Parity is a remote HVAC optimization company that uses software to deliver automatic, guaranteed energy and cost savings to multifamily residential clients and hotel owners. By combining real-time data, automation, remote measurement and control, and expert advising, Parity’s product offering slashes energy use and CO2 emissions while reducing on-site staff workloads. With Parity, building owners have their HVAC micromanaged while monitoring performance and controlling set points remotely, requiring minimal time and attention from facility staff Parity’s energy experts act as an extra line of protection for your building’s HVAC, tracking patterns to identify potential system issues and sharing insights to lock in future savings. As energy efficiency and greenhouse gas emissions regulations tighten, Parity opens new, low-cost opportunities for compliance and access to government incentive programs. Parity is currently trusted by over 200 multifamily buildings (50,000+ units) in Toronto and NYC. On average, Parity saves building owners $50,000 in energy costs. Parity investors include ArcTern Ventures, Wyse Meter Solutions Inc. (Wyse) and RET Ventures. Parity has received various nominations such as: Wood and Mac - Companies to watch (2019), Globe and Mail - Top Growing Companies 3 years in a row (2020-2022) The company was recently recognized as the first service provider to be awarded the designation of LEADER by the NYC Accelerator (2023).

Parity

A brief getting started guide. is a blockchain development framework with many cool features like upgradable blockchains, modular architecture, customizable block execution logic, and hot-swappable consensus. For an overview of the Substrate framework, watch (Web3 Summit, October 2018). Parity Substrate this talk from Dr. Gavin Wood This article is about how you can get started with the Substrate framework to build your own blockchain. Let’s jump right in. Installation The first step towards getting started with Substrate is setting up your development environment. The Substrate team has created a bash script which installs all the dependencies and compiles the relevant packages as part of installing the Substrate framework. Run the following command in your terminal, and it will set up your machine ready to hack on Substrate. curl https://getsubstrate.io -sSf | bash The command takes a few minutes to complete (depending on your hardware) as it also compiles all the Rust packages needed for the Substrate framework. There is a faster option also available, but it installs only the dependencies and does not compile the Substrate packages. To use this option, run the following command. curl https://getsubstrate.io -sSf | bash -s -- --fast In the faster option you will not have the Substrate CLI installed globally in your system. Note: Substrate Node Template Once the install script finishes execution, along with the dependencies, you will also have a couple of commands installed on your machine. One of these commands is the substrate-node-new command which helps you set up a template node. Think of this as a project scaffolding template. The command downloads a Rust code base and compiles it. This codebase packages together all the bootstrapping code needed to set up a Substrate runtime. To create an instance of the node template, run the following command in your terminal. substrate-node-new <project name> <author name> The first parameter is a name for your blockchain project and the second (optional) parameter is the name of the author for this chain. For example: substrate-node-new substrate-demo demoauthor Once this command completes, it will create the following directory structure inside the (or the project name you used) directory. It will also initialize a git repository in this directory. substrate-demo substrate-node-template directory structure The sub-directory houses the blockchain runtime related logic. The runtime can be called the business logic for your blockchain. It is further divided into runtime modules and each module packages together it’s own state (storage) and behavior (logic). The runtime directory contains files for the runtime modules. runtime The directory contains the low-level code which brings together all the components of the Substrate framework for execution of the runtime. src The node template contains a build.sh script which allows us to build the Substrate runtime for the Wasm (Web Assembly) environment. Running the Substrate Node Once the substrate-node-new command finishes execution, it would have also compiled the source code of the node template (takes a few mins). At this moment, you can already start the node, and it will begin producing blocks. To start the Substrate node, run the following command, in the context of the node-template directory. The following command will start a Substrate node based on the node-template using the dev configuration. In essence, it is running the executable generated by the compilation of the node-template codebase. cd substrate-demo // in case you haven't done this already

./target/release/substrate-demo --dev The command will produce output similar to the following. 2019-04-08 17:28:31 Substrate Node
2019-04-08 17:28:31   version 1.0.0-x86_64-linux-gnu
2019-04-08 17:28:31   by demoauthor, 2017, 2018
2019-04-08 17:28:31 Chain specification: Development
2019-04-08 17:28:31 Node name: adorable-wind-3578
2019-04-08 17:28:31 Roles: AUTHORITY
2019-04-08 17:28:31 Initializing Genesis block/state (state: 0x4397…ab51, header-hash: 0x0353…30ef)
2019-04-08 17:28:31 Loaded block-time = 10 seconds from genesis on first-launch
2019-04-08 17:28:31 Best block: #0
2019-04-08 17:28:31 Local node address is: /ip4/0.0.0.0/tcp/30333/p2p/QmYsPTbsxQiKV8Dk3rWL19xFXxfpt2NrzFRd2P63AjRM3o
2019-04-08 17:28:31 Listening for new connections on 127.0.0.1:9944.
2019-04-08 17:28:31 Using authority key 5FA9nQDVg267DEd8m1ZypXLBnvN7SFxYwV7ndqSYGiN9TmTd
2019-04-08 17:28:40 Starting consensus session on top of parent 0x03534673f220e0514d5324acd179438094e05f4c2419f33226c42e33f5cf30ef
2019-04-08 17:28:40 Prepared block for proposing at 1 [hash: 0xdc6de1c9b04607fe51bf4abed8cfdbd6313a74e9eeda78e3db4f6d2b60e69903; parent_hash: 0x0353…30ef; extrinsics: [0x0421…0149]]
2019-04-08 17:28:40 Pre-sealed block for proposal at 1. Hash now 0x1e5375649660d9e8b8e41fde74c861185a1e55153285e4332111dd0aa240684a, previously 0xdc6de1c9b04607fe51bf4abed8cfdbd6313a74e9eeda78e3db4f6d2b60e69903.
2019-04-08 17:28:40 Imported #1 (0x1e53…684a) As you can see, the node has started producing blocks. Building a Substrate Runtime Module Now that we are all set up with Substrate and our template node is working as expected, let’s build some custom logic for our blockchain. The business logic for the blockchain resides in the runtime modules. A collection of runtime modules constitutes a runtime. Let’s say we want to build a blockchain runtime for a token transfer functionality. To implement this, we would be needing the following: simple State: Total Supply of the token Accounts and Balances mapping Behavior: Initialization of the token (total supply allocated to the owner account) Transfer of token between accounts As mentioned before, a Substrate runtime module packages together it’s own state and behavior. We would be creating a custom runtime module with the storage items and functions as mentioned above. In the node-template directory which we created above, inside the runtime/src directory we will find two files — lib.rs and temaplate.rs. The lib.rs is the Rust crate root for the runtime. It imports all the necessary dependencies and types. It also initializes the runtime modules using some Rust macros part of the Substrate framework. The template.rs is a template of a Substrate runtime module which is included in the node-template. It contains some dummy state and behavior (with a description in code comments) and is fully functional runtime module in itself. To implement our token functionality described above, let’s make some changes to the template.rs file. Declaring Storage Firstly, let’s declare the storage items needed for the token functionality. In the decl_storage! macro call, let’s add the following two items for total supply and balances mapping of the token. TotalSupply get(total_supply): u64 = 21000000;

BalanceOf get(balance_of): map T::AccountId => u64; In the first line, we are adding a storage item TotalSupply to save the total number of the tokens. We are also setting a value to this storage item (21000000). In the second line, we are creating another storage item as a StorageMap with a mapping between an AccountId and the token balance associated with it. We are calling this storage item BalanceOf. The full storage declaration code for this module looks like the following. (Note: We’ve removed the dummy storage items which came with the template module.) // storage for this runtime module
decl_storage! {
  trait Store for Module<T: Trait> as Template {
    
    TotalSupply get(total_supply): u64 = 21000000;

    BalanceOf get(balance_of): map T::AccountId => u64;
  }
} Implementing the Runtime Logic Now that we have the storage defined for our Substrate module let’s write some code to manipulate these storage items. In Substrate modules, public dispatchable functions are defined using the decl_module! macro. We have two functions to implement the simple token transfer functionality in our module. These are the initialization of the token and the transfer function. In the following snippet, these two dispatchable functions — init and transfer are defined in the decl_module! macro. decl_module! {
  pub struct Module<T: Trait> for enum Call where origin: T::Origin {

      // initialize the token
      // transfers the total_supply amout to the caller
      fn init(origin) -> Result {
        let sender = ensure_signed(origin)?;
        <BalanceOf<T>>::insert(sender, Self::total_supply());
        Ok(())
      }

      // transfer tokens from one account to another
      fn transfer(_origin, to: T::AccountId, value: u64) -> Result {
        let sender = ensure_signed(_origin)?;
        let sender_balance = Self::balance_of(sender.clone());
        ensure!(sender_balance >= value, "Not enough balance.");

        let updated_from_balance =         
        sender_balance.checked_sub(value)
        .ok_or("overflow in calculating balance")?;
        
        let receiver_balance = Self::balance_of(to.clone());
        let updated_to_balance = receiver_balance.checked_add(value)
        .ok_or("overflow in calculating balance")?;
        
        // reduce sender's balance
        <BalanceOf<T>>::insert(sender, updated_from_balance);

        // increase receiver's balance
        <BalanceOf<T>>::insert(to.clone(), updated_to_balance);
        
        Ok(())
      }
  }
} Note how we are accessing the module’s storage withSelf::total_supply() and <BalanceOf<T>> to get and set values of these storage items. Note: From a security perspective, these functions do need a bit more in terms of checks and validations. But to keep things simple, let’s skip them for now. That’s it; we have now defined the state and behavior of our tiny blockchain runtime. The full module code is available in the following GitHub gist. We have removed most of the code with came initially with the template.rs file and have only included the proper storage and functions needed for the token transfer functionality. <a href="https://medium.com/media/41a8b7e1dc409ee384f1bba18b5e7c61/href">https://medium.com/media/41a8b7e1dc409ee384f1bba18b5e7c61/href</a> Building and Running the Substrate Node Let’s now run the Substrate runtime we just created through the token transfer functions in the template.rs file. Compiling First, to compile the runtime for the Wasm environment, run the following command in the context of the repository directory. ./build.sh Once the above command completed, run the following command to build the Substrate node for the native environment. cargo build --release Running the Node Running the node is the same as how we did before, just after creating the node-template. ./target/release/substrate-demo --dev This command should again have a similar output, and the node should be up and running, producing blocks. Connecting the Substrate node with a User Interface Now that we have the Substrate node running with the token transfer runtime, let’s connect it with a UI to see it working. The simplest way would be to use the Polkadot Apps Portal. It is a hosted web app primarily made for connecting to the Polkadot network nodes but it can also connect to a local Substrate node. To try it with the , follow the following steps, Polkadot Apps UI Once the local node is running, open the following in your browser, https://polkadot.js.org/apps/ Go to the settings page and select Local Node in the remote node/endpoint to connect to input. Click Save & Reload . The apps portal would be connected to your local Substrate node and if you go to the Explorer page, then it should show the blocks as they are produced. The following screenshot shows the Explorer view of the Polkadot Apps portal with a local node connected. Calling the Dispatchable Functions from the UI To initialize the token, call the init() function under the template section in the Extrinsicspage of the Apps portal. See the following screenshot for reference. As you can see, there is a pre-selected account Alice and it will be used to sign the function call when the Submit Transaction button is clicked. When this transaction is finalized in a block, the account Alice will have all the 21000000 tokens as per the logic in the init() function in our module. Browse Storage Values from the UI After calling the init() function from the UI, the account Alice should have the updated token balance of 21000000. Let’s verify that by checking the storage values from the UI. Recall from the previous section that we used a storage item called BalanceOf to store token balances against AccountIds. Let’s check what is the balance stored with Alice’s AccountId. You can use the Chain state page of the portal to query storage items. Navigate to this page, select template from the first drop-down menu (list of modules) and then select balanceOf(AccountId): u64 from the next menu. From the AccountId menu, select Alice. Now click on the + button. It will show you the updated value for Alice’s token balance (as shown in the following screenshot). That’s it. We have built a simple blockchain runtime and connected it to a UI in less than 20 mins. Yes, it is really that easy to get started with the Substrate framework. This was just a tiny demo for kind of a “hello world” tutorial purposes. You can further extend this runtime module by implementing more functions like approval, transfer_from, etc (from the ERC20 interface). Resources Here are some resources to help you learn and build on Substrate. — The go-to place for developers building on Substrate. Substrate Official Documentation — An in-depth tutorial covering all the basic concepts in an interactive, hands-on way. Substrate Collectibles Tutorial — A set of tutorials covering how to build an end-to-end solution with Substrate (runtime, UI, unit tests, storage patterns, etc.) Substrate TCR Guide

How To Build Your Own Blockchain Using Parity Substrate

FTC v. Amazon Court Filing, retrieved on Sep 26, 2023, is part of . You can jump to any part in this filing . This is part 37 of 80. HackerNoon’s Legal PDF Series here a. Amazon penalizes sellers when Amazon finds lower prices off Amazon 272. Amazon’s anti-discounting strategy has taken several forms. Amazon originally included a clause in its Business Solutions Agreement—a contract every seller must agree to— that explicitly prohibited sellers from offering lower prices elsewhere. From at least as early as (redacted) until March 2019, this contract required each seller to “maintain [price] parity” between Amazon and other online sales channels. This meant that a seller could not offer lower prices on other online stores without breaching their Amazon contract, even when their selling costs were lower on those stores. 273. After European competition authorities launched multiple investigations into Amazon’s price parity clauses, Amazon dropped this requirement in Europe in August 2013. 274. In December 2018, U.S. Senator Richard Blumenthal sent public letters to the Federal Trade Commission and the U.S. Department of Justice expressing “deep[] concern[] that the price parity provisions in Amazon’s contracts with third-party sellers could stifle market competition and artificially inflate prices on consumer goods.” Three months later, Amazon quietly stopped its practice of applying this particular contractual price parity provision to all sellers. 275. Despite making this particular change, Amazon never abandoned its strategy of preventing sellers from offering lower prices elsewhere. Instead, Amazon (redacted) 276. An internal Amazon document written weeks after Amazon dropped its contractual price parity requirement acknowledged that Amazon intended to use (redacted) to enforce its “expectations and policies,” which “ha[d] not changed.” Whether done contractually or algorithmically, Amazon requires sellers to keep prices off Amazon as high or higher than prices on Amazon. Amazon uses (redacted) “not only trivial but a trick and an attempt to garner goodwill with policymakers amid increasing competition concerns.” 277. (Redacted) If Amazon disqualifies every offer for a given product from winning the Buy Box, Amazon removes the Buy Box itself from the product’s Detail Page. 278. (Redacted) 279. (Redacted) 280. (Redacted) 281. Today, Amazon tells sellers that they will be punished if Amazon detects a lower price on any other online store. In 2022, for example, Amazon explained to thousands of sellers that a “pre-requisite” to “win[ning] the ‘Buy Box’” is to ensure that lower prices are never available off Amazon. 282. (Redacted) 283. Today, Amazon (redacted) by wielding a suite of penalties to bury products (redacted) including: (a) demoting them in search results; (b) (Redacted) (c) (Redacted) and (d) (Redacted) 284. (Redacted) Amazon itself recognizes that removing a seller from the Buy Box causes their sales to “tank.” Offers outside of the Buy Box comprise less than (redacted)% of all purchases on Amazon. 285. Amazon’s penalties effectively deter sellers from offering prices elsewhere that are lower than their prices on Amazon, even where their costs are lower through other online sales channels. That in turn limits the ability of other online superstores to offer prices lower than those on Amazon, hindering the growth of would-be rivals and denying them the scale necessary to compete. Continue Reading . Here About HackerNoon Legal PDF Series: We bring you the most important technical and insightful public domain court case filings. This court case 2:23-cv-01495 retrieved on October 2, 2023, from is part of the public domain. The court-created documents are works of the federal government, and under copyright law, are automatically placed in the public domain and may be shared without legal restriction. ftc.gov

From Parity Clauses to Algorithmic Control: Amazon's Price Suppression Tactics

A Tract on Monetary Reform: Chapter III - II. The Theory of Purchasing Power Parity

Bernhard Mueller, the creator of MythX , shows how to detect vulnerabilities in Ethereum smart contracts. On November 6th, a user playing with the Parity multisig wallet library contract , effectively freezing the funds on all Parity multisig wallets linked to the library’s code. According to early estimates this might have made more than $100 million worth of Ether inaccessible (update: in the meantime, that number has ). “accidentally” triggered its kill() function gone up to $280 million As it happens, just a couple of weeks ago I wrote about . The newest Parity accident was caused by an instance of this vulnerability. In this blog article, I’ll examine what happened in the latest attack and introduce a new analysis module that can be used detect similar issues in Solidity code and on-chain contracts. using symbolic analysis to detect unprotected SUICIDE instructions Mythril Ethereum rendition by Shed Designs for EventChain.io First, let’s have a brief look at what happened. User (for the sake of simplicity, I’ll just call him “the attacker”) managed to cause havoc by sending only two transactions. The called the function to set the state variable to devops199’s address. devops199 first transaction initWallet owner Function: initWallet(address[] _owners, uint256 _required, uint256 _daylimit)MethodID: 0xe46dcfeb[0]:0000000000000000000000000000000000000000000000000000000000000060[1]:0000000000000000000000000000000000000000000000000000000000000000[2]:0000000000000000000000000000000000000000000000000000000000000000[3]:0000000000000000000000000000000000000000000000000000000000000001[4]:000000000000000000000000ae7168deb525862f4fee37d987a971b385b96952 You might be wondering why this worked so easily. Weren’t there checks in place to prevent random senders from calling ? As you can see in the , access to this function is restricted with the modifier: initWallet source code only_uninitialized / throw unless the contract is not yet initialized.modifier only_uninitialized { if (m_numOwners > 0) throw; _; }// constructor — just pass on the owner array to the multiowned and// the limit to daylimit function initWallet(address[] _owners, uint _required, uint _daylimit) only_uninitialized This modifier allows the wallet to be initialized once. Normally, when a new wallet is set up, this library function is called immediately during creation. However, itself was never to be supposed to be used as a . It’s only purpose was to provide code to other contracts calling it via . Therefore, and very unfortunately, the library contract instance itself had never been initialized. This was an oversight by the developers, and can be partly attributed to Ethereum’s confusing library/CALL semantics. This topic would warrant its own blog post at some point, but for now let’s focus on the particular attack. WalletLibrary wallet DELEGATECALL Being the contract owner, the attacker now called the function in the : kill second transaction Function: kill(address _to)MethodID: 0xcbf0b0c0[0]:000000000000000000000000ae7168deb525862f4fee37d987a971b385b96952 This terminated the library contract, causing all wallets that depend on the library code to be unusable. Detecting the Bug “unchecked suicide” module attempts to detect exposed kill functions like the one in . The module is executed automatically when running mythril with the option. Mythril’s WalletLibrary -x To try it out, you can run the analysis against the . Unfortunately, Mythril’s on-chain scanning feature can’t be used on the dead contract instance, and the code only compiles with solc 4.10. The best way to get it to work is to first compile the code in , then pass the runtime bytecode to Mythril with the option. You should get the following output: Parity wallet WalletLibrary remix -c ./myth -x -c "60606040(…)0029"=== Unchecked SUICIDE === Type: Warning The function kill(address) executes the SUICIDE instruction. The remaining Ether is sent to an address provided as a function argument. There is a check on storage index keccac_1461501637330902918203684832716283019655932542975_&_caller. This storage index can be written to by calling the function 'initMultiowned(address[],uint256)'. There is a check on storage index 0. This storage index can be written to by calling the function 'initMultiowned(address[],uint256)'. There is a check on storage index 1. This storage index can be written to by calling the function 'initMultiowned(address[],uint256)'. The algorithm works as follows: of all intructions that are not constrained by msg.sender (i.e. callable by anyone); Make an inventory SSTORE Look for instructions and check the constraints on each. SUICIDE If a ‘tainted’ for every relevant storage index found, attempt to solve the constraints on the basic block containing the block to make sure it is reachable. SSTORE SUICIDE It’s a pretty simple check, but sufficient to detect trivial flaws like the Parity one (although it isn’t false-positive-proof). About Mythril and MythX is a free and open-source smart contract security analyzer. It uses symbolic execution to detect a variety of security vulnerabilities. Mythril is a cloud-based smart contract security service that seamlessly integrates into smart contract development environments and build pipelines. It bundles multiple bleeding-edge security analysis processes into an easy-to-use API that allows anyone to create purpose-built smart contract security tools. MythX is compatible with Ethereum, Tron, Vechain, Quorum, Roostock and other EVM-based platforms. MythX

What Caused the Accidental Killing of the Parity Multisig Wallet & How to Detect Similar Bugs

Postmortem: The what, when, and how of the Nov 6th Parity Wallet Hack behold my photoshop skills TL;DR The WalletLibrary contract deployed 1 day after the first Parity Wallet Hack contained a bug that allowed anyone to execute . Someone experimenting with the previous exploit called and, subsequently, on the WalletLibrary, removing it from the . Because the actual wallet contract delegates all calls to this hard-coded WalletLibrary contract, it no longer has the logic to send funds. Parity Multisig initWallet initWallet kill blockchain Approximately 513k ETH (≈154 million USD) has been locked in the affected contracts. No funds were “stolen” per-say; only made unreachable. The user (whose name will go down in history 😄) did this accidentally while experimenting with the previous well-known exploit. devops199 What’s Different from Parity Wallet Hack 1? I’d recommend reading this technical breakdown on how the first hack went down. _A vulnerability was found on the Parity Multisig Wallet, that allowed a hacker to steal over 150,000 ETH._blog.zeppelin.solutions The Parity Wallet Hack Explained The simplified version of Parity Wallet Hack 1 is as follows: The contract is a simple contract that uses to execute transactions using ’s code The WalletLibrary contract assumes that it will be called in the context of a contract that have state that it can modify (namely ) and this is the core assumption that caused the recent disaster. In the first Parity Wallet Hack, the hacker changed the state of various contracts by delegating a call to , setting themselves as the owner of the contract and then withdrawing funds normally. Wallet delegatecall WalletLibrary within the context of the Wallet function. does m_numOwners Wallet initWallet Wallet How and Why In this case, the internal state of the contracts that have been deployed hasn’t been changed; what changed was the internal state of the contract. The contract contains a state variable (along with and similar) that it expects to be shadowed by the calling contract’s own state. The rest of its state is globally shared between all Parity Multisig Wallets that hardcode its address. Wallet WalletLibrary WalletLibrary m_numOwners m_owners After deploy, the WalletLibrary contract is simply uninitialized. is . This means that the modifier (which would act correctly when called in the context of an initialized Wallet contract) always passes. If the WalletLibrary isn’t executed in a Wallet contract’s context, is 0, allowing anyone to call methods that this modifier guards, one of which is . m_numOwners 0 only_uninitialized m_numOwners initWallet Anyone could have called this function at any time in the past 110 days since it was deployed, but it obviously went undetected until now. Result (the Polkadot ICO wallet, containing ~90m USD in ether). Note line 451 where the WalletLibrary address is hard coded. Assuming all calls to this address fail (comments removed and knowing that the constructor isn’t actually included in the contract bytecode), this is what the contract looks like right now: Here’s an example of an affected wallet contract Wallet is WalletEvents {function() payable {if (msg.value > 0)Deposit(msg.sender, msg.value);} function getOwner(uint ownerIndex) constant returns (address) {return address(m_owners[ownerIndex + 1]);} address constant _walletLibrary = 0x863df6bfa4469f3ead0be8f9f2aae51c91a907b4; uint public m_required;uint public m_numOwners;uint public m_dailyLimit;uint public m_spentToday;uint public m_lastDay;uint[256] m_owners; … which doesn’t do much at all, and certainly doesn’t send funds anywhere. Timeline T= Jul 20, 2017 04:39:46 PM UTC The following the aftermath of Parity Hack 1. . Of note are lines 215 ( ) and 225 ( ). [WalletLibrary](https://etherscan.io/address/0x863df6bfa4469f3ead0be8f9f2aae51c91a907b4) contract was deployed You can see the verified source code on Etherscan only_uninitialized kill T= Nov 06, 2017 02:33:47 PM UTC was sent to WalletLibrary, calling the method. This transaction succeeded in making the sole owner. Transaction 0x05f71e1b initWallet [0xae7168deb525862f4fee37d987a971b385b96952](https://etherscan.io/address/0xae7168deb525862f4fee37d987a971b385b96952) https://etherscan.io/tx/0x05f71e1b2cb4f03e547739db15d080fd30c989eda04d37ce6264c5686e0722c9 T= Nov 06, 2017 03:25:21 PM UTC (+51 minutes from previous tx) was sent to WalletLibrary, calling the method with as the beneficiary address. Transaction 0x47f7cff7 kill [0xae7168deb525862f4fee37d987a971b385b96952](https://etherscan.io/address/0xae7168deb525862f4fee37d987a971b385b96952) https://etherscan.io/tx/0x47f7cff7a5e671884629c93b368cb18f58a993f4b19c2a53a8662e3f1482f690 T= Nov 06, 2017 03:54:34 PM UTC (+29 minutes from previous) devops199 created documenting the transactions. parity#6995 https://github.com/paritytech/parity/issues/6995 T= Nov 06, 2017 04:33:00 PM UTC (+39 minutes from previous) devops199 posts a link to the issue in the . parity gitter channel I can’t seem to link to gitter messages, so a screenshot will have to do. and is understandably worried about the consequences. T= Nov 6th, 2017 07:51:00 PM UTC (+ 3 hours and 18 minutes) Parity releases a warning and states that they’re investigating. Possible Resolution Avenues Off the top of my head, here are the three possible approaches for recovering funds: Hardfork, ala DAO Hack, which may or may not result in another “classic” fork. If this is done during the planned Constantinople hardfork, it may proceed particularly smoothly. Break cryptography and deploy a new contract to the hardcoded WalletLibrary address. Which is, at the moment, cryptographically infeasible before the heat death of the universe. , which provides a community-controlled way to recover funds during events such as these. While this EIP doesn’t specifically solve the issue ( ), there is at least some precedent for the community supporting a method like this to avoid a hard fork. Implement EIP156 as noted by sciyoshi In general, though, it seems the funds are locked for the foreseeable future. Possible Prevention Measures How could this have been prevented? The primary cause of the bug seems to be twofold: The quickly-patched WalletLibrary code was not audited after the first Parity Wallet Hack. The library pattern hid the fact that WalletLibrary is an actual contract with internal state. This encouraged an assumption that it would only be called in the context of a Wallet contract. The Solidity library construct would have made this bug much more obvious; Solidity library contracts aren’t allowed to have internal state, so the fact that anyone could call would have been much more obvious. Additionally, they wouldn’t be able to implement ownership (internal state), which is what made this code feel safe; the modifier was expected to perform correctly. initWallet onlyOwners Some possible prevention measures (could have been): After deploying the WalletLibrary contract, anyone could have called with a null owner, effectively locking the contract from change (when called directly). It would still function correctly as a library when the Wallet contract state shadows the null-owner state of the WalletLibrary contract. addOwner Placing the logic within a contract that was designed to be immutable is a suspect decision. Again, it seemed safe because of the modifier and Wallet context assumption, which is why wasn’t placed directly on the Wallet contract itself. At least in the future, monitoring lines will be part of every code audit. kill onlyOwners kill selfdestruct In general, the globally shared state of the WalletLibrary contract was a curious decision. It didn’t directly contribute to this hack, but transparently sharing state between MultiSig contracts like this just feels . weird Who’s Affected? Here’s a list of the wallets affected by the deletion of WalletLibrary, ordered by net worth. ! but wait there’s more Of note: the with 306k ETH Polkadot ICO wallet 0x3bf an with 115k ETH ICONOMI-affiliated wallet 0x376 a with 16k ETH MUSICONOMI-affiliated wallet 0xc7c if you know the owners of the other wallets and don’t mind listing them, let me know! Conclusion Nice. The situation is still developing, to an extent. Parity will most likely announce an update . on Twitter To be clear, I place exactly 0 blame on devops199, and I don’t think anyone else should either. ps. I was the first person to think of advertising on the contract’s old address. On that note, if this post made you happy, informed, or some other vaguely positive emotion, please smash that 👏 button because I feed on imaginary internet points. Thanks to Dror Liebenthal for proof reading the post.

Parity Wallet Hack 2: Electric Boogaloo

Blockchain is one of the most revolutionary technologies in today’s tech space. It has transformed businesses and is touted as the main component of the fourth industrial revolution. It is the first permanent, decentralized ledger of records that has revolutionized the system of records. Using blockchain for developing applications can be a little intimidating for developers at first. However, with the growing number of developers coming on board in the blockchain domain, there is a significantly higher need for efficient tools. Here are a few of the best tools that blockchain developers can utilize enjoying support scalability, flexibility and provide ample of functionalities that are crucial to blockchain development. These tools can be on a . So you don’t need to worry about any other prerequisites or mandatory programs that you might need to use these tools. loaded laptop or computer running Linux or Windows Geth is an implementation of an Ethereum node. In simple language, it is a program that functions as Ethereum blockchain node. It acts as a medium which accepts input commands to execute definite functions. Geth If there are no default values set, Geth will automatically connect to the Ethereum mainnet. It is available on platforms such as Linux, Mac and Windows. Since Geth downloads entire Ethreum blockchain automatically, using an external hard drive is advised. Geth uses the Go programming language and allows the user to do the following: Transfer tokens between addresses Creation and execution of smart contracts on the Ethereum Virtual Machine Explores the block history Mist Before starting with Ehtereum, it is important to use and understand as it is used for the execution of smart contracts. Creators of Ethereum developed an Ethereum wallet which is now known as Mist. It is a full node wallet which is implied to store ether tokens. It is available for Linux (32- and 64-bit), Windows (both 32- and 64-bit) and Mac. To use Mist, one has to download the 1 Tera Byte size of entire Ehtererum blockchain. Mist Once it is downloaded, the software syncs up with the latest Ethereum blockchain. Following the sync, you will be asked if you want to continue on the main blockchain or test blockchain. Then, you will be prompted to choose a password. Make sure that you set a strong password as it can not be changed once it is created. Every time you want to send Ether, you will be asked for your password. So don’t forget it and refrain from sharing it with anyone unless required. Solidity is used to write smart contracts and Ethereum based apps. It is an object-oriented programming language that is slimmed down, a loosely-typed programming language with a JavaScript-like syntax. Solidity It is a slimmed-down, loosely-typed programming language with a syntax similar to that of JavaScript. However, there needs to be an intermediate medium to convert solidity script to a format that can be easily read by Ethereum Virtual Machine. This is where a solidity compiler or “solc” comes in. There are two types of solidity compilers: Solc, which is coded in C++ Solc-js, which uses Emscripten to cross-compile from the source code of solc C++ to JavaScript. Built from similar source code, they tend to give slightly different results from each other. Solc-js is slower as compared to Solc. They also have different line interfaces. Parity After compilation, to deploy contracts on the Ethereum blockchain a development environment needs to be set first. is used as an Ethereum client which is needed to complete the task. It was founded by Gavin Wood, the former Ethereum CEO. Written in the Rust programming language, Parity is directly embedded into a web browser. Parity Parity gives access to basic wallet functions and ethers. It is a secure way to interact with the blockchain. It enables access to all the Ethereum network characteristics that make it a GUI browser for Ethereum. Truffle is a great development suite for smart contracts and asset pipelines. It offers support for the library that links complex Ethereum apps and allows developers to make decentralized applications in a much quicker and easier manner. It promotes custom developments to build new contracts that meet the requirements of the developer. Truffle Truffle enables developers to run automated tests using tools like Chai and Mocha. It is a framework that helps in performing scriptable deployments and migrations. Some of the most important features of Truffle are: Supports custom build processes and allows developers to configure build pipeline. Offers network management for deploying to private and public networks. Has an Interactive console feature for direct contract communication. Smart contract compilation, deployment, linking and binary management built in. The instant rebuilding of assets during development. Blockchain technology has great potential and a bright future with ample of high-paying job opportunities and business ideas. What was initially created as a means to power a decentralized payment network has now transfigured into a decentralized supercomputer network that enables developers from all around the world to come and create their personalized software applications. These tools are some of the most reliable, convenient and easy to use tools in blockchain development. They will help you in your development journey and make it simpler for you to build applications that meet your end goals.

Best Tools for Blockchain Developers

Across habitats, organisms of several species' types come to understand that there are consequences to actions. They do, not just by examples, but by self-experience. These consequences, in part, add to factors that result in balance for habitats. Consequences generally tame intelligence. Intelligence can be described as excitatory, while consequences as inhibitory. Intelligence without consequences would be free to cause ruin and may quickly lead to the collapse of habitats—and survival. Consequences may include affect—emotions, feelings or variants; it may also include physical limitations, restrictions and species revolt. Intelligence is dynamic enough for organisms, but the necessity of consequences checks against harm to self or others. It also checks harm-by-errand, since the consequences could fall on the carrier. Organisms often display high precision and caution, because of consequences, including predators [losing consumption] and preys [losing existence]. There are, however, several areas where consequences for other organisms are lax, that are not, for humans. Human society is a bevy of consequences. Human advanced intelligence—including language, knowledge, skills, reason, analysis and so forth—is vital for progress, but could be widely misapplied without consequences of different categories—including risks, threats and losses. To remain a part of human society, there are consequences that must never be forgotten even if other things are. There are many scenarios in human society where the first to forget the consequences loses. Human quest for advancement with research and exploration can also be described as seeking out consequences, to know what to do or avoid, if things would endure—life expectancy, infant survival and so forth. The intelligence of consequences is almost more important, for several outcomes, than the intelligence of subjects. Consequences may sharpen intelligence, as well, for good or otherwise. Intelligence is sometimes most valuable when applied to seek out or avoid consequences. Consequences and intentionalityare central to some mental states. New consequences continue to emerge, as the world makes progress. AI, AGI—or ASI Nature has a rule—so to speak—you cannot have intelligence without consequences, and that has somehow worked out. Artificial intelligence [AI] so far has broken this rule. It does not forget anything with its plug into digital memory, but it has no way, for now, to bear the consequences of its negative outputs. For AI, there is nothing to fear and it has nothing to lose, unlike organisms, where, without being circumspect in some situations, consequences may sometimes be sudden and destructive. No human has all the knowledge, available across subjects, yet, consequences can be humongous. AI possess—or can make—intelligence available, yet, no consequences for it at all. AI does not have emotions or feelings, but it has memory. A research area for AI safety and alignment could be to seek out how some memory or compute access of large language models [LLMs] might be briefly truncated, as a form of penalty for certain outputs or misuses, including biological threats. AI should not just be able to refuse an output, acting within guardrail, but slow the next response or shut down for that user, so that it is not penalized itself. LLMs have—large—language awareness and usage awareness, these could be channels to make it know, after pre-training that it could lose something, if it outputs deepfakes, misinformation, biological threats, or if it continues to allow a misuser try different prompts without shutting down or slowing against openness to a malicious intent. This could make it safer, since it would lose something and will know it has.
AI is not just an object whose control is solely under humans, like an air-conditioner, an elevator, a dishwasher, a smartphone, or others. AI has what can be called self-intelligence, where it can provide intelligent information in a novel way outside the original inputs from humans. This multimodal—texts, images, audios and videos—self-intelligence can be useful for good or warped. When it is good, great. When it is not, from AI that can feel nothing, the effect is on the human society it has encroached. AI has a free pass—do or say whatever. Although responsibility for object-use or misuse has often been with humans, AI is different because it can originate usable intelligence, giving it parity with some productivity from an educated individual. When AI is misused, it is possible to sanction the user but this ability, by AI that cannot be directly reprimanded is a disorder for human society. It may cause more harm, in public and private, than can be effectively prevented, as seen now with misinformation and deepfakes—images, audios and videos. People are not accepted into many parts of society without their understanding of consequences. AI is fully accepted and gets better at self-intelligence without self-control or self-affect for discipline. Alignment research may explore beyond guardrails towards some form of censure for AI, which may also be useful against existential risks—with artificial general intelligence [AGI] or artificial superintelligence [ASI] in future​. AI already does some of what makes humans special. Some people may argue that it is overrated or it is just numbers or probability, maybe, but can it cause harm? If so, maybe there should be consideration to seek technical ways it might get punished just like it is done, to entities in possession of intelligence. This may also be helpful in preparing for AGI or ASI, since penalty modeling from now, may shape their safety and alignment as well, if they are developed in future. There is a recent preprint on arXiv, Adversaries Can Misuse Combinations of Safe Models, where the authors wrote, "In this work, we show that individually testing models for misuse is inadequate; adversaries can misuse combinations of models even when each individual model is safe. The adversary accomplishes this by first decomposing tasks into subtasks, then solving each subtask with the best-suited model. For example, an adversary might solve challenging-but-benign subtasks with an aligned frontier model, and easy-but-malicious subtasks with a weaker misaligned model. We study two decomposition methods: manual decomposition where a human identifies a natural decomposition of a task, and automated decomposition where a weak model generates benign tasks for a frontier model to solve, then uses the solutions in-context to solve the original task. Using these decompositions, we empirically show that adversaries can create vulnerable code, explicit images, python scripts for hacking, and manipulative tweets at much higher rates with combinations of models than either individual model." A recent press release, Los Alamos National Laboratory teams up with OpenAI to improve frontier model safety, stated that, "Researchers at Los Alamos National Laboratory are working with OpenAI on an evaluation study to bolster artificial intelligence safety. The upcoming evaluation will be the first of its kind and contribute to state-of-the-art research on AI biosecurity evaluations. AI-enabled biological threats could pose a significant risk, but existing work has not assessed how multimodal, frontier models could lower the barrier of entry for non-experts to create a biological threat. The team’s work will build upon previous work and follow OpenAI’s Preparedness Framework, which outlines an approach to tracking, evaluating, forecasting and protecting against emerging biological risks." The US Department of Energy also recently announced Frontiers in AI for Science, Security, and Technology (FASST). Across habitats, organisms of several species' types come to understand that there are consequences to actions. They do, not just by examples, but by self-experience. These consequences, in part, add to factors that result in balance for habitats. Consequences generally tame intelligence. Intelligence can be described as excitatory, while consequences as inhibitory. Intelligence without consequences would be free to cause ruin and may quickly lead to the collapse of habitats—and survival. Consequences may include affect—emotions, feelings or variants; it may also include physical limitations, restrictions and species revolt. Intelligence is dynamic enough for organisms, but the necessity of consequences checks against harm to self or others. It also checks harm-by-errand, since the consequences could fall on the carrier. Organisms often display high precision and caution, because of consequences, including predators [losing consumption] and preys [losing existence]. There are, however, several areas where consequences for other organisms are lax, that are not, for humans. Human society is a bevy of consequences. Human advanced intelligence —including language, knowledge, skills, reason, analysis and so forth—is vital for progress, but could be widely misapplied without consequences of different categories—including risks, threats and losses. advanced intelligence To remain a part of human society, there are consequences that must never be forgotten even if other things are. There are many scenarios in human society where the first to forget the consequences loses. Human quest for advancement with research and exploration can also be described as seeking out consequences, to know what to do or avoid, if things would endure—life expectancy, infant survival and so forth. The intelligence of consequences is almost more important, for several outcomes, than the intelligence of subjects. Consequences may sharpen intelligence, as well, for good or otherwise. Intelligence is sometimes most valuable when applied to seek out or avoid consequences. Consequences and intentionality are central to some mental states. New consequences continue to emerge, as the world makes progress. Consequences and intentionality AI, AGI—or ASI AI, AGI—or ASI Nature has a rule—so to speak—you cannot have intelligence without consequences, and that has somehow worked out. Artificial intelligence [AI] so far has broken this rule. It does not forget anything with its plug into digital memory, but it has no way, for now, to bear the consequences of its negative outputs. For AI, there is nothing to fear and it has nothing to lose, unlike organisms, where, without being circumspect in some situations, consequences may sometimes be sudden and destructive. No human has all the knowledge, available across subjects, yet, consequences can be humongous. AI possess—or can make—intelligence available, yet, no consequences for it at all. AI does not have emotions or feelings, but it has memory. A research area for AI safety and alignment could be to seek out how some memory or compute access of large language models [LLMs] might be briefly truncated, as a form of penalty for certain outputs or misuses, including biological threats. AI should not just be able to refuse an output, acting within guardrail, but slow the next response or shut down for that user, so that it is not penalized itself. LLMs have—large—language awareness and usage awareness, these could be channels to make it know, after pre-training that it could lose something, if it outputs deepfakes, misinformation, biological threats, or if it continues to allow a misuser try different prompts without shutting down or slowing against openness to a malicious intent. This could make it safer, since it would lose something and will know it has. AI is not just an object whose control is solely under humans, like an air-conditioner, an elevator, a dishwasher, a smartphone, or others. AI has what can be called self-intelligence, where it can provide intelligent information in a novel way outside the original inputs from humans. This multimodal—texts, images, audios and videos—self-intelligence can be useful for good or warped. When it is good, great. When it is not, from AI that can feel nothing, the effect is on the human society it has encroached. AI has a free pass—do or say whatever. A research area for AI safety and alignment could be to seek out how some memory or compute access of large language models [LLMs] might be briefly truncated, as a form of penalty for certain outputs or misuses, including biological threats. AI should not just be able to refuse an output, acting within guardrail, but slow the next response or shut down for that user, so that it is not penalized itself. LLMs have—large—language awareness and usage awareness, these could be channels to make it know, after pre-training that it could lose something, if it outputs deepfakes, misinformation, biological threats, or if it continues to allow a misuser try different prompts without shutting down or slowing against openness to a malicious intent. This could make it safer, since it would lose something and will know it has. AI is not just an object whose control is solely under humans, like an air-conditioner, an elevator, a dishwasher, a smartphone, or others. AI has what can be called self-intelligence, where it can provide intelligent information in a novel way outside the original inputs from humans. This multimodal—texts, images, audios and videos—self-intelligence can be useful for good or warped. When it is good, great. When it is not, from AI that can feel nothing, the effect is on the human society it has encroached. AI has a free pass—do or say whatever. Although responsibility for object-use or misuse has often been with humans, AI is different because it can originate usable intelligence , giving it parity with some productivity from an educated individual. When AI is misused, it is possible to sanction the user but this ability, by AI that cannot be directly reprimanded is a disorder for human society. It may cause more harm, in public and private, than can be effectively prevented, as seen now with misinformation and deepfakes—images, audios and videos. AI is different because it can originate usable intelligence People are not accepted into many parts of society without their understanding of consequences. AI is fully accepted and gets better at self-intelligence without self-control or self-affect for discipline. Alignment research may explore beyond guardrails towards some form of censure for AI, which may also be useful against existential risks—with artificial general intelligence [AGI] or artificial superintelligence [ASI] in future​. AI already does some of what makes humans special . Some people may argue that it is overrated or it is just numbers or probability, maybe, but can it cause harm? If so, maybe there should be consideration to seek technical ways it might get punished just like it is done, to entities in possession of intelligence. This may also be helpful in preparing for AGI or ASI, since penalty modeling from now, may shape their safety and alignment as well, if they are developed in future. some of what makes humans special There is a recent preprint on arXiv , Adversaries Can Misuse Combinations of Safe Models , where the authors wrote, "In this work, we show that individually testing models for misuse is inadequate; adversaries can misuse combinations of models even when each individual model is safe. The adversary accomplishes this by first decomposing tasks into subtasks, then solving each subtask with the best-suited model. For example, an adversary might solve challenging-but-benign subtasks with an aligned frontier model, and easy-but-malicious subtasks with a weaker misaligned model. We study two decomposition methods: manual decomposition where a human identifies a natural decomposition of a task, and automated decomposition where a weak model generates benign tasks for a frontier model to solve, then uses the solutions in-context to solve the original task. Using these decompositions, we empirically show that adversaries can create vulnerable code, explicit images, python scripts for hacking, and manipulative tweets at much higher rates with combinations of models than either individual model." arXiv Adversaries Can Misuse Combinations of Safe Models A recent press release, Los Alamos National Laboratory teams up with OpenAI to improve frontier model safety , stated that, "Researchers at Los Alamos National Laboratory are working with OpenAI on an evaluation study to bolster artificial intelligence safety. The upcoming evaluation will be the first of its kind and contribute to state-of-the-art research on AI biosecurity evaluations. AI-enabled biological threats could pose a significant risk, but existing work has not assessed how multimodal, frontier models could lower the barrier of entry for non-experts to create a biological threat. The team’s work will build upon previous work and follow OpenAI’s Preparedness Framework, which outlines an approach to tracking, evaluating, forecasting and protecting against emerging biological risks." Los Alamos National Laboratory teams up with OpenAI to improve frontier model safety The US Department of Energy also recently announced Frontiers in AI for Science, Security, and Technology (FASST) . Frontiers in AI for Science, Security, and Technology (FASST)

PARITY

paritygo.com

11-50 employees

Since 2016

COMPANY RANKING

PARITY

EVERGREEN INDEX #8323

Representing this company? Click here to claim and customize this page!

Parity WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!

PARITY

paritygo.com

11-50 employees

Since 2016

COMPANY RANKING

PARITY

EVERGREEN INDEX #8323

RELATED COMPANIESRANK

STORIES ABOUT PARITY

Representing this company? Click here to claim and customize this page!

Parity WIKI

Apply to get your Tech Company News Page live on HackerNoon.com today!