Ethereum is Doomed

http://nakamotoinstitute.org/mempool/ethereum-is-doomed/#selection-7.4-7.22

by kushti • 10 years ago

299 209 10 years ago

The programming classic "Mythical Man Month" had a chapter for the "second system effect". Its where developers put lots of complicated features in to the second system in a series. Its a pattern for failure.

In this case, Ethereum developers built a much more complicated cryptocurrency by making it Turing complete - to the extent of writing their own new computer language and virtual machine to run it.

They skipped over the halfway step of declaring parameters in the payment transactions, that open source enterprise library code, e.g. Java, could execute for for required behavior. No. They made the new code itself a user-contributed and immutable! part of the system.

viraptor6• 10 years ago

That's actually a pretty good decision in my opinion. At least in this case. Think what would happen if they went for alternative solutions:

1. If it wasn't immutable, you'd never be sure when a contract changes. That's the basic assumption about contract - once you sign it, whether in real world, or by doing some action in Ethereum, you don't expect it to change how it works. That's why immutable is good.

2. User-contributed is just how it's supposed to work. It's decentralised. Everyone's a user. The content has to be user-contributed. Having some central publisher/gatekeeper is contrary to the whole idea.

3. Own VM is debatable. Sure, they could go with JVM, but the scope would have to include much more complexity (classes, namespaces, etc.) than just function/instruction execution. Maybe the limits of javacard would be enough, maybe not.

I really don't think the second system effect applies here. It's not a rewrite of something that existed and had issues.

yawaramin• 10 years ago

Solidity contracts are already modules which contain functions. They're equivalent to Java classes with static methods or Scala objects. As for namespacing, I don't know how in this day and age programmers can say that's not worth it.

dasil003• 10 years ago

Is it a case of Second System Effect, or Build One to Throw Away? I don't have an opinion either way, but just pointing out that the very same pattern is also known as a successful one in some cases.

sp332• 10 years ago

Build one to throw away means you're building the same "system" again, but with more specific requirements based on what you learned. Second system effect is building a bigger system will broader and vaguer requirements.

(Also, Brooks later said: "This I now perceived to be wrong, not because it is too radical, but because it is too simplistic. The biggest mistake in the 'Build one to throw away' concept is that it implicitly assumes the classical sequential or waterfall model of software construction." He wrote a later book, The Design of Design, encouraging iterative development.)

maxander• 10 years ago

Turing-completeness was the entire conceit of Ethereum, as I understand it- without that you would have Bitcoin with a few bells and whistles, and no one would bother. And once you're committed to that, a new language and environment are essential- something this entire fiasco shows is that a language for contract programming has very different requirements than what software engineers are currently used to, in order to be safe in ways that don't apply to ordinary software.

In all likelihood, a working and reliable Ethereum simply requires computer science theories we don't have yet. A working Solidity would probably look something like Ada, but with types and invariants the likes of which we've never seen. Its potentially a very interesting research subject! But for now, yes, investing in Ethereum is like climbing aboard in a rocket aimed at Mars- exciting and futuristic, but unlikely to get you where you hope to go.

dvdkhlng2• 10 years ago

I think we have a lot of theory about turing-complete computation. I really wonder why somebody would be willing to sign a turing-complete contract? The problem of understanding properties of the contract may be NP-hard [1] i.e. practicallly uncomputable. It may even be undecidable by involving instances of the halting problem [2].

[1] https://en.wikipedia.org/wiki/NP-hardness

[2] https://en.wikipedia.org/wiki/Halting_problem

cheez4• 10 years ago

They created a situation in which bugs would be expected to arise in an environment in which bugs are legally exploitable. That is hacker heaven.

Every single system has this problem. You think banks aren't hacked?

pmorici4• 10 years ago

What _legally_ exploitable bank bugs have you heard of? Keyword there being legally.

cheez4• 10 years ago

It's effectively legal because a lot of financial fraud is not pursued.

For example, people from different countries scamming old people out of $1000 for Prince Abu to free his millions.

That being said, I can understand why you think something being legally exploitable is something new. Just like a loophole in a contract is a loophole in a contract.

In the case of smart contracts, there is no recourse unless built in to the contract. This is by design.

All that's going to happen is people will start writing smaller, more testable, less damaging contracts. This regime is different from legal contracts because many lawyers specifically write contracts to create problems later. In this new world, good contract writers will be gods.

So if you're a good software engineer, there is potentially a huge market about to open up for you.

cyphar7• 10 years ago

This exploit wasn't legal either. It was blatantly fraud. I've asked a lawyer for their opinion and it was a very simple question to answer. Contracts are never entirely literal and usually there are implied clauses in contracts. There is a very simple test called the "officious bystander": if there had been a neutral bystander who had asked "should we allow anyone to take $50 million dollars without our consent" then unless both parties would've said "of course!" then it isn't considered to be a clause of the contract and it is just simply fraud. The developers of theDAO wouldn't have said "of course" so it's fraud.

DavidPlumpton• 10 years ago

Jeremy Clarkson published his bank account details in his column to back up his assertion that you can send money to a bank account but not withdraw any. However apparently anybody can set up an automatic payment from any account to any other account...

mmanfrin3• 10 years ago

Banks aren't legally exploitable.

IanCal• 10 years ago

Was the hack legal? A system letting you in if you poke it just right doesn't mean you are legally allowed in. I fail to see how a bug in banking software would be any different to the bug in the DAO.

xoa3• 10 years ago

As other comments say, legality and hard failure are big differentiators here, and in fact the specific language you used invokes a really key point. Emphasis added:

You think banks aren't hacked?

There has been a lot of general description of the individual or group that performed the splitting as an "attacker" or "hacker", but the very nature of the system in question subverts the conceptual foundation of "attacking". To be an "attack" rather then a legitimate execution of an agreement, the action would have to be "illegitimate", but when legitimacy is explicitly defined by the code itself, then how can any action allowed by the code be illegitimate? It'd be a different issue entirely if the underlying VM or a system had been exploited, but merely doing as the code allowed when the code is made the agreement's authority?

Also, I've been using "agreement" here too rather then "contract" because, despite the label of "smart contract" Etherium has adopted I think there's a basic legal question about whether legally they're "contracts" at all. A contract is a subset of the space of agreements; all contracts are agreements, but not all agreements are necessarily contracts. There are many factors in determining validity of contracts and a huge body of contract law that has already been discussed a great deal, but all that depends on there being a contract at all, and for that there needs to be an agreement where the parties intend to be bound by the law (of whatever jurisdiction whose enforcement power they wish to invoke). There are many agreements where there is no intention to have legal enforceability, and in that case the courts have nothing whatsoever to say on the matter. Contract law never even enters the picture.

The DAO, and Etherium in general, have made a big deal specifically about not invoking the courts. That was supposed to be part of the entire point of smart "contracts", that they'd have nothing at all to do with any common legal system and be self-contained in and of themselves. In turn though that could mean that any smart contract that declares itself fully self-definitional is in turn not a contract period, so there cannot be an "attacker" in the legal sense.

Bank hacks in contrast aren't much different in concept from bank heists of any other kind. They are able to invoke real world power in response, and have multiple levels of fallbacks and insurance for their customers. It's by design a much softer fail, multiple level system with an expectation of occasional failure built-in and a strong human element. This adds expense and inefficiency, but provides benefits to imperfect human societies too. It came out of ages of real world experience and testing after all.

cyphar7• 10 years ago

It was definitely fraud. Either it was a contract, in which case "taking $50 million without anyone's consent" doesn't pass the officious bystander test. Otherwise it wasn't a contract, so the default is still fraud (though in that case, the DAO would be the thing being defrauded rather than the investors).

barisser• 10 years ago

Software is almost always flawed to a certain extent.

The problem with Ethereum is that you can't push a fix to your contract.

vessenes• 10 years ago

You absolutely can if you're not too proud to imagine you'll need to upfront.

mmanfrin3• 10 years ago

Having a little bit of trouble parsing how the attack worked -- so when a transfer happens, the destination account gets to run a command; they then ran a command that called the source's send-ether command, which ran because it was still in 'we owe destination account money' mode because the full initial contract had not concluded?

Then at some point it terminates itself before emptying the source account (and thereby causing a rollback that would cascade back?)

darawk• 10 years ago

My understanding is that it looks essentially like this:

    send(theEther, childDao)
    deduct(theEther, tokenHolder)

But that you can get it to overflow the stack in between the two so that the send completes but the deduction no longer happens.

DennisP5• 10 years ago

If you overflow the stack it throws and rolls back (which is another attack in certain circumstances). What killed TheDAO is basically that childDao called back the sender method, which sends again without having deducted yet.

Do the deduct before the send, and the whole problem goes away.

amaks5• 10 years ago

Here is the analysis:

http://hackingdistributed.com/2016/06/18/analysis-of-the-dao...

carver• 10 years ago

You've nailed it. In this case, the call stack depth would halt you before TheDAO runs out of funds, though. So you end up with some multiple, say 30x, where you can put in 1 ether and drain 30 ether. There is about a month lockup period during which your seed cash and your multiplied cash is frozen.

What made this particularly devastating is that there was a second bug which allowed the attacker to transfer their token that represented that first ether back to the DAO. So instead of 30x return, they could eventually drain the whole DAO (although they stopped after the discussion of a fork began).

I'm largely basing my understanding off this article: http://vessenes.com/deconstructing-thedao-attack-a-brief-cod...

3pt141593• 10 years ago

Ethereum isn't doomed. I don't think it will ever have as much backing as Bitcoin because of institutional buy-in; but the world needs programmable smart contracts. Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them. Individual will is what cryptocurrencies are about. Bitcoin in terms of international payments and store-of-value; and Ethereum in terms of contracts and computing.

altoz• 10 years ago

RTFA. The idea of smart contracts isn't dead, but Ethereum looks like a terrible platform for it, given that it's very hard to audit the smart contracts on it.

whiddershins• 10 years ago

I agree with your sentiment but downvoting because the guidelines specifically ask that you not say things that imply a commenter hasn't read the article.

jerf• 10 years ago

A contract-based blockchain seems very likely to me. But there's no reason that has to be Ethereum. Having had the chance to sort of ponder this over the last couple of days, I can't help but come to the conclusion that Ethereum is indeed fundamentally flawed and probably entirely unsalvageable, for all the reasons given in that blog post and more. The eventual contract-based blockchain that succeeds is going to look a lot more, well, engineered, for lack of a better word. Probably a lot more proofs of various things. Fewer features that are all individually much stronger.

In fact, there's little reason to believe that something this complicated would be done correctly the first time. Remember... Bitcoin is not the first digital currency either!

timmytokyo• 10 years ago

Ethereum is doomed, and not just because it's based on a poor design. It's doomed because it just shot its credibility to shreds by protecting a single, uniquely privileged contract. Forking proves that the ethereum network cannot be trusted as the neutral contract arbitrator it was designed to be.

The idea of smart contracts is an interesting one, and perhaps another project will come along and do it better. But Ethereum won't be that project.

heliumcraft3• 10 years ago

Based on a poor design? according to who? It's the most advanced blockchain out there by far and wide! This was a single contract with a flaw, it's like saying the whole internet is doomed because some website got a SQL injection.

JorgeGT2• 10 years ago

Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them.

But apparently it only takes a fork to freeze/reverse their contracts. I would take my chances with a traditional foundation, Alfred Nobel's is still running smoothly since +110 years ago, yearly executing its "code".

viraptor6• 10 years ago

I think you're thinking of use cases that would definitely be stopped outside of ethereum world:

Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them.

You can do things like this, but the law either already covers this, or will adjust. If you gain money, you're expected to pay the usual tax on that gain. First few may get away with it, but once it becomes popular, audits will start.

Individual will is what cryptocurrencies are about.

Same as above - inheritance tax.

Essentially it's this xkcd situation: https://xkcd.com/1494/ Just with wealth gain and tax office instead.

Tinyyy• 10 years ago

The point of Ethereum is to provide something that is different from the real world. If not, it is simply fiat, except that it is 1000 times more inefficient and burns up loads of electricity.

bendbro2• 10 years ago

As long as you never convert into traditional currency, how will they know you participated in a transaction?

3pt141593• 10 years ago

You cannot rely on the law to treat your wishes long after you are dead. The largest park in Toronto (High Park), for example, should technically not be owned by the city because the person that bequeathed it to the city said that it would revert to some other organization if a catholic was ever elected mayor, but that never happened.

As for XKCD - where something happens is no longer clear cut. If someone creates a etherium contract during a year in Argentina while SSH'd into a computer in Hong Kong it starts to become very difficult to enforce the law.

I'm not even talking strictly about tax evasion I'm talking about subversion of the states restriction on individual action - and I agree that this isn't a good thing across the board. I don't like the idea of billionaires hiding their influence and wealth, I just think it is inevitable.

jacques_chester2• 10 years ago

Some rich soon-to-be-dead billionaire tech nerds want to be able to do something every year without worrying about a judge taking that away from them.

Billionaires still have nexuses with the physical world. The machines which execute their code, for example, can absolutely be affected by court orders. So too can their homes, their cars, their planes, their drones and of course their person.

There's a brand of techno-utopianism that assumes that if it's virtual, it's magically immune from the whole mechanism of law. This has never been true. The law asserts itself to be omnipresent in all human affairs and -- unlike a computer program -- the law's power is accepted at face value by billions of people and underlined by men with guns and dogs.

lsc• 10 years ago

the law's power is accepted at face value by billions of people and underlined by men with guns and dogs.

emphasis mine. I find that last bit, though, to be super interesting; "enforced by men with guns" has always been a big part of the rhetoric of any discussion of law, anarchist, or libertarian thought.

But... I'm not sure I've ever seen dogs mentioned in that context.

kalleboo• 10 years ago

want to be able to do something every year without worrying about a judge taking that away from them

Except we're just about to prove that an institution can decide to nullify a Ethereum contract with the soft/hard forks. In the very best case that will a cabal of miners with unknown intentions (and clearly they're not too invested in the Libertarian "code is contract" angle of the network) instead of a democratically constructed judicial system.

peterbonney• 10 years ago

"without worrying about a judge taking that away from them"

Unfortunately the ultimate arbiter of the courts' authority is not a piece of code or a piece of paper, but the courts themselves. If someone disputes the authority of a contract (smart or otherwise) that dispute will ultimately be settled in court. Even if the contract contains language claiming that it is not open to interpretation by a certain court or set of courts, the validity of THAT language will ultimately be interpreted by... a court.

There is no degree of technical cleverness that can supersede the authority of a sovereign entity. You can hide things from a sovereign, move things out of the reach of a sovereign, but you can never overrule a sovereign's authority within its own borders.

3pt141593• 10 years ago

In which border does the Etherium contract reside and who should the court order name?

dkarapetyan13• 10 years ago

I didn't know the language was turing complete. Isn't this computing 101? If you want a secure thing then you must be able to reason about it statically. Making things turing complete means any non-trivial property of program correctness can not have a generic solution and so you've just opened yourself up to a world of hurt.

aakilfernandes7• 10 years ago

The whole point of Ethereum is turing completeness. Ethereum without Turing completeness already exists and its called Bitcoin.

While this implementation of The Dao has failed, Ethereum is the only blockchain where implementing The Dao is possible.

TylerE• 10 years ago

There is a huge canyon between "you can use this small set of ops" and "turing complete".

drdeca2• 10 years ago

There is a thing that advertises itself as being like Ethereum but without the Turing completeness.

It is meant to be able to do more computation based stuff than Bitcoin, but without being Turing complete.

However, they seem to have confused the halting problem not being computable with Godel's second incompleteness theorem? (They might have corrected this since I saw when they published something with this.)

dkarapetyan13• 10 years ago

This doesn't sound right to me. Contract law should not require turing completeness. First order logic should be more than sufficient. How does having a loop in contract law make any sense?

intrasight• 10 years ago

I also don't see the relevance of it being TC. I've heard regex is TC. Wouldn't want to write a contract in regex.

naasking6• 10 years ago

Ethereum without Turing completeness already exists and its called Bitcoin.

There are an infinite number of non-Turing complete languages. Not-Turing complete != Bitcoin.

eternalban• 10 years ago

Another VC funded outfit I chatted with also boast of TC. This is, I agree with you, software engineering 101. But that's probably it: don't know about you, but I could not stomach making a pitch for funding for the latest hype [1] knowing that the fundamentals are unsound.

I am hoping that the recent events -- Theranos, out-smarted contracts, etc. -- will permit a return to maturity in this field. Money has poisoned this field.

[1]: wrote about (genetically) evolving cellular corporation back in '96 so this is not a case of I don't get it.

rtpg3• 10 years ago

Well for one it costs you money to run the programs so if you want to run your program forever you can try that but it's a bit of a money pit.

I think the idea vehind TC is that now you could write in certain styles that do guarantee termination without sacrificing readability.

For example if you're working with just primitively recursive functions you can always guarantee termination

So the prerequisite for people investing is for the contract to be in a certain style, or something

EDIT: besides, even without TC you still need to check the contract for logic bugs. TC is a bit of a red herring for "due diligence is always needed"

wyager8• 10 years ago

You can reason statically about turing-complete languages. They just have to be syntactically restricted to forms amenable to mathematical analysis. Ethereum's scripting language is poorly designed for this.

Many high-tech fintech digital contracts are written in languages like Haskell or Ocaml. Fintech people value strong types, declarative programs, immutability, etc.

dkarapetyan13• 10 years ago

Correct. That is what I mean but you still don't just want a restricted subset. You want something that guarantees termination and also lets you reason about any weird runtime behavior and resource usage in a very rigorous way. Some of these things are still research problems and some of them are barely becoming practical in languages like Rust.

plaguuuuuu2• 10 years ago

Turing completeness isn't so bad when you have a relatively low gas limit on a transaction that ensures you can halt at some point.

Maybe I spent too much time in functional languages and I've been doing too much React stuff lately but the way I see it, we have

    Contract_method(state, parameters) => {new state, return value}

You could always run the program on a fake, mock state then test postconditions for sanity. So, if those postconditions pass and we haven't run out of gas, run the program for real, otherwise return an error.

Eg transferring 30 eth from contractA to contractB you would have one of the postconditions asserting that ContractA balance is the old balance minus 30.

The notion of gas implies a stack or effort limit, so it's guaranteed that any operation will eventually fail once it runs out of resources. Thus you can specify a theoretical upper limit on resources used in pre-verification, which (AFAIK)is paid by the client contract that requests to withdraw money from the other contract.

I guess one could avoid this by using a DSL that is formally verifiable, but it's still an interesting option

dkarapetyan13• 10 years ago

Yes, I'd assumed since Ethereum was so highly touted and hyped that the foundations of the entire thing were sane. Well I mean sane in the sense that the actual contract language was as restrictive as possible and custom made for expressing contract law but it turns out you can do arbitrary computation and although in theory you're limited by this gas thing because the language is not formally specified and verified it is not clear at all if there are no other bugs lurking around with respect to bypassing the gas bounds.

What you described is basically abstract interpretation and if it was designed properly then the type system would have taken care of the simulation piece.

DennisP5• 10 years ago

I have actually tested this attack technique (using my own contracts on a local test chain), and I've been in discussions with some Solidity developers and the guy who first published the attack. The situation is not as bad as this article claims.

For starters, you can use address.send(x) instead of address.call.value(x)(). All computations on Ethereum have to be funded with "gas" (transaction fees), and send() only forwards a small amount of gas. The recipient can write to the log but that's about it. TheDAO used .value() which forwards all the available gas.

If you do use .value(), then you can do it safely by doing it only once per method, as the very last step, and only using it in top-level methods. Then any sort of reentrant callback will find any required state changes already done. E.g. subtract from the user's balance, send the funds, and if the send fails then throw. The recipient can call back but the balance is already decremented. Using a mutex is another option. I've tested all this and it works.

There are a lot of reasons Ethereum is designed this way. The most common reason for a contract to run code when receiving funds is to prevent users from accidentally losing their money. E.g. in any contract that holds ether and maintains a ledger with balances for multiple users, if anyone sends ether to the contract address, they'll lose it, unless the contract either throws an exception or automatically adds to the user's balance on its ledger.

User addresses and contract addresses are interchangeable, because it lets you do things like use a multisig timelocked vault to receive funds and anything can send to it just as if it were a regular user account.

All that said, the devs are working on improvements too.

amaks5• 10 years ago

All computations on Ethereum have to be funded with "gas" (transaction fees)

But that's what was wrong with the exploited DAO code - it didn't use gas. The point of the article is that it's very hard or impossible to verify the correctness of the smart contracts.

aakilfernandes7• 10 years ago

it didn't use gas

this is incorrect

yarrel2• 10 years ago

Send at the end is like return-once or tail recursion.

Does -

http://www.joeykrug.com/home/a-serpent-send-exploit

change things at all?

DennisP5• 10 years ago

Nope, Serpent is a different language that compiles to the EVM, and Krug just noticed that by default, a send in Serpent includes more gas than Solidity does, opening a door to unexpected attacks.

Solidity is the official supported language, Serpent is an earlier and slightly lower-level language that some people still use. I expect they'll fix the gas default.

curiousgal2• 10 years ago

Well Well Well, what do you know, someone who has actually looked into things and not just basing their statements on their anti-crypto beliefs.

ianpurton2• 10 years ago

The situation is not as bad as this article claims.

Well it kind of is actually. The people that wrote the DAO script had the script checked by lots of Ethereum experts and the bug slipped through.

So if the Ethereum experts can't stop things like this happening then what chance do individual developers have. Basically creating a turing complete scripting language on the blockchain is not secure.

No financial institution will risk creating smart contracts on this platform.

tomw1808• 10 years ago

Whenever I hear "expert" I think of https://www.youtube.com/watch?v=BKorP55Aqvg

wickedlogic• 10 years ago

Not a knock on your post, but "checked by experts" is like saying "QA looked at it". If the tools aren't in place to warn/prevent, re:"stop things like this", unintended executions are only going to continue. It is the brave new old world.

aakilfernandes7• 10 years ago

Here's a better explanation of the attack: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t...

Ethereum is not doomed. But devs do need to be educated of this attack.

coldcode• 10 years ago

It is doomed, who would trust a contract now with real "money"? Unless you have a mathematically rigorous proof that the contract is trustworthy I sure wouldn't.

aakilfernandes7• 10 years ago

Hopefully no on ever trusts a contract with 100 mill for a while, but for lower values and simpler contracts... absolutely i would.

endergen2• 10 years ago

I love that Smart Contracts act basically as bug bounties to make the Ethereum systems, community knowledge, and open contracts improve dramatically.

dragontamer• 10 years ago

I love how law and court systems are basically bug bounties on legal systems, community knowledge, and social constructs. Society will inevitably improve dramatically.

Oh wait, no. We just turned programmers into politicians and lawyers. I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract".

Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.

endergen2• 10 years ago

I hear your sentiment. But not your argument as much. Politicians and Lawyers are inherently > smart contract writers?

'I think more people will be pissed when they find out that "trust in the system" ultimately means "trust the writer of the smart contract".' How is this different than not trusting Lawyers?

'Unlike law, which has admitted that insane things happen and provides "emergency stops" (ie: Supreme Court can say whatever the heck they want and provide a check against any of Congress's laws)... there isn't really a way to add human "emergency stops" to the equation of Ethereum.' Agreed on using Ethereum contracts anytime in the near future (or ever) for anything life or death or over exposing your self financially is insane. There are plenty of cases that are a better fit for a smart contract system. People should invest affordable proportions of their money.

verbify• 10 years ago

Except that once theere's a lot of money in smart contracts, people will hack the contracts without letting people know. Somebody's going to complain about "losing all their money in a contract and they don't know why" but they'll be ignored as technically ignorant and in the meantime, the thief will walk with lots of money.

munificent• 10 years ago

Solidity is like programming in JavaScript, except with your bank account accessible through the Document Object Model.

Such a beautiful, terrifying sentence.

henrik_w• 10 years ago

I recently saw this on Twitter, and thought it was pretty funny:

"What's Ethereum?"

Imagine that your dollar bills were written in Javascript.

(from @random_eddie)

graup2• 10 years ago

This is a very snarky hyperbole. Solidity has as much to do with Javascript as Java does.

For starters, Solidity is a compiled, typed language.

It is still new and has to be improved.

sesm• 10 years ago

Solidity is a compiled, typed language.

The same language can be both compiled and interpreted, this doesn't affect the semantics of the language. For example, OCaml ships with both a compiler and an interpreter. There exist AOT compilers for JavaScript too.

Also, JavaSript is a typed language. It is just dynamically typed and does too much type coercion.

anaphor• 10 years ago

What if they had used a language without the possibility of recursion and without loops? I'm being serious. Languages that disallow certain types of recursion, and disallow loops exist. You'd think they would've used something that actually allows for total functions that are guaranteed to terminate in a certain way, instead of a JavaScript clone...

aakilfernandes7• 10 years ago

We want to allow recursion and loops. We want to be able to run arbitrary code.

We just need to be a little wiser about how we do it.

dkarapetyan13• 10 years ago

How did this madness start? I don't want law to be turing complete. Especially programatic law. Why are people so nonchalant about this? This is not sane design. You want totality and termination proofs. At least that's what I would look for in any programatic system of law.

marssaxman2• 10 years ago

Why on earth would you want that? How can such a staggering explosion of potential complexity justify itself?

pushrax• 10 years ago

You don't need recursion to have a useful computing system. Think about GPUs, which don't have a stack at all.

TD-Linux• 10 years ago

You are describing Bitcoin script.

AceJohnny2• 10 years ago

I'm getting a strong Accelerando deja-vu here.

(ref: http://www.antipope.org/charlie/blog-static/fiction/accelera... )

odrekf• 10 years ago

As expected, "Ethereum is turing-complete" turned out to be just a marketing meme (or a horrible idea at best), just like "Litecoin is silver", "Doge is community", and all the others.

heliumcraft3• 10 years ago

Absolute trash article.

bithive123• 10 years ago

"I thought again about my early plan of a new language or writing-system of reason, which could serve as a communication tool for all different nations... If we had such an universal tool, we could discuss the problems of the metaphysical or the questions of ethics in the same way as the problems and questions of mathematics or geometry. That was my aim: Every misunderstanding should be nothing more than a miscalculation (...), easily corrected by the grammatical laws of that new language. Thus, in the case of a controversial discussion, two philosophers could sit down at a table and just calculating, like two mathematicians, they could say, 'Let us check it up ...'" --Gottfried Wilhelm Leibniz

teslaberry• 10 years ago

run for the bitcoin hills!.

apapli• 10 years ago

Surely an issue here irrespective of technology flaws or not is the economic impact on the time taken to write smart contracts.

If it now takes substantially more dev time to write a smart contract that is "secure" (ie by spending lots and lots of time testing for vulnerabilities) this will invariably come at a cost.

So while the theory of smart contracts is brilliant this recent hack might go down in history as a case study as to why writing contracts is too expensive to do in all but the top 1% of situations.

xoa3• 10 years ago

I wrote this originally in response to a post by cyphar (https://news.ycombinator.com/reply?id=11942889), but I'd really love a response from anyone with more knowledge or thoughts on how the law might interpret this situation in relation to already existing "virtual legal systems". cyphar wrote:

  "It was definitely fraud. Either it was a contract, in which case "taking $50 million without anyone's consent" doesn't pass the officious bystander test. Otherwise it wasn't a contract, so the default is still fraud (though in that case, the DAO would be the thing being defrauded rather than the investors)."

I'd like significantly more details on your legal theory for how this was "definitely fraud" or how "the default is fraud" if there was no legal contract, the split executor was a direct party to the agreement, and the terms of the agreement were followed. "$50 million" was not taken, 3.6 million or so "ether" was split out from the original smart contract/account, which may or may not end up having some dollar value.

In at least two previous threads [1, 2], comparisons were made to the MMOG EVE Online (developed by CCP Games), and I think the analogy raises some interesting questions. EVE is a self-contained artificial system that, so long the system framework itself is not exploited, is ruled entirely by code. It has a digital currency (ISK) that has an official conversion rate from real world fiat currency to ISK, and an unofficial ToS breaking (but non-criminal AFAIK) conversion rate from ISK back to fiat. CCP has nothing to do with this exchange, but exchanges for ether to other currencies are also 3rd party. Virtual items as well as ISK itself thus have calculable value, both within the system, in terms of time/rarity, and in terms of nation-state issued money. There are person-actor driven "contracts" of various sorts, and people driven markets. There is fraud, piracy, and pure chaotic destruction as well, and that's considered entirely within the system framework so long as the overall code rules of the world are not violated.

Given that, what exactly is the legal difference between the DAO and EVE Online? In EVE, if Alice attacks Bob, or infiltrates his organization, and steals/destroys a few hundred billion in ISK (equivalent to a few thousand dollars at current exchange rate), or sets up a fraudulent bank/scheme that makes off with hundreds of billions or trillions (this has actually happened), do you think Bob should be able to sue in a real world court of law? The essence of the situation looks similar/identical to me: that the parties are operating under a non-contract non-legal agreement to be governed within the a specific set of world rules, and that therefore any interactions within those world rules, however angry they might get about it on a personal level and whatever colloquial English they might use to describe it, creates no legal standing of any sort outside. If EVE client/server were hacked (the world rules distorted) it'd be an issue (though still not necessarily a legal one), just as if the Ethereum VM was hacked it'd be an issue, but if those were operating entirely as they should be then what's the basis of legal complaint? What's the generalized objective basis for court involvement in people agreeing to mess around with made up numbers on computers, even if other people decide to try to exchange those numbers for money?

1: https://news.ycombinator.com/item?id=11925904

2: https://news.ycombinator.com/item?id=11929208

tamana5• 10 years ago

Legally speaking, CCP goes out of its way to emphasize that isk are play tokens money with no cash value, and losing it all is part of the game. TheDAO/Ethereum supports exchanging ether for money. And anyone who lies about contract (beyond smiling and saying "here the contract code, sign it if you want" is commiting a fraud

xoa3• 10 years ago

Legally speaking, CCP goes out of its way to emphasize that isk are play tokens money with no cash value

CCP officially supports converting money to ISK, and there are 3rd party exchanges for ISK to money. My understanding was that TheDAO ran purely on ether, and that any exchanges for money (be it fiat or another digital currency) were also happening purely 3rd party. Does an official line on "don't go the other way" make a material difference? If CCP merely took no stance on it at all, involved in no way but not working to ban anyone doing it, would that change anything? How "seriously" do they have to police it? Is there any case law on this?

And anyone who lies about contract (beyond smiling and saying "here the contract code, sign it if you want" is commiting a fraud

Can you clarify your point here, and what you were referring to?

1. (and again): How is there any legal contract here, and if there isn't what's the 'fraud' legally (not a colloquial "fraud" with no legal impact)? Are you arguing that people should not be allowed to have non-legally binding (and thus non-contractual) agreements on shifting around "value" based on coded rules?

2. In the case of TheDAO, there were no lies, TheDAO stated clearly and repeatedly that the definitive governing authority was the smart contract itself, and TheDAO organization itself was not (or at least, publicly claims it was not) involved in the controversial smart contract execution. Instead it was at least one of the independent parties to the agreement. So if you were referring to TheDAO I'm confused.

3. In the case of EVE, are you arguing that ISK is different and therefore fraud is legally ok? Or are you arguing that it's still legally fraud?

baybal2• 10 years ago

Fiy, i recently came upon this company http://m.imgur.com/Hv9n7fk,55JgdgK that wants to sell ETH to Chinese. I checked the company registry, and found out that the guy has registered a proprietorship back in 2013.

Apparently a friend of Vitalik

amq• 10 years ago

It is just a job posting.

erikpukinskis• 10 years ago

People (rightly) make the same critique of Bitcoin: it is very easy for regular people to lose their money. To keep it safe you need to be a security expert, and even then there are no guarantees, and mistakes are forever.

My response is the same for both Bitcoin and Ethereum:

Even if these technologies are only used by trained professionals, they can still be revolutionary. Almost no one can safely operate a printing press, and yet that invention has toppled empires.

At worst, these are back office technologies. At best in a decade or two someone will figure out how to design a good enough GUI that a novice can safely explore a powerful subset the technology, trusting that bumpers are in place around the sharp edges.

jbmorgado2• 10 years ago

People at large are not supposed to put money in printing presses they can't use properly, they are supposed to put money in books made by those printing presses.

Ethereum is definitively unsafe, it's basically impossible to create code without any bugs, and it's impossible to prove a piece of code doesn't have any bug. That defeats the all purpose of Euthereum.

Bitcoin is just unsafe by nature for the user, although the protocol itself is most probably safe.

bobjones201606• 10 years ago

Could the person who got the DAO's ETH create a contract to pay out miners who vote against a hard fork with the "stolen" ETH?

patrickk• 10 years ago

Probably quite difficult in practice, unless he/she could somehow convince a mining pool or something.

Another option would be to set up mining hardware in a place like China with low cost electricity. However, this would take time, money and serious effort - if you cash out ether to fund it, you likely crash the price, and if you succeed in fighting the hard fork, the split in the community would likely destroy the trust in Ethereum and your funds go poof.

tromp• 10 years ago

Assuming contracts can identify the coinbase address of past blocks, then that would be relatively straightforward.

But this may not be up to the miners alone. Perhaps even more important is what for the major exchanges choose to run, since they're needed to convert Ether back into BTC/fiat currency. If a major exchange makes a public announcement committing to either the soft or hardfork, then that will sway a great many miners.

yarrel2• 10 years ago

....to succeed. ;-)

lquist• 10 years ago

The Coinbase founder that a month ago called ethereum the future of cryptocurrency looks kind of silly now.

Animats• 10 years ago

It's now clear that Ethereum's contract system has major security vulnerabilities. This is a killer flaw for something which exists only to secure transactions between mutually mistrustful parties. Maybe someone else will do this again, better. Etherium itself probably is doomed.

There are also hard questions to ask the people involved. The same people seem to be behind Etherium, the DAO, and the programmable door-lock startup which the DAO was supposed to fund. This is suspicious. This might be an inside job. At least three times in the Bitcoin world, some Bitcoin exchange claimed they lost money due to a "hack", but in the end it turned out to be an inside job.

rwallace4• 10 years ago

The problem with Turing completeness is that if it's not there from the start, people inevitably end up needing features that aren't present in the restricted language, and then a Turing complete language is added to either the original system or a successor, and being an afterthought it usually ends up being a hack job.

Examples: SQL was supplemented with procedural languages for stored procedures, Excel was supplemented with VBA, HTML was supplemented with JavaScript and, well, Bitcoin was supplemented with Ethereum.

So providing a Turing complete language was the right decision as far as it goes, but it's not enough by itself. If you need reliability - which this does - it needs to be the case that typical code does not involves arbitrarily complex computation. Typical code needs to fit stereotyped patterns whose behavior is predictable.

If Ethereum is to continue, it's clear that exhorting people to try even harder not to make mistakes in the current version of Solidity, won't cut it. The language needs to be supplemented or replaced with something that makes it easy to write correct code for the kind of things people typically want to do.

edejong• 10 years ago

There are languages which are both expressive and Turing incomplete, for example Coq. In the Coq language, Turing incompleteness is actually needed to be able to make complete proofs. Maybe Solidity would have been better implemented within Coq, but it's too late now.

lmm• 10 years ago

See http://publications.lib.chalmers.se/records/fulltext/234939/... (suggesting Idris for this use case)

lomnakkus• 10 years ago

Edwin Brady's coined(?) a nice term for this: Pacman Complete

rwallace4• 10 years ago

Is it too late now? It seems to me that it should be possible to implement a better language on top of the existing system, there are plenty of languages that compile to JavaScript after all, so it's still worth discussing what a better language might look like.

You say Coq is expressive; okay, but in what sense, for what purposes? A language which isn't Turing complete - or even one which is - isn't going to be expressive for all purposes. As I understand it, Coq is designed to be expressive for the kind of things people doing research in type theory want to write, in the same way SQL is designed to be expressive for database queries.

What sort of things do smart contracts typically want to say? Are they more similar to type theory research, database queries or something else?

One possible answer is that it's too early to say yet, in which case perhaps extensibility is an important attribute. For example, suppose Racket were used as a language for writing smart contracts, with a backend to generate Ethereum byte code. Being a dialect of Lisp, Racket is highly extensible. It also has an optional type system. Do smart contracts tend to be prone to the kind of errors that are caught by a type system? If so, it would be worth using one.

jobigoud• 10 years ago

it's too late now

Ethereum uses a virtual machine. There already have been several different languages to write contracts.

cwmma2• 10 years ago

Coq is pretty specific in what it does like css (also Turing incomplete. There is a pretty low bar for features needed to make something Turing, it doesn't take much more then mutable variables and a while loop or recursive functions to impliment rule 110

chriswarbo• 10 years ago

Interestingly, Coq is expressive enough to write arbitrary computations; for example, you can write a Universal Turing Machine emulator; or, more realistically, many people write programming language implementations in Coq, in order to prove results about them.

However, Coq can only run those computations for a given number of steps; in other words, you can't say "run this until it halts, and give me the result", but you can say "give me the result after 3^^^3 steps, or 'Nothing' if it hasn't halted by then".

The reason this is interesting in this discussion is that Ethereum uses "gas" in a similar way.

a-nikolaev• 10 years ago

Yep, yep, and if contracts were written in Coq or a similar language, it would be easier to formally prove that they are "safe" from smarty pants hackers..

That would be a really nice application for formal methods, it seems.

pt1988• 10 years ago

Its too bad, I really thought Vitalik was the Chosen One, but I think he reacted incorrectly here by panicking and showing concern.

If I had been him I would have let DAO fail without even discussing any fork. Be as emotionless about it as the code itself. Admit mistakes were made, somebody (DAO investors) will lose some money in the short term but stay true to the principles of Ethereum.

PLUS even after all this drama, $ETH has a market cap of ~$1B as well as independence (fingers crossed) from government intervention making it an alternative to Fiat currency, as well as a much better block rate than BTC lending itself to mining on consumer-grade GPU's for the moment at least. I'm looking at litecoin LTC as my next crypto-bubble investment as well.

There's still lots of good to be said about Ethereum. DAO is toast, long live DAO2! Ethereum will come out stronger long term.

thelollies• 10 years ago

I wonder if a language like Haskell with a strong type system and strict typing could help. If you were able to express exchange of currency with the type system.

codygman• 10 years ago

I'm pretty sure you can do that. See units in F# for example.

anonbanker• 10 years ago

Doom articles mean market debasement is happening.

If you have the ability to invest, this is a good time to do so. you're about to see massive increases in valuation.

Ethereum is Doomed

Related Stories