Thinking About Smart Contract Security

The problem of codifying reality with words and rules is an old one, as old as the law, and no one has come up with a good solution yet. The edge cases seem to be infinite.

> The reason for this fundamental conclusion is as follows. All instances of smart contract theft or loss – in fact, the very definition of smart contract theft or loss, is fundamentally about differences between implementation and intent.

This is, I think, to its core the fundamental problem with any kind of rigid language in contracts. It's nice to see an acknowledgement of its existence, but disappointing to see no acknowledgement of its severity. We see this all the time, not just in code, but in law and policy as well: an overly-prescriptive law can be just as problematic as an overly-vague one. And imperatively written smart contracts are about as prescriptive as you can get.

This is of course in addition to another critical shortcoming for smart contracts: they are capable only of interacting with informational assets (of which "money" is a subset). You can't possibly create a smart contract to purchase a house, because at the end of the day the person that physically occupies the house is in the position of power. Any smart contract enforcement mechanism would necessarily rely upon some outside system, which defeats the whole purpose of the thing in the first place.

I have high hopes for cryptocurrencies, in no small part because they inherently deal with only information (again, money is a subset thereof). But I'll be honest: I remain extremely skeptical that smart contracts as we currently understand them will ever see general adoption. It strikes me as an emotionally understandable, but rationally ill-advised, radical departure from hundreds of years of political philosophy and sociology... not in a way that inspires the term "disruption", but rather in a way that evokes "out of the frying pan, and into a boiling pot of lava". I'm all for "a better contracts system", but given that a contract (even one with a non-human entity) is by its very definition a social instrument, I just fail to see a reasonable way forward for what is essentially contractual bytecode.

If the intent of the DAO was to create a decentralized system that people could buy into so that they can vote/participate in investment opportunities presented by other members, then the big question I have is why was the system implemented in such a way as to hold all investment funds up front?

Wouldn't a more secure implementation have allowed members to buy in for a nominal fee and keep their investment funds outside of the DAO until they voted/participated in a specific contract/investment opportunity?

What I think might be useful is something like the Rust borrow checker but it would be a currency ownership checker which would check for currency ownership at compile time.

It's a complete aberration that the Ethereum Foundation is even considering pushing a fork (hard or soft). There will be a fork, that is people leaving "Ethereum" for its new shiny successor.

If you want the protection of a big brother, why not invest in the regular stock market? Lots of neophytes trying to get rich quick are now crying for help after realizing they made a mistake. It's really touching.