8

As of 18 June no hacker repeated the DAO attack, even if for a certain time (until the network is spammed and the recursion is stopped) the hack would work the same way the first attack worked. What are the reasons that this does not happen?

4

The attack exploits splitDAO. (More specifically, withdrawRewardFor which is inside splitDAO.)

But first a newProposal must be invoked, then a minSplitDebatePeriod of 7 days must elapse before splitDAO can be invoked.

An attacker can also join an existing split to invoke splitDAO per @Roland's comment.

EDIT: Multiple attacks were performed, including a "White Hat attack" named Robin:

... Robin detected that there was a new attack going on. It was draining slowly, a few ether per round, but it had already amassed a few thousand dollars. It seemed to be someone testing the waters and seeing if it could drain more.

Having our hands forced, the group decided to go forwards with the attack. I donated 100k dao tokens to the process with the full knowledge that it could be burned in the process. The more tokens the Robin contract had, the faster it could syphon the ether to protect it. The attacker picked up the pace and other attackers joined in. Some of the most efficient hackers were able to do up to 30 recursions with up to 200 ether moved in each, so it became clear that if we didn't do anything the DAO would be drained before anything could have been done.

We contacted some "whales" who were happy to donate to the effort and we were able to secure about 6M DAO tokens. We made it clear to everyone that we were not sure they would be able to recover these tokens, but these generous friends were happy to contribute to the effort. Thanks to this we were able to outpace the attacker, doing 4,000 and then at up to 40,000 ether per round, totaling up30 rounds of recursions.

  • is the whitelist now empty? – Roland Kofler Jun 18 '16 at 5:26
  • 1
    Whitelist asked in ethereum.stackexchange.com/questions/6229/… – eth Jun 18 '16 at 5:35
  • Your assertion of 10d seems disputable @eth : see vessenes.com/deconstructing-thedao-attack-a-brief-code-tour >>As Martin Köppelmann noted, the attacker actually just joined an existing split with a new wallet contract two days ago. There was no need to wait 7 days, any available split contract would do.<< – Roland Kofler Jun 18 '16 at 6:53
  • 1
    @RolandKofler Thanks, fixed and found the correct variable. – eth Jun 18 '16 at 8:03
  • If attacker joined an existing split then what about the one who made available that existing split. I mean the person who made proposal for the split will also be the member of ChildDAO. So did we see any action from him/her. – Aniket Aug 11 '16 at 9:49
3

It will happen again, and again, and again. You can do it also over every pending split proposal, it's not needed to wait 7 days for a new proposal. You can join the split and when the proposal is over, you can launch the attack. By the way, to launch a good attack, you need to be a solidity developer and to have some money to spend (you need to have or to buy DAO tokens).

And note that because split proposal are faster then normal proposal (7 days vs 14 days) your child DAO with stolen ETHs can be attacked the same way. And so on.

  • DAO tokens are cheap now, but OK the more the better. Smartness is not required as the exploit is described extensively. – Roland Kofler Jun 19 '16 at 15:09
  • 1
    Yes, the exploit is actually described very well. I replaced "smart" developer with "solidity" developer ^^ – Giuseppe Bertone Jun 19 '16 at 15:16
2

Well, it happened at last.

The DAO is being drained again, it seems to be a different attacker. So far there have been 2 transactions: 0x201c0253a6fd5d5e7efb0617acb115dcbd39731869bfba796d7f9656eda3c5f2 0x0f6994bd16df20f0d0992a607ab78e8be1a05cb07b411437fed2fec83be1bc9c

This time, only 0.85 ETH are drained each split.

Additional links: The child dao, The attacker, The contract used for exploitation

edit The attacker only stole 22 ETH yet, probably only testing the exploit

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.