Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ethereum Contracts Are Going to Be Candy for Hackers

vessenes.com

Post reply on HN
Print view View original

21–30 of 85 posts

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#21

Post by fragsworth »

kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening.

Your fear seems to stem from misunderstanding how Ethereum works or what it even is.

Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or complex as you like. If you're afraid of bugs, don't put money into any complex smart contracts. If there's a lot of money involved, then spend some money/time reviewing the smart contract.

Also, contracts can set precedent once they are in the ecosystem. If a contract has been heavily used prior to your desire to use it, you can copy it, and be relatively confident that it will be secure for you to use.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#22

Post by Bromskloss »

vessenes wrote: post #15
dmix wrote: post #12

Don't these contracts existing in a market? If one contract is flawed won't customers flock to another competing one? This would create an incentive for quality control. Or is the proposed problem that these flaws are unavoidable or too costly to prevent? I could see the high-investment cost being a deterrent for developers to adopt the platform. In general the contract code should be as simple as possible and memory…

From my review of some of these contracts, even fairly obvious flaws are not being exploited (yet). So, flaws will become known, and presumably there will be ratings and trust ratings and so on eventually. In the interim, though, some of the flawed contracts moved well over $100k in their first week of existence. That seems worth paying attention to. I would propose flaws like these are unavoidable, unless you can pa…

What are the fairly obvious flaws?

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#23

Post by harwoodleon »

jerf wrote: post #17
pessimizer wrote: post #14

Don't lawyers do this to real-life contracts?

First, let me acknowledge that this is a fair question. A bit cynical, perhaps, but fair. To answer it, no, not like this. Contract law has a lot of humans in it. You are certainly able to sign some contracts with combinations of clauses that can get you, and I've read horror stories at the mega-corp levels about contract clauses interacting unexpectedly and screwing some party or other. But even in those cases, the…

But the issue with humans is also interpretation. If a contract or set of clauses is detrimental to a specific party, because if the complexity of the structure of a contract, not the language used - then surely this is easier to spot and fix with software heuristics, rather than deciphering humalanguage

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#24

Post by Rauchg »

ICYMI: Bitcoin will gain Turing-completeness via a merge-mined sidechain called Rootstock (http://www.rootstock.io/), that also offers a transaction throughput boost (300TPS right off the bat).

I highly recommend their whitepaper as it's also a great overview of the Blockchain ecosystem as a whole.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#25

Post by Bromskloss »

jerf wrote: post #17
pessimizer wrote: post #14

Don't lawyers do this to real-life contracts?

First, let me acknowledge that this is a fair question. A bit cynical, perhaps, but fair. To answer it, no, not like this. Contract law has a lot of humans in it. You are certainly able to sign some contracts with combinations of clauses that can get you, and I've read horror stories at the mega-corp levels about contract clauses interacting unexpectedly and screwing some party or other. But even in those cases, the…

I'd love to hear more about those horror stories you mention.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#26

Post by voidlogic »

fragsworth wrote: post #21
kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0.

"will be effectively error-free" != "probably as good as the Linux kernel", not even close :D

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#27

Post by vessenes »

harwoodleon wrote: post #19

I went to a talk with Vitalik Buterin recently where he stated code quality was one of ethereum's biggest threats. But, there is a market for code quality review too now! Trustless contracts must at least be audited or they will have no ultimate credibility. Just because something carries a risk, that is no reason not to adopt it, even try to fix it. If the authors main point about code quality error rates is the mai…

I'm the author, and I agree with Vitalik. I thought it was interesting to dig into the wild west of live contracts and see what was happening right now.

The early days of Bitcoin had many of these same business models, although with much worse security and trust models.

Getting security and secure practices together is going to be a large effort, and a simple post like mine is just a way of throwing my hat in the ring and getting some conversation going.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#28

Post by aab0 »

voidlogic wrote: post #26
fragsworth wrote: post #21

Earlier quoted context omitted.

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

>Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. "will be effectively error-free" != "probably as good as the Linux kernel", not even close :D

The security history of the JVM suggests that one shouldn't be optimistic there either.

Re: Ethereum Contracts Are Going to Be Candy for Hackers

#30

Post by geographomics »

fragsworth wrote: post #21
kneel wrote: post #3

Running a machine on a blockchain (Ethereum) is much more complex and error prone then recording transactions on a blockchain (bitcoin) The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. I do see a lot of glitzy websites using blockchain buzzwords, but there isn't much going on besides fundraising. This should be a conc…

> The Ethereum virtual machine has to be completely error free if any sane person is going to put their money into it. I just don't see that happening. Your fear seems to stem from misunderstanding how Ethereum works or what it even is. Most likely, Ethereum itself (the "engine") will be effectively error-free - probably as good as the Linux kernel - once it reaches 1.0. And smart contracts can be as simple or comple…

Hopefully a lot better than the Linux kernel: http://www.cvedetails.com/product/47/Linux-Linux-Kernel.html...
Post reply on HN