Relive the Ethereum "The Dao" Hack

Editor's Note: This article comes fromFirst class warehouse blockchain research institute (ID: first_vip1)Editor's Note: This article comes from

First class warehouse blockchain research institute (ID: first_vip1)

First class warehouse blockchain research institute (ID: first_vip1)

, Author: Spreeha Dutta, translation: First Class Warehouse (First.VIP), reproduced by Odaily with authorization.

Ethereum is an open source platform based on blockchain and the birthplace of smart contracts. Its token ETH currently ranks second in market value.

In June 2016, Ethereum was hacked, and more than 3.6 million ETH was stolen by hackers, worth about 50 million US dollars.

Here are a few blockchain terms to better understand such attacks for novices:

DAO: Decentralized Autonomous Organization, which acts as a computer program in which the organization's policies and decision-making structures are encoded. It is transparent to all stakeholders, so no central authority is required.

Smart Contract: A computer protocol designed to digitally facilitate, verify or enhance the negotiation or performance of a contract. Smart contracts execute reliable transactions without the need for third parties. These transactions are traceable and irreversible (Wikipddia). In short, it is code that executes on the Ethereum blockchain and can interact with ETH and user wallets.

Distributed Ledger: A public database of all transactions on the Ethereum blockchain and maintained by every Ethereum node.

Ethereum utilizes the above concepts to make the blockchain have the most important security and immutability. When these core principles are threatened, the losses of stakeholders are immeasurable!

Backstory of the hack:

Ethereum (Ethereum) was founded in 2015 by 21-year-old Vitalik Buterin, who wanted to achieve a decentralized Internet through Ethereum. Crowdsourcing campaign raised Ethereum startup capital (sold $18 million worth of ETH).

Ethereum is a decentralized autonomous organization (DAO). In April 2016, a German start-up company called Slock.it launched "The DAO". It was compromised within two months of its launch, and hackers began withdrawing ETH from the "DAO" and transferring it to a child DAO that had the same structure as the parent. This directly caused ETH to drop sharply from $17.5 to $13.

The problem with Ethereum

Hacktivism

The hacker used the loophole to great advantage and stole ETH within the legal framework. Ethereum is a platform where all transactions can be done with Gas as the transaction fee, which is the cost of executing smart contracts on the blockchain. Attackers exploit this vulnerability by flooding the capacity of Ethereum blocks with worthless illegal transactions. This results in a delay in actually using the transaction.

However, the attacker cannot access the ether in the sub-DAO for 28 days because that is the initial funding period of the sub-DAO. Any attempt to exit the child DAO will raise an alarm. And the attacker can't do it again!

image description

An open letter from hackers to the community

Unsolved issues in Ethereum

A problem that the designers of Ethereum have not yet solved is that all ETH is stored in one address. This provides an opportunity for hackers. Of course, the idea of ​​splitting the "DAO" to prevent attacks did catch the attention of stakeholders, but at the time there wasn't much time to reach consensus and vote on it.

There were only two options at the time. One is to go with the flow, but you could end up losing millions of dollars. The second option is to perform a soft fork first, followed by a hard fork. This goes against the principle of immutability represented by the blockchain, i.e. the previous state cannot be changed. This has raised many doubts.

In response to the DAO vulnerability on June 17, Vitalik Buterin said: "The development community is discussing a soft fork, (no rollback; no transaction or block will be undone), which would make any transaction execution with a hashcode call/ The calling code/delegate call (i.e. DAO and children) invalidates the transaction (not just the call, the transaction), preventing the attacker from withdrawing ETH after the 27 day window. A hard fork will follow, which will make the token holding holders are able to restore their token holdings.”

However, the soft fork proposal was later shelved as it raised numerous security concerns. On the other hand, the majority of Ethereum stakeholders were in favor and agreed to the hard fork.

image description

Historical price of Ethereum (Source: Google)

Ethereum hard fork