Top all-time · #5596
Peter Vessenes
Personal blog · vessenes.comsecurityeconomics
Peter Vessenes's personal blog at vessenes.com covers security and economics. Since 2016, 14 different Hacker News readers have linked it 23 times, most often “The DAO Vulnerability”. The last post was in 2023, but the archive is still widely read.
Too few sampled comments (8) to say how often HN recommends it.?
Why HN links it
HN readers link Peter Vessenes's posts on Ethereum and TheDAO attack, explaining how the bug worked and warning about smart contract risks. Commenters use them as explanations of the attack and as sources.
Summarised by Claude from a sample of 8 HN comments that link here. Each comment is marked recommending, critical or neutral (citing without judging); how this works.
PV: is investing, incubating, building, inventing Peter Vessenes is a technologist and investor with deep roots in digital currency, tokenization, and blockchain. An early adopter of Bitcoin (he started mining in 2010), he co-founded the Bitcoin Foundation in 2012 where he served as its Executive
Most-linked posts?
- The DAO Vulnerability5 people · 7 mentions · first linked 2016-06-09
- Deconstructing the DAO Attack: A Brief Code Tour5 people · 5 mentions · first linked 2016-06-18
- Ethereum Contracts Are Going to Be Candy for Hackers3 people · 3 mentions · first linked 2016-05-18
What Hacker News says?
I've written a longer post about this: http://vessenes.com/point-counterpoint-ethereum-miners-shoul...
Comment linking /point-counterpoint-ethereum-miners-should-blacklist-thedao-theft/
on “Critical Update on DAO Vulnerability”Submitted Deconstructing the DAO Attack: A Brief Code Tour as a story · 253 points
HN discussionI wrote this attack up last week -- a solidity dev initially noticed this bug, but seemed to think it wasn't a big deal. http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t... The comments here are generally spot on; it's a combination of problems -- upgradability is designed to be hard because other people's money shouldn't be easy to steal, programmers are not used to making whole programs reentrant, exis…
Comment linking /more-ethereum-attacks-race-to-empty-is-the-real-deal/
on “Critical Update on DAO Vulnerability”Submitted Ethereum Contracts Are Going to Be Candy for Hackers as a story · 193 points
HN discussionIn case anybody is wondering how this happened, it looks like the attack is exploiting the "recursive call via default function" vulnerability [1]. [1]: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t...
Comment linking /more-ethereum-attacks-race-to-empty-is-the-real-deal/
on “Critical Update on DAO Vulnerability”Submitted Ethereum: Hard Fork Security Issues as a story · 3 points
HN discussionRisk free, assuming the DAO doesn't have a bug that allows an attacker to steal all the money. Somewhat related: "Ethereum Contracts Are Going to Be Candy for Hackers" http://vessenes.com/ethereum-contracts-are-going-to-be-candy... HN discussion: https://news.ycombinator.com/item?id=11725624 (192 points, 6 days ago, 83 comments)
Comment linking /ethereum-contracts-are-going-to-be-candy-for-hackers/
on “Coinbase Co-founder: Ethereum Is the Forefront of Digital Currency”Submitted Ethereum: Tx.Origin Attacks, Oh Wow as a story · 3 points
HN discussionWell perhaps but I read this article ( http://vessenes.com/deconstructing-thedao-attack-a-brief-cod... ) and it says: "OK, here we go. _recipient.call.value()() is called without a gas amount. That is easily attackable with an attacking wallet."
Comment linking /deconstructing-thedao-attack-a-brief-code-tour/
on “Ethereum is Doomed”Submitted The DAO Vulnerability as a story · 3 points
HN discussionHere's a better explanation of the attack: http://vessenes.com/more-ethereum-attacks-race-to-empty-is-t... Ethereum is not doomed. But devs do need to be educated of this attack.
Comment linking /more-ethereum-attacks-race-to-empty-is-the-real-deal/
on “Ethereum is Doomed”Submitted TheDAO Whitehats: Make a refund wallet first as a story · 2 points
HN discussionYou've nailed it. In this case, the call stack depth would halt you before TheDAO runs out of funds, though. So you end up with some multiple, say 30x, where you can put in 1 ether and drain 30 ether. There is about a month lockup period during which your seed cash and your multiplied cash is frozen. What made this particularly devastating is that there was a second bug which allowed the attacker to transfer their t…
Comment linking /deconstructing-thedao-attack-a-brief-code-tour/
on “Ethereum is Doomed”Submitted Ethereum Miners Should Fork as a story · 2 points
HN discussionThe code at that location in the Ethereum blockchain implements a Decentralized Autonomous Organization that takes Ether from participants in exchange for tokens granting them the right to vote on proposals for this specific DAO to fund and the right to receive any benefits from the execution of funded proposals. This is the primer to the how it is supposed to work: https://blog.slock.it/a-primer-to-the-decentralize…
Comment linking /deconstructing-thedao-attack-a-brief-code-tour/
on “An Open Letter (The DAO Attacker)”Submitted More Ethereum Attacks: Race-To-Empty Is the Real Deal as a story · 2 points
HN discussion`Transfer` is an event, `transfer` is a function. This [0] is from TheDAO attack and is one of the (many) bugs making the attack so terrible. As for name mangling, read this [1] and see if it seems sane to you. For bonus points [2], `this.foo()` and `foo()` mean two wildly different things. I don't even know what they were thinking. [0] http://vessenes.com/deconstructing-thedao-attack-a-brief-cod... [1] http://solid…
Comment linking /deconstructing-thedao-attack-a-brief-code-tour/
on “Underhanded Solidity Coding Contest”Submitted More Ethereum Attacks: Race to Empty Is the Real Deal as a story · 2 points
HN discussionThis also explained it well, predicting contracts would be full of problems http://vessenes.com/ethereum-contracts-are-going-to-be-candy...
Comment linking /ethereum-contracts-are-going-to-be-candy-for-hackers/
on “Why an unhackable mobile phone is a complete marketing myth”Submitted Ethereum Wallets Attack: Griefing Wallets Can Lock Contracts as a story · 2 points
HN discussionSubmitted We Need Some Best Practices for Smart Contracts as a story · 2 points
HN discussionSubmitted More Ethereum Attacks: Race-to-Empty Is the Real Deal (2016) as a story · 1 points
HN discussionSubmitted Race to Empty: TheDAO exploit published last week as a story · 1 points
HN discussion