Hacker News Reader

Comment by wlesieutre | Hacker News Reader

> The article also clearly shows in the smart contact that this was premeditated.

It's almost as if having a readable contract that the signers can all understand and a judge who can rule on reasonable interpretations of the contract is a feature, not a bug.

Whatever component of the "smart contract" that allowed them to do this would have been negotiated out, but since it's a decentralized "the contract enforces itself" cryptosystem, people just trust that the contract does what it says on the tin.

What should be the procedure before using these? Pay a security researcher for an independent review, like you would have a lawyer go over a contract? If you have to do that, why not just use a regular contract and lawyers where you have recourse when something goes wrong?

View on HN

The use of the term "contract" in computational blockchains like ethereum and binance smart chain is a bit of a misnomer. They aren't actual contracts in the sense that they are agreements between 2 or more parties. They are simply small scripts/programs that execute on the blockchain.

Gotta say though, the choice of the term "smart contracts" was great marketing.

Calling them simply scripts/programs is also a bit of a misnomer.

It's easier to think of them as the rules to a game, like chess. The smart contact defines the pieces and valid moves. The EVM enforces the rules.

A smart contract is literally code. It compiles to a bytecode that is executed on a turing-complete virtual machine (EVM) within a restricted environment (the blockchain).

Yes, but that doesn't capture the nature of the EVM, specifically addresses.

It's pretty analogous, particularly with other colloquial uses of "contract" like "contract of an API" and "design by contract". A smart contract is simply a guarantee that "if you do this, the outcome on the blockchain will be that", where "this" is defined by the method signature and "that" is defined by the smart contract's code.

A contract between two people is fundamentally an agreement that "If you do this, then I will do that", enforceable by law. It exists to allow trust: if you have no way of knowing what the other person is going to do in response, why would you ever do something like give them money or perform services for them? With smart contracts the legal system is replaced by a worldwide network of computers, and the actions that you can guarantee are restricted to quantities or properties represented on the blockchain. But the basic motivation and principal are the same: you want to provide guarantees about the future so that people can take mutually beneficial actions with them in mind.

But they had a readable contract and it wasn't a bug but a backdoor.

If we took this take into your analogy this would be a scam artist solicitating funds and having a contact cause that has a loophole. Investors signed without reading and loose their money.

A judge could only rule after the fact and if the scammers left the country with the money the ruling wouldn't bring the investor's money back.

How can there be a backdoor in a smart contract? Aren't they necessarily readable in full (even if the behavior is obscure)?

If I understand correctly, there can't be any actual secrets; you have to read carefully, then caveat emptor.

Backdoor with a loose tarp blending it into the wall.

> Pay a security researcher for an independent review

Yes, that is the normal practice, and any bigger project worth their salt pays for an external security auditor.

Do we know that this project wasn't audited?

What is generally audited is the source code. You can then verify is that the audited source code matches the deployed source code. That ability is lost to some degree (or not as transparent) if you use upgradable proxy contracts (which Meerkat did). Given the young age I don't see any indication that anyone audited the proxy contracts and their usage.

As explained in the blog post of the top comment here (https://obelisk.medium.com/meerkat-finance-and-the-0-that-wa...), this was clearly an exit scam by the Meerkat developers, which is exactly why users shouldn't put any significant amount of money into contracts that haven't been audited by a reputable external auditor.

Reply on news.ycombinator.com