Well, then they should have designed a better vending machine, shouldn't they? It may be unethical but I certainly wouldn't call it illegal. Again, back to the gas analogy, I don't think someone pumping gas at $0.20 is breaking the law even though that's clearly not the intent.

> What do you mean by "valid"?

None of the interactions for this attack were using the system in a way it wasn't meant to be used. It wasn't exploiting code. It was buying and selling assets in a way that enriched the attacker. That is a valid interaction.

Also, the whole point of these contracts IS that the code is the specification. That's the whole point of crypto in general. Trust nobody and let the blockchain determine truth.

This is what I like to refer to as “stupid tax”.

I’ve had cases where I put money into a soda machine and it gave me a drink plus more than I deposited into it. Or kicked out more than one item because one was stuck and my purchase obviously unstuck it.

Does this make me a criminal?

As an aside I used to work at a place with a soda machine that was basically like a slot machine with slightly higher payouts than one in Los Vegas. This was at a grocery warehouse and the drinks were at cost so “losing” your bet cost like a quarter. Probably designed that way, who knows?

However, that's not what happened in this attack. This attack was far more akin to the "getting 2 units for $1.25" that I described. In fact, that's exactly what it was at the root of it. At no point did the attacker actually exploit code.

The technical and explicit intent was followed to a T here. The attacker got a loan (perfectly within the intent) bought a bunch of the index (again, within the intent) sold a bunch of a underlying stock of the index (Again, within intent), sold the index, and sold the loan. Nowhere in this process was there a "this violates the essence of the contract".

And, let's be frank here, it's not like the attacker didn't open themselves to a huge liability. Anyone that saw this attack in progress could have bought sushi coin or UCI and ultimately drained away the income this attacker was earning, potentially putting them on the hook for a pretty massive loan.

Now, would such a scheme be legal if this were actual securities and not crypto? Nope, because we put more protection around real securities in the US and other countries. However, crypto went out of it's way to make itself above the law and outside of securitifaction. That, in fact, was the entire point of crytpo, to be something governments COULDN'T regulate.