The DAO explicado. Meetup Ethereum Madrid.

Ah, welcome everyone to this event, although we were expecting a few more people. Okay, we'll start later. First, I want to explain the program. I'm going to give a short introduction, including a visual to show how the world has reacted to this topic. Then Lu will talk about eum and what the action is, followed by Carlos.

After that, I'll explain who we are and go into more detail about the attack. Finally, Alejandro will explain a bit about the legal world. And of course, the most interesting part is the roundtable discussion. We have some questions prepared, but if you have many questions, we'll leave them to you and go straight to yours. So, who are we?

In short, we're a small group. We're currently called YIO Madrid. It's not very creative, but the truth is we 're all quite different. What we have in common is this interest in eum, blockchain, and the decentralized world. We have two people here: Alejandro, who is a lawyer and focuses on blockchain, working as a consultant, and Denis, who is connected online.

You can't see him, but he's here. Denis works at Consensus as a full-stack engineer, and he'll also be participating in the roundtable discussion. We also want to Thank you so much to the people at Shuttle Cloud for letting us use this space, which is great and helps us a lot with the whole organization. Okay, I'll start. I'll give an intro and say it, okay.

Okay, we live in a centralized world. Although it seems a bit... never mind, okay. I'm prepared and I'm going to say it, okay? Well, we live in a centralized world.

Okay, we're all aware that when we want to transfer money between us and we don't know each other, there are banks between us. Because these banks give us the trust that we don't have among ourselves. But when we write messages on Facebook, they all go through Mr. Shuttle, and then a new idea came up: the idea of ​​the sharing economy. What were we thinking?

Wow! Now, yes. Now we're going to share everything between us, and we're... But why are there Airbnbs? Why do we need Airbnb to connect us?

Is this what they give us? That we need them? And if so, we have to pay. We have to pay the banks. We have to pay these banks, these Airbnbs, with our money and especially with our data.

But now, and of course, you know where we're going. Imagine that there's a technology that... It allows us to connect directly, all of this without external parties, without walls, without anything between us, and we can actually exchange money, messages, homes, everything, and this without paying with our money and without paying with our data. And that technology, as I imagine you already know, is called blockchain, and it already exists. And well, to many, this technology seems like a new world, a world that gives us the possibility of creating new ideas, a decentralized world, a connected world, a free world, and a secure world.

That's kind of the question, as you may already know. And a very good idea that has emerged based on blockchain is the idea of ​​the DAO, which is a Decentralized Autonomous Organization, as you know. And the idea is that people can invest their money in projects that they find interesting and with a lot of potential. So it's like a decentralized but collective investment that has the concept of democracy, and that idea seems super good, so good that many people in the world thought, "Wow, I'm going to invest in this," and it has reached, as I think you know, 150 million dollars, the largest crowdfunding campaign in history, and I think that's something we all expected. Because the IUM blockchain IDs are still in the proof-of- concept phase, this has attracted attention because there's a lot of money involved, and they want to take advantage of it.

One of them managed to do so last week by filling a gap left by that organization. Now we're dealing with this, wondering how we're going to react to this attack. The experts will explain that, but I wanted to show two or three maps of the tweets. This map, for example, shows the tweets from DA and the times when the information was released on social media. It shows how all that information was distributed, and it's very clear that IUM DAO is decentralized.

There's also global interest; it's not like a single point where the information goes everywhere, not just to Europe, but to America, and also to South Africa. This is a truly global issue, which is what I wanted to show with this map. You can also see the panic. And here, because the other question is, is this a DA or IUM thing? Here you see the tweets from both in comparison, and it's very clear.

For example, in the north of England, it's more "yo," which has a much stronger presence, while in the south, those concepts of "de daado" are more prevalent. And the last one—yes, the last one, because I don't want to talk too much about this—is a map. It's all the same, the same data, but this way you can see the retweets. So the question is, which tweet had the most presence? And in fact, it's one that's also distributed worldwide.

This one—yes, this one is the most retweeted so far, and it seems to be because it's from a guy who's a teacher and his name is the same, Heck. So it seems he's in both worlds a bit, and he explains the consequences very well, and for me, it was interesting to see that this tweet— okay, it's in English, but it's also worldwide. So all the communication on this topic is global, so it's also decentralized. And I'm going to share the map links because you can really play with this, and if you're interested in a particular place, you can zoom in or send it to friends or whatever. Well, and this is my introduction, and now I'll leave it at that.

Yes, for Lu, I wanted to ask you a question, first of all, who... Do you know about blockchain and Ethereum? Well, the opposite is true. Who doesn't know anything about Ethereum and blockchain? And who controls the whole thing?

Let's get into the nitty-gritty. So, we want to do a basic review of what it is, since there has been quite a bit of confusion, especially after the DAO case and during the whole thing, about how it comes from Ethereum, that Ethereum has parts of the DAO, that money has been invested, etc. So, in the first presentation, we're going to try to separate things and explain what each one is and what the relationship is between them. So, a quick review, since you already know more or less what the topic is: Why does Ethereum exist after Bitcoin? Programmers who were working with the blockchain concept realized that it could be used to send or exchange other things besides money, like with Bitcoin, using that last part of the transaction where you can put code.

And this could be applied, for example, to products, as is being discussed now in the case of the Internet of Things, how machines can communicate and even pay each other by exchanging code for services, as we will see. The DAO case is an organization that Use that part of the code in a transaction directly between two people, and this is done through smart contracts, which is the fundamental aspect of Ethereum—its potential. For example, how could this exchange of contracts between people or organizations be used? Combining the two parts of products and services, let's imagine a transaction where a payment is released conditionally based on an internal decision within an organization. For example, upon reaching a consensus on a decision, the payment to a supplier or client is automatically released.

It could also be conditional on the opening of an Airbnb home lock without intermediaries. Okay, I want the lock to open when the user I've registered for the service approaches and has paid for the service they've contracted. If these two conditions are met, the lock opens automatically; no one needs to intervene in the process. The third example I wanted to give you is, for example, travel insurance. We could automate all of this if we know when the plane has actually departed, when it has landed, and if it's delayed.

Automating travel insurance claims involves automating the process of verifying if a plane has arrived late, confirming that the passenger was on board, and that the plane has reached its destination but with a delay. In that case, the entire insurance claim would be automated. It's a combination of products and services on a platform that works with Smart Contracts. That's the idea behind ium. And then, it's also worth mentioning that it's an internet-based platform, so all its management is independent of the physical location of the organization or individual using it.

How ium is organized is a topic of much discussion; it's quite broad. I've tried to highlight the three fundamental things I think are important: it's an open-source protocol; it 's not designed by a company that profits from it; it's open source, and no one has authority over that code. There's the ium Foundation, which played an important role when the Ether currency was launched, which we'll see shortly. Initially, a legal entity was needed, which was a foundation, to assume the responsibility of ensuring that those funds didn't belong to anyone; rather, everything... Reinvestment had to be made in the project itself, and this is done through a foundation that today has the role of guiding and promoting the opening of new code, the release of new applications, and conducting all the necessary reviews of the fundamental Ethereum protocol code.

The foundation handles this, and as a third important agent in this ecosystem, of course, are the miners. As you know, for a transaction to be confirmed, it works the same way a bank confirms a payment or transfer. In blockchain technology, it's the miners who validate transactions. A miner is simply a significant computing power, and Carlos will explain this to us later: it performs calculations to validate these transactions. The thing is, miners also use the current Ethereum protocol, so in that sense, the miners are the ones who write history.

We'll see later what's happening with the software versus hardware case. Ultimately, the user can make part of the decision, but the miners are the ones who ultimately make the final decision. So, to summarize and highlight the most important aspects of Ethereum, what do we have here? We have a cryptocurrency called Ether, which can be traded on exchanges around the world. And then there's the real potential of Ethereum, which is a more or less abstract programming language that allows you to write smart contracts.

Currently, the two most widely used are Solidity and Serpent, and that's where things really begin. One of these smart contracts that exists on Ethereum today is The DAO. It was created on Ethereum, and you interact with that contract on Ethereum, but it doesn't belong to Ethereum. Neither the foundation nor the developers have any direct involvement in its management, its creation, or its proper creation. These are two separate things.

Vital Bin, the creator of Ethereum, made this very clear on Reddit last Thursday: the foundation has no ownership of the DAO cryptocurrency. He personally invested money and will remain transparent about it. To summarize, it could be considered a very large computer— a computer, really—because ultimately you feed code into a decentralized machine, and that machine processes a series of information, which are the smart contracts, and gives you a result. In that sense, it can be considered a very slow computer because a transaction right now, whether it's a decision in the DAO or a cryptocurrency payment, is verified every 15 or 16 seconds. Right now, it's very slow.

Okay, it doesn't want to replace all the speakers in the world either. Okay, it's designed right now for very specific things, based on the blockchain, of course, and it allows you to interact with smart contracts, implement them, write them, publish them, and interact with them between people without the need for an intermediary. Okay, this is Ethereum briefly, highlighting some important points. Now we move on to the case of DO DAO. What is DO DAO?

Well, as of today, what exists publicly, what is known about the case, okay, there are around, and we'll see in a moment, more than 20,000 people who have decided to be part of that project and for that they have invested money in the form of cryptocurrency, which is DOO. Okay, the idea was to put together these 20,000 people's money in a fund so that the fund can make decisions about which projects it would be good to invest in. That changes the picture a bit as it is known today. And I don't think I'm wrong about investment funds. It's not that each person decides individually what to invest in, but rather that in the case of The DAO, the 20,000 people were going to reach a consensus among themselves on whether or not to invest in a given project, and you risked, let's say, the funds you had contributed, but the decision is common to both.

That is, if you had voted no to a project and it turns out that the majority says yes, your funds will also be invested in that project regardless of what you had chosen to do, okay? And of course, once the funds are invested, we'll see through what mechanism those funds can be used in practice. But the idea is that in that same Smart Contract, the terms were also defined under which investors would recover their money, more or less losses or gains, depending on the economic success of the project in which they invested. I repeat, The DAO is code; there's no one who thinks that I think it's right to do something else, that everything is based on the code and how it's organized. That's the message that I personally would like you to take away.

This is where a lot of confusion arises. As the transparency indicates, it's a Smart Contract that sits on top of Ethereum. There are many other Smart Contracts that have the exact same representation, the same interaction with Ethereum. The only real difference is that it has attracted over 200,000 people, 14% of Ethereum's current market capitalization of $150 million, as Sandra mentioned at the beginning. This makes it very attractive to attackers, but the Smart Contract itself is nothing special.

It's different, but it's not particularly unique compared to other existing Smart Contracts. Augur Makers, LCK, DJ WF are all projects based on the same technology, and nothing has happened with their Smart Contracts to date. Okay, something has happened with the DAO. To give you an idea of how the funds are distributed among those who have invested in the DAO, what you see here is a pie chart representing the top 50 most important shareholders of the DAO. So, the first quadrant, the largest, includes all the others.

Okay, the first The quadrant, however, that indicates 7% here is one address; it's unclear if it's an organization, a person, or an address where funds are invested. It has 7%, okay? And now, I think it would be good to know a little bit about this. It exists in something that is more or less understood, which is a Smart Contract, but in practice, what does this mean for someone who wants to use this? The technology is very nice, but if it doesn't serve anyone in real life, it's not very useful either.

So, we've gone over the use cases a bit, and as I explained before the event happened, how this was going to be used in practice. DAO was intended to be the fund where funds were available to invest, either by hiring what are called contractors, that is, commissioning a certain company to make the logo for DAO, not just anything you want to buy from a supplier. On the other hand, they also wanted to invest money, but by betting, that is, investing in a new company with a view to it developing a product or service. And then, it could also have a relationship between the suppliers and these products and services. This was the ecosystem they planned to implement.

And how? Well... Let's go through the steps that would be involved in the journey from having an idea, which is the first thing, that the idea makes sense both for Ethereum and, uh, that it can be written in a Smart Contract, to actually being able to use those funds. Okay, let's review those steps. After the idea, of course, we have to translate that entire idea, that is, all the business logic, into a Smart Contract.

This is n't obvious to the average person, but it's a necessary step to write and describe the business logic in a Smart Contract, and of course, under what conditions the funds will be returned once the company is founded, exists, and generates economic activity. All of that has to be thought out beforehand. Sorry. Then that code, that Smart Contract, is sent to the DAO, and the DAO currently has a series of people who are the curators, and they are going to review the code, uh, to make sure there are no problems, that there is real business logic, that nobody wants to take advantage of those funds, and also to validate that the project makes sense for the platform on which it is designed. The wording would be equivalent to a pitch when a startup approaches investors; they have to pitch to get their idea accepted.

In that case, the smart contract is validated with all the conditions. This is currently done by a series of curators on the DAO. Then comes the moment to vote. Everyone on the platform who had previously invested in Dodo could vote on this project: if they think it's worth investing, if they agree with the conditions, if they think the amount they're asking for is justified, and if they think how much they plan to return, when and under what conditions, and what benefits this activity will generate are appropriate. All of this is voted on for the entire project, and finally, they fund it.

So, if the majority of token holders on the DAO agree, it gets funded. The problem is, what do I do with DAO tokens? I can't just go up to someone on the street and say, "Hey, I have a million DAO tokens. Can you write me a sign?" So, what happens at that point is that the funds, or rather, access, become available.

The funds were already partially in existence, but what was being done was to create a Swiss-based company, a joint venture between Slit and BT, that would, let's say, bridge the gap between the world of tokens, the world of blockchain, and real life. Why? Because in Switzerland you do n't need to legally know someone's identity, where they live, etc., to have an exchange, to make a transaction with them. As long as you have—you've seen Ethereum addresses, they're endless numbers and letters—that's apparently enough to make a transaction.

In Switzerland, a company called John Venture, which is called Dowling, would be able to receive the invoice that the company that had gained access to the funds would issue. For example, to create the DAO, that company would use its own smart contract to claim those funds from the DAO. The DAO would pay them, and once the payment was validated, the funds in euros or dollars, or whatever currency, would be transferred to the company that had gained access. It was like a kind of intermediary, necessary for legal reasons, to make the connection between access to the funds in Ethereum and the real-world operation of the company that wanted to use those funds. This is the example I'm giving here: a proponent who has obtained the money in DA tokens, for example, can invoice DA Link for the purchase of office supplies, for example, 10,000.

They issue an invoice to DA Link, and through their own smart contract, DA Link claims the funds from the DAO for the amount in DA tokens. The payment is made, and finally, with that validated invoice, DA Link transfers the funds to the company. To return the funds, exactly the same thing happens. If, for example, the company has profits from its economic activity and wanted to return those funds, as stipulated in the Smart Contract, whether there were losses or gains, the process would be done in reverse, using downloading for that purpose. And that's it.

I think the most important thing, in short, is to say that Ethereum is necessary to interact with Smart Contracts; it's the platform where they live and where exchanges take place with them. But the DAO is just one of many Smart Contracts currently residing on Ethereum, and the good or bad functioning of a Smart Contract doesn't call into question the functioning of the Ethereum platform. There's no direct connection between that Smart Contract malfunctioning and Ethereum being worthless; that relationship doesn't exist. Thank you very much. [Applause] Well, I'm Carlos.

Good day. I'm going to explain a little bit about the most controversial part of the whole attack and the whole conflict that has occurred, specifically with the DAO theft. We know that 150,000 have been stolen; about 60,000 have been stolen. Millions, about 3 million ether, we're going to steal. They've been attacked.

We're going to... we're not going to specify in words for now, but about 3 million ether have been attacked. We're going to see how it was attacked and what methods we'll have to deal with this attack. It's a new situation. First of all, Logan has already told us a little bit about it.

But we know that what was damaged is a Smart Contract. That is, what a Smart Contract is, is an address within the blockchain in which, instead of being controlled by an external person, it will be controlled by code. This Smart Contract has been developed by the Slit team and it's not their property, but rather the property of the token holders, the people who bought all the tokens at the time, and who are the people who have now lost their money. A chronology of the attack: Well, on June 12th, talk began about a series of events. Talking about a series of patterns in the code patterns that could lead to theft, this was a pattern that many smart accounts had back then, and the first to raise the alarm after it was discussed in the media was the creator of Maker, who said it had a vulnerability, but that it had already been fixed.

Shortly after, Stephen Tual, who is basically the COO, well, you could say he's the leader of DAO, although it doesn't have a direct leader, said that DAO wasn't secure, basically that not all of DAO's tokens were safe. Well, only 5 days had to pass before Stephen Tual himself came out saying that DAO was being attacked. This was when we had just arrived at work, it was 9 in the morning, it was n't very clear what was happening yet, things were starting to be discussed on Reddit. And well, little by little, he started to comment that the attacker had moved all the money to a to a child of a DAO. What's really happening?

Nobody really knows what this is about all the money being moved to a child. Well, it was direct. All the people who had ether, who had it at that moment... Of course, this is a very big vulnerability, one of the biggest known in blockchain, especially in the history of blockchain and in the history of Bitcoin. You could say that blockchain also includes the Bitcoin part.

And well, basically what happened inside that child of a DAO was that 3,364 million ethers had already been moved, which could be equivalent at that time to 55 million dollars. These 55 million dollars or these 3 million ethers were present in another contract, which means that there was basically a DAO, exactly the same as what happens when creating a blockchain, in which the only participant... The daado had 3.64 million, the equivalent of 3.64 million ether, which basically just appeared in an account with all this money since only he could access it.

However, this money, although due to the principles he had, could not be withdrawn because, as stipulated in the code, there are 27 days in which, uh, how many days? 27, right? Well, there are 27 days in which the money cannot be withdrawn, the money cannot yet be transformed from the tokens into ether. Well, this started to become completely ridiculous. Money started moving everywhere, the news was more and more extravagant.

It turns out that on the 22nd, they tell us that they have now stolen the rest of the money that remained in the main contract and put it into a different contract. It was an ethical hack, and in which the creators, how could it be? The team could be from iium or derivatives. They had launched an attack on the main contract to do exactly the same thing the attacker had done. They followed the exact same procedure as the attacker, basically to keep that money frozen for another 27 days because it would be more secure there.

This means that the money in a new contract, in a child contract, wouldn't be able to be modified. So, it's a little more secure. Now, what the attack was really about—I'm not going to bore you with programming details—but you can really understand the pattern that was found initially. It was basically the ability to make a money transfer before updating the balance. If we make money transfers before updating the balance in this method, in the withdraw reward method, which is where the whole attack started, this method doesn't control the entire flow of where it can happen and can allow a The attacker puts an intermediate contract between all the flows so that WOSS occurs continuously before updating the balance.

This is really a very simplified explanation; it's not exactly that. It's really a complete simplification of what happened, but basically, from the attacker's perspective, they would call the DAO split function and tell it that they wanted to create a daughter DAO contract through what we know as a Contract Wallet, which is basically a way to do wallet functions, but it has the ability to inject a series of parameters with which to execute code. This is the split function, which is where the error was. But the fact that the error was in the split function doesn't mean that it's related to split itself; it's a programming pattern, as I said, a programming error that could have occurred anywhere. It's in the withdraw function where they basically added...

It added money to the Child DAO, but at the same time, it repeatedly called the same code, essentially creating a continuous flow where more and more money was taken from the contract, which is the one the child has. After taking all that money, it could check and update the person's balance. So, basically, this wasn't a bug, a vulnerability in C, or at least not a direct one. We can't say it was a flaw in how the programming language was made. We could say that perhaps we need languages ​​a little more oriented towards preventing these kinds of events, but it wasn't Solidity's fault.

It was human error. I don't know who put the... line but but but well it was a human error in the code. The code was audited by the creator of Solidity, it was audited by the best, by the people who could best understand how to find a flaw here. I mean, it's not a mistake, it's not a flaw that was easily found, not at all.

And the fact that recursive split is only because it's in the split function, but the vulnerability isn't directly with this function. Well, basically, the most important lesson is that this was already known a week ago. There had been a lot of talk about this new pattern where you first have to update the balance, and then you perform those functions that move funds. But now that this has happened, it's much more obvious that we're going to have to look for new security patterns. There will probably be a lot of focus in the coming months on trying to make SmartCons secure because, really, if not, right now...

A smart contract doesn't give me any security when it comes to depositing money. I do n't think, I don't think, that in a month or two people won't have deposited another 150 million into a new one. And well, it's also part of that security, and new auditability solutions come into play. Well, this has already happened, we've had hack, and I'd like to... Let's go, the problem, and when all the controversy starts here, is how do we solve this?

And it has to be solved, right? And the first thing, the first solution that has been proposed, and which really isn't temporary and doesn't have to be permanent, is the software solution. What does this solution mean? Basically, what it means is that the miners, or those who validate the transactions, for a certain time to give us time to think about what we do with this: whether we should return the money to the people who invested it, or whether they deserve it, or attacker should keep it. Sure, exactly.

I mean, there are many theories within... there are many theories, and both sides... Really, the arguments of both sides are very... They are very strong. Well, this is the solution that I know has been proposed for the moment.

Basically, it consists of agreeing among all the miners that we are not going to accept transactions made from contracts that have to do with the parent DAO or with any of the children that have appeared now. But we mean any relationship with the DAO, we are going to freeze it for the moment. We are not going to validate it. Maybe at some point we will validate it again, but for the moment we are going to freeze it because it is not very clear what the way forward is. Well, actually, a vote is being held to carry out this vote, since those who actually have to update the code are the miners, so they themselves are the ones who are currently voting for it.

This vote is done, well, just like it came out in a consensus mechanism, well, through a validation mechanism. Transactions are also handled through the computing power employed by each of the miners, and well, right now it's really quite unbalanced. It seems that at the moment the soft fork has much more support. Yes, well, even more controversial is the hard fork. With a hard fork, we can basically do everything we can think of, or all the blockchain laws that we've been talking about so far.

If we want, a hard fork is really a 51 attack, which is the attack according to which if someone has 51% of the network power, they could do whatever they want with the transactions. It's about reaching an agreement and modifying the solution we decide on. It seems to me that this solution is very complicated to reach a point because there will always be interested parties, and no matter how many votes are taken, the outcome will be different. Some sectors that had certain opinions could ultimately lead to having different options for Bitcoin. But well, it would also be true that even though we're saying we're losing principles, one of the arguments, which I'm putting here, is that a protocol change— this is a protocol change—and in the end, we need to reach a consensus among all of us on what the best solution is.

I mean, there are many arguments for any of the options, and we'll talk about it more at the round table. As background, Bitcoin already did it in 2010. It was already more mature, even though it had been around for two years. You can also look at what happened with Bitcoin, but basically, faced with a problem, Bitcoin performed a hard fork, a rollback. Faced with a problem with coin creation, there was an error in which people could create new coins, and they decided to do a rollback.

The last solution, which also has... Many followers, well, it's about doing nothing, huh? This also fits very much within the philosophy that has been carried out in the blockchain. We have always talked about the principle of immutability. Everything that happens in the blockchain, or every transaction that is carried out in the blockchain, we are completely sure that it will be carried out.

Everything that happens in the Smart Contract is clear that it will be carried out. What happens if we now have a mechanism in which we can modify what we can decide, what has happened? We can modify the past. It's really to ask ourselves if this doesn't violate the principles that we have discussed from the beginning. In this case, well, the attacker would acquire the 3.

6 million ether. And probably what would happen afterward is that all of the rest, not only these 3.6 million but the rest, would also be distributed among other hackers, probably basically because the moment the algorithm ran out, the software... If there were no frozen funds, people could attack instantly and send it to their own accounts. This is a known vulnerability that everyone can exploit.

Okay, and with that, I'll finish. Here are a few links of interest, especially regarding security. There's a blog about blockchain security where they've discussed all the attacks, called distributed hacking, and where you can see in detail how the attack was carried out. Another blog is Peter Venes' personal blog; it's also very good and explains, though in less detail, how to perform this attack very well. In fact, he was one of the first to warn about the vulnerability.

Let's go back to the beginning, around June 12th, and the software vote, which we have there. And with that, we're finished. We're going to talk about legal implications, but I also like to add the term "governance" because when we talk about legal implications, we always think about making a connection to a specific jurisdiction that applies one set of regulations or another. I like to think about governance because there are many cases where current law is hardly applicable to such decentralized issues. Why?

Well, because you can't do what's called forum shopping, that is, choose which jurisdiction will apply based on a given fact, because the entities don't know each other on a network and can be anywhere in the world. Therefore, the proposal I want to make in the end is to look for governance mechanisms that work internally within the DAO, beyond the regulations we currently have. So, how does the DAO work? I think we've already covered that quite a bit. Basically, it consists of a smart contract on the blockchain that has two phases: a collection phase, that is, a crowdsourcing process where people buy tokens that arguably represent ownership titles, which bring with them voting rights.

Turning the destiny and the ether that goes under these tokens, and then there's the launch where proposals will be made to the ADAO and some proposals will be voted on. I'm not going to go into more detail. What are the main characteristics of an ADAO? It's not hierarchical in terms of responsibility; that is, it's not like a company where there are different positions with different responsibilities from the COO down. In this case, we also have to make nuances depending on the type of data we have; it will be one thing or another.

But specifically, the one that was attacked was a pseudo- investment vehicle and it's based on smart contracts, and this is where I'm going to start a little with the legal part. Under most jurisdictions, well, first, in this case, the code is the only contract that the parties had. There isn't a signed contract as we knew it until now on paper with the signatures of the parties. Therefore, the only thing that will regulate the data, and therefore the contract behind it, will be the code itself. On the other hand, in most jurisdictions The contract will be binding between the parties, and on the other hand, we have that a Smart Contract of this type, a DAO, self-executes and functions autonomously, in theory, without human intervention.

There are a lot of legal issues here—I do n't know if there are any lawyers here—that are very interesting to analyze. What we do know for sure is that a token will give us voting rights, so we can choose the future destination of the funds. But we have to consider whether it truly constitutes a title of ownership, because in many cases it emulates what happens in a company, and therefore we are holders of shares, so to speak, or stakes in a cooperative. And then, on the other hand, in theory, the tokens can be withdrawn in exchange for ether, which would be similar to a capital reduction. What I like to analyze now with all these new developments is what impact this has on the legal frameworks we have, which is quite a challenge because it's very difficult.

And then another very interesting thing, which was mentioned before, is that certain countries have already found some kind of patches or solutions. in which a DAO could contract with companies or individuals and that there is a stable legal relationship. So, what happens when a DAO interacts with a natural or legal person? For example, let's imagine we have a DAO that is going to request services from a specific company. How does that company account for the income from those sets that will arrive, or those DA tokens that will arrive in exchange for that service?

These questions arise as this technology evolves. Now, the legal aspect... we've already seen a bit of the ethereal legal framework in which a DAO operates, and now we're going to look a bit at the legal framework in which the attack took place. As has been mentioned quite a few times, the code had vulnerabilities. It should be noted that many of these vulnerabilities were known and warned about before investing in them.

Not this last one through which it was stolen, but it was known to be a high-risk vehicle. This is a detail to keep in mind for something we will discuss later. Through hacking, some people want to call it an exploit, others want to call it hacking. Well, let's call it what we want. Let's say three and a bit million ethers have been stolen, which is equivalent to about 60 billion dollars.

Several solutions have been proposed: doing nothing, a hard fork or a soft fork, freezing assets and then seizing the funds later (the hard fork). This is important because, in fact, the hacker himself, the attacker, had argued legally—some arguments stronger than others—that his attack was completely legal because, given that the contract was law between the parties and that he had only used the conditions that all parties had signed, he said that he had obtained the money legitimately. That is defensible. The opposing position is also defensible. He says that since the code is a contract, it doesn't act against the code, and therefore, since the code is law between the parties, it doesn't even act against private law.

Here another question arises: what legislation applies? Normally, the United States tends to want to monopolize all these international matters, but it's not clear which law wouldn't apply in this case. And the other important point is identifying the responsible party. There are several possible responsible parties that could be argued. Legally, who is to blame for what happened?

Is it the creators of the DAO for leaving a bug open, even for incentivizing people to put their funds into it? Or are these shareholders—let's call them that— or token holders, for investing the money while ignoring the risk? Or is it the attacker for potentially breaching the contract, which is also difficult to defend, although it is defensible? So, I wanted to briefly explain the timeline of what happened: the DAO was created, there was a 50 million investment, there was an attack, and we find ourselves at this point. One possibility is to move forward, meaning the money has been stolen or lost, and someone here has tokens.

Well, the first DAO, from my point of view, has served to finance the first beta tester of a DAO who actually found a bug in the code. I don't know if it was expensive or cheap; it will be studied in the future, but it would be one of the paths. What is the other path, the one that was discussed, the hard fork? This could... It may not be defensible, but it's dangerous.

Why? Because a hard fork is a trip back in time. That's why I've put the Back to the Future logo here. Well, I've included our civil code because I'm a lawyer in Spain, and it's the law I know. The validity and fulfillment of contracts cannot be left to the discretion of one of the contracting parties.

This refers to contracts between two parties, but let's extrapolate it to where there are many. That is, agreeing to different conditions than those initially signed can be of dubious legality. That's why it's a point to consider: first, because it will eliminate legal certainty, and second, because retroactivity is only acceptable when it benefits the rights of those affected. But here, there will be affected parties of both types. I wanted to propose a parallel hypothesis, a parallel reality, where we imagine that the hard fork occurs and the sets are released, and this hacker, or attacker, or bet tester, whatever we want to call them, starts interacting with third parties—those acting in good faith, that is, third parties who don't know the origin of the funds and who have carried out perfectly legitimate legal relationships with them.

Valid in this case, let's rethink the hard fork. So we have to see if this patch, so to speak, of going back in time, is going to be the logical thing to do going forward. And on the other hand, is there an economist here? Well, uh, you know what moral hazard is? Moral hazard is when an individual has privileged information about the consequences of their own actions, but nevertheless, they are not going to take responsibility for the risk of the decisions they are making.

That is to say, it informs us how individuals assume risks in their own decisions when the negative consequences will not be borne by them but by third parties. That's what happens with moral hazard, which reduces the market's capacity to efficiently allocate risk among the parties. Why have I said this, this verbiage? Uh, for example, moral hazard is when financial institutions began to see that high-risk investors had very high returns and decided to leverage their own interest rates up to five, six, or seven times with the money of the people who had those funds because they are not assuming the risk. Or what happens, for example, when there is a bailout, uh, I leverage my funds and I...

I risk other people's money knowing that they're going to bail me out. I wanted to apply this to what's happening here. There are many people who have invested their money without knowing the consequences, knowing there was risk, a lot of risk, knowing there were bugs in the code because they were warned beforehand and they entered without advice. What are the consequences of saving these people, of returning the funds to this person who in the future will have no disincentive to repeat an action of this type, that is, investing their money without prior advice? In fact, regarding the problem of going back to the past, I wanted to include a video here where Doc explains it more easily.

We're going back to 1985, then I'll destroy the magician. You're going to destroy it, and all that stuff about humanity, where we come from, and where we're going. This trip, or this incident, demonstrates it. Imagine what can happen if the machine falls into the wrong hands. I only realize that I'll never be able to visit my favorite era and the old world.

But time travel is too dangerous. It would be better to dedicate them to the study of the other great mission of the universe: women. Well, what I wanted to say with this is that doing a " Back in Time" is dangerous. I think using F5 here is not the way to do it. So, what I mean is that going back has consequences.

That is, decentralizing a lie—the fact that something didn't happen—will have future consequences for the trust in smart contracts. For example, in my personal case, considering that a smart contract is reversible makes me distrust everything we've been sold up to now, which is the security that when I sign a transaction, it will occur as we expected. So, even though it was very expensive, the hack they carried out, or the attack they carried out, however we want to call it, is very useful because it will allow us to look for solutions so that instead of having to fix it afterward, it allows us to implement solutions beforehand so that this doesn't happen to us in the future. Here I have proposed three solutions, and I'm sure you can think of many more. One of them is pre-arbitration systems where the data subject hires arbitrators, who can be decentralized or not, where they will make decisions in case of conflict.

Here I wanted to introduce a concept that, if we run out of time, I'll touch on very briefly. It's a concept from Anglo-Saxon law called equitable remedies, which are legal mechanisms for seeking alternative solutions and conflict resolution when the law has certain gaps. On the other hand, it's about setting up a decentralized insurance system, that is, a parallel DAO that covers the risk of the other, and where people decide to invest because that DAO is secure. So, in the event of a hack, the funds from that second DAO would go to the first, thus mitigating the risk and preventing such a problem in the future. The other thing we wanted to propose was a decentralized code audit system, meaning that a portion of the DAO's funds would be allocated to code auditors, creating a reputational system and calibrating it somewhat based on the auditor's past performance to see if their code review is efficient.

We could even include several auditors for the same code and create an incentive system similar to proof-of- work, the first one to enter the books of a... Smart Contract is going to take the profits, uh, that it has made available from the pot for the auditors. Here I wanted to propose something for the community that we are here, and that is to do a meetup, a D, a D, a MEAP, as an experiment. That is, instead of doing a D that raises 150 million that could be lost, let each of us put in, I don't know, between 1 and 5 euros that we are willing to lose, to, for example, organize other meetups, depositing funds. That is, and then see the technical and legal implications of what is done.

Let's imagine that here we have each put in 5 and we have raised, I don't know, 100 or 150 to organize the next MEAP, hire a venue, buy beers, etc., and reach an agreement with the catering company so that they accept the payment of the DAP, and send, for example, queries to the accounting and auditing institute or the tax agency to tell us how the heck this is taxed because I do n't know today and I am a lawyer. And then with this I finish, uh, I wanted to Speaking of equitable remedies, which is a concept we don't have in our continental law, but which the Americans—well, law in general in the United Kingdom—already have in place, and they are... In this case, what I wanted was to decentralize this concept, but they are called coaches of equity, which are tribunals that are responsible for applying equity by implementing complementary measures or resources to fill those points where there is a lack in the law. What are the possible actions of these tribunals?

There are three very simple ones, and in fact, we have similar concepts in our Spanish law: void, which would be to consider a contract null and void, or lacking executive force in certain cases when certain events occur that we have foreseen, so that this contract is invalidated, or it's like a kind of suicide clause that is executed by a decentralized or non-dams third party; and the granting of sums of money as compensation for damages when something of this type happens, by whomever we determine should be responsible when this happens. But it is very important to determine this before creating the contract and not afterward so that what has happened now doesn't happen again. It's compensation for lost profits resulting from a breach of contract by one of the parties. If we establish rules for the operation of the DAO and these rules are breached, but often these mechanisms prove insufficient. This is where Anglo-Saxon law, which has its advantages and disadvantages (in this case, disadvantages), comes in with the solution of specific performance.

This means compelling one of the parties to fulfill the commitments assumed in the contract exactly as stipulated. That is, the contract will be fulfilled exactly as written, without any nuance. It's an obligation for one of the parties to perform a specific action specified in the court's order. In this case, we call this decentralized court we've established a "court," or to refrain from performing an action. It's an obligation to do or not to do something.

We can see different translations, such as " interdicto preno," which we have here. Well, they 're not relevant. And the last one is rectification, in this case of the DAO. Obviously, I think almost no one invested money in the DAO wanted this bug in the code to be there. In this case, this mechanism could...

What to do is consider that the contract isn't accurately reflecting the intentions of the parties when they invested. I think, well, it's the only one. I don't think I expected this to happen; it wasn't stated anywhere. Well, I mean, it didn't say anything. It's also true that I haven't read the entire code, but that's why we talked earlier about code auditors.

It's like when someone goes with a lawyer when they're going to carry out a relatively complex contract and also hires a lawyer to do it. Here, it's about finding solutions where the company itself invests in these types of solutions beforehand. But in this case, which we were talking about as rectification, it means that certain lines of code can be changed. On the one hand, a third party in good faith, which could be another company or community dedicated to reputation management, could do this type of thing and allow them to correct that bug, for example, because they have been previously authorized to do so if this happens. And I imagine many more legal questions will arise.

I have more in mind, but I didn't want to go on too long, and that's all for now. [Applause] Presentation: The same thing he did in the last meetings when security issues were discussed. He had to explain to everyone that none of the currencies had ever been attacked because there wasn't a CEO big enough to launch an attack. We've suddenly gone to the whole system being overwhelmed. The specific question is, what has the final version of the Go statement is what banks are doing now?

What this is absolutely not. We've gone from absolute euphoria that we're in the world of blockchain, that everything was about, that there were no security issues, that there was a civil code. Listen, be careful when you put your money in, the banks steal, they steal the money. There are people in Armenia and nothing happened. Suddenly, everything that the banks do, well, an arbitration is set up, a National Securities Market Commission is set up, a code is set up, civil courts are set up so that the people can sue.

We've gone from something wonderful to an issue where the banks are back in control and all citizens are losing money, all because of just 60 million. It reminds me of other issues that have arisen, and I'm not talking about issues in Spain. So I want to know if we've gone from that in three weeks From a wonderful topic, it was all about the banks being on the ropes, being devastated, and that by developing, we were going to break the system. Now, suddenly, the banks come, and I'm a civil system. I'm a lawyer, a telecommunications engineer, an economist from the University of Navarra, and I specialize in real-time software.

I've been around for a few years, as I know, physically, and I've come to see what's happened. The conclusion is that we're in the hands of the banks. I don't know if my conclusion is incorrect; the code can always be attacked. The promise that it's secure at some point, I think, is a lie. And in fact, it's not the first time funds have been lost.

Funds have been lost from other contracts, not because of this type of issue, but because of other errors, like not taking into account how much gas cost, what the gas limit was, etc. There have been other losses and losses. During the coming months and years, there will be quite a few more. There's no surprise in this case; it has attracted attention, and the community is responding differently precisely because it's 60 million, but total security will never exist. Really, a top topic of one entity, a corporation, with another corporation.

The transfer has a bank, has enough power to do mining. Nothing happens. Now, if I distribute and try a topic of, "Hey, put in 150 million, nothing happens," let's look. Here's the last one, which are two different topics: the deum code, the RIP code, the dellers code. It's very different from, say, "I open a bank, leave the doors open, and let everyone come for the money."

These are two conceptual topics. It's not the same as a topic of a code to make a transaction in rort, which I do from one bank to another and transfer a million in less than 10 seconds, 8 seconds, and see who catches me. It's over. Here, it's 27 days that the transaction can be. Well, one thing to see inside...

So, the person who hacked this was someone who was already involved, someone who had already invested money in it. Okay, what are the references using Ethereum? That's something completely different, and there's no way to attack that system by just jumping in and stealing that money. Okay, then, it's true that the community has come together and they're talking about trying to find solutions. Okay, and it's true that there's talk of a hard fork, okay, but within this system, it's pretty well controlled.

Okay, because what I was saying about this person doing a split, okay, a split basically means that you put in the funds, and if you said you didn't want to keep investing, you took that money out and put it in a chown. Okay, and to have a form of security, you were required to keep that fund there for 27 days. Okay, in the worst-case scenario, it's true that investors can lose all their money, but you can, at a programming level, attack that hacker and take all the money they have in another chown. Okay, so the code... I imagine we're all a bit decentralized.

I think that once a decentralized system is established, I think any side of the game is defined beforehand in the game code. These game rules are based on the consensus of all those who participate. The game rules are purely laws, but then there's morality, which are laws that everyone in society has. This moral law, in a way, what can be applied is a proposal to activate a series of mechanisms, also under consensus, as long as changes can be made to that organization in those rules of the game. Because it's perfect that a set of rules has been created among many, there can be some error that is detected in the future, which society should always have.

There should always be consensus, so that everyone believes that a change has to be made, that it has to be done, even to reverse a contrary decision. Where before it is, you have to be told that there is consensus. If we start to what I said, setting up arbitration, centralizing in a group that makes decisions, we are no longer decentralizing and we are doing... well, the blog... if you didn't like it because there were central banks...

Well, now we put a central authority, a representative... I don't know, that's a bit what... We do n't want to decentralize, we want a pure democracy, and that's how it can be done. First of all, I agree with you that it's been sold as if it were the philosopher's stone, and we mustn't forget that it's a very beta experiment. In fact, one of the differences I've seen between Bitcoin, which is taking very small steps, and this...

well, they were already talking about decentralized washing machines that automatically buy detergent. So, we have to look at current society a bit. The problem is that people think many things that don't cost them money are free, far from it. What we were saying before about moral risks is that the particles of risk are dispersed, and people don't know where they are. We've tried to centralize the system, and now I think people, at certain points, must assume responsibility for their actions.

If I'm going to invest in a product that has already been warned has bugs in the code, that it's high-risk, and so on, well, I enter under my own responsibility. But the problem is that now they're trying to spread risks here and there. Someone save me from my problem. So, going back to the topic of comparing the banking system with this other one, uh, decentralization and centralization are opposites, but if we want decentralization, we have to find equilibrium points before entering the system. If we don't have an equilibrium point, or what they call a game equilibrium, it doesn't make sense to develop it.

So, when we were talking earlier about arbitrage and auditing systems, they can be centralized or they can be decentralized. They can be decentralized authoring systems where I put dozens of code reviewers and the first one gets it. It's still a centralized system, but at least I've gotten closer to the equilibrium point because I know there will be fewer books. The issue of insurance, that is, "Hey, I want to enter here and I don't want to assume certain risk particles, okay, I'll pay the extrapolation of risk particles," but the decentralization isn't free, nor does it pretend to be. Bitcoin isn't free, nor does it pretend to be, nor is the system free, nor has it ever pretended to be.

Maintaining the system costs money, and that's something I think we have to accept from minute one. The risks a person assumes when entering a system of this type, okay. Ah, okay, okay, all in. Yes, I think we're losing a very clear point of view. You 've defined it, and I personally appreciate it.

I suppose not everyone has presented it, but now you've presented it as a Smart contract, right? So, uh, please, let's differentiate between what a contract is and what technology is. One thing is that technology has been used in favor of the autonomy of the will, which is one of the elements for a contract to exist. Without autonomy of the will, there is no contract. That contract can be...

There's a lawyer to be able to say it. So I think that's where the key lies. The governance part we 're explaining here is very good, but are we discussing the technology or are we discussing a contract? Then it 's normal that we go to the centralized part because we're talking about a contract. The discussion in the forums is journalism with engineering; that's the topic, and so when we come to these forums, it's a matter of engineering and depth of law; it's not exactly a PR issue.

And then, to a brilliant gentleman who... He's been involved and has made a bad point. The conclusions being drawn from that side aren't that he's misused it; he's made absolutely correct use of blockchain to use one of those methods. But before, but the technology isn't being used, it's not playing around. Making good use of it is the reason to continue using the technology because traditional accounting has been working in the world for 40 years, and all the big corporations have been using it for a long time.

What happens is that there are costs, as my colleague said, there are costs that are taken up. And this is open, and the costs are lower, and it's something open, and that's the key point for it. And from the point of view that it seemed to me, it takes it to a very interesting, super interesting area. So from the point of view, do you think that the banks are the ones who are going to put it into play? Because that's what I think.

I don't think it's the banks. I think that the banks are going to make equal or better use of it than the banks. Maybe you want to comment on the question we left. Should we invest in this problem, as we explained before? It 's actually directly connected with isum.

And that might be a question: is it generally okay that we're discussing these software and hardware solutions? I'd like to talk to Denis first. If you heard me, the question you asked was whether isum should intervene in this whole matter. Should the isum leadership, so to speak, intervene in the problem? Many believe we need to be quite careful, as these are technologies that are legally problematic.

And, well, this could be used in the future to establish responsibilities regarding other attacks. Because, while this is the first attack, there will be new issues in the future, and we'll certainly have more. Because, as I said, security is key, and we always include information every time we write. I don't know how we do it, but we always include courses. So, from my point of view, the community needs to try to minimize these risks and errors, but be careful with the responsibilities and what kind of issues we generate.

Does anyone want to add anything? I have nothing to add. I completely agree. Okay, okay, another question. I think it's very important, and in fact, we're discussing it amongst ourselves: who bears some responsibility?

Because this has happened, and there's a lot of money involved. So who is responsible? Is it the creator of Solidity, the founders of the DAO, or the people who invested their money? Should they know all the code? Where does the responsibility lie?

Well, we had mentioned that there are three possible responsible parties: the owners themselves, that is, the owners of their own funds; the attacker, or whatever we want to call it; or the Iium community. From my point of view, and this is totally debatable, and I don't have a dogmatic opinion, but one approach is that people entered into these contracts without knowing what they were investing in. Most people didn't know what a DAO was for when they bought these DA tokens. But on the other hand, I think we could also hold those people who encouraged buying these things responsible, selling them as if they were a philosopher's stone when they really weren't. For example, COES was warning us about certain books and...

On the other hand, we had people at the top of the community saying it was completely safe, but then I have a question. For example, not me, but someone else, I'm very interested in the concept, but I don't understand code. What do I do? Because this way I can never understand everything. In my personal opinion, if we get to this point where people have to understand all the code, people will leave, not out of fear, I think, and they won't invest much more.

Look, I think... I bought Tao, and right on the page where you buy it, there was absolutely no information associated with them finding a box, that this might not be entirely safe. Okay, so I think the responsibility lies a lot with the developers for knowing there was a problem and not saying anything. I also perfectly understand that someone who buys Tao tokens can't possibly know what's in the code. You know, I want to answer with another question, in a Galician way.

When I have to sign an extremely complex contract, whether it's a mortgage or a merger or acquisition, I don't care. I'm not going to sign it in my own handwriting alone, in front of the other party or their lawyer. I go with a lawyer, as we were saying before. Things aren't free. We've been sold this as if it were decentralized, which it is, and completely free, do n't you see?

It's not the same as signing a normal contract. If you want to assume certain risks, you can assume them and it will be free. Now you also assume the risk associated with not having had proper advice. Who should advise on these matters? I think that over time this type of role will be defined.

The technology is in its infancy, but I do believe that in the end, a third party has to answer for it because I didn't get proper advice when I invested my money in a product. I'm spreading my responsibility when the responsibility was really mine, and that's what I was saying before about moral hazard. It's true that the development team has responsibility because here, but it's a matter of good development and security practices because it wasn't known about it either. It could have [something]. And how much investment could a process bring?

But right now, maybe, well, yes. In this sense, I think the responsibility could fall on the company or on this whole system. It's not an impression that, because otherwise, we're also [involved]. Like killing freedoms, a question we also had is whether in the future we reach a point where Smart Contracts are virtually unhackable, a bit like banks also started at one point and are now so secure because many attacks have already happened, right? And that's the first point.

So you want to think that in the future, this code is going towards almost 100% security one day? I sincerely believe not. I mean, it's code, and code can always be attacked. I think that in the future what we're going to have is perhaps a system of auditors where, based on reputation, you'll use those contracts that have been previously audited by an auditor you trust. And if they fail you, they'll lose reputation, and you'll stop trusting them and stop using those failed contracts.

But to think that it's 100% secure at the code level? I think it's possible. And if this code isn't going to be exploitable, we have to change. I mean, I want to talk about the software because it doesn't seem like a good idea. Option one of the two cases, that is, both the software corrupts the code, corrupts the codebase, since all the contracts and loops are quite hairy.

So if this code isn't going to be exploitable, why would we have to move the base and change the ground on which the code sits? It doesn't really have to be changed, but this case, I think, is exceptional because although it's true that it doesn't attack the protocol itself, it's a contract that's above it. But it does affect, I think, everyone because of the amount of money involved and the amount of... in the end, an exceptional situation, an exceptional decision can be made, and a bit like what I mentioned before is what the public says, that perhaps... a decentralized moral decision can be made.

In the end, it's the miners who write history, they'll even write it, that is, and that's why decentralized mining doesn't... propose at a given moment... important thing that just touched on that issue of the miners making the moral, philosophical decisions, which I don't like, and that is that it's the miners who are voting, not all the members, that there is n't a single person... Unot has a number of to that, focusing on the network, are those who are voting to change their own code that they are managing, deciding for everyone instead of deciding for everyone. In the end, the interest that we cease to have is the interest of everyone.

It could happen, okay, let's see what happens here is that the miners are the ones processing all the data. And they are the ones who can directly vote. It's true that we could all vote, but they are the ones who have the most control right now because they are mining the transactions, so right now the vote is being given to them. But in the future, the next versions of Ethereum won't have miners, so if something like that happens, I think it will be possible to do this type of vote globally. Well, I have a question and want to comment on what I understand.

Or, of course, it's, let's say, software, and that software is made into a new version. To make that new version, that's what all the miners have to modify. I don't know if... So why isn't it possible to make a new version with the code corrected and respect the contract? Is that the equivalent of having a model?

The housing contract could be used to explain what I want, given, let's say, a housing model with clauses, as if I download it now here in my house and someone tears holes in the wall, and I realize that the contract didn't say not to tear up the wall. So, I make a new version of the template that says, "Hey, I won't tear up the wall." But of course, I made a contract based on the template. So, the hacker hasn't actually violated the contract; they've simply respected the protocol. Morally, all sorts of discussions can be made, but legally, they've respected the contract.

So, a new version can be made, and from then on, the template already has that action. And if that contract, from those dates onward, with version 1.1, should have problems, and the contract is signed, look, there are two things here: first, the money that person has taken is stored like a box and is there for 27 days. Okay, the options that the rest of the people who know how to program this and all that have are to end up taking those funds from that user. Okay, if you make a second contract, that money is in the...

First contract, and he has his money in his own account, so you can't transfer it to another. Yes, I'm not saying to make a second contract, change the protocol, so that's what's going to happen and people can relax. Well, ideally, we should fix the problem Carlos was talking about regarding how that person got the money. You know, then the other problematic part of the DAO is that this hacker has taken a huge amount of Ethereum. Okay, and in the next versions, which are proof- stake, the amount of Ethereum you have will give you a lot of power.

So, the fact that we let this person get away with it and take that Ethereum means that the next version, which is going to be very important, will have a lot of power over everyone else. That's why they're trying to make a decision. The possible decisions are: Block everything in there and never touch it again; go back to the point where it started and get all the money back; and do nothing, but what the hackers would do is attack that account, keep taking the money, and that would be a... The struggle between the hacker and the one hacking them is underway, with trust being compromised because the promises made are being broken. That's true, but as others have said, we're in a kind of beta version, and I think the people who rolled the dice weren't expecting that amount of money.

They were talking about at most 5 million, and they've been overwhelmed by the amount. Regarding what the last comment said, let's use an analogy to Linux. Okay, Linux is based on free software, and that doesn't mean it's bad because it's software, and you see, what happens is that it keeps getting better. It's much harder to find vulnerabilities than to exploit them, and people use it. It would be somewhat equivalent to, maybe it's not perfect, but it's improving little by little.

People... It's the issue that a colleague mentioned before, that sometimes the system crashes because of a poorly drawn contract by an entity. Those are two different things. I remember with Brexit, they said it wasn't going to happen because the bookies said it would n't. Once it happened, what do we do?

Well, here's a technology that is brilliant in... The thing is, it's really well done, the R and all that, but because of misuse, someone has blown it up to 150 million. Something that was going to be just for everyday use suddenly becomes part of the intelligence to see what's done in the future. There are two things we can't stay silent about. I have a cone.

Let's start. There are two topics that I ca n't quite grasp right now. Yes, there was one question, another question. Yes, I'm just getting into this technology, but the part I did n't quite grasp is: What's the difference between using current technology with current money and these types of applications? Well, they gave us the example of RBM.

RBM, for something it does besides some governance, is worth something like 30 billion dollars or something like that, a sworn amount of money. But all of this, I can get to a place, open it with my smartphone, send a message, have it taken from my real account, under current legislation, and for the whole service it charges me a certain amount for governance. Yes, in the end, this system also has governance and it will have an end, the added value. The value you have is that it's a decentralized system, and you're not working right now. When you want to rent something with Airbnb, you're going through Airbnb, and they're taking their percentage, but in this case, you're making a transfer directly to another person.

A bank isn't involved, so you're not being charged the percentages that a bank charges. The system has to charge for its own expenses. And now that they have insurance, which is a centralized system, it's about keeping things as minimal as possible. It's more of an ECM option, where instead of charging me two, it's not... Adding one more thing, it's not just that.

What all this basically does is distribute trust in an environment where people don't trust Airbnb point-to-point. You have to trust Airbnb and all the onboarding processes. You trust them and pay a fee. Nothing happens, but here, the distribution of all this trust is absolutely point-to-point, person-to- person, without needing to trust a third party. This is the value it brings; it 's a trust where nobody is in the way, let's put it that way.

Okay. So how are governance systems supposed to work? Sure, you can build all that on top of it, which will make everything more expensive. Of course, but it doesn't take away that value of peer-to-peer trust, which is what it is. With Bitcoin, I'm taking coins; you trust that I sent them to you.

There's no need to trust anyone else. That's what peer-to-peer communication is across the entire network. For example, BNB handles your credit card data, personal information. The site can crash. Man, that measures what this type of decentralization allows, apart from reducing costs.

Because it's true that good governance is important, but they also take their cut for providing the service, which is their profit. First, it reduces costs, and second, you don't have to give all your data. For example, that's one of the benefits of Airbnb not operating in your country, or Airbnb having a regulatory problem in your country. In the banking sector, there are many countries where there is no financial inclusion. So that's what decentralization ultimately provides: a principle of neutrality between the parties, which isn't...

We have translation issues in many places. That's where I'm weak, the part you mentioned about the Jovent. This one in Switzerland that's going to be an intermediary because, well, that would be the problem. Well, that's been a regulatory patch that's been made to complete the process, I mean, in the end, and to be able to provide visible human resources behind the scenes. This infrastructure will always have the real world; problems exist and can always fall.

There's always a possibility of falling, in short, there's always that link to the real world. So there always has to be a door somewhere that allows the money that's transformed to pay people, judicial money, however it's done. And that's what this has done in this specific case. The law in Germany doesn't stipulate that a machine paying a person has to have a person, but that's not the law. If it were different in Germany, then that wouldn't be the case in Switzerland.

Switzerland is more involved in everything, so that's why they created it. But I think what he said, well, what he said has merit because in the end, well, it's said That's not going to be a payment, it's not going to be free, but it's not free in the end. Yes, it will have governance mechanisms that will create a fee, but the act of having competition in the system will then lower the fees. But it won't be free, there's no way that's the objective. The objective isn't even to lower the fees.

In my opinion, well, lowering the fees in Brazil... I arrived in Brazil in... and they are things that are not... they have no basis. It's a case of abuse and abuse, and micropayments, for example, that I work with the Grand Muertas group, and they are very simple people.

That here, so they are things that can pay micropayments without... there's a very small and absurd amount. That would be a sustainable case, so that also... Besides, in some cases it can also reduce the costs associated with certain services. The objective in this case is not the lowering of costs but the decentralization of...

Where are the powers? That is, really, at the moment when you... You're paying an intermediary, a single person. That person has power over you, power to use your money. You don't really know what that person is going to do with your money.

There are cases where this centralization leads to abuses, like the cases you're telling me about, where you 're paying absurd costs. That abuse is precisely because it's a monopoly, an oligopoly, which makes everything... that's the case where the transaction really does vary a lot. There are points where I don't know, for example, if it actually makes the transactions cheaper than what's available. I imagine it is, economically speaking, probably better than what's available.

Another thing we don't realize here in Europe is that, globally, there are many people who don't have access to banks. And having these kinds of systems allows you to make micropayments where you can have your own bank and you don't depend on a central bank. The CAS. Ah, yes, you have to depend on the CAS. Likewise, you have other figures.

It's an Elo that you exchange. A town in Africa, if you exchange it, buys you a card with money so you can pay others. As a company, it's a micropayment company. Yes, I know it. So, in the end, there will always be a character who has to take it.

Not necessarily to exchange the CAS, that also exists, it's not necessarily. Because if the country works with, for example, Bitpeso, it's not necessary. I've read that in Bitpeso, once you convert it to that, it's used to pay for everything. You're paying a taxi driver, but if you have to go to the supermarket and you can pay with a city, and they want the money, and you pay them with an SMS company, the exchange will go. That money, well, if it's not widespread, but with that microtransaction, the commission is very low.

In another case, a Clara case, it's impossible to carry it out because they don't have cards either. Well, apart from that, you can get the cards, you know. So, there will always be a third character who has to have the CAS or give CAS, it's not necessarily. Look, you don't have to survive with You can live perfectly well with this type of value system. There you have it, the taxi driver who paid the little guy from Nigeria.

He took a taxi in the city, yes, he paid that. The taxi driver doesn't want the usual money, a character who takes money. I 'm not entirely sure. I think that if it's a system that everyone can end up using, it can end up eliminating currency itself. For example, I know quite a bit that it's being used in Africa, and you can pay a taxi driver just like you can go to a supermarket and pay them because it's a system that works very well with very simple phones, which always...

or the service that ultimately... Today, it can be like that, but the embassy... the last question I'm clear on is the future. So I want to start again with how you see the future of... Oh no, of course...

Well, I think that all of us who work with similar projects of autonomous organizations, let's say, are at a moment of pause to reflect on this... and for example... Well, we are developing a document of practices because in the end what has happened... Here are patterns or designs or programming practices that are already in place, for example, in work right now we are in the process of releasing a new version, but we are going to take a little bit of a break now because we want to release a secure project, and there are many projects in Cono that are oriented towards being able to make forecasts of results through investment markets, predicting results, and depending on how we use them, we can organize a betting system or predict the outcome, or make decisions regarding the use of these tools, and from here on Skype, the Pina night website, and we are attentive, we see the messages, writing, we have the messages in view, you can say thanks to me next time because here I would like to answer more, but the public can't hear me, I hear you, mate, I mean, regarding the future of DAO, I think that this attack has helped us to take into account the most important thing about DAO, which is everything that happens before, we hadn't cared because it was very beautiful, everything that was going to be possible to do with But what could be done to the DAO from the outside hadn't been taken into account. So I think this will also help us to build with bricks, not straw.

And on the other hand, I also think that another of the major developments that will have to take place around it, as I mentioned, is that all external agents are DAO that will internally affect issues of oracles, forecast markets, etc., because in the end, a DAO by itself is practically useless; it needs to interact with external agents. I think it's very important to determine how this DAO will interact with both centralized and decentralized entities. We were talking about the possibility of a DAO interacting with legal entities and seeing how they could account for that in their balance sheets, whether it could become contractually obligated by a contract between a DAO and, that is, a signature on the DAO with the signature of a legal entity, and resolve those kinds of issues. So, on the one hand, there's the whole aspect of cybersecurity and conflict resolution mechanisms, including In the exante code, and on the other hand, how will the data relate to the outside world to prevent abuse?

Well, then I think we'll end up like this. Thank you very much. And before I go, one more thing: why did you say "meup"? So write the comments, things you like or things you want to improve. We're totally decentralized, so...