The DAO is under attack, a third of its ether reserves stolen
The DAO, a digital Decentralised Autonomous Organisation that has been set up to support projects related to Ethereum, a public blockchain platform that allows programmable transactions, has been hit by unknown attackers that are draining its ether (cryptocurrency) reserves.
Users who have invested their ether in DAO get a token that allows them to vote on which projects will get funded by the organization and, hopefully, get dividends once the project is successful. According to the organization’s website, they have amassed some 9.23 million ether. At the moment, the attackers transferred a little over a third of it to an ether wallet they control.
The attack was made possible not because there is a vulnerability in Ethereum, but because there is one in DAO.
“The attack is a recursive calling vulnerability, where an attacker called the ‘split’ function, and then calls the split function recursively inside of the split, thereby collecting ether many times over in a single transaction,” Vitalik Buterin, Ethereum creator and one of the DAO curators, explained on the blog of Switzerland-based Ethereum Foundation.
He says that the leaked ether is in a child DAO, and can’t be withdrawn by the attackers for at least another 27 days.
In the meantime, the developers proposed a solution to getting the ether back to DAO token holders.
“The development community is proposing a soft fork, (with NO ROLLBACK; no transactions or blocks will be ‘reversed’) which will make any transactions that make any calls/callcodes/delegatecalls that execute code with code hash 0x7278d050619a624f84f51987149ddb439cdaadfba5966f7cfaea7ad44340a4ba (ie. the DAO and children) lead to the transaction (not just the call, the transaction) being invalid, starting from block 1760000 (precise block number subject to change up until the point the code is released), preventing the ether from being withdrawn by the attacker past the 27-day window. This will later be followed up by a hard fork which will give token holders the ability to recover their ether,” Buterin explained.
This time window will then be used by the community to debate and decide on a definitive fix for the situation.
“Miners and mining pools should resume allowing transactions as normal, wait for the soft fork code and stand ready to download and run it if they agree with this path forward for the Ethereum ecosystem. DAO token holders and ethereum users should sit tight and remain calm. Exchanges should feel safe in resuming trading ETH,” he added.
As the news of the attack spread, many users panicked and began selling their ether, and at the same time ether’s value has taken a sharp dive. But, things seem to have started improving once news of the proposed solution got around (click on the screenshot to enlarge it):
The situation seems stable right now, but it the hard fork is implemented, the stolen funds will be retrieved, but it will be the end for DAO.
“The DAO will be winded down completely and transformed into a simple contract where you can only withdraw. It’s shutting down but as no ether was stolen and no ether was spent, nothing was lost,” stated Stephan Tual, founder and COO of Slock.it, a company that created a system for building smart locks with Ethereum, and hoped to receive funding via the DAO.