Oops, we blew up all your money.
Today someone “accidentally” deleted some critical code used by the popular Parity multisig wallet.
I have no idea if this was the real person or not, but it doesn’t matter. It happened.
We’ve been here before. Just a few months ago *the same wallet* had a hack that allowed attackers to steal $30mil in funds. They would have stolen more, but white-hat hackers beat them to it, stole the funds first and then nicely gave it back.
I guess you really can count on the kindness of strangers.
How did this happen??
UNIT TESTS should have helped. The bug was introduced in the refactor that occured after the last hack. One of the primary points of unit tests is to protect yourself during a refactor. The key is, you need to unit test not only what should happen but what should NOT happen. Apparently that didn’t occur.
The most worrisome part here: If the most experienced people in the business can get crushed, what are your chances? The creators are none other than Gavin Wood and his team. Gavin co-founded Ethereum and helped write solidity. How many years of experience does he have? Only ALL OF THEM.
I’m not knocking Gavin by the way. We’re all human. And that’s the problem.
It Wasn’t Even On Purpose?
Playtime with millions! — Photo by Dawn Armfield on Unsplash
It appears this wasn’t a dedicated attacker, this was someone “playing around”. What does that mean for the ecosystem? How many bugs like this are lurking for someone to accidentally blow it all up?
The biggest app for Ethereum so far is the ICO. And while I’m a huge fan of ICOs, it’s not reassuring to investors to have millions lost by various small bugs every few months. ICOs are great, but we need an approach that doesn’t let “oops” lead to hundreds of millions of lost funding. I’ve heard that it’s “growing pains” and it will “get better” but this is a recurring theme. People write code, people are imperfect and write imperfect code, imperfect code has bugs, and if all your money relies on perfect code because it’s on a blockchain then you can’t rely on your money which means you won’t rely on the blockchain. And if you can’t rely on the blockchain… what’s the point?
Help me help you: Want in depth knowledge of blockchain?
If you really want to understand blockchain and what it means for the future of technology, check out my new book: Blockchain Quick Reference
Blockchain Quick Reference: A guide to exploring decentralized blockchain application development_Blockchain Quick Reference: A guide to exploring decentralized blockchain application development — Kindle edition by…_www.amazon.com
Audits aren’t enough
It’s clear that despite extensive peer review that the code for the Parity wallet cannot be trusted. Chances are, plenty of other code can’t be trusted either. One thing is clear: Audits aren’t enough. This is heavily scrutinized code. We need better tools and we need them now. Again, this isn’t against Parity, Gavin, or his team. This is an ecosystem wide problem stretching back to the DAO.
Proper Tests
It’s key that for every function in every contract there need to be unit tests against authority. Who can run the function, who cannot, and when? This needs to become the standard and expectation. Every contract will need to have every function called by every user access level involved — including anonymous.
And that’s why checking for this is part of the code audit process at BlockSimple. We can’t let a mistake like this happen again.
In the meantime, be careful. And for the love of money, don’t put it all in one wallet.
Help me help you: Want in depth knowledge of blockchain?
If you really want to understand blockchain and what it means for the future of technology, check out my new book: Blockchain Quick Reference
Blockchain Quick Reference: A guide to exploring decentralized blockchain application development_Blockchain Quick Reference: A guide to exploring decentralized blockchain application development — Kindle edition by…_www.amazon.com
About BlockSimple
We think Blockchain technology can change the world, but only if it works for ordinary people and organizations. We’re devoted to making Blockchain… simple! Check out http://blocksimple.consulting