Ethereum Contracts Are Going to Be Candy for Hackers
1–10 of 85 posts
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#2Article is much better than headline, including a case study and constructive proposals.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#3Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin)
The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening.
I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a concern for anyone speculating on Ethereum.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#4Article is much better than headline, including a case study and constructive proposals.
Thanks! The headline did have a bit of a buzzfeed quality on reflection.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#5I don't know much about Ethereum so I might be way off here.
From what I understand though:
1. The contract you deploy to the blockchain is tied to your account where it gets the funds (ether/gas in Ethereum's lingo) to pay for its existence. So if those funds aren't there - the contract is 'dead' ;
2. There are ways to use Ethereum's registrar metadata to use contract's 'name' that isn't hardwired to the implementation so you can change the implementation behind the scenes. You can also have an intermediate contract whose only purpose is to proxy requests to the more involved contract so you can update your 'backend' at will.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#6This is pretty interesting. So I guess there's a huge opportunity here for grey/black-hatted people to analyse contracts and transactions and spot flaws? Apparently even bitcoin has weaknesses like these, with non-standard transaction scripts that may be easily solvable/stealable for anyone with a bit of insight
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#7Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…
I think we'll see a lot of interesting blockchain stuff come out in the next year. Recently, I have been trending toward the idea that one thing Bitcoin got right was carving out its useful domain area and focusing on that when it came to opcode support.
It seems to me to be much easier to reason about a very limited set of actions than the virtually unlimited ones Ethereum offers.
On the other hand, it's incredibly fast to spec out and deploy one of these contracts, which is pretty amazing to me. Lots of interesting things coming.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#8This is pretty interesting. So I guess there's a huge opportunity here for grey/black-hatted people to analyse contracts and transactions and spot flaws? Apparently even bitcoin has weaknesses like these, with non-standard transaction scripts that may be easily solvable/stealable for anyone with a bit of insight
Let's just say I was courteous to some of the early and published contracts out there.
It does sketch out a new world for grey and black hats, when the attacks can be pretty easily separated out from an IP since they're submitted over the ethereum network.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#9I don't know much about Ethereum so I might be way off here. From what I understand though: 1. The contract you deploy to the blockchain is tied to your account where it gets the funds (ether/gas in Ethereum's lingo) to pay for its existence. So if those funds aren't there - the contract is 'dead' ; 2. There are ways to use Ethereum's registrar metadata to use contract's 'name' that isn't hardwired to the implementat…
1) Well, contracts have balances, true. The people calling the contracts pay for it to run, so the dead terminology is at best imprecise. If the contract pays out 10 ether in .01 ether increments, and never takes any in, then it will be dead once depleted. On the other hand, people calling the contract pay for the cycles to run it, so one wouldn't typically go dead in that way.
2) I'm not an expert on the registrar situation by any means. But, I do not believe that updating a registrar pointer changes the balances at each contract (the old and new), so while it may be useful for some cases, those which involve balances may be more troublesome if you haven't thought ahead.
Re: Ethereum Contracts Are Going to Be Candy for Hackers
#10I don't know much about Ethereum so I might be way off here. From what I understand though: 1. The contract you deploy to the blockchain is tied to your account where it gets the funds (ether/gas in Ethereum's lingo) to pay for its existence. So if those funds aren't there - the contract is 'dead' ; 2. There are ways to use Ethereum's registrar metadata to use contract's 'name' that isn't hardwired to the implementat…
1) Well, contracts have balances, true. The people calling the contracts pay for it to run, so the dead terminology is at best imprecise. If the contract pays out 10 ether in .01 ether increments, and never takes any in, then it will be dead once depleted. On the other hand, people calling the contract pay for the cycles to run it, so one wouldn't typically go dead in that way. 2) I'm not an expert on the registrar s…
the 2nd point was to address the fact that the contract can be updated/patched with little if any impact to it's end users. so the new version of the contract gets pushed out, the old one is not in use any longer and just kind of dies off :)