The opening scene of Christopher Nolan’s The Dark Knight represents the quintessential bank heist. Joker and crew, armed with guns, break into a bank and manage to whisk away gunny bags full of cash. However, not all robberies are this dramatic. As cryptocurrencies become more popular, millions of dollars can be swindled with just the click of a button.
In May, Prof. Emin Gun Sirer, computer science, and his colleagues discovered a bug that left DAO, a smart contract that crowdsources investment proposals, vulnerable to such heists. DAO operates like an online venture capital firm — it gathers the virtual currency ‘Ethereum’ from investors, uses a tally system to vote on investment proposals and funds projects with high enough votes.
“Cryptocurrencies like Ethereum are a new class of distributed systems that are part peer to peer, part bank, part Janet Yellen, part consumers and part merchants,” Sirer said. “They bring together these actors and govern the creation of money to make sure people who earn cash, earn it for good reasons.”
Bitcoin is the most prevalent cryptocurrency today, with around six billion dollars to $10 billion worth in circulation. Ethereum is a relatively new form of cryptocurrency and was designed with a different purpose.
“While Ethereum has the same core operations as Bitcoin, Ethereum is designed to implement programs that direct money flow automatically; Bitcoin is for value transfer alone,” Sirer said.
Essentially, Ethereum allows algorithms to automatically make payments, eliminating the need for “middlemen” to handle monetary transactions. By reducing the chances of human error, Ethereum should have made investing safer.
Unfortunately, a hacker stole $52 million worth of Ethereum from DAO, using a bug that Sirer had discovered.
“The attacker took advantage of a bug related to reentrant calls [that allows programs to pause and restart execution as necessary],” Sirer said. “Reentrancy was part of the language design, but its implications for software design were not well-understood. People missed it because it wasn’t immediately visible in the code.”
Though DAO’s code was eventually replaced, restoring the lost funds required the transaction to be forcefully reverted. However, some Ethereum hardliners felt that any artificial manipulation violated the integrity of the cryptocurrency and so, this was never done.
Instead, a separate currency known as Ethereum Classic was created while Ethereum continues to exist. Furthermore, as no laws governing cryptocurrencies exist, some users of the currency argue that the transaction was legal because the hacker simply used a feature of the smart contract that no one else foresaw.
Despite these challenges, Sirer continues to believe in the potential of cryptocurrencies and argues for their reform. Though safety is of the utmost importance, Sirer argues that the biggest challenge is in implementing cryptocurrencies so that they conform to certain universal principles.
“We need to be certain of how a program will behave, so that we can catch the problems that are otherwise easily overlooked,” Sirer said.“There are many protocols out there, some with very interesting features. This is an exciting field, and it would be best for us to see a thousand flowers, each targeting different feature sets, bloom. I’d urge the cryptocurrency community to avoid infighting — the bigger fight to be had is for external adoption, not between cryptocurrencies, especially between systems targeting different use cases.”