Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

Post reply on HN
Print view View original

31–40 of 156 posts

Re: Smart Contract Security Field Guide

#31

Post by mypastself »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

At the bottom, it’s an address holding a program that can release funds to another address or a group of addresses (which may be wallets or other smart contracts) based on some predefined conditions.

There’s technically no limit to what you can implement, but there’s no killer app yet, and it’s questionable if there ever will be. For me, it’s mostly an interesting piece of tech to learn about.

Re: Smart Contract Security Field Guide

#32

Post by anamexis »

rattlesnakedave wrote: post #22
greiskul wrote: post #21

Earlier quoted context omitted.

It's amazing how quickly code-is-law becomes regular law is law when the code allows all your money to be stolen. And that is the nail in the coffin of this ideology, proponents of blockchain claim one day your house deed will be on the blockchain. What happens when people hack your house away from you then?

Code is law. The issuer of tokens backing rwas should be able to figure this out and reissue.

So, the issuer of tokens is law

Re: Smart Contract Security Field Guide

#33

Post by hn_throwaway_99 »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Wish I could upvote this more.

I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research.

The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an improvement over existing alternatives. Instead, so often you get:

1. Long missives about how the technology is really cool, but that completely sidestep the original question: show me a simple example of what a smart contract is used for.

2. Lots of examples that are only relevant to crypto in the first place (i.e. just speculating on valuation movements in crypto). What I mean by this is that the purpose of finance (at least the intended purpose) should be to provide capital for real goods and services. Pretty much all of the smart contract examples I've seen are just, for example, triggers related to the prices of a bunch of different tokens.

I would honestly be thrilled if someone could just give a simple example of someone actually using this stuff in the real world.

OK, please commence all the "HN just always hates on crypto" non-responses... (this last sentence is sarcasm but also born out of frustration of getting straightforward answers in this domain).

Re: Smart Contract Security Field Guide

#34

Post by jjordan »

Veserv wrote: post #29
jjordan wrote: post #16

Earlier quoted context omitted.

There is a thriving community of security researchers and engineers in the smart contract auditing space. Services like code4rena ( https://code4rena.com/ ) and sherlock ( https://www.sherlock.xyz/ ) make audits a public and competitive process with leaderboards that track the best of the best. Naturally those that rise to the top of these leaderboards tend to end up offering boutique auditing services due to project…

But does it work? Do any of the audits ever come back clean i.e. no detected defects? Are those audits actually serious and representative of the resources available to a profitable attack? Many smart contracts manage millions, tens of millions, hundreds of millions and up in value. Do they actually do multi-year audits with a team of 5 that come back clean? Do they seriously believe and publicly state their design p…

Audits are performed as a due diligence before actually launching the product or service that will utilize it. The audit is a collaborative process between the auditing team (or contest participants, in this case), and the developer of the smart contract. Contestants are rewarded financially for finding exploitable issues, with unique criticals (i.e. exploits that lose customer funds or otherwise fundamentally breaks the intended behavior of the contract) paying the most. AFAIK no public Codearena or Sherlock audit has had a critical vulnerability exploited after a contest was completed.

It would be hard to compare the smart contract auditing ecosystem with audits of internal processes at those entities you mentioned, because the problem being solved is fundamentally different. Google, Amazon, et. al. are protecting access to information stored in data centers, whereas smart contracts are at most a few thousand lines of code that needs to work as intended, without clever hackers finding a way to exploit them.

Re: Smart Contract Security Field Guide

#35

Post by mteigers »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I have no direct affiliation with this service (nor am I a user of it) but I recently learned about "Pool Together" which is a "lossless" lottery system. It's a daily lottery that happens automatically, you do not need to collect as it happens automatically, and you can withdraw all of your capital at any time.

I thought that was a decently novel use case.

Re: Smart Contract Security Field Guide

#36

Post by duxup »

mteigers wrote: post #35
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I have no direct affiliation with this service (nor am I a user of it) but I recently learned about "Pool Together" which is a "lossless" lottery system. It's a daily lottery that happens automatically, you do not need to collect as it happens automatically, and you can withdraw all of your capital at any time. I thought that was a decently novel use case.

That sounds amusing ... albeit the lottery aspect makes me suspect shenanigans. Is anyone reading the contract to understand if it really is what it says it is?

One of those issues is of course that people will need to find someone who can read the contract for them, and hope they get it right.

Still, good example that is easy to get, seems like easy to code and work.

Re: Smart Contract Security Field Guide

#37

Post by Veserv »

jjordan wrote: post #34
Veserv wrote: post #29

Earlier quoted context omitted.

But does it work? Do any of the audits ever come back clean i.e. no detected defects? Are those audits actually serious and representative of the resources available to a profitable attack? Many smart contracts manage millions, tens of millions, hundreds of millions and up in value. Do they actually do multi-year audits with a team of 5 that come back clean? Do they seriously believe and publicly state their design p…

Audits are performed as a due diligence before actually launching the product or service that will utilize it. The audit is a collaborative process between the auditing team (or contest participants, in this case), and the developer of the smart contract. Contestants are rewarded financially for finding exploitable issues, with unique criticals (i.e. exploits that lose customer funds or otherwise fundamentally breaks…

So, no. Lots of “process”, words, and gamification, but no results and no evidence of actual robust security at the necessary multi-million dollar level.

Looking at the leaderboard [1] it looks like the pay out is a few thousand dollars for a “steal all the money” defect. These companys literally want to manage millions of dollars, yet it regularly costs only a few thousand dollars in developer time to steal all the money. And these are the good companys doing audits.

What a joke. It is worse than XP, but at least Microsoft knew they were a laughing stock.

[1] https://code4rena.com/leaderboard

Re: Smart Contract Security Field Guide

#38

Post by coding123 »

mteigers wrote: post #35
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I have no direct affiliation with this service (nor am I a user of it) but I recently learned about "Pool Together" which is a "lossless" lottery system. It's a daily lottery that happens automatically, you do not need to collect as it happens automatically, and you can withdraw all of your capital at any time. I thought that was a decently novel use case.

Sounds really unnecessary. What is there not to trust in an actual lottery? Are the people that go on TV to show the results not worth the job they have?

Why does the website have a starting sentence that includes:

"a passion project I hold dear to my heart."

What is it about lotteries or smart contracts that have people that saying "dear to my heart". The only thing "dear to my heart" is probably my wife and family. I don't know how something related to money could be. And I have a hard time trusting a person that has a passion project dear to their heart related to lossless lottery systems.

Re: Smart Contract Security Field Guide

#39

Post by hn_throwaway_99 »

mteigers wrote: post #35
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I have no direct affiliation with this service (nor am I a user of it) but I recently learned about "Pool Together" which is a "lossless" lottery system. It's a daily lottery that happens automatically, you do not need to collect as it happens automatically, and you can withdraw all of your capital at any time. I thought that was a decently novel use case.

First off, wanted to say thanks very much for posting this, primarily because I think it is an example that is straightforward and easy to understand. That said, I'm also thinking "if this is one of the best, straightforward examples people are talking about when referring to 'the value of smart contracts', then smart contracts are just nowhere near the important tech its boosters believe." (To be clear mteigers, not directing this at you, just saying this because what you've posted is probably the best example of a real-world use case I've seen).

In summary, what PoolTogether (https://pooltogether.com/) does is basically act like a normal savings account, except instead of you getting 4% interest a year or whatever, that interest is all pooled and then given out in big chunks at random - most people get nothing, but "winners" will get what is essentially everyone else's interest. Some notes:

1. I'm not clear what activity they're engaging in that actually generates interest (e.g. who they're lending to in order to generate a spread), but in fairness I didn't spend much going into the details. That said, if they really are generating income by lending, then I'm very curious how they can't suffer from some of the same negative edge-cases inherent in fractional reserve banking, like a run on the bank. If they are not generating real income from lending, I'm very suspect about how they can really be generating interest. Again, I didn't look much into this, so totally admit I could just not be understanding the details here.

2. I see absolutely no real benefit that comes from doing this as a smart contract vs. just doing this as any other kind of normal software (e.g. what core banking software provides), despite what their blurbs on the website say.

So still just dumbfounded by the lack of real utility in any of these smart contract examples I've seen.

Re: Smart Contract Security Field Guide

#40

Post by photonthug »

hn_throwaway_99 wrote: post #33
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no established mechanism for doing this peer-to-peer. If you're "lucky" then you see a whole industry of middle-men created around trying to solve /skim on this, which then increases the costs of transaction (say realtors or car dealerships). If you're unlucky, then there's simply no way to have a trust-free transaction, and you just weigh the risk and take it or leave it.

This does seem solvable, right? Because there's only a few APIs (bank transfers, title queries) that are involved in a fully automatic escrow. Such escrow could be provided as a free service by the government, or it might be pay-per-use (and simply cost less than markup from dealerships/realtors).

Post reply on HN