back to article Parity: The bug that put $169m of Ethereum on ice? Yeah, it was on the todo list for months

Alt-coin wallet software maker Parity has published a postmortem of the bug that put millions of dollars of people's Ethereum on ice – and has admitted it knew about the flaw for months. It just hadn't got round to fixing it. Last week, netizens using Parity's multi-signature wallets – which each require more than one person …

  1. Doctor Syntax Silver badge

    "Parity said that it deeply regrets making the coding error that led to the wallet freeze and the loss of the millions of dollars they contain."

    I'm sure those who've lost the millions of dollars are happy to hear that Parity deeply regrets it.

    1. This post has been deleted by its author

      1. MonkeyCee Silver badge

        Re: Nothing is lost

        " Ethereum will hard forked the code."

        So your suggestion for "fixing" a third party developers clusterfuck is to unwind ~5 months of transactions, hard fork the blockchain, and then unicorns?

        How about instead Parity gets sued for incompetence and goes bust?

        Those wallets aren't "frozen", like some bank account under sanctions. They appear to have had another user added to the required signatories, then that user has been deleted. Thus the required signatures can never be obtained.

      2. mosw

        Re: Nothing is lost

        Question: If you can unwind transactions with the agreement of just 51% of users, doesn't that suggest that 51% of users could get together to defraud the other 49%?

        1. Christian Berger Silver badge

          Re: Nothing is lost

          "Question: If you can unwind transactions with the agreement of just 51% of users, doesn't that suggest that 51% of users could get together to defraud the other 49%?"

          That's the basic principle of any blockchain. That's also the promise behind it as it makes it more democratic than a centrally managed system... in theory. However since people can just buy more processing power, the power over the system will be more and more centralized as we see with Bitcoin.

          1. phuzz Silver badge

            Re: Nothing is lost

            "Question: If you can unwind transactions with the agreement of just 51% of users, doesn't that suggest that 51% of users could get together to defraud the other 49%?"

            Well, that's a step forward from yer actual capitalism, where it only takes 1% to screw over the rest of us.

  2. frobnicate
    Facepalm

    "Ethereum prices are currently $330 per coin...

    ... and have risen slightly since the Parity snafu."

    This community *does* deserve everything that happens to them. Reminds one of the immortal passage from Mackay's Memoirs of Extraordinary Popular Delusions:

    "But the most absurd and preposterous of all, and which shewed, more completely than any other, the utter madness of the people, was one started by an unknown adventurer, entitled "A company for carrying on an undertaking of great advantage, but nobody to know what it is." Were not the fact stated by scores of credible witnesses, it would be impossible to believe that any person could have been duped by such a project. Next morning, at nine o'clock, this great man opened an office in Cornhill. Crowds of people beset his door, and when he shut up at three o'clock, he was thus, in five hours, the winner of 2000l. He was philosopher enough to be contented with his venture, and set off the same evening for the Continent. He was never heard of again"

    1. Anonymous Coward
      Anonymous Coward

      Re: "Ethereum prices are currently $330 per coin...

      Huh, what a coincidence, I started reading that book last night. Opening paragraph gave me chills, aside from the more florid victorian vocabulary it could have been written last week about Trump's America :O

      IN READING THE HISTORY OF NATIONS, we find that, like individuals, they have their whims and their peculiarities; their seasons of excitement and recklessness, when they care not what they do. We find that whole communities suddenly fix their minds upon one object, and go mad in its pursuit; that millions of people become simultaneously impressed with one delusion, and run after it, till their attention is caught by some new folly more captivating than the first. We see one nation suddenly seized, from its highest to its lowest members, with a fierce desire of military glory; another as suddenly becoming crazed upon a religious scruple; and neither of them recovering its senses until it has shed rivers of blood and sowed a harvest of groans and tears, to be reaped by its posterity.

  3. Martin Gregorie Silver badge

    It might be rather a good idea for Parity to replace the lost coinage at no cost to those whose wallets have been locked and to do it before they start getting sued for negligence.

    Then they can recover and keep the coin in the blocked wallets. Or carry the loss/face bankruptcy if they can't recover the coin. Either way it will serve them right for being careless, lazy bastards.

    1. Snowy
      Facepalm

      @Martin Gregorie

      That would a good but for the problem they do not have the 513,774.16 coins spare to give away.

    2. Anonymous Coward
      Anonymous Coward

      They'll just pester the devs to include a fix that'll give them the wallets back.

      Ethereum. Where the code is the contract. Mostly. Except where we fuck up the code and need to override the contract.

      If you don't like that, you'll want Ethereum Classic instead. They're more 'If you write a contract and shovel hundreds of millions of dollars into it and oops you didn't consider an edge case and someone finds it? Too bad for you. Hire a few testers or competent coders ffs'

      1. David Given

        It won't be long before someone tries to use an Ethereum contract to enforce a business contract... which will be wrong, and will be taken to court, and the judge will say, "You can't do that, give them their money back", and won't accept, "but code!" for an answer.

        I have some popcorn ready.

  4. Rob Moir

    I'm sure that one day everything will be lovely and fluffy but this just proves that right now, the whole digital currency thing is a complete joke.

    1. Mark 110 Silver badge

      Agree. So how on earth has the price gone UP since this clusterfuck?

      1. Nonstopdrivel

        In a word, scarcity.

        There's a whole lot of Ethereum that's been taken out of circulation in the blink of an eye. I'm starting to think Ethereum is a misnomer. Perhaps they should call it Ephemerum instead.

  5. Sweeping Brush

    Change to code to require only majority of signatories?

    I know enough about cryptocurrencies to know that I dont know enough, but would it be possible to modify the Eth codebase so that multisig contracts only require the consent of the majority of signatories rather than all of them and thus be able to unlock the wallets that way?

    Then once they are unlocked and moved to a safer wallet the codechange can be reverted?

    1. Claptrap314 Bronze badge

      Re: Change to code to require only majority of signatories?

      Presumably, a fix along these lines is not available. In order for these contracts to be at all credible, they have to be resistant to certain classes of modifications. AFAIK, the entire point of a blockchain is that all future changes depend on prior ones--the only way to go back is to recompute every hash in the chain since the offender. In a case like this, where there is no dispute as to who should be the owner of the coins, there should be some constructive solutions that the community can support.

  6. Richard 34

    Scarcity Value!

    Presumably the price rose after this cock-up because the coin is now scarcer!

    Maybe some of the digital world does mirror the real one.

  7. Claptrap314 Bronze badge
    Megaphone

    Still beating this drum.

    Blockchain is an incredible technology that is going to make huge changes. Eventually. But we've got this weird situation where we have entered the early phases of explosive hype growth while the technology is still very much in an exploratory phase. The folks using it now are not "early adopters"--there is nothing really to adopt just yet. They are speculators. The engineering work to figure out just what this technology can and should be made to do is really just beginning. But since the hype has overtaken things already, the serious workers are being swamped with the usual circus acts. I expect that it is going to take some major fails (as if what we've already seen does not count!) to get folks to understand just how hard this class of programming really is.

    This explosive technology is currently in the hands of children.

  8. Ilsa Loving

    Jeebuz....

    "However, rather than just having more audits, we strongly believe that more extensive and formal procedures and tooling around the deployment, monitoring and testing of contracts will be needed to achieve security. We believe that the entire ecosytem as a whole is in urgent need of such procedures and tooling to prevent similar issues from happening again, in particular if and when the number and complexity of live contracts grows."

    Gee, ya f__king think? It didn't occur to you *before*, that top notch security would be necessary in order to reliably handle other people's money?

  9. This post has been deleted by its author

  10. John Smith 19 Gold badge

    Yet Another startup "discovers" formal development process can be quit useful.

    Good thing it's not working on anything important or a lot of peoples cash could be seriously f**ked up.

    IBM federal Systems developed the process to do this in the 1970's.

    1)Do code audits which a)Record bugs but don't fix them on the fly and b)Find bugs, don't blame developers

    2)Identify if there are bug "patterns" of error prone (or just wrong) code

    3) Use those patterns to scan the whole code base for other examples and fix those before going back into retest

    No "deep learning." No neural networks. Just small teams eyeballing the code and writing pattern recognition scripts fed from a code repository where all code changes were tracked by developer and date/time on a line by line basis. SoA in the mid 70's but today....

    Of course that was for a code base in MB, when a 1 MHz 32bit processor with 1MB of RAM was screaming performance at a Rolls Royce cost.

    You'd think in 2017 people could do a bit better, wouldn't you?

    Yet with single processors several 1000x faster and memory several 1000x bigger, with potentially massive MIPS (GIPS?) available on demand, apparently not. :-( .

    1. Anonymous Coward
      Anonymous Coward

      Re: Yet Another startup "discovers" formal development process can be quit useful.

      There are big companies handling large amounts of money with no need for serious formalities. Systems are so completely broken that there's not even a starting or ending point for fixing anything. Replacement is the only cure and it would require essentially rebuilding and re-launching the company. Or... just keep patching stuff that generates the most complaints. These companies have high employee turnover rates so it's easy to blame "the big one" on inherited problems.

    2. Claptrap314 Bronze badge
      FAIL

      Re: Yet Another startup "discovers" formal development process can be quit useful.

      I see you noted the increase in computational power over the last 40 years. Did you also notice the increase in program size? What you are talking about is a human process involving tribal knowledge. Neither fully scales. What does scale are changes in what we are allowed to do in the first place. Tired of fails for zero-terminated strings? Use counted strings. Tired of fence post errors when enumeration collections? Use iterators specific to the collection. Memory leaks are much less of a problem with garbage collection. And so on.

      Unfortunately, I don't see any of this built into the Etherium VM. This would be great comedy if the stakes were not so high.

  11. Christian Berger Silver badge

    You know, there are places where you shouldn't apply Postel's principle

    And that's when you need security. You need to be able to decide whether data is formally correct or incorrect before you act on it.

    That's why, quite some years ago, there's been a LANGSEC movement. Bitcoin apparently already followed the guidlines.

    http://langsec.org/

    or if you are in a hurry:

    http://langsec.org/occupy/

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Biting the hand that feeds IT © 1998–2019