How to steal Ethers: scanning for vulnerable contracts
palkeo.com
palkeo.com
Suppose my ether gets "stolen". For whatever reason I am able to turn to an external legal framework -- police or a law suit.
Why wouldn't I just skip the middle bit and go straight to dumb contracts executed by smart humans, rather than smart contracts executed by dumb machines?
What exactly have I gained over the status quo if, at the end of the day, I still rely on the enforcement mechanics of the status quo?
It's like chargebacks. 99.9% of my purchases I will never issue a chargeback for, so most of the time I choose to use a payment mechanism (cash, bitcoin when I can) that doesn't come with all that overhead. If I was frequently getting screwed by merchants, then my payment habits would change accordingly.
Then consider the fact that for most transactions, you pay no incremental cost for using a credit card. Yes, that is because the merchants eat that cost, but as an individual there is still no incremental cost to you. Merchants do this in part because they get more sales, and in part because credit cards save THEM money, too - easier accounting, no need for armored car service, less theft or error by employees.
Finally, it’s not accurate to compare the chargeback rate of credit card transactions with cash/crypto. Chargebacks for credit cards are very low because vendors are on the hook to pay for the costs, and they can lose their ability to accept cards altogether. If we all move to cash/crypto, the fraud rate will undoubtedly go up. Of course, someone will then create an escrow service that gives you the opportunity to dispute the transaction, in return for a small transaction fee. Maybe they’ll even offer to let you buy things in Bitcoin and pay them back later in cash, and charge you interest. I bet they could add in a rewards program...
...and you're back at square one ?
No: from a monolithic, impenetrable system you get an environment which favors competition. That's a win.
Few in the cryptocurrency community, except the so-called "Bitcoin maximalists", believe Proof of Work will survive as the dominant consensus algorithm.
What's more likely to be widely adopted is a Proof of Stake [1], or Proof of Space [2] system.
[1]: Snow White: https://eprint.iacr.org/2016/919.pdf, Ouroboros: https://eprint.iacr.org/2016/889.pdf, Algorand: https://people.csail.mit.edu/nickolai/papers/gilad-algorand-...
[2]: Chia: https://eprint.iacr.org/2017/893.pdf, SpaceMesh: https://spacemesh.io/assets/built/whitepaper1.2.pdf
Those unregulated environments are the trust settings where cryptocurrency will shine, not the local, already regulated economies.
Applications like "real-estate on the blockchain", "event tickets on the blockchain" are mostly just opportunistic buzzword riders. What cryptocurrency best serves is international trade and black markets. All the places that can't be regulated by traditional means, or that intentionally steer away from regulators.
I fear the day we go to war because of some clerk's off-by-one error in a "smart" contract.
Honestly though, I'd think programmers of all people would be first to realize that using code to represent law affecting anything in the physical reality is a dumb idea. Think of any time you had to write a program to conform to customer's requirement document. Does anyone here had, even once, done that without discovering holes, inconsistencies or unintended consequences in the document? And this is essentially the same exercise as formulating a "smart contract", except the code can now ruin someone's life.
(There's some middle ground to be had here, though. A way of optimizing the "long tail" of legal problems, without trying to do the near-impossible thing of codifying intent.)
There certainly could be many life changing bugs happening for smaller entities. But that's not a cryptocurrency-specific point. Humans are more and more willing to accept trusting technology with their lives (factory robots, pacemakers, automated cars, risky snapchats).
The key for cryptocurrencies is to keep humans in the loop: keep it incremental and require human confirmation for meaningful transactions. Machine learning can be used to detect anomalies in busy transaction flows.
[1]: https://www.cryptocompare.com/coins/guides/the-dao-the-hack-...
Seems like there will be a big trend with all kinds of symbolic execution tools showing up in the upcoming year :)
[1] https://blog.coinfabrik.com/smart-contract-auditing-human-vs...
[2] https://www.reddit.com/r/ethdev/comments/a4492r/comment/ebbn...