Découverte d’une bogue dans le code de The_DAO et exploitation de cette bogue ce matin pour virer…

Aujourd’hui, vers 1320 UTC, au bloc 1920000, la #chaine_de_blocs #Ethereum a subi un « hard fork » (une fourchette dure ?) :

Il s’agissait de changer les règles pour récupérer l’argent de #The_DAO volé suite à une bogue dans le contrat (cf. ►https://seenthis.net/messages/500970 ) Pas de trucs techniques particuliers à signaler. La nouvelle chaîne (celle où les « actionnaires » de The DAO sont remboursés) est de loin la plus rapide, celle des opposants au hard fork traine derrière.

Le résumé de l’opération par la Fondation Ethereum : ▻https://blog.ethereum.org/2016/07/20/hard-fork-completed

Un article de synthèse en français (derrière un paywall) : ▻http://www.nextinpact.com/news/100716-ethereum-un-hard-fork-controverse-pour-oublier-the-dao.htm

L’adresse où se trouvent désormais les fonds de The DAO (les retraits ont déjà commencé, rechargez la page, vous verrez le solde baisser vite) ▻https://etherscan.io/address/0xbf4ed7b27f1d666546e30d74d50d173d20bca754

Les arguments des opposants au hard fork (le groupe « Ethereum Classic ») : ▻https://bitcoinmagazine.com/articles/rejecting-today-s-hard-fork-the-ethereum-classic-project-continues-

$80 Million Hack Shows the Dangers of Programmable Money
▻https://www.technologyreview.com/s/601724/80-million-hack-shows-the-dangers-of-programmable-money

A huge digital heist is a reminder that when your code has direct control of millions of dollars of assets, it had better be free of errors.

[...]

All software comes with bugs. And money is sometimes stolen via digital means from conventional financial institutions, for example in the recent attacks on the SWIFT system used for cross-border transfers.

But when software is empowered to directly control funds, as Ethereum was designed to allow, security becomes more critical.

Unfortunately, the designers of Ethereum and the DAO don’t appear to have drawn much on standard techniques that programmers and computer scientists have developed to contain the risk of security flaws. The DAO’s code wasn’t accompanied with documentation explaining the design of its various pieces, for example. That could have helped someone spot and fix the flaw used in the DAO heist sooner, perhaps before it was released.

[...]

There were many warnings that Ethereum’s design had security problems before today’s hack. The flaw used against the DAO was flagged earlier this month by Peter Vessenes, a Bitcoin entrepreneur who had previously cautioned that software built on Ethereum would be “candy for hackers.”

In a 2014 paper, researchers at University of Maryland who had asked students to build things with Ethereum concluded that “several subtle details about Ethereum’s implementation make smart contract programming prone to error.”

And in May, Sirer and two people active in the cryptocurrency community, including a researcher with the Ethereum project, called for the DAO to be effectively frozen until security flaws in its voting mechanisms were fixed.

[...]

A real fix for Ethereum’s problems will take a long time, and perhaps a complete redesign of much of its technology.

Cinglant article de la MIT Technology Review.

#Bug_(informatique) #Decentralized_autonomous_organization #Ethereum #Faille_informatique #Piratage_informatique #The_DAO_(organization)