Sam Bankman-Fried's secret 'backdoor' discovered, FTX lawyer says

[bearjaws]

Reminds me back at a certain large travel website I worked at, someone left the debug promo codes enabled in prod...

Eventually someone found the "5000off" code, and posted it to Slickdeals.

We had alarms for bookings that lost us money (especially with bundled flights), so it was found relatively quickly, but around 30 people had used it already...

Except SBF was just massive fraud, not a whoopsie doopsie.

[lifefeed]

At a certain shoe online retailer I worked at, we had a hard limit on the maximum discount, and it was built into the code. Not configurable, and not overridable. There were a lot of problems with that codebase, and some of those problems probably led to that particular solution, but I liked it.

[pacaro]

The hoover free flights promotion is a good cautionary tale https://en.m.wikipedia.org/wiki/Hoover_free_flights_promotio...

[contingencies]

For codebases with deployment modes, best practice may be to have a test process defined in your CI/CD to run when you spin-up prod that verifies all non-prod features are fully disabled.

[Eduard]

What would the "5000off" promo code do? Provide a discount by 5000 gazillion percent?

[digianarchist]

How did they find the code? Brute force?

[tsimionescu]

Interestingly, while some are quoting a "single line of code", the article is actually using some even stranger information:

> "Mr. Wang created this back door by inserting a single number into millions of lines of code [emphasis mine] for the exchange, creating a line of credit from FTX to Alameda, to which customers did not consent," [FTX lawyer Andrew Dietderich] added. "And we know the size of that line of credit. It was $65 billion."

[Centigonal]

$65B seems oddly specific - could it be that they just set the liquidation limit for Alameda's account to 65,535 (max 16bit unsigned int), in millions of dollars?

[beau_g]

It must have been an existing boolean flag he set to true, allowSecret65BillionDollarBackdoor

[beaned]

Maybe some specific accounts were hard-coded to have credit lines of certain amounts, and they just changed the one for Alameda from 0 (or whatever) to 65 billion.

Not uncommon for a startup to hack features into code directly before there's a db column and frontend to support updating values through an admin interface.

[conanbatt]

> inserting a single number into millions of lines of code

So basically a clean npm install.

[faangiq]

Absolutely lulzy to think of cranking out millionssss of lines of code in the ~2 years FTX existed.

[makestuff]

Impressive that it was a one line code change to allow a 65b credit line. This is some office space level stuff.

[hodder]

I'm guessing this "single line of code" called a function which was 9000 lines.

Regardless this is pretty damning smoking gun information if true. "uh-oh, sphaghettio"s becomes a pretty tough legal defense.

[jrockway]

> "uh-oh, sphaghettio"s becomes a pretty tough legal defense.

I guess if a jury is involved you don't need a legal defense, you just need to confuse the jury to the point where they can't agree on the facts. "uh-oh spaghettios" has probably worked at least once, especially if computers are involved.

[nextaccountic]

maybe. but there are underhanded code contests that are about submitting code that contains purposeful bugs but that aren't easily detected, and if detected, look like genuine mistakes (like off by one errors etc) rather than deliberate malicious code

see http://www.underhanded-c.org/ for the contest in C, and the one for rust is offline, but can be read here

https://web.archive.org/web/20190511070359/http://blog.commu...

[ineedasername]

Doesn't look like it: I mean sure, the entire system was many LOC, but in this case it appears accounts had automatic limits set as variables that could be overridden.

[michaelbuckbee]

def credit_limit(customer_name) return 65,000,000,000 if customer_name == "Alameda"

    # process normally

end

[awestley]

Maybe he saw Office Space one too many times.

[layer8]

The article says “single number”, not “single line of code”.

[korroziya]

I don't see it mentioned in the article but is SBF still doing the "dumb blonde" act as though this were all an unintended accident or have his lawyers gotten him to tighten his lip?

[dragontamer]

https://sambf.substack.com/

I'm surprised how dumb SBF is throughout this entire situation.

[mcast]

You would think if you were raised by Stanford law professors, you would know the importance of staying silent and not incriminating yourself (especially on record). But I guess SBF has a superiority complex and thinks he can evade punishment if he can manipulate the right people.

[voganmother42]

“Dumb blonde” is not useful and such a silly stretch…I don’t think this was a good choice for a description of his actions and weakens the potential impact of your comment considerably.

[LatteLazy]

Fiddling your own accounting system is not really a "back door". It's just lying.

So far that sums up this whole fraud: it's just bare faced stealing, there is no complexity or master plan...

[Animats]

Yes. It's surprising how dumb this whole scam was. Had nothing to do with cryptocurrency technology. It was straight theft of customer assets. Then they lost the money they stole. Probably because they were trying to double-down and win back previous trading losses.

Most crypto scams are better run than this. They get people to buy some crap asset, take a slice of the profits, the asset tanks, and the promoters keep their cut. Axie Infinity and Yuga Labs come to mind.

[ineedasername]

It seems insane that they'd let the limit be that high ($65B) but it's really quite reasonable when you look at it from the POV of already performing fraudulent activities. Once you're in the $100M-$500M range of theft, do you really care, does it really register morally/ethically (to the thief), if you bump that up to $65B?

[aaroninsf]

Guess: it's a number in a database field not "code"... :P

[wahnfrieden]

“I wanted to get rich not because I loved money, but because I wanted to donate it to charity.” - SBF, notable EA

[indigodaddy]

yahoo news non-pw version https://finance.yahoo.com/news/sam-bankman-frieds-trading-fi...

[dclusin]

Have they punished the total number of customer deposits? They keep saying they found $x billion in assets. But no mention of the liabilities or the delta between the two.

[paradygm]

The short answer is they don’t know. FTX’s current management is having to rebuild customer accounts by hand because they don’t trust the books https://www.wsj.com/articles/ftx-says-it-has-located-more-th...

[PedroBatista]

If this is true like the lawyer says, then it's the end of the line for our Sammy..

I don't see how he can pull some miracle to avoid less than 40 years.

[chrisbrandow]

I want to know what the “single line of code” was

[robswc]

if user == 'SBF'; model = TestModelDoNotUse

But seriously, I would love to know too. It really could be as simple as allowing a certain account "unlimited" credit, as the article suggests. I only have reservations since it seems like a bit of a game of telephone and sometimes journalists go for the sensational vs simple.

[oliwary]

UPDATE accounts SET creditLimit = 65000000000 WHERE accountHolder = "alameda"

[joshmn]

`if user.id == 1`

[programmarchy]

`if (account["user_id"] === session.user.id || session.user.username === "sbf") {`

[iancmceachern]

Sudo

[warinukraine]

An if that bypasses the check of whether to issue a margin call if your userid is that of Alameda's. Obviously.

[ornornor]

Aside: that has to be one of the most confusing and dark patterny cookie consent pop up I’ve seen in a while.

[lancesells]

https://web.archive.org/web/20220922164619/https://www.sequo...

[nieve]

Perhaps that one number was a blockchain address or account number?

[miga]

SBF may have made mistakes or even committed fraud, but it is concerning that bankruptcy attorney does not seem to focus on recovering the value of the assets.

If FTX US was liquid, this action has brought down another company...

[stdbrouw]

I thought Matt Levine's take in Wednesday's Money Stuff was insightful:

> If you go around talking up the value of the FTX’s business and its tokens, you might be able to talk someone into paying a lot of money for them; maybe not now but perhaps in November. If you go around talking down the value of FTX — if you make statements about how poorly it was run and how much fraud it did — then that value will tend to zero, and you won’t be able to sell it.

> At some level Bankman-Fried is surely right that if he had remained CEO of FTX, instead of stepping down and being replaced by Ray, he would have had a better chance — though still quite slim — of selling FTX’s business and tokens for more money, and thus raising more money for FTX’s customers. If you want to sell that business, you have to say that it’s good.

> It’s just that, you know, if FTX was a fraud, he would have been getting that money for customers by doing more fraud? Like if Ray is right that FTX was a fraudulent mess, then he shouldn’t be trying to sell it to investors for a lot of money, since that would itself be fraud.

[function_seven]

I assume they’re being honest about the value of the company. They’re not “lowering” it. The company is worth whatever a potential buyer is willing to pay for it. And whatever that number is, I can’t imagine it’s meaningfully different from “$0”.

I’m talking about the brand and the technology, not the assets that need to be distributed to creditors.

The alternative here is if the lawyers found the back door, and decided to keep it secret. That’s not ethical IMO.

[matt3210]

if a secret back door is not fraud I don't know what is