Here is a more detailed explanation of the exploit.
The Pepaire-Bueno brothers exploited a bug in MEV-boost’s code that allowed them to preview the content of blocks before they were officially delivered to validators, according to the indictment.
The brothers created 16 Ethereum validators and targeted three specific traders who operated MEV bots, the indictment said. They used bait transactions to figure out how those bots traded, lured the bots to one of their validators which was validating a new block and basically tricked these bots into proposing certain transactions. […]
So hardly an attack on any core system of cryptocurrencies.
So they discovered faulty code and made some money?
Can anyone explain to me how this is illegal?
The code is a contract. If someone writes bad code and loses money, then write better code - just like if someone writes a bad legal contract and loses money.
IANAL and all, but bad/unfavorable contracts and literal deception/fraud are two different things, at least in the legal system. Not everything that’s technically possible is also allowed, obviously.
Compare it to using a security flaw to hack into a system. Technically you’re only using the official API, maybe in unusual ways, but still. But you’re doing it in bad faith and causing harm, maybe pretending to be someone you’re not or injecting fake data into the system, and that can make a difference.
Hacking a private corporate system, which is generally on closed nets and requires an internal actor / phishing, is significantly different from exploiting a code fault on a public network.
Trustless systems rely on mathematics to secure their networks. This is both the revolution of them and the risk. If you build a system of value and it is on a public network, and you fail to properly secure it, that is supposed to be the risk. You lose money, hopefully go bankrupt / lose credibility, and a more efficient actor eats your lunch.
Treating it like a traditional system with these unspoken legal safeguards when it uses a public blockchain and public network is absurd.
You can’t just make up your own permission and punishment system, and then expect the legal system to just step aside and let it handle all disputes, especially when it comes to fraud. That’s like founding your own city in an existing country, and declaring all existing law obsolete. I know some people think this is a real possibility, but the real world doesn’t work like that.
Here is a more detailed explanation of the exploit.
So hardly an attack on any core system of cryptocurrencies.
So they discovered faulty code and made some money?
Can anyone explain to me how this is illegal?
The code is a contract. If someone writes bad code and loses money, then write better code - just like if someone writes a bad legal contract and loses money.
The justice system is awful.
IANAL and all, but bad/unfavorable contracts and literal deception/fraud are two different things, at least in the legal system. Not everything that’s technically possible is also allowed, obviously.
Compare it to using a security flaw to hack into a system. Technically you’re only using the official API, maybe in unusual ways, but still. But you’re doing it in bad faith and causing harm, maybe pretending to be someone you’re not or injecting fake data into the system, and that can make a difference.
Hacking a private corporate system, which is generally on closed nets and requires an internal actor / phishing, is significantly different from exploiting a code fault on a public network.
Trustless systems rely on mathematics to secure their networks. This is both the revolution of them and the risk. If you build a system of value and it is on a public network, and you fail to properly secure it, that is supposed to be the risk. You lose money, hopefully go bankrupt / lose credibility, and a more efficient actor eats your lunch.
Treating it like a traditional system with these unspoken legal safeguards when it uses a public blockchain and public network is absurd.
What’s absurd is this crypto maximalist take.
You can’t just make up your own permission and punishment system, and then expect the legal system to just step aside and let it handle all disputes, especially when it comes to fraud. That’s like founding your own city in an existing country, and declaring all existing law obsolete. I know some people think this is a real possibility, but the real world doesn’t work like that.
The “real” world works however the people want it to.
As it stands, it works with laws that protect the rich and elite with superior rights.
Someday, maybe the people will decide on a more equitable system. Nature and mathematics might be heavy contributors to that system.