Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

Post reply on HN
Print view View original

51–60 of 156 posts

Re: Smart Contract Security Field Guide

#51

Post by pcthrowaway »

dafelst wrote: post #14
pcthrowaway wrote: post #9

Earlier quoted context omitted.

As a dark-hat in the space you'd have a pretty good chance of being caught by chainalysis eventually. Meanwhile there are still hundreds of millions of dollars of bounties available for white-hats who responsibly disclose. The dark-hat hackers who aren't held responsible are likely in either Russia or North Korea

At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…

There are loads of bounty payouts in the hundreds of thousands. Probably 1000 payouts per year at that size. Most protocols would rather pay out $1 million than lose $100M to an exploit.

Re: Smart Contract Security Field Guide

#52

Post by brobinson »

karpierz wrote: post #47
csumtin wrote: post #45

Earlier quoted context omitted.

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

How exactly does the Spanish bank get the USD that the American bank sent without trusting a third party?

You don't need to trust when you can verify. The source code for the intermediary bank (smart contract) would be available for everyone to read.

Re: Smart Contract Security Field Guide

#53

Post by latchkey »

jjordan wrote: post #30
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Arguably the most popular use case is that smart contracts are used to create decentralized exchange services. See: Uniswap. They are also used extensively in the crypto sub-genre called DeFi, or decentralized finance. One of the most popular implementations is called Aave, which allows one to take loans out (i.e. give the contract Ether as collateral, receive an amount of USD stablecoin in return) on a given set of…

This answer right here is, in my opinion, one of the most interesting use cases that is available today.

Provide collateral and take out a loan against that collateral. It allows people to act as their own bank. No longer do you have to go to a bank, ask for permission and then get approved for a loan. Now, you can do that yourself, instantly, without any trouble at all. Amazing really.

What are those loans used for today? Well, mostly it is about interest rate arbitrage and providing liquidity. As a super basic example, you can borrow funds at 2% and then lend them out again at 3% and make 1%. It is essentially risk free (assuming the contract doesn't have bugs/exploits).

The larger picture will be to enable people to be their own Kiva's. Crypto often is pushed to 'bank the unbanked', but it is more than just holding money. It is enabling people to borrow against their existing holdings, effectively allowing anyone, globally, to put their savings to work for them, without having to rely on a centralized banking system to do so. This might not be interesting for USA people, but it is especially valuable in countries that don't have a stable banking system.

Re: Smart Contract Security Field Guide

#54

Post by latchkey »

sunshine-o wrote: post #13

Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…

You're literally commenting on a post that is a reference to a website that is trying to encourage a higher level of security in smart contracts. People are working on solving this issue.

Re: Smart Contract Security Field Guide

#55

Post by karpierz »

brobinson wrote: post #52
karpierz wrote: post #47

Earlier quoted context omitted.

How exactly does the Spanish bank get the USD that the American bank sent without trusting a third party?

You don't need to trust when you can verify. The source code for the intermediary bank (smart contract) would be available for everyone to read.

I'm not talking about code.

The goal of the transaction is for the Spanish bank to have access to USD. In the example given, the Spanish bank would then have to take the crypto it got and trust an exchange to give it USD in exchange for the crypto.

How do you get USD to the Spanish bank without trusting a third party?

Re: Smart Contract Security Field Guide

#56

Post by [deleted] »

photonthug wrote: post #40
hn_throwaway_99 wrote: post #33

Earlier quoted context omitted.

Wish I could upvote this more. I'm a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research. The thing that is striking to me whenever smart contracts come up is how extremely rare it is to be just presented with a simple, understandable, real-world use case that is an impr…

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

[deleted]

Re: Smart Contract Security Field Guide

#57

Post by Uptrenda »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an entire fucking field in a way that will make sense to you.

You will have to read papers, and think about what works and doesn't, over years to understand what is going on. And to be ahead of the curve -- you'll also have to do your own experiments that 9/10 won't yield any interesting results. In the blockchain and 'crypto' industry we also have the problem that entry is easy while skilled execution is not. Consequently: many fuck-ups have happened. It's easy to point to them and say that 'this is the industry' but its really not. Those are a few bad eggs.

Re: Smart Contract Security Field Guide

#58

Post by jason_pomerleau »

Uptrenda wrote: post #57
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an e…

Genuine question from someone on the outside watching all of this: then who are these things for? Apparently not me, nor GP, nor my mum and dad. Are we waiting until the Smart People sort out all of these complex details to make this stuff accessible for regular people?

Re: Smart Contract Security Field Guide

#59

Post by csumtin »

karpierz wrote: post #55
brobinson wrote: post #52

Earlier quoted context omitted.

You don't need to trust when you can verify. The source code for the intermediary bank (smart contract) would be available for everyone to read.

I'm not talking about code. The goal of the transaction is for the Spanish bank to have access to USD. In the example given, the Spanish bank would then have to take the crypto it got and trust an exchange to give it USD in exchange for the crypto. How do you get USD to the Spanish bank without trusting a third party?

USD doesn't have smart contract abilities so yes you are correct about trusting a third party to exchange crypto to USD. You could use a stablecoin but that requires you to trust the stable coin backing.

Re: Smart Contract Security Field Guide

#60

Post by chrisco255 »

karpierz wrote: post #47
csumtin wrote: post #45

Earlier quoted context omitted.

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

How exactly does the Spanish bank get the USD that the American bank sent without trusting a third party?

They may be willing to accept trusting the dollar-backed token issuer. In the case of USDC, it's Circle. But there's nothing stopping JPMorgan, BoA, Wells Fargo, Western Union, etc implementing their own dollar backed tokens, and I suspect we'll see more and more of that as regulatory clarity settles.

Maybe the Fed themselves will issue tokens in this way. It's also entirely possible to construct a permissioned, yet decentralized exchange of tokens among whitelisted parties.

Either way USD is never sent trustlessly.

Post reply on HN