5

How did the DAO get hacked? Can someone explain in simple terms?

Improve this question
1

4 Answers 4

Reset to default
3

The simple high level explanation would be like this;

When you (as a DAO token holder) split from DAO, it creates a new child DAO and pays you back (in a transaction) your share by sending it to the new splitted DAO, (your DAO).

The attacker created a loop (by recursively calling the splitDAO function) caused the DAO paying several times instead of once.

This loop caused the DAO repeatedly (27996 times) transact the amount of 237.62451099999999 Ether to the new child DAO.

Improve this answer
3

Ethcore blogpost does a good job at describing the history of the hack. Basically they knew about the vulnerability two days before the attack and fixed the function that they though was affected. Read more here slock.it blog.

From the guy who wrote about the vulnerability before the attack:

I wrote up this vulnerability last week: you can read more about it at my blog. In simple words, it's like the bank teller doesn't change your balance until she has given you all the money you requested. "Can I withdraw $500? Wait, before that, can I withdraw $500?"

And so on. The smart contracts as designed only check you have $500 at the beinning, once, and allow themselves to be interrupted.

The blog post he mentions can be found here.

Improve this answer
3

A reasonable analogy I've heard is:

  • You go to an ATM and withdraw the money.
  • After the ATM gives you the money, you unplug the ATM before it updates your account.
  • You plug the ATM back, withdraw money and repeat the process.

One of the things that can help mitigate this reentrant attack is for the ATM update to your account first, before giving you the money.

Improve this answer
1

It repeatedly uses a part of the dao code to send Ether to a new child-dao which is under the hackers control but blocked for 27 days there from withdrawal.

Why couldn't he just extract it to his own wallet? As the code does not allow this for a new created Dao for a predefined period of 27 days.

Improve this answer
3

Not the answer you're looking for? Browse other questions tagged or ask your own question.