A reentrancy bug drains 3.6 million ETH from The DAO and forces Ethereum's defining choice

JUN 17 2016 · 12:05

Video: Code is Law? The Story of the Most Infamous Ethereum Hack in History Date: 2016-06-17 · Type: failure · Tags: hack, reentrancy, security, dao, ethereum, 2016, code-is-law The attacker did not break the contract. The contract executed exactly as written. That was the problem. In the early hours of June 17 2016, an attacker began calling The DAO's `splitDAO` function recursively — exploiting a reentrancy pattern that allowed repeated ETH withdrawals before the contract's internal balance register updated. Peter Vessenes had flagged the generic vulnerability class weeks earlier; a fix was in progress; it was not in production. Some 3.64 million ETH — roughly one-third of The DAO's holdings — moved into a child DAO under the same 28-day mandatory waiting period that governed all DAO splits. That waiting period was, accidentally, the community's lifeline: the funds were frozen for twenty-eight days, long enough to organize a response. The technical post-mortem, published by Phil Daian within twenty-four hours, remains one of the cleaner pieces of security writing from the period. The reentrancy pattern was not novel — it was a known anti-pattern in concurrent systems programming — but Solidity's calling semantics made it easy to introduce inadvertently, and the stakes had been invisibly high. The vulnerability became the canonical Solidity teaching example, and 'reentrancy guard' modifiers are now standard boilerplate in every professional contract. The twenty-eight days that followed were the most contentious in Ethereum's history: off-chain governance running simultaneously on Carbon Vote, IRC, Reddit, and private signal groups, with Vitalik threading a line between the 'code is law' absolutists (who would later form Ethereum Classic) and the pragmatists willing to hard-fork. The hack did not destroy Ethereum. It defined it. Facts • Attack began approximately 03:34 UTC, June 17 2016 • ~3.64 million ETH siphoned (roughly one-third of The DAO's holdings) • Attacker child DAO subject to 28-day mandatory waiting period — the only thing preventing immediate loss • Reentrancy vulnerability type published by Peter Vessenes before the attack; fix not yet deployed • Phil Daian's post-mortem published June 18 2016, became canonical Solidity security reference • Estimated USD value at time: ~$60M; at later ETH cycle highs: >$3B Primary Documents • Phil Daian: Analysis of the DAO exploit (June 18 2016) — https://hackingdistributed.com/2016/06/18/analysis-of-the-dao-exploit/ • Vitalik Buterin: Critical Update Re: DAO Vulnerability (EF Blog) — https://blog.ethereum.org/2016/06/17/critical-update-re-dao-vulnerability