FBXL Social

One important task of smart contracts, that has been largely overlooked by traditional EDI, is communicating the semantics of the transaction to the parties involved. There is ample opportunity in smart contracts for “smart fine print”: actions taken by the software hidden from a party to the transaction. For example, grocery store POS machines don’t tell customers whether or not their names are being linked to their purchases in a database. The clerks don’t even know, and they’ve processed thousands of such transactions under their noses. Thus, via hidden action of the software, the customer is giving away information they might consider valuable or confidential, but the contract has been drafted, and transaction has been designed, in such a way as to hide those important parts of that transaction from the customer.

What the everloving fuck is this blatent disregard for honesty?!

From Smart Contracts by Nick Szabo, the guy who originally invented the concept

cc: @sun

To crypto's credit though, AFAIK most smart contract chains don't allow that (or, at least, not Ethereum).

@Hyolobrika you can try to hide and obfuscate stuff in smart contracts. But they can be decompiled and analyzed to see their true behavior.

You can never be certain what's gonna happen as a side effect of interacting with a contract. It doesn't have to tell you anything.

@feld @Hyolobrika Yeah, it's all public but that doesn't mean it's easy.

True. They are compiled, and releasing the source code is not a given. How many contracts do that? Do any use reproducible builds?

You being mean to me is also public

They don't mention any of this on https://ethereum.org/en/smart-contracts/

Just:

>Finally, like traditional contracts, you can check what's in a smart contract before you sign it (or otherwise interact with it). A smart contract's transparency guarantees that anyone can scrutinize it.

I knew it already though.

@Hyolobrika the language is limited and you can decompile it. Tools like IDA have to deal with way more complicated stuff.

AIUI You can get almost identical code back out but without the variable names and comments etc obviously

https://jbecker.dev/research/diving-into-decompilation

@Hyolobrika 99% sure that reproducible builds are a given with the EVM. A contract always has to compile and produce the same hash otherwise it's hard to verify it, right?

@Hyolobrika @feld not sure if this is what you're asking, but etherscan allows contract authors to upload source and they'll verify it compiles out the same. Clicked a random transaction and found this one as example: https://etherscan.io/address/0xd4e96ef8eee8678dbff4d535e033ed1a4f7605b7#code

1. It doesn't show the source code it verified.
2. I want a way to verify it myself, so I don't have to trust anyone.

>You can never be certain what's gonna happen as a side effect of interacting with a contract. It doesn't have to tell you anything.
Wdym by this? Surely everything is in the Solidity code, which can then (potentially) be reproducibly built to verify it corresponds to EVM bytecode, right?

@feld @Hyolobrika Yes, Solidity compiler is deterministic builds, within the same version number. So, if you look on Etherscan like Harblinger mentions, you will notice that it lists the exact solc compiler version and settings. When you upload the contract code you have to include the compiler version and settings.

Nvm. I found it.
replies
1
announces
0
likes
1

@Hyolobrika @feld you may be interested to know that a different chain, Arbitrum, has smart contracts that run on a WASM engine. That is better in a lot of ways but also makes it harder to verify contracts since a lot more languages can compile to it but don't have deterministic builds.

Freenet, which is not cryptocurrency but is conceptually similar to Ethereum, also uses WASM (currently just with Rust, which the core program is also written in)

@Hyolobrika @feld yeah the main language being pitched for wasm smart contracts is Rust!