Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smart Contract Security Field Guide

scsfg.io

Post reply on HN
Print view View original

91–100 of 156 posts

Re: Smart Contract Security Field Guide

#91

Post by photonthug »

duxup wrote: post #46
photonthug wrote: post #40

Earlier quoted context omitted.

Escrow is the simple thing. Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys. How to proceed without the transaction requiring trust between people who don't know each other? If you physically get the car/house/keys, what guarantees that title was transferred as expected? Depending on the cash volume and the jurisdiction, there is basically no…

One theory I have about all this is that doing deals with zero trust is that ... people don't want to do that ... and no matter what you do there's going to be this whole process around these transactions to provide some assurances and so on. On the surface all this title company stuff is silly and it is, unless there's a real problem with the title and then you want it. These are human problems.

These sound like problems I associate with bureaucracy, not people, and problems that just go away if/when some kind of API is provided. If the purpose of the title company or lawyer or whatever is to do something like "phone the county office clerk and tell them to look up a rubber stamp and fax us a signed copy", then it's not like it's impossible to get rid of the middlemen.

Re: Smart Contract Security Field Guide

#92

Post by csumtin »

JumpCrisscross wrote: post #83
csumtin wrote: post #74

Earlier quoted context omitted.

I think the bank failing risk is eliminated, if it fails the forwarded payment is unlocked so bankA gets their money back.

> think the bank failing risk is eliminated, if it fails the forwarded payment is unlocked so bankA gets their money back Bank failing in this context would be the bridge (EDIT: contract) gets hacked. Hence mitigated, but not eliminated.

If bankB is hacked, bankA still gets their money back or the payment is sent to bankC. So I still think the counterparty risk is eliminated between bankA and bankB

Re: Smart Contract Security Field Guide

#93

Post by JumpCrisscross »

csumtin wrote: post #92
JumpCrisscross wrote: post #83

Earlier quoted context omitted.

> think the bank failing risk is eliminated, if it fails the forwarded payment is unlocked so bankA gets their money back Bank failing in this context would be the bridge (EDIT: contract) gets hacked. Hence mitigated, but not eliminated.

If bankB is hacked, bankA still gets their money back or the payment is sent to bankC. So I still think the counterparty risk is eliminated between bankA and bankB

> counterparty risk is eliminated between bankA and bankB

Correct, but in its place is a new systemic risk with a real-world nonzero probability: the contract itself getting hacked. There isn't analogy for this in modern banking since the equivalent issue would either (a) get rolled back or (b) fold into the bank failing envelope. (There is analogy in pre-modern banking, though it largely revolved around debasement and invasion.)

Re: Smart Contract Security Field Guide

#94

Post by wslh »

Beyond the hype, my organization finds that smart contracts are a good area for research in software security methods such as static and dynamic analysis. The reason is that smart contracts are very small compared to general codebases and have a lot of real risks linked to money.

For example, here [1] the thesis is that when TVL rises, the probability of being hacked also rises which means that at some point there is not budget that can scale to protect your TVL.

[1] https://bittrap.com/resources/defis-growing-pains:-as-tvl-ra...

Re: Smart Contract Security Field Guide

#95

Post by alexslobodnik »

duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Ethereum name service, more commonly known as ENS.

In ethereum address appear like 0x233eb...042, ENS let's you associate a human readable name like nick.eth with that address.

Works similar to DNS, turning IP addresses into something we humans recognize.

What's the pro of using a smart contract? (DNS works without one).

With a smart contract you can have immutable data store (assuming ethereum continues) that can give you ownership over your name, like nick.eth.

What's the con?

It's immutable which means people can own names they shouldn't with no mediation process possible.

Like a lot of things in life the system is good as long the system works for you, but not everyone is lucky enough to exist in a system that works well enough.

Crypto* is trying to make things better.

edit: *some people are others are not

Re: Smart Contract Security Field Guide

#96

Post by trompetenaccoun »

sunshine-o wrote: post #13

Smart contracts are fundamentally a business technology where money is hosted & manipulated natively on the platform. This is pretty awesome & could be very dirsuptive. The problem is at least in ecosystems such as Ethereum you have a single line of defense, your smart contract code. And that code is written in a poor language with very little security features. Worst if something go wrong you can maybe pause, suicid…

It's a misunderstanding that smart contracts are just about money. What you have in essence is decentralized verifiable computation, which can and often is used for finance stuff, but isn't limited to that at all.

Re: Smart Contract Security Field Guide

#97

Post by photonthug »

samuellevy wrote: post #68
hn_throwaway_99 wrote: post #49

Earlier quoted context omitted.

OK, great example, so I'll explain why a smart contract couldn't work here at all. So, to start, going to be clear I'm using your specific example of "escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)". Simple enough. But, at the end of the day, who is to say "the keys you gave me are really the keys to the house you said you sold me"? That is, there needs to be some way to…

More than just needing an oracle - the keys and the house are both physical items. There's not really any practical way for a contract on the blockchain to validate that a particular physical item is in fact the item that it purports to be. Are these ACTUALLY the keys to this house? Are they the only set? The original set? Were the locks changed, and this set in the contract is no longer valid? Then putting aside all…

> More than just needing an oracle - the keys and the house are both physical items. There's not really any practical way for a contract on the blockchain to validate that a particular physical item is in fact the item

Responding to you but this applies to lots of stuff in this thread. Quoting wikipedia, "a smart contract is a computer program or a transaction protocol that is intended to automatically execute, control or document events and actions according to the terms of a contract or an agreement. The objectives of smart contracts are the reduction of need for trusted intermediators, arbitration costs, and fraud losses, as well as the reduction of malicious and accidental exceptions."

How can anyone possibly object to this technology as if it were a) impossible or b) useless? In the next sentence we get into "commonly associated with cryptocurrencies", but I think the main idea is already there in the opening. There is no strict requirement for whatever implementation details that you love to hate (blockchain, digital goods, digital titles, web3, etc).

Re: Smart Contract Security Field Guide

#98

Post by trompetenaccoun »

jjordan wrote: post #30
duxup wrote: post #27

Can someone give me a good use case (even better if you're doing it yourself) for a smart contract? What is anyone doing with them that they find really handy? I've never been able to understand how it gets used / why you would use smart contracts. I've googled and read... still don't grok it. I've seen so many "benefits" listed, but none make sense to me as far as the process you go through and how it works out in t…

Arguably the most popular use case is that smart contracts are used to create decentralized exchange services. See: Uniswap. They are also used extensively in the crypto sub-genre called DeFi, or decentralized finance. One of the most popular implementations is called Aave, which allows one to take loans out (i.e. give the contract Ether as collateral, receive an amount of USD stablecoin in return) on a given set of…

For the record NFTs get a bad reputation because the public associates them with silly pictures traded for outrageous prices. However NFT simply means that the token itself is not fungible and can therefore be used to refer to something specific that does not have to be art at all. Tickets would be an example that multiple teams are working on using the same tech, although they may not refer to it as NFT because the name is tainted.

Re: Smart Contract Security Field Guide

#99

Post by peyton »

namdnay wrote: post #42
freemanon wrote: post #28

Earlier quoted context omitted.

Well it was the same with the internet itself. It's prone to hacks, bugs, and outage, and yet today we all use it to manage our finances and make payments.

Well, for the internet you could say “it allows stores to show pages with their products, and people can choose what they want to order, give their address and pay it with credit card , all without leaving their home” That’s a pretty obvious killer feature of the internet

Worth noting this wasn’t allowed on the early precursors to the internet. Also the credit card company and processor both take a fat cut and maybe deposit the money a few days later if they feel like it.

Re: Smart Contract Security Field Guide

#100

Post by soulofmischief »

RcouF1uZ4gsC wrote: post #85
soulofmischief wrote: post #80

Earlier quoted context omitted.

Governance of next-generation automated economies and societies. It's one thing to make a promise to someone. It's another to marry your business procedures directly to immutable code which guarantees to users, employees and partners that the business operates in the intended and described way. Most of these benefits require your company to be digital in nature, but many asset-based economic systems can benefit from…

> For example, automatic, trustless guarantee of both quality of transport and payment for shipping goods. I am very, very skeptical your example would work purely with smart co tracts for this. I can think of a bunch of ways where real world interactions would cause all sorts of problems that would have to be sorted out by regular contract law.

Maybe, maybe not. Fedex and others are experimenting nonetheless, so we'll see how many problems it solves vs introduces.

https://www.truckinginfo.com/10183205/blockchain-once-overhy...

https://www.fedex.com/en-us/about/policy/technology-innovati...

https://www.supplychain247.com/company/blockchain_in_truckin...

A common misconception is that smart contract enthusiasts believe it replaces existing contract law. It doesn't, though in some cases it removes the need for relying on it with digital services. It is meant to enhance the letter of law by adding additional guarantees.

Post reply on HN