks and credit card companies. Applying that logic to finance has made for a powerful and controversial currency system, but Ethereum pushes it even further. Instead of limiting the blockchain to transactions, Ethereum lets developers build any kind of code on top of a blockchain ledger — that could mean blockchain-based contracts, blockchain-based businesses, or even wilder systems that haven’t been created yet. Like most blockchain proposals, it’s still experimental and more than a little starry-eyed, but it’s managed to raise $15 million and catch the attention of some of the industry’s biggest investors.The DAO is one of the most ambitious systems built on top of Ethereum. It’s designed to function as a kind of decentralized venture capital fund. Ethereum users can purchase tokens that work like stock, entitling them to voting power on projects and investments, as well as a share of any profits. It’s still in the very early stages, but believers hope it could provide a model for a new kind of decentralized corporation.But there was a problem. The contract programs that powered the DAO had a bug that, under the right circumstances, would allow escrow accounts to be emptied out through a balance-check mechanism. Those contracts were built on top of Ethereum, rather than being made a part of its core code, but they were crucial for the day-to-day operation of the DAO. A number of researchers had drawn attention to the bug, most notably former Bitcoin Foundation chairman Peter Vessenes, but developers didn't seem to realize how devastating the bug could be once exploited. "This particular bug was not unknown," says Vessenes. "The core developers knew about it."In hindsight, it’s easy to blame the developers for not spotting the problem early enough, but the nature of the DAO project put them at a disadvantage. A coder building a web database has decades of code and security standards to draw on, but coding on the blockchain is a completely new field. It’s hard to predict which security problems will turn out to be severe and which protections will turn out to be effective. And with tens of millions of dollars at stake, there were plenty of attackers poring over that code for anything they had overlooked."This is the ultimate test of defensive software engineering," Vessenes says. "You have to worry about attacks in four years with code you can’t modify. The tooling is not there, the documentation is not there, and the best practices are still being discovered."
"The fundamental problem is that teenagers can get rich really fast."
Ethereum developers have put in heroic efforts to patch the bug, but that still leaves the question of the missing $53 million. The money is still in Ethereum coins, and because of the unique nature of the DAO contracts, it’s stuck in a specific holding account for the next 27 days. If the community doesn’t do anything during that period, the attacker will be able to walk away with it — but given how much is at stake, that’s unlikely to happen....MORE
