Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

Post reply on HN
Print view View original

61–70 of 156 posts

Re: Smart Contract Security Field Guide

#61

Post by kspacewalk2 »

Uptrenda wrote: post #57
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an e…

I genuinely cannot tell if this comment is veiled sarcasm or not. That or a question about concrete, practical examples of this tech and what unique advantages smart contacts bring to the table has hit a real nerve and set you off. If the latter is the case, that is of course a telling answer in itself.

Re: Smart Contract Security Field Guide

#62

Post by chrisco255 »

anamexis wrote: post #32
rattlesnakedave wrote: post #22

Earlier quoted context omitted.

Code is law. The issuer of tokens backing rwas should be able to figure this out and reissue.

So, the issuer of tokens is law

If the code allowed the issuer such flexible control, then yes. But many tokens have immutable implementations that can no longer be altered after deployment.

Re: Smart Contract Security Field Guide

#63

Post by csumtin »

csumtin wrote: post #48
csumtin wrote: post #45

Earlier quoted context omitted.

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Explanation: bankA -> bankB -> bankC. bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA. Tada, we eliminated the risk of bankB running away with money. This is the lightnin…

I realise that this might seem a bit niche but we can use this to create a payment network(like visa). This system is better as the nodes in the network don't need to trust each other.

Cast your mind back to 2008 and hopefully this means that one bank falling over doesn't bring down the whole system.

Re: Smart Contract Security Field Guide

#64

Post by dguido »

dmuhs wrote: post #12
dguido wrote: post #7

I appreciate how organized the Consensys guide is laid out. It's pretty easy to read. Trail of Bits has a similar guide that is a little more in-the-weeds technically. It also covers, what we think is, essential background about certain automated analysis techniques like static analysis and how fuzzers work. Check it out! https://secure-contracts.com/

Hi Dan! Small correction: This is not a ConsenSys guide. It's my own work. As a private person. :) More content on offensive security techniques is yet to come, so stay tuned!

Oh neat! I didn't realize. It's good! I could have been fooled it was done by a whole team :D

Re: Smart Contract Security Field Guide

#65

Post by Uptrenda »

kspacewalk2 wrote: post #61
Uptrenda wrote: post #57

Earlier quoted context omitted.

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an e…

I genuinely cannot tell if this comment is veiled sarcasm or not. That or a question about concrete, practical examples of this tech and what unique advantages smart contacts bring to the table has hit a real nerve and set you off. If the latter is the case, that is of course a telling answer in itself.

It's not this specific question. It's the fact that any time anything about blockchain tech is posted on hacker news the first comment will be 'b-but where are the use-cases' with the second being something like 'lol scam.' It would be the equivalent of replying to every HN post with 'but why would anyone want to own a personal computer?' That's how irrelevant and uninformed these posts are.

Re: Smart Contract Security Field Guide

#66

Post by JumpCrisscross »

csumtin wrote: post #48
csumtin wrote: post #45

Earlier quoted context omitted.

Correspondent banking. So say a bank in the States needs to send money to one in Spain. They may not have a relationship, so they go through an intermediary bank. You can use a smart contract to eliminate the trust in the intermediary bank, so eliminating that counter party risk

Explanation: bankA -> bankB -> bankC. bankC creates a secret number, hashes it and sends it to bankA. bankA sends money to bankB locked to hash. bankB can't get money until they have that secret number. bankB sends money to bankC locked to hash. bankC reveals secret number to bankB to unlock that money. bankB does the same with bankA. Tada, we eliminated the risk of bankB running away with money. This is the lightnin…

> we eliminated the risk of bankB running away with money

This isn't a real risk with correspondent banks. Instead, it's counterparty risk: bankB failing while it holds the funds in transfer. That risk can be mitigated with smart contracts, but it's not eliminated. (Correspondent banks also take a portion of the client bank's fraud and AML risk.)

Re: Smart Contract Security Field Guide

#67

Post by Uptrenda »

jason_pomerleau wrote: post #58
Uptrenda wrote: post #57

Earlier quoted context omitted.

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an e…

Genuine question from someone on the outside watching all of this: then who are these things for? Apparently not me, nor GP, nor my mum and dad. Are we waiting until the Smart People sort out all of these complex details to make this stuff accessible for regular people?

I'd say something like this: the average person isn't doing anything that complex with money. They can use cash for instant, real-time payments (with good counterfeit prevention), and can generally rely on their banks. But this is less than ideal because their assets can easily be seized, inflated, frozen, and their banks could fail. The blockchain could offer superior piece of mind or something of an insurance policy. Though the problem with that is most of the world runs on regular money so there would still need to be ways to buy/sell those assets.

To talk about the more specialized use-cases: there are some truly novel things that can only be done with the blockchain. To give you a direct example -- 'provably fair' gambling enables someone to place bets and know for certain that the result will be fair. This is accomplished by having outcomes enforced for a network of computers instead of trusting some shady website to stay fair. It's basically fully transparent. I know there will be people saying that this grasping at straws but the list of use-cases is quite long. I don't have time to research and list all the interesting ones here. But if anyone is interested in the subject I promise you that learning more about it won't be a disappointment.

It's just not easy to explain in short-form posts.

Re: Smart Contract Security Field Guide

#68

Post by samuellevy »

hn_throwaway_99 wrote: post #49
photonthug wrote: post #40

Earlier quoted context omitted.

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

OK, great example, so I'll explain why a smart contract couldn't work here at all. So, to start, going to be clear I'm using your specific example of "escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)". Simple enough. But, at the end of the day, who is to say "the keys you gave me are really the keys to the house you said you sold me"? That is, there needs to be some way to…

More than just needing an oracle - the keys and the house are both physical items. There's not really any practical way for a contract on the blockchain to validate that a particular physical item is in fact the item that it purports to be.

Are these ACTUALLY the keys to this house? Are they the only set? The original set? Were the locks changed, and this set in the contract is no longer valid?

Then putting aside all of that... How do you ENFORCE a "smart contract"? Probably through... Existing contract law. Because that's what it's there for. Smart contracts are just more convoluted paper, and we can do that already with DocuSign or any number of other digital contract options - all of which provide, so far as I can tell, precisely the same level of verification that a smart contract does. The only "advantage" of a smart contract over those platforms is that the history of the "document" is more or less baked into the chain, instead of trusting that the third party platform hasn't modified it... Which they will never have any motivation to do...

People have been initialing pages to mark them as read/accepted for more years than I've been alive. In the event of a contract dispute, smart contract or not, it's going to be up to a third party (mediator, judge, etc.) to decide on resolution anyway... At which point even the exact wording of the contract may well be discarded as being unenforceable because _contracts are not above the law_.

Re: Smart Contract Security Field Guide

#69

Post by pluto_modadic »

Uptrenda wrote: post #57
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

I find posts like this honestly infuriating because its like you don't know the first thing about an entire, specialized field, yet because its something taking place in tech you feel like you're qualified to write about it. Ask the same question about chemistry, biology, electrical engineering, or any STEM subject, and here's the actual answer: it's beyond the scope of a comment on hacker news to spoon feed you an e…

counterpoint: engineers building complicated things /and then looking for a problem they would solve/ is bad.

if you are unable to easily explain it to a human who isn't your profession, it's snake oil.

what's a tooth filling? it's a bio-safe, quick setting, similar plasticity to your teeth enamel.

what's shipping logistics software? it's not wasting an idle or half empty truck.

what's S3? durable object storage.

what's the TLS certificate transparency chain? an append only, low power proof of what the CA's issued. No blockchains or smart contracts involved because it's less expensive and less absurd.

what's sigstore? an append only, low power signing proof of binaries, docker images, git commits, etc. No blockchains or smart contracts involved because it's less expensive and less absurd.

Too many blockchains and smart contracts and such seek to be "the engine" that everything runs on. They want web 3.0 because they want a do-over to be kingmakers.

what's HTTP/HTML? a simple way to exchange data between webservers & web browsers, the universal engine.

Re: Smart Contract Security Field Guide

#70

Post by pornel »

iramiller wrote: post #17
dafelst wrote: post #14

Earlier quoted context omitted.

At most you are going to make a few thousand, maybe if you're super lucky and skilled, a few tens of thousands of dollars on bug bounties. Compared to the amount of poorly-secured money that was/is in crypto, it is a pittance. Add to that the fact that many of the hacks are largely legal consequence free due to crypto's famous lack of regulation (by design, lol), the economics are far more skewed towards the black ha…

Doing crime on a system with a perfect immutable record doesn’t seem like a smart play to me. As noted above the firms like chainalysis will continue to uncover and attribute all of the nodes in the graph. If you are taking 100s of thousands or more through fraud the incentives are aligned to see your crimes prosecuted.

It can't be a crime. The contract is always executed exactly as written.
Post reply on HN