In June 2016, the Ethereum ecosystem experienced one of its most dramatic and consequential events: the hack of The DAO. This event shook the community to its core, led to a controversial hard fork, and left lasting lessons about smart contract security that are still relevant today.<\/p>\n
The DAO (Decentralized Autonomous Organization) was a groundbreaking experiment in decentralized governance and venture capital. Launched in April 2016, it raised over $150 million worth of Ether in what was, at the time, the largest crowdfunding campaign in history.<\/p>\n
The concept was revolutionary: a leaderless investment fund governed entirely by smart contracts and its token holders. Anyone holding DAO tokens could vote on proposals for investments, and profits would be distributed back to token holders.<\/p>\n
The attack that drained The DAO exploited a classic smart contract vulnerability: reentrancy<\/strong>. The concept is surprisingly straightforward once you understand it.<\/p>\n The vulnerable code pattern looked something like this:<\/p>\n Here’s the attack sequence:<\/p>\n The attacker exploited this vulnerability to drain approximately 3.6 million Ether (worth about $50 million at the time) into a \u00abchild DAO.\u00bb The attack was elegant in its simplicity \u2014 the attacker wasn’t breaking any rules, merely exploiting the contract’s logic against itself.<\/p>\n Importantly, the attacker’s funds were locked in a time-locked child DAO, giving the Ethereum community a window to respond.<\/p>\n What happened next is still debated today. The Ethereum Foundation proposed a hard fork to effectively reverse the hack and return funds to DAO token holders. This was deeply controversial because it violated the \u00abcode is law\u00bb principle that many considered fundamental to blockchain’s value proposition.<\/p>\n The community was split:<\/p>\n The hard fork passed, creating two chains: Ethereum (ETH)<\/strong> \u2014 the forked chain where the hack was reversed, and Ethereum Classic (ETC)<\/strong> \u2014 the original chain where the hack remained.<\/p>\n The DAO hack fundamentally changed how smart contracts are written and audited:<\/p>\n The DAO hack was a painful but ultimately valuable lesson for the entire blockchain ecosystem. It demonstrated that smart contracts, despite running on an immutable blockchain, are only as secure as the code they contain.<\/p>\n More importantly, it showed that the blockchain community could respond to crises, even if the response itself was controversial. The debate about immutability versus pragmatism continues to this day and is fundamental to understanding how blockchain governance works.<\/p>\n The attacker(s) technically followed all the rules. In \u00abcode is law,\u00bb they won. The community disagreed and changed the rules. Both of these things are true, and both say something important about what blockchain technology is and isn’t.<\/p>\n","protected":false},"excerpt":{"rendered":" In June 2016, the Ethereum ecosystem experienced one of its most dramatic and consequential events: the hack of The DAO. This event shook the community to its core, led to a controversial hard fork, and left lasting lessons about smart contract security that are still relevant today. What Was The DAO? The DAO (Decentralized Autonomous […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[162,182,248,250],"tags":[186,252,224,254,256],"class_list":["post-216","post","type-post","status-publish","format-standard","hentry","category-blog-en","category-cripto-en","category-dao-en","category-hacking-en","tag-cripto-en","tag-dao-en","tag-ether-en","tag-ethereum-en","tag-the-dao-en"],"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/posts\/216","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/comments?post=216"}],"version-history":[{"count":1,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/posts\/216\/revisions"}],"predecessor-version":[{"id":242,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/posts\/216\/revisions\/242"}],"wp:attachment":[{"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/media?parent=216"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/categories?post=216"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/santiagomarquezsolis.com\/index.php\/wp-json\/wp\/v2\/tags?post=216"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}\/\/ VULNERABLE CODE - DO NOT USE\r\nfunction withdraw(uint amount) public {\r\n if (balances[msg.sender] >= amount) {\r\n \/\/ DANGER: External call BEFORE updating state\r\n msg.sender.call.value(amount)();\r\n balances[msg.sender] -= amount; \/\/ Too late!\r\n }\r\n}<\/code><\/pre>\n\n
withdraw()<\/code> with their balance<\/li>\nwithdraw()<\/code> again<\/li>\nThe Scale of the Attack<\/h2>\n
The Controversial Response: Hard Fork<\/h2>\n
\n
Lessons Learned<\/h2>\n
\n
\/\/ SECURE VERSION\r\nfunction withdraw(uint amount) public {\r\n require(balances[msg.sender] >= amount);\r\n \r\n \/\/ Update state FIRST\r\n balances[msg.sender] -= amount;\r\n \r\n \/\/ Then make external call\r\n msg.sender.transfer(amount);\r\n}<\/code><\/pre>\nConclusion<\/h2>\n