Learn Ethereum smart contract programming

by ym705 • 9 years ago

403 235 9 years ago

g00n• 9 years ago

Maybe it's because I don't have a use for it yet, or at least don't know if I have a use for it. But, the whole Ethereum universe seems vague and seems like they could explain it more than they do. "Install Ethereum wallet, write a contract, ..., Profit!" ?? Is there a better source that might explain what it is, how it works (a glancing explanation not a full network inner workings)??

Double_a_92• 9 years ago

Yeah people. Explain Ethereum without using the words "smart contract" please.

mbrock14• 9 years ago

It's a distributed money database with stored procedures.

xHopen2• 9 years ago

It takes some time to wrap your head around the blockchain, first you have to understand Bitcoin , then you will have no issues understanding Ethereum. But I tell you one thing, once you understand it, you will not stop thinking about it.

https://www.youtube.com/watch?v=3RN8bnNe-Is

bshanks2• 9 years ago

Ethereum is a cloud computing service. It has two advantages over other cloud computing services: (1) it is extremely highly available (2) the person who uploads a program cannot modify that program afterwards and has no special admin access over that program's data storage; furthermore all data stored including program code is publicly viewable.

Because the program author has no admin privileges, users don't have to worry about the service provider abusing their admin privilages to secretly modify the database (which may otherwise be a concern for high-value applications such as, e.g. vote-counting, e.g. a database that stores bank account balances, etc).

The disadvantages are (1) it is much more expensive compared to other cloud computing services, (2) since the uploader doesn't have admin access, they can't fix bugs, and since everything is transparent, it's hard to store secrets.

jerguismi• 9 years ago

The use-cases for smart contracts seem to be quite low, so I wonder if it really is worth the investment to learn to develop smart contracts. Additionally, even the smart contracts written by the experienced ethereum developers have contained bugs, resulting to losses of tens of millions worth of ethereum. To me it sounds like it is much smarter to use some pre-existing smart contract which is used by many, instead of making your own. However if you really have a new idea for smart contract then you could learn the language.

ym70514• 9 years ago

"To me it sounds like it is much smarter to use some pre-existing smart contract which is used by many, instead of making your own." This is exactly how the last "big hacking" had happened https://qz.com/1034321/ethereum-hack-a-coding-error-led-to-3...

But as you said writing your own is also error prone.

jwfxpr• 9 years ago

I Am Not An Expert.

If I understand correctly, these are a way to automate the execution of the financial part of normal contracts without the need for undue trust between parties. Some simple examples that might help (and I invite correction):

• I and a few investors agree to buy into an enterprise in several installments. A contract can be written to the blockchain that automates these payments. Should a majority of the investors decide to withdraw support, the payments will cease, but while more than 50% wish to continue support, everyone will continue.

• I have an enterprise that I am highly confident will generate profit. I can establish a smart contact that guarantees my investors a minimum ROI at specific intervals; should the balance fail to grow by the agreed margin, all investors will instead be refunded (in full or part) based on a scheme agreed a priori to be fair — say, a function of shares owned for how long.

• I and several other Ethereum miners agree to develop a scheme built on top of Ethereum for, say, a specific method of interoperability between the Ethereum blockchain and traditional futures markets. We have a specific idea for this, but agree we need to ensure that there is momentum in the project, and want those participating to have 'skin in the game'. We build a tontine such that all of us invest a non-trivial amount, and any investor becomes ineligible for payout if their hash power abandons the protocol. If this falls below a certain threshold, remaining investors can vote to continue or divide the pot and abandon the project.

ym70514• 9 years ago

Uses case are infinite.. You could also for example write transparent casinos system, transparent marketplace where every transactions would be certified by both parts, a banking system, some new money, ect..

sjy• 9 years ago

The problem with your first two examples is that the 'investment' locked up in the smart contract can't be spent, which means the investors are not bearing any risk, and therefore cannot enjoy a return. If the money could be spent on capital and operating expenses, then the smart contract wouldn't be able to refund it if the conditions of the investment failed.

It is possible to create a smart contract, like the DAO, which implements the rules of a joint stock company. But stockholders are not concerned about the risk that these rules will be broken. The risk is that the company fails and there is nothing to distribute according to the rules. Replacing the general meeting of stockholders with a smart contract doesn't change the economics of collective investment – it just adds the risk of losing everything to a bug in the contract.

al2o3cr• 9 years ago

    without the need for undue trust between parties

Needing to assume that the contract author didn't make a trivial mistake (like leaving off `internal`) that makes all your tokens fall on the floor seems like a pretty sizable chunk of trust - and that's also assuming everybody involved isn't malicious.

dullgiulio• 9 years ago

I know this might sound like a joke, but it is not: how about documenting how to actually test and debug smart contracts? Is there even a way to do so? How about fuzzying?

ym70514• 9 years ago

They are frameworks for supporting development with testing (not covered it yet) for example http://truffleframework.com/

cdetrio2• 9 years ago

The best tool for debugging is http://remix.ethereum.org/. It lets you step through the compiled EVM bytecode, while highlighting the solidity source mapping.

omarforgotpwd2• 9 years ago

Programmable smart contracts are a great idea in a world where programmers write bug free code. That world does not exist yet. Until we have near-perfect code writing AIs every new smart contract is just a disaster waiting to happen.

repomies6914• 9 years ago

They might still be a good idea, you just have to live with that risk. World is full of risks anyway and you might die tomorrow in a traffic accident. Sometimes risks are worth taking, such as leaving your apartment and risk walking under a car.

apapli2• 9 years ago

Not that I have mathematical proof, but I'd be happy to bet that the chance of buggy code being written is higher than the risks you outlined above :)

elmigranto3• 9 years ago

Give all your money to me, and I'll return it million fold in a year. I know it's risky, but you can die tomorrow in an accident anyways, so why not.

Before you write a comment with "why not", apply that to eth first.

halflings• 9 years ago

That's like saying legal contracts are a disaster because we do not live in an ideal world where lawyers don't do mistakes, and there are no legal loopholes.

Granted, bugs are much more common than legal loopholes, but in the same way an operating system's APIs and constraints are tested until it becomes reliable enough for other people to rely on it, I can see some standard types of contracts (in the same way as in the traditional legal system) becoming recognized for their robustness and used for common operations.

justusw2• 9 years ago

One could argue that legal contracts are less binding than smart contracts. There is a distinction made between the 'letter and spirit of the law'.

Furthermore, a contract, or at least a clause, will become invalid if it goes against existing law in a country (at least this applies to the EU). E.g, I cannot sign a contract in which I sell my kidney to you, as commercial organ trading is outlawed in many countries.

Is a smart contract able to make this distinction? I suppose as soon as it develops a moral consciousness it does.

lindig• 9 years ago

Most "real life" contracts have bugs too. The difference is: the visibility of these contracts is very limited such that these bugs cannot be exploited by random hackers. And any exploit can be challenged in court. Ethereum takes away both - opening you up to be challenge by everybody with no recourse.

PeterisP3• 9 years ago

Legal contracts have a solution for bugs and loopholes, namely, the court system. I can write a three-line contract with the core terms on a napkin, sign it, and it will be okay, since everything not explicitly mentioned will be given reasonable defaults, and attempts to exploit stupid loopholes will be laughed out of the court. If someone defrauds me and gets me to sign a contract based on false information, they don't get to point to a loophole and figuratively take my firstborn, we have a process to void fraudulent contracts.

However, if you want contracts that cannot be overridden and are enforced by machines as written (not as intended, as in the legal system), then the bar becomes much higher, then you must get all the details explicitly right the first time and ensure that people don't sign fraudulent contracts, and I'm not sure if this is possible at all.

simias3• 9 years ago

I think I'm going to end up pasting this link in all discussions surrounding Ethereum: https://en.wikipedia.org/wiki/Letter_and_spirit_of_the_law

When one obeys the letter of the law but not the spirit, one is obeying the literal interpretation of the words (the "letter") of the law, but not necessarily the intent of those who wrote the law. Conversely, when one obeys the spirit of the law but not the letter, one is doing what the authors of the law intended, though not necessarily adhering to the literal wording.

This is a very ancient concept and like all ancient concepts it's bound to be rediscovered every other decade on average.

"The code is law" is a wet dream for a dystopic authoritarian state and I don't understand why anybody, much less actual coders, would think that's a good idea.

"Thank you for subscribing to our contract for your $2 weekly subscription. By the way through a clever loophole obfuscated in our code the amount actually doubles every week. Freedom is Slavery, Ignorance is Strength, Code is Law. Have a good day sir".

In the real world you have a safety net for these types of things, in many case you can break an abusive contract because society has created regulations that ban certain tactics. Ethereum has no such thing. A single mistake or intentional deception and like that, you've lost all your money. The code is law, nothing we can do sir. How is that a feature exactly?

Look at how dumb the average spam is, and yet there's no shortage of people falling for them. Yet it seems like the ethereum crowd genuinely believes that my mother is suddenly going to be able to proof Solidity scripts, something I wouldn't even trust myself to do with decades of programming experience behind me. I don't know if Ethereum is an economic bubble but it definitely is an intellectual one.

omarforgotpwd2• 9 years ago

Legal contracts are enforced by courts, which are run by humans. Humans do not take things 100% literally and there is always an opportunity to change the law. For example someone would not be forced to empty their entire bank account and give it to some random person just because that person discovered a typo in the EULA.

mitchmindtree• 9 years ago

We put our lives in the hands of code written by humans every day, e.g. cars, planes, trains, etc.

Perhaps the permanence of executing solidity contracts will at least motivate some safer, more secure practises, in the same way that the permanence of death does when programming vehicles that carry human lives.

It would be cool to see APIs for compiling Solidity contracts from safer languages with more concise type systems like Idris[1]. That said, I haven't had a proper dig into Solidity myself yet so it could very well offer some of these features. I'd love to hear some experiences from devs who have written a significant amount of code in it.

[1] https://www.idris-lang.org/

elmigranto3• 9 years ago

We put our lives in the hands of code written by humans every day, e.g. cars, planes, trains, etc.

Except that code is regulated and tested to the degree average eth enthusiast making this point either not aware of, or intentionally omits.

bshanks2• 9 years ago

You might appreciate https://news.ycombinator.com/item?id=14835977#14839943

paganel• 9 years ago

That world does not exist yet

With a big emphasis on "yet". Serious question: are the "halting problem" and the "yet" in your sentence dependent on each other? I.e., don't we need to first solve the halting problem before we can manage to write 100% bug-free programs?

elmigranto3• 9 years ago

There is no need to solve halting problem in general case. We can have heuristics that do not accept programs they are not sure about and it is programmer's job to make correctness more obvious.

Jabanga3• 9 years ago

My understanding is that the halting problem does not prevent formal proofs of Ethereum contract correctness because Ethereum contracts have gas limits that make them terminating.

lou13062• 9 years ago

I don't see how you can "solve" the halting problem. But there are lots of ways to tiptoe around it and have some kind of formal verification of software.

Asdfbla• 9 years ago

It's possible to write provably correct code, though. At least then you reduce the problem to the issue of correctly specifying what the code is supposed to do. Certain classes of contracts might be small enough to do that.

Granted, the requirement for NASA-level code correctness would make smart contracts expensive to develop and put them out of reach of average developers.

mkagenius2• 9 years ago

issue of correctly specifying what the code is supposed to do.

also the intent of the programmer, right?

staticelf6• 9 years ago

The problem I see with Ethereum is that it is way too complex. I have read perhaps at least 10 times on their home page without even understanding what it does, what problems it solves etc.

This is the sole reason why I don't think it will be successful in it's current state. With most successful tech or services or whatever the core idea is often super simple to grasp and you can instantly see the benefit. I don't see this with Ethereum.

Even with bitcoin which is complex the benefits are instantaneous for the common man. Decentralized system, no single entity controls it. It is a fixed amount of bitcoins so like a mineral it's value is probably going to be stable in the long run and also each bitcoin will increase in value when more people get interested. It's easy to send coins to anyone in the world, at any time.

What does Ethereum do? Smart contracts is probably the key word but I don't understand how it works or how it will benefit me. Why bother?

thepoet• 9 years ago

I am assuming you have gone through the Ethereum whitepaper. It does lists some potential use cases which can be extrapolated. http://fermatslibrary.com/s/ethereum-a-next-generation-smart...

staticelf6• 9 years ago

I have not.

Do you really think I should have to?

mbrock14• 9 years ago

You know Bitcoin is useful. One of the useful things in Bitcoin is that you can make a transaction conditional on a multiparty approval ("multisig"). This is used by many organizations to control funds in a safe way. Ethereum lets you construct even more interesting types of transactions. For example you can easily implement the logic of a crowdfunding (unless X is raised by time Y everyone is refunded). In that context, "smart contract" is just a way of saying that you're not relying on the promise of a third party to perform the refund—it's automatic.

staticelf6• 9 years ago

Ok but that raises a lot of technical questions. Do I myself host that logic or is the logic itself distributed? While creating a crowdfunding contract, I am the host in my mind so assuming that the smart contract is hosted on my machines this must mean that when people are sending Ethereum to my wallet the logic does it's thing?

Another version of that could be that the logic is sent out to all interested peers and they only actually send Ethereum to the correct wallet after the logic in the contract they got sent is executed.

This is the parts of Ethereum that is so very confusing. People are simply swinging around with words like "smart contracts" but there are little to no actual description on how it actually works.

mkagenius2• 9 years ago

In that context, "smart contract" is just a way of saying that you're not relying on the promise of a third party to perform the refund—it's automatic

What if the code is malicious, and instead of auto refund it steals the money? I mean, not everyone would read the code to see what it really does, so what happens in that case?

ericfrederich• 9 years ago

Just shifting the problem. Okay, so the money is raised... you still never get your vaporware product.

maehwasu• 9 years ago

The big thing that helped me was to understand that: smart contract == program stored on the blockchain

The blockchain tracks the program's state and handles state transitions. Read-only functions are free to execute; functions that alter the program's state cost Ethereum to run.

That's it. It's quite powerful and conceptually simple, but the phrase "smart contract" seems to throw a lot of people off.

staticelf6• 9 years ago

I've got that now but that worries me even further. I don't trust myself to create bug-free programs and are in the belief that it's impossible.

The issue with the system is that you can't update the contract, which means it has to be perfect when it is distributed on the blockchain. 1 bad mistake away from loosing maybe the entire wallet and it seems to already have happened several times.

The main issue that it is a big incentive to find bugs since you can make a lot of money from it and the contracts are vulnerable since they can't be updated.

But people in favor of this system, Ethereum, seems to just wave shit like that off with fancy words. If some system handles my money, it better be damn secure and the only way to be secure IMO is constantly updating it.

jesusthatsgreat• 9 years ago

Maybe if you actually used it you'd see the benefits of it... try transferring any amount of value with Bitcoin.. take note of how much it costs and how long it takes. Then do the same with Ethereum. You'll start to learn pretty quickly what some of the main differences are.

Regarding the 'fixed amount of Bitcoins' argument, I'd agree it's a nice simple marketing message but if you look in to what Ethereum is planning to do, issuance could well go to close to zero, zero or even below zero once proof of stake is introduced: https://twitter.com/VitalikButerin/status/879858608091144193

VMG• 9 years ago

Then do the same with Ethereum.

As long as you only ask him to do it, it will be fine. What if everybody using bitcoin did it though?

Keeeeeeeks2• 9 years ago

At this point, people could convert from btc and use any random shitcoin for value transfer, then convert back to USD

BaronSamedi2• 9 years ago

Ethereum reminds me of what happened to the web: the desire to add code. The blockchain by itself wasn't good enough so Ethereum added code to it, just like HTML wasn't good enough so people added applets, Flash, and JavaScript.

I understand why they would want to do this but I think it gets the priorities wrong. It prioritizes features and functionality over security and reliability. Given how hostile the Internet has become I think this is a mistake.

My guess is that Ethereum is only a couple of scandals away from being perceived as a fundamentally insecure platform. Bitcoin has its own problems and it may not survive either. Perhaps another cryoto currency can learn from the mistakes of both and deliver something better?

cesarb• 9 years ago

Ethereum reminds me of what happened to the web: the desire to add code.

Also known as Zawinski's law: "Every program attempts to expand until it can read mail. Those programs which cannot so expand are replaced by ones which can."

lou13062• 9 years ago

This! A money exchange platform can't be both distributed and unrealiable. If PayPal screws up, at least you can call them and get a refund.

kordless• 9 years ago

Bitcoin has code. The language is called Script. It lacks loops, however.

RoboTeddy• 9 years ago

I actually think this is a great analogy, although not sure your conclusion follows. What happened after people added JavaScript to the web?

will_brown• 9 years ago

If you understand Bitcoin benefits as: "decentralized no single entity controls"

Then, think of Etherium as: decentralized virtual slot machines no single entity controls

So visualize a slot machine: it advertises only the various ways you could win (in fact it never discloses the number of non winning combinations which are far greater in number) in other words manufacturers advertise only the possible upside to get you to put your money in. At best the thing being advertised happens at worst something else occurs which wasn't advertised, namely you lose your money.

The big difference between smart contracts and slot machines, is the ownership, in theory the casino owns the slot machines or at least leases the slot machine from the manufacturer, and so the casino gets the profits guaranteed by the code of the slot machine. Similarly smart contracts are crated/manufactured by an individual or groups of individuals, But here is where is gets tricky...instead of a casino hosting slot machines, smart contracts will live in perpetuity hosted on a blockchain. So whereas the slot machine directs funds that aren't wins to the casino, where do such funds in the smart contracts go? To wherever the smart contract tells the funds to go, even if it's an anonymous account (really owned by the smart contract creators) or the ability for any 3rd party to claim said funds. This little trick of anonymity allows the contract manufacturers to at least claim ignorance of the location of the funds.

There is one more thing to remember, Proponents of the smart contract somehow believe between the step the manufacturer creates the contract and releases said smart contract in the wild in perpetuity, by placing the smart contract on the blockchain, they somehow become indemnified legally (both civilly and criminally) from any damages the smart contract causes. In a most extreme example proponents i talk to believe you could build a bomb coded to go off upon a funding event, and once placed on the blockchain they would have no liability for the damage caused by the bomb because they claim the bomb was controlled/detonated by the code.

naasking4• 9 years ago

Smart contracts is probably the key word but I don't understand how it works or how it will benefit me.

I virtually guarantee you don't really understand how the regular monetary system works either, but you can still use it and have some idea of how it benefits you. Ethereum can be used to set up another monetary system whose currency flows are guarded by code-driven contracts that anyone can write.

So imagine the e-bay auction process as a smart contract that's controlled directly by the monetary framework, without involving Paypal or credit card companies, or any other centrally managed financial institutions.

The core idea behind Ethereum is sound and first envisioned a long time ago [1], but the current implementation leaves a lot to be desired. The Ethereum languages are being designed by programmers who try to address the needs one encounters in programming, like delegation patterns and some types of dynamism that makes extension and reuse easier.

Unfortunately, this is often the opposite of what you want for robust contracts, where writing the contract is not the important part, it's understanding all of the possible outcomes and what causes them. The dynamism makes static analysis hard, so understanding the behaviour of the complete system is too difficult, and vulnerabilities proving this point will continue to crop up.

[1] http://erights.org/smart-contracts/index.html

roywiggins2• 9 years ago

code-driven contracts that anyone can write

Anyone can write a contract, but only a handful of people seem to be able to write correct contracts. And an incorrect contract means your money is gone.

DennisP5• 9 years ago

Ethereum is like Bitcoin but with scripts that can store data, hold money, and send it to other accounts.

rmetzler2• 9 years ago

I took a glance at the lottery example [1] and I wonder: isn't the owner of the lottery able to change the outcome so the winningNumber is always in his favor?

[1] https://ethereumdev.io/managing-multiple-users-a-simple-lott...

ym70514• 9 years ago

Could you explain more how would it be possible?

jsnathan2• 9 years ago

In the example code used, the random number which determines the winner is derived from the previous block hash. Since the lottery-owner determines when the function is run, they could call the function when the previous block hash favors their own bet, or else modify their bet before calling the function.

jsnathan2• 9 years ago

Yes, but the author does point to [1] for a better way of generating randomness for such a contract using commitments.

[1] https://ethereum.stackexchange.com/questions/191/how-can-i-s...

justinfrankel3• 9 years ago

the lottery code is so broken it isn't even funny. actually it is hilarious! the first bet will almost always win, especially if it's a very small bet!

pknerd• 9 years ago

Is there any other crypto platform allow to write dApps for blockchain?

joeyspn• 9 years ago

RSK [0] is already in beta and EOS [1] will launch a dev testnet in Q3-Q4 IIRC. RSK uses the ethereum VM so the smart contracts and dApps will be compatible/portable.

[0] http://www.rsk.co/

[1] https://eos.io/

skeebuzz• 9 years ago

Not out yet, but Filecoin: https://filecoin.io/. It's like Ethereum but with file storage capabilities + built-in bridges to other cryptocurrencies.

teod3• 9 years ago

Filecoin doesn't have any smart contracts as far as I'm aware, so it's limited to use as a decentralized storage network. I believe it would be possible to build something very similar to Filecoin on the Ethereum platform. Storj (https://storj.io/) may be trying to do that.

kodroid• 9 years ago

https://www.shiftnrg.org/

renas2• 9 years ago

Yeah sure, check this version of the lottery https://github.com/renasboy/ETHLottery

siliconviking• 9 years ago

EOS is the likely successor in my opinion.

(eos.io)

In development now, but a development environment will be up and running by the end of the summer; testnet coming in the fall. Full release next summer.

hexhex2• 9 years ago

I didn't have high expectations for Solidity considering the recent vulnerabilities, but even these were disappointed. If some guy writes this kind of code at home, alright, but this as the alleged foundation for our future financial system? Frightening.

Just one example: "Our function EndLottery() must be only accessible by the owner of the lottery." [0]

function EndLottery() public { if (msg.sender == owner) { ... } }

What about code guards? Not to speak of decent typing, etc. etc.

[0] https://ethereumdev.io/managing-multiple-users-a-simple-lott...

ym70514• 9 years ago

Have you read next article? https://ethereumdev.io/better-readability-with-modifiers/

hexhex2• 9 years ago

You are right, they solved the particular problem I highlighted with Modifiers.

But the main question remains: Why don't they utilize the progess we made in decades of research for better programming languages?

The argument that Solidity should be useable by the average programmer doesn't hold, in fact, typing makes programming easier since it clarifies data structures that are implicit in languages like JS.

masklinn2• 9 years ago

I understand the eth VM is pretty limited and limiting, but Solidity is just sad, it's like somebody saw Javascript and thought "ok that's a pretty terrible basis for writing contracts, but surely we can make it even worse?"

And then they succeeded at failing.

dallashoxton2• 9 years ago

Can't remember where I read it, but someone put it best during the DAO fiasco last year when they wrote "Imagine Javascript but your bank account accessible through the Document Object Model."

runeks• 9 years ago

Many issues with Solidity as a contract language were pointed out in a previous HN thread after the Parity multisig-incident: https://news.ycombinator.com/item?id=14810008

naasking4• 9 years ago

I'll do you one better, vulnerabilities directly associated with the dynamism of Solidity were predicted on LtU in 2014:

http://lambda-the-ultimate.org/node/5003

kristianc3• 9 years ago

Does this not seem like the kind of area where you don't want people writing hacky, proof of concept code?

The idea of people coding up weekend projects on Ethereum, putting them behind flashy websites and encouraging large scale adoption terrifies me, to be honest.

ym70514• 9 years ago

As the technology evolves you need more and more people fluent. Most people will never write live code involving million of dollars but it might help people understanding the techno and the code behind... This is an introduction and as more and more article will be written the learners will be more skilled and aware of security and good practices

toadkicker2• 9 years ago

Just wait until artificial intelligence does it for us...

JustNothing• 9 years ago

Am I misreading the code? Isn't the EndLottery function completely broken? It looks like it finds the first user who bet less than the winning number. So, in order to win you should play ASAP and bet epsilon > 0, right?.

justinfrankel3• 9 years ago

yeah, it's completely broken. which normally you would fix, but oh look too late!

ym70514• 9 years ago

Thanks for your comment and it's fixed thanks to a hard fork ;)

k__2• 9 years ago

They talk about storing money in the contract.

Does this mean I will be "charged" right in the moment I "store" money in the contract?

Or does it mean I'll be charged when the contract gets "destroyed" and the money "in the contract" is sent to some address?

I'm asking because both sides have problems.

If I don't get charged when storing money in the cotract, I could spend it elsewhere until the contract resolves.

If I get charged when storing money, someone could write contracts that never resolve to purge money.

anilshanbhag2• 9 years ago

I would suggest you read the white paper (https://github.com/ethereum/wiki/wiki/White-Paper)

The short answer is contracts are accounts. Just like your normal ethereum accounts. When you invoke a method marked as payment, you are essentially transferring some ether from your account to the contract. If someone wrote contract from which you can't withdraw and you send ether to it, thats stupidity - even fiat can be destroyed by stupidity.

k__2• 9 years ago

I see, thank you :)

Stupidity? Doesn't Ethereum want to prevent all money getting locked up somewhere?

anilshanbhag2• 9 years ago

Here is a cool application - https://predictiontoken.github.io/#TRMP. It lets people bet on outcomes and bets be settled in a decentralized manner. There is a video in the link if you want to understand how it is accomplished.

justadeveloper22• 9 years ago

Are you familiar with Assassination Politics?

kbody• 9 years ago

The sad reality of Ethereum: 1. Bitcoin is slow and expensive, Ethereum is the future 2. Ethereum software has security hole, gets hacked 3. Ethereum fans say it's an experiment there are lots of things that will transform Ethereum (Casper/PoS, Raiden, zkSNARKs, Enterprise Alliance) 4. Low price getting pumped by Ethereum Foundation & big-holder affiliates 5. Back to #1

We've seen it happen again (DAO) and again (Parity) and it will keep happening, because it's broken by design. 90s cypherpunks that pioneered this ideas had considered Turing complete design and discarded it for cryptographic state-machines that allow for formal verification.

I appreciate the experimentation, but the takeover-the-world echo-chambers of ethereum that don't focus at all on the real tech behind it and ignore everything negative is pretty disappointing. Especially because we keep getting new people buying this and becoming the greater fools.

When talking about engineering on such a critical subject, people should be way more responsible. If Bitcoin had the same attitude regarding security like Ethereum does, we wouldn't be here and cryptocurrencies would be a joke.

Lazy engineering comes at great cost as time goes by and the illusion of security is unveiled.

DalasNoin• 9 years ago

"but the takeover-the-world echo-chambers of ethereum that don't focus at all on the real tech behind it and ignore everything negative is pretty disappointing" i dont think this is a good representation of the ethereum community, most people on r/ethereum for example are quiet self conscious about the security issues. that is at least my impression from reading the threads there.

mbrock14• 9 years ago

The belief that Turing machines aren't amenable to formal verification is a hobgoblin that shows up in every thread like this, but it's not real.

Of course there are limited formalisms that make certain types of verification easier, but proving programs has been possible since, like, the 1960s.

A multisig, for example, has a finite number of states when considered under symbolic execution. A model checker can rip through it and prove whatever properties you want.

Is the Ethereum world right now full of buggy contracts that haven't been proven correct? Yes, absolutely. It's a disaster. But it's a disaster that points the way fairly straightforwardly.

Should Ethereum not have been launched until it had solid methods for auditing and proving? Maybe, but that's not how the world works, typically. Worse is better and all that.

merijnv• 9 years ago

Sure, you CAN verify Turing machines, but verifying languages that AREN'T Turing complete is sufficiently simpler. So why not make your verification work easier by using a total language? The only real argument against that would be "we can't do what we want in a total language".

I don't buy the argument that what people want to do with smart contracts requires Turing-completeness. In fact, as time goes on I become more and more convinced that Turing completeness is highly overrated. Almost all code wants to do finite and/or structurally inductive operations. The only case that doesn't fall in that are things like request loops where you want to "infinitely" wait, process request, loop back to waiting. But even those things can be done in total languages via co-induction, so exactly why do we want to make our analysis/verification work more difficult by using a non-total language for things like Ethereum?

KirinDave3• 9 years ago

Etherium should have launched with a language that wasn't a high-school-extra-cirricular-level in terms of construction and consideration.

Solidity doesn't have a problem with formal verification of programs. Check their bug tracker: you can't even trust the runtime to do what it claims to do. On several levels.

empath75• 9 years ago

Should Ethereum not have been launched until it had solid methods for auditing and proving? Maybe, but that's not how the world works, typically. Worse is better and all that.

As a platform for experimentation that's fine. As a platform for doing real things with meaningful amounts of money, it's madness.

naasking4• 9 years ago

It's a disaster. But it's a disaster that points the way fairly straightforwardly.

A disaster that could have been avoided if they had done a little more research on security and smart contract languages:

http://lambda-the-ultimate.org/node/5003

Solidity is still clearly focused on programming productivity instead of contract soundness. The built in dynamism is proof of this.

guscost3• 9 years ago

the takeover-the-world echo-chambers of ethereum

You toss out this pejorative description, and then in the next paragraph:

When talking about engineering on such a critical subject, people should be way more responsible.

This is absurd. How could it ever become critical without a lot of research and development first?

I've been holding a handful of Ethereum since there was a decent dip in the price. I haven't spent much time on it and I have no good leads for program ideas yet, but if the code is buggy and I get hacked and lose my investment, that's fine. A smart contract is a project, and it could fail like any other.

Don't put your retirement savings in a smart contract right now unless you're OK with losing it all. Maybe in the future Ethereum will move beyond this phase, and maybe not. All the drama is ridiculous, everyone needs to chill out.

lawless1234• 9 years ago

"I've been holding a handful of Ethereum since there was a decent dip in the price. I haven't spent much time on it and I have no good leads for program ideas yet, but if the code is buggy and I get hacked and lose my investment, that's fine. A smart contract is a project, and it could fail like any other. Don't put your retirement savings in a smart contract right now unless you're OK with losing it all. Maybe in the future Ethereum will move beyond this phase, and maybe not. All the drama is ridiculous, everyone needs to chill out."

This is the exact spiel we're all sick of hearing.

grey-area• 9 years ago

When it comes to contracts I think a more interesting idea is a limited formal expression of them and thus automatic production and evaluation/translation/summaries (would require a formal spec for each domain with very limited options), not a Turing complete expression of them which as you say leaves too many holes. Also tying all of this to a currency and payments makes zero sense and just expands the attack surface massively. Just fixing contract law with automated checks of contracts would be a huge opportunity/challenge.

KirinDave3• 9 years ago

The other sad thing is that Solidity, the language of Etherium, is a trainwreck. It has tons of bugs, properties that maximize the memory cost of the program, and until ~6 days ago had crazy double init bugs in constructors using "this".

DennisP5• 9 years ago

Looking at Solidity's release log, the last update was 18 days ago. It fixed some minor bugs from the previous release three days prior, and none of the bugfixes mentioned in the previous release seem to fit your description. Do you have a link?

https://github.com/ethereum/solidity/releases

ekidd3• 9 years ago

2. Ethereum software has security hole, gets hacked

The last time this was discussed on Hacker News, I found this comment particularly instructive: https://news.ycombinator.com/item?id=14810008

It points out a great many fundamental issues with the Solidity contract language. Basically, the language design sounds extremely amateurish and it appears to have ignored everything we've learned about security in the last 30 years. Samples:

- "Operators have different semantics depending on whether the operands are literals or not. For example, 1/2 is 0.5, but x/y for x==1 and y==2 is 0."

- "All state is mutable by default (this includes struct fields, array elements, and locals). Functions can mutate state by default"

- "Order of evaluation is not defined for expressions. This in a language that has value-returning mutating operators like ++!"

I wouldn't trust a Solidity smart contract with $100.

grogenaut4• 9 years ago

I hate immutable variables because I'm lazy but I would definitely use them as a feature in a system like this. Maybe I should reconsider using erlang or my position on immutble variables... Nope that's enough self discovery for today... Carry on.

Edit: And again erlang people can't take a joke. I'm literally making fun of myself for having an invalid bias and erlang folks take it as an attachment on the language.

It's also a commentary on how long it takes for devs to mind shift and incorporate new ideas.

pkulak• 9 years ago

Does Solidity really matter, though? "How's the VM" is the real question. I haven't spent more then 10 minutes looking into it, but it seemed reasonable to me. No heap and 256(?)-bit addressing seem like good ideas to keep execution complexity down.

ojr3• 9 years ago

You wouldn't trust a bank with an SQL-injection vulnerability or a hospital running on an old version of Windows either but that doesn't mean all banks and hospitals are not trustworthy

A new monetary system created 3 years ago and is highly demanded might have some growing pains

You hold $0 of Ether but suggest on how to spend it, you wouldn't send ether to a contract that was coded poorly or vulnerable so the language is not as important as you make it seem.

Ethereum has a great bug bounty program so contracts that are vulnerable get exposed fast. Each new smart contract should learn lessons for previous contracts and the software will improve over time, imagine that...

IncRnd• 9 years ago

This! ^^

Solidity code is horrible, especially after looking at concise, maintainable, provably correct code.

aeriklawson• 9 years ago

Ugh that's... disconcerting to say the least.

hellbanner• 9 years ago

"90s cypherpunks that pioneered this ideas had considered Turing complete design and discarded it for cryptographic state-machines that allow for formal verification" - are you referring to Bitcoin?

Or some other ideas that aren't currently implemented?

macmee• 9 years ago

Ethereum software has security hole, gets hacked

The exploits so far were NOT security holes in ethereum, they were poorly written smart contracts by third parties.....

touhonoob• 9 years ago

That's pretty like early days of web development when people write SQL-injection vulnerable code on daily-basis

theptip2• 9 years ago

Worth mentioning that there is at least one other language being built on top of the EVM:

https://github.com/pirapira/bamboo

This one takes a strict state machine approach, and aims to solve some of the tricky reentry and state tracking problems of Solidity.

bguy74• 9 years ago

This would be compelling were it to contain accurate information. However, likening the parity incident to a "hack of ethereum" is like saying the USD is flawed because wells fargo was broken into. The same thing is true for the DAO, although it is indeed more complex in that the _resolution_ of it was handled by Ethereum proper. I think that was questionable.

Literally no one within Ethereum calls it an experiment. You have to cherry-pick from population and then ascribe it to the whole for this to be even sensical.

Essentially every technology we can think of can be rooted back to the 90s, or really any period we want to look at since that is how knowledge works. If you've got a particular, say it...rather than just this poor, lazy attempt at a sort of character assassination by employee (fairly inaccurate) appeal to oldness.

It is thoroughly _without merit_ to suggest that the analogous components of ETH and BTC have BTC being more secure. In fact, the opposite is true by any reasonable measure. Further, there are indeed things that Ethereum tries to do that add complexity, but if they come with value we shouldn't then find ourselves saying things like you do that amount to a sort of "my abacus is more secure than quickbooks online" - different purposes, solving different problems and creating different sorts of value. Even beyond that BTC holds all records for security events and $ cost of them, coin-loss amounts of of them, and so on.

throw2016• 9 years ago

The problem with crypto coins is some have bought in and thus are vested making balanced discussion impossible. We see even with something as trivial as choice of programming language some can become very religious in their support. When money becomes involved expecting rational discussion is perhaps naive.

Money is a social construct that needs societal consent and a framework to manage it that is accountable to the societies rules and regulations. So a random person can't just create money or value out of thin air. There is no value being created here.

They can make a private coin, and convince others to use it between themselves, there were and still exist many such private arrangements in traditional economies, but the value only exists for those who choose to trust this system, and can never hope to replace the main economic currency.

Bitcoin and other coins exists in this space of a private coin based on mutual trust and of no real value to the main economy. Holders of such coins would of course love for it to become a real currency and continue making outlandishly self serving arguments about the economy so they can gain something out of nothing. But that begins to resemble a pyramid scheme powered exclusively by greed and self interest to the exclusion of that society's interests.

richardknop• 9 years ago

I agree with this view.

justadeveloper22• 9 years ago

Not only is it a social construct, but the concept of money took thousands of years to evolve, with fits and starts, to what it is today. No matter what, some new technology isn't going to just show up all of a sudden and completely revolutionize what is an intrinsic component of human civilization. To think otherwise is to be taken in by scammers.

I know that current money systems have flaws and are manipulated by the elites. Crypto won't end up being any different in that regard, however. Inflation is a tactic utilized within the current flawed system to move wealth to the top without your bank balance displaying the change. Cryptos will end up having their own flaws to be exploited.

Jabanga3• 9 years ago

I think you're underestimating the impact of a durable and formal consensus mechanism that can be run by machines and can operate efficiently at a global scale by utilising telecommunication networks. This is orders of magnitude more efficient than traditional governing structures and will displace several core industries over the next few decades in my opinion.

Keeeeeeeks2• 9 years ago

I think we need an Etudes for Ethereum contract development and best practices; there are like 4 different "make a smart contract that juggles millions of assets on the shutter" tokens and sites, but few that focus on security and how to vigorously remind people that mistakes are worth millions of dollars

hackermailman• 9 years ago

If you are considering writing a smart contract, you should read this first https://github.com/ConsenSys/smart-contract-best-practices for Solidity security pitfalls, and hopefully have some idea of invariants/contracts to verify expected properties of your smart contract https://www.cs.cmu.edu/~rjsimmon/15122-s16/lec/01-contracts.... and additionally hope the EVM doesn't have unexpected behavior.

Anybody know if the legality of exploiting leaky smart contracts has been tested? Since a lawyer can exploit a badly written contract I wonder if somebody who finds a flaw in a smart contract can legally just jack all the coins or alternatively, write purposely obfuscated contracts (underhanded Solidity contest) to run a scam.

gjem97• 9 years ago

It is an interesting question. In addition to any common law covering contracts, there are also some statutes that specifically cover interactions on a computer, like the Computer Fraud and Abuse Act. These laws often refer to "intended use" or "exceeding authorized access". IANAL, but It seems complicated enough that we probably won't really know the answers until a few cases are litigated.

JackC• 9 years ago

I wonder if somebody who finds a flaw in a smart contract can legally just jack all the coins

One way to interpret this legally is to assume that smart contracts are in fact enforceable legal contracts. (Most promises about exchanging stuff are enforceable legal contracts, so this is plausible.) The general first-year-contracts answer is then that it depends on the expressed intent of the parties.

Take two extreme examples:

(1) I put an ether bounty in a smart contract and say anyone who can exploit the contract can have it. Definitely legal to exploit (and I can be held to the promise).

(2) I hire you to review my smart contract for exploitable flaws, and instead you exploit the flaws. Definite breach of contract.

The real situation is neither of those, but you can see how expressed intent matters.

So the question is what's the actual expressed exchange of promises between the parties to a given smart contract? And here I think some of the code-is-contract statements around Etherium tilt things toward my (1) example - the text advertisements for the DAO have a bunch of stuff to set the expectation that whatever the code says, goes. But that would be up for debate in court.

(And then there's lots of non-contract ways to slice this, from computer fraud to gambling law to securities law to...)

rdiddly2• 9 years ago

Thread warning: I'm actively downvoting any argument that tries to address (read: not address) a cryptocurrency's flaws by changing the subject. Example:

Person A: Cryptocurrency X is insecure isn't it.

Person B: So is { the dollar | driving | flying | the internet | * }.

ym70514• 9 years ago

Don't you have anything else to do?

rdiddly2• 9 years ago

What could be more important than discouraging faulty argumentation techniques on the internet?

andreasgonewild• 9 years ago

Please, enough with the JavaScript already; there are thousands of saner means of expression already existing or waiting to be discovered. Writing flawless, verifiable contracts is the worst use-case ever for that stinking pile of a language. I wonder how many missing bazillions it's going to take for the world to wake up and move on.

EternalData• 9 years ago

There needs to be a separation of the underlying technological fundamentals of ETH and its economic reality -- which is, like anything else, likely to go through bubble phases.

theptip2• 9 years ago

Pretty much sums up the state of Ethereum/Solidity development right now;

Step 1, install wallet. Step 2, deploy contract. Step 3, learn about Solidity. ... Testing? Nah.

Learn Ethereum smart contract programming

Related Stories