Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

101–110 of 156 posts

Re: Smart Contract Security Field Guide

#101
post #48
post #45

Earlier quoted context omitted.

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Explanation: bankA -> bankB -> bankC. bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA. Tada, we eliminated the risk of bankB running away with money. This is the lightnin…

Fair but LN is not a smart contract. Bitcoin can't do smart contracts the way a chain like Ethereum does, it's functionality is very limited.

Re: Smart Contract Security Field Guide

#102

Earlier quoted context omitted.

More than just needing an oracle - the keys and the house are both physical items. There's not really any practical way for a contract on the blockchain to validate that a particular physical item is in fact the item that it purports to be. Are these ACTUALLY the keys to this house? Are they the only set? The original set? Were the locks changed, and this set in the contract is no longer valid? Then putting aside all…

> More than just needing an oracle - the keys and the house are both physical items. There's not really any practical way for a contract on the blockchain to validate that a particular physical item is in fact the item Responding to you but this applies to lots of stuff in this thread. Quoting wikipedia, "a smart contract is a computer program or a transaction protocol that is intended to automatically execute, contr…

> How can anyone possibly object to this technology as if it were a) impossible or b) useless?

Because it doesn't work, nor do I believe it ever really can work, at least as it's largely advertised. I mean, you just read the description from Wikipedia and are basically saying "How can people object to this idea?" That's like reading about all the great things flying cars can do and then saying "How can anyone object to flying cars?"

The point is that I (and many others, but I'll only speak for myself) do not believe that the utility the crypto boosters like to tout about smart contracts is technically feasible, at all, for most of the things we use contracts for in the real world.

Re: Smart Contract Security Field Guide

#103
post #48

Earlier quoted context omitted.

Explanation: bankA -> bankB -> bankC. bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA. Tada, we eliminated the risk of bankB running away with money. This is the lightnin…

Fair but LN is not a smart contract. Bitcoin can't do smart contracts the way a chain like Ethereum does, it's functionality is very limited.

I'd argue it is a smart contract :) just not a Turing complete one

Re: Smart Contract Security Field Guide

#104
post #92

Earlier quoted context omitted.

If bankB is hacked, bankA still gets their money back or the payment is sent to bankC. So I still think the counterparty risk is eliminated between bankA and bankB

> counterparty risk is eliminated between bankA and bankB Correct, but in its place is a new systemic risk with a real-world nonzero probability: the contract itself getting hacked. There isn't analogy for this in modern banking since the equivalent issue would either (a) get rolled back or (b) fold into the bank failing envelope. (There is analogy in pre-modern banking, though it largely revolved around debasement a…

True although I'm not talking about Ethereum smart contracts, I'm talking about Bitcoin ones which are very limited and not Turing complete. The lightning smart contract is like 20 lines and has been live since 2018, I feel the probability of the contract getting hacked is very low(famous last words!) https://github.com/lightning/bolts/blob/master/03-transactio...

Re: Smart Contract Security Field Guide

#105
post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I don't see any good answers here so I'll give it a try.

Smart contracts can be used to build voting systems, multi-signature agreement systems, escrow systems, exchanges etc. But all of these rely on data being in the crypto world e.g. on blockchain.

The most powerful emerging use case for smart contracts is verifying zero knowledge proofs. Using groth16 or PLONK you can compress any amount of information or computation into a constant size proof (constant in both size and verification complexity [1]). This leads to the question, what is the use case for zero knowledge proofs?

TLS notarization: a user can prove they received data from a website by proving the signature in the TLS session. So e.g. i could prove how many twitter (sorry, X) followers i have by proving an element in the HTML that is signed by twitter, or prove that i have a dm with individual X (not the company, a variable meant to indicate some person). This can be extended to proving e.g. bank account balances using TLS signatures. The idea is such a TLS proof can be ingested on the blockchain so anything on the internet can be used as a logical condition for a smart contract. https://tlsnotary.org/

^ a similar case exists for email data verification using RSA

Private user data: companies can track information about users without knowing what information belongs to what user. The idea is, the user data is stored inside a ZK proof and the user manipulates the data in ZK, then provides a proof to the web application that they manipulated it in a way that follows the rules defined by the application. A simple example might be ZKFlix. Each time a user watches a movie they add an entry to their data indicating `moviedId: true`. The web application can store the user state without knowing which user watched which movie. Put more simply, each change to user data is attributed to an anonymous actor. Theoretically it should be possible to build websites with the same functionality of existing websites, but where the website is non-custodial of the user data (this isn't strictly blockchain related). This type of system allows users to make proofs about their application user data and submit them to the blockchain.

^ the more general case is building a state system that exists entirely in ZK and putting a state root on the blockchain. Then anything about the state system can proven onchain

These are the examples I have off the top of my head (though i do work in this space). I think smart contracts by themselves lack functionality and resort to hacky things like permissioned oracles. Combined with ZK though smart contracts become a financial system that is trustlessly bound to the internet. The hard part is making the internet provable as sequences of polynomials.

Hard agree that the current user experience sucks though. I'm of the opinion that in the future users won't directly interact with the blockchain the same way a user doesn't interact directly with e.g. postgreSQL. If to make an account on a website you had to write an SQL query inserting the row that would be a similarly bad experience to managing your own private key xd

[1]: The scaling isn't strictly constant, but small enough to be considered for practical purposes constant

Re: Smart Contract Security Field Guide

#106

Earlier quoted context omitted.

OK, great example, so I'll explain why a smart contract couldn't work here at all. So, to start, going to be clear I'm using your specific example of "escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)". Simple enough. But, at the end of the day, who is to say "the keys you gave me are really the keys to the house you said you sold me"? That is, there needs to be some way to…

I guess you could say you don't need Amazon, the problem of getting goods is solved by physical stores. Yet, millions of people find value in ordering through Amazon instead. There will be use cases where people simply prefer blockchain over the legacy alternatives because it's cheaper, faster or better and there will be "whole new world" use cases.

This is just more "handwaving with a bad analogy", which again only goes to show how hard it is for people to show any real utility for smart contracts.

It is very easy for me to explain and understand the benefit of ordering over Amazon vs. going to a physical store. When Amazon first showed up, I didn't think "Gosh, what is this really for?" or "Can somebody explain to me, simply, what Amazon is for?" No, I went to amazon.com, browsed a giant selection of books, ordered one and it showed up at my house a couple days later. "Wow, that's awesome" I thought.

If you say "There will be use cases where people simply prefer blockchain over the legacy alternatives because it's cheaper, faster or better and there will be "whole new world" use cases." then why is it so difficult for anyone to say what those use cases actually are?? You say it will be "cheaper, better, faster", but are able to offer no concrete examples or rationale as to why.

Re: Smart Contract Security Field Guide

#107

Earlier quoted context omitted.

Asking about practical applications of a relatively mature technology is an entirely, 100% legitimate question to ask. It is frequently asked about many other techs and advances, although it's also frequently omitted since the answer is obvious and readily available/forthcoming. Not so with pretty much anything blockchain. So yeah, if a technology is a solution in search of a problem for ten years, that's gonna come…

It reflects a profound level of ignorance which over time feels more like gas lighting than any real attempt to understand what the industry is about. - provably fair gambling, lotteries, etc (otherwise vulnerable to selective scamming) - p2p asset exchange without centralised deposits (otherwise vulnerable to theft) - micro-payments and offchain payments (they help to scale the tech) - flash loans (instant access to…

lol scam.

Re: Smart Contract Security Field Guide

#108

Earlier quoted context omitted.

OK, great example, so I'll explain why a smart contract couldn't work here at all. So, to start, going to be clear I'm using your specific example of "escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)". Simple enough. But, at the end of the day, who is to say "the keys you gave me are really the keys to the house you said you sold me"? That is, there needs to be some way to…

> There is no real way to do that without some sort of oracle, and then you've just moved the problem back a step (i.e. you need to trust the oracle). Sure, and of course this is desirable. The "oracle" is a trusted external API (the bank, the DMV, the municipality, whatever). Some people may not like that these institutions are the arbiter of ownership or whatever, but of course we expect to be able to trust these i…

OK, I think I can fully understand and agree with your point, but what you are describing is really not a "smart contract" as it is usually described, at least by people who think of it as revolutionary technology. It sounds like you just want a title company with better technology, and that I can wholeheartedly agree with.

But the fundamental raison d'être of smart contracts (i.e. that they are "trustless", that "code is law", there is no intermediary) do not really support the use case that you are describing.

Re: Smart Contract Security Field Guide

#109
post #79

Earlier quoted context omitted.

All of your examples are trivial and deal with every day concepts. Blockchain technology intersects cryptography, computer science, government, politics, economics, finance, information security, probably even sociology and philosophy. It's multi-disciplinary. The idea that something needs to be simple to be legitimate is not a good one. Some things simply are complex and to say otherwise is to over-simplify them. Or…

Can you give examples of things which are "simply are complex and to say otherwise is to over-simplify them" and that are not either blockchain or snake oil? Note that internal operation does not really matter, only applications do; I might have no idea how CRISP/CAS works, but I can totally understand some of its applications and why people call it revolutionary.

Neuropsychopharmacology

Medicine

Higher level mathematics

Material science

Chemical engineering

...

There are specialized journals for blockchain tech now.

Maybe 'diverse' would be a better word than 'complex' for blockchain tech because projects aren't all financial. The OP made the claim that he couldn't think of use-cases for smart contracts. The problem isn't that there are no use-cases but that there are too many. What use-cases are there for a language for structuring trust when it can touch so many areas?

Every time we have these threads ignoramuses wander in and expect those in the industry to justify their whole field and area of expertise. Even though from their questions the only thing they know about the industry comes from news headlines and memes. Yet this is what passes for discussion around here. They expect to be spoon fed an entire area of knowledge they know nothing about. And when failing to instantly grasp the years of knowledge people have in this area they declare that it doesn't exist.

I'm over it. Pick up a book.

Re: Smart Contract Security Field Guide

#110
post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

For me personally:

When architected correctly (as with pretty much all software), it allows for a service to live (effectively) forever, independent from the creators of the service.

Example: I create a smart contract where everyone can post an IPFS hash to it, with added functionality to be able to post on someone's behalf if they give a signature to do so.

(This simple example is deliberately chosen to be a starting point. More complex functions & services can be derived from this starting point alone.)

If I were to kick the bucket, or if I'm not capable of contributing to its development, the service is still accessible to everyone else. If someone else wants to keep developing the service, they can do so via the contacts defined endpoints.

To me, the positives of this starting point outweigh the technical complexities involved with its development & maintenance. It varies wildly for others, but for me, this is the anchor point from which I can build something that can last long after me.

Post reply on HN