Hacker News Reader

Comment by jotakami | Hacker News Reader

I don’t think you understand. The arbitrage bots aren’t exploiting poorly written contracts, they are capturing free value that users of a dApp have opened up. This free value is available to miners as well, and could be used to subsidize an otherwise-unprofitable double spend attack.

But more to the point: allowing smart contracts in a blockchain introduces all of the complexity of trying to make any other piece of software secure. Except... now it’s on a blockchain where the code is open source and mistakes can allow adversaries to steal money, not just data. How is this an improvement?

View on HN

I do understand. I work in the industry, specifically with decentralized exchanges. Both the order book and the order matching should be P2P with 0 conf transactions and client side verification. The fees paid by the user should be top off fees for the contract balance rather than pay to play fees.

I did about 0.1% of the amount of research you did a few years ago and was really struck by the irreversibility of mistakes. Other engineering domains can have irreversible (e.g. fatal) mistakes as well, but they don't have as many enthusiasts jumping in to the field.

Our CTO likens developing a smart contract to civil engineering. Our CTO also remembers what it was like to ship your software in its final form on a floppy disk!

I think it’s great that more and more people are jumping in and learning what it’s like to develop in such an unforgiving domain (no point here, I just think it’s great!)

Learning on the job in an unforgiving domain can be costly.

The blockchain is indeed fraught with peril. Code review, audits, and bug bounties are an absolute necessity when it comes to smart contracts! Learning in a high stakes situation seems pretty good as long as you have a robust support structure.

I completely agree! It's sparked an interest in formal methods and learning more about how engineering takes place in other disciplines to improve their product quality.

Reply on news.ycombinator.com