Smart Contract Security Field Guide • Hacker News Board

Re: Smart Contract Security Field Guide

#41

Post by namdnay » Wed, Jul 26, 2023, 9:10 PM UTC

hn_throwaway_99 wrote: post #39

mteigers wrote: post #35

Earlier quoted context omitted.

I have no direct affiliation with this service (nor am I a user of it) but I recently learned about "Pool Together" which is a "lossless" lottery system. It's a daily lottery that happens automatically, you do not need to collect as it happens automatically, and you can withdraw all of your capital at any time. I thought that was a decently novel use case.

First off, wanted to say thanks very much for posting this, primarily because I think it is an example that is straightforward and easy to understand. That said, I'm also thinking "if this is one of the best, straightforward examples people are talking about when referring to 'the value of smart contracts', then smart contracts are just nowhere near the important tech its boosters believe." (To be clear mteigers, not…

So they’re “premium bonds”? Indeed they have been around far longer than crypto

Re: Smart Contract Security Field Guide

#42

Post by namdnay » Wed, Jul 26, 2023, 9:12 PM UTC

freemanon wrote: post #28

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Well it was the same with the internet itself. It's prone to hacks, bugs, and outage, and yet today we all use it to manage our finances and make payments.

Well, for the internet you could say “it allows stores to show pages with their products, and people can choose what they want to order, give their address and pay it with credit card , all without leaving their home”

That’s a pretty obvious killer feature of the internet

Re: Smart Contract Security Field Guide

#43

Post by hn_throwaway_99 » Wed, Jul 26, 2023, 9:17 PM UTC

namdnay wrote: post #41

hn_throwaway_99 wrote: post #39

Earlier quoted context omitted.

First off, wanted to say thanks very much for posting this, primarily because I think it is an example that is straightforward and easy to understand. That said, I'm also thinking "if this is one of the best, straightforward examples people are talking about when referring to 'the value of smart contracts', then smart contracts are just nowhere near the important tech its boosters believe." (To be clear mteigers, not…

So they’re “premium bonds”? Indeed they have been around far longer than crypto

Oooh, yeah, sounds exactly like that, which according to Google has existed in the UK since 1956. AFAIK we don't have anything like that in the US.

Re: Smart Contract Security Field Guide

#44

Post by GauntletWizard » Wed, Jul 26, 2023, 9:20 PM UTC

photonthug wrote: post #40

hn_throwaway_99 wrote: post #33

Earlier quoted context omitted.

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

Escrow's only real value is when a third party steps in to judge who's in the right when things go wrong. When Escrow works well, it's highly automatable and already significantly automated by modern escrow companies. When one or both parties try to cheat, then you need human intervention, and again; Crypto/Blockchain/"Web3" is completely unsuitable.

Re: Smart Contract Security Field Guide

#45

Post by csumtin » Wed, Jul 26, 2023, 9:25 PM UTC

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank.

You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Re: Smart Contract Security Field Guide

#46

Post by duxup » Wed, Jul 26, 2023, 9:27 PM UTC

photonthug wrote: post #40

hn_throwaway_99 wrote: post #33

Earlier quoted context omitted.

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

One theory I have about all this is that doing deals with zero trust is that ... people don't want to do that ... and no matter what you do there's going to be this whole process around these transactions to provide some assurances and so on. On the surface all this title company stuff is silly and it is, unless there's a real problem with the title and then you want it.

These are human problems.

Re: Smart Contract Security Field Guide

#47

Post by karpierz » Wed, Jul 26, 2023, 9:28 PM UTC

csumtin wrote: post #45

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

How exactly does the Spanish bank get the USD that the American bank sent without trusting a third party?

Re: Smart Contract Security Field Guide

#48

Post by csumtin » Wed, Jul 26, 2023, 9:29 PM UTC

csumtin wrote: post #45

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Explanation: bankA -> bankB -> bankC.

bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA.

Tada, we eliminated the risk of bankB running away with money. This is the lightning network

Re: Smart Contract Security Field Guide

#49

Post by hn_throwaway_99 » Wed, Jul 26, 2023, 9:30 PM UTC

photonthug wrote: post #40

hn_throwaway_99 wrote: post #33

Earlier quoted context omitted.

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

OK, great example, so I'll explain why a smart contract couldn't work here at all.

So, to start, going to be clear I'm using your specific example of "escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)". Simple enough. But, at the end of the day, who is to say "the keys you gave me are really the keys to the house you said you sold me"? That is, there needs to be some way to import to the smart contract ecosystem "yes, these are the keys to the house he sold me, and yes, the seller is the unencumbered title holder of this house". There is no real way to do that without some sort of oracle, and then you've just moved the problem back a step (i.e. you need to trust the oracle).

I happen to think title insurance is vastly overpriced in many states, but that's not the same thing as thinking that title companies (who normally do escrow in the US) don't serve a very important purpose. Most importantly, they ensure the seller is the actual title holder. And I can hear the crypto fans saying "Well, if you just held that title on a blockchain, there would be no ambiguity about who owns it." But that just pretends that all the real world examples don't exist, like a contractor who puts a lien on a house because he claims he wasn't paid. Also, in the real world, if someone steals the key to your house, it's not usually that hard to evict them and change your locks. In the crypto world it's "sorry, finders keepers".

So again, this simple example just falls apart on further inspection. Very happy to hear why any of the rationale I've given above is not correct.

Re: Smart Contract Security Field Guide

#50

Post by dale_glass » Wed, Jul 26, 2023, 9:32 PM UTC

photonthug wrote: post #40

hn_throwaway_99 wrote: post #33

Earlier quoted context omitted.

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

That only works so long the "car" resides entirely within the blockchain.

In the real world, there can be disputes after the sale. The property might have some horrible undisclosed effect. You might have stolen it. Or something else along those lines.

Securely swapping a bag of cash for some keys is solving the trivial part of the problem, and ignoring the rest.

The blockchain will do its thing and give you the title to a house infested from top to bottom with termites, but everything went according to the smart contract, so as far the blockchain is concerned there's no problem to be solved.