Smart Contracts: Threat or opportunity?
By: Omid Haghighatgoo
Tags: Blockchain Technology, Blockchain, Smart Contracts, Bitcoin, Ethereum

A “smart contract” is simply a program that runs on the Ethereum blockchain. It’s a collection of code (its functions) and data (its state) that resides at a specific address on the Ethereum blockchain.

Photo by vjkombajn from pixabay

A. Terminology

smart contract: is a computer program or a transaction protocol which is intended to automatically execute, control or document legally relevant events and actions according to the terms of a contract or an agreement. The objectives of smart contracts are the reduction of need in trusted intermediators, arbitrations and enforcement costs, fraud losses, as well as the reduction of malicious and accidental exceptions.

White paper: is a report or guide that informs readers concisely about a complex issue and presents the issuing body’s philosophy on the matter. It is meant to help readers understand an issue, solve a problem, or make a decision.

Blockchain: is a growing list of records, called blocks, that are linked together using cryptography. Each block contains a cryptographic hash of the previous block, a timestamp, and transaction data. The timestamp proves that the transaction data existed when the block was published in order to get into its hash. As blocks each contain information about the block previous to it, they form a chain, with each additional block reinforcing the ones before it. Therefore, blockchains are resistant to modification of their data because once recorded, the data in any given block cannot be altered retroactively without altering all subsequent block

Ethereum: is a decentralized, open-source blockchain with smart contract functionality. Ether is the native cryptocurrency of the platform; among cryptocurrencies, it is second only to Bitcoin in market capitalization.

B. What is Smart Contracts?

The phrase and concept of “smart contracts” was developed by Szabo (computer scientist, lawyer and cryptographer) with the goal of bringing what he calls the “highly evolved” practices of contract law and practice to the design of electronic commerce protocols between strangers on the Internet

Smart contracts are a type of Ethereum account (if you want to know more you can read their white paper here. This means they have a balance and they can send transactions over the network. However they’re not controlled by a user, instead they are deployed to the network and run as programmed. User accounts can then interact with a smart contract by submitting transactions that execute a function defined on the smart contract. Smart contracts can define rules, like a regular contract, and automatically enforce them via the code. Smart contracts cannot be deleted by default, and interactions with them are irreversible.

C. Smart Contract Architecture

Within a smart contract, there can be as many stipulations as needed to satisfy the participants that the task will be completed satisfactorily. To establish the terms, participants must determine how transactions and their data are represented on the blockchain, agree on the if/when…then…” rules that govern those transactions, explore all possible exceptions, and define a framework for resolving disputes.

Smart Contract Schematic

Then the smart contract can be programmed by a developer — although increasingly, organizations that use blockchain for business provide templates, web interfaces, and other online tools to simplify structuring smart contracts. The basic architecture of the EVM (ethereum virtual machine) that runs smart contracts is that all calls to the contract are executed as a transaction where the ether required for a contract method executed is transferred from the calling account address to the contract account address. The contract code resides on the contract address on the blockchain and expects the calls to come in as transactions carrying the method parameter data along with the transaction as “input”. To enable a standard format for all clients, the method name, and parameters need to be marshaled in a recommended format.

D. Pros and Cons

Why we should use smart contracts?

1-Speed, efficiency and accuracy

Once a condition is met, the contract is executed immediately. Because smart contracts are digital and automated, there’s no paperwork to process and no time spent reconciling errors that often result from manually filling in documents.

2- Trust and transparency

Because there’s no third party involved, and because encrypted records of transactions are shared across participants, there’s no need to question whether information has been altered for personal benefit.

3- Security

Blockchain transaction records are encrypted, which makes them very hard to hack. Moreover, because each record is connected to the previous and subsequent records on a distributed ledger, hackers would have to alter the entire chain to change a single record.

4-Savings

Smart contracts remove the need for intermediaries to handle transactions and, by extension, their associated time delays and fees.

Why we should AVOID using smart contract?!!!

Smart contracts introduce an additional risk that does not exist in most text-based contractual relationships — the possibility that the contract will be hacked or that the code or protocol simply contains an unintended programming error. Given the relative security of blockchains, these concepts are closely aligned; namely, most “hacks” associated with blockchain technology are really exploitation of an unintended coding error. As with many bugs in computer code, these errors are not glaring, but rather become obvious only once they have been exploited. For example, in 2017 an attacker was able to drain several multi-signature wallets offered by Parity of $31 million in ether. Multi-signature wallets add a layer of security because they require more than one private key to access the wallet. However, in the Parity attack, the attacker was able to exploit a flaw in the Parity code by re-initializing the smart contract and making himself or herself the sole owner of the multi-signature wallets. Parties to a smart contract will need to consider how risk and liability for unintended coding errors and resulting exploitation are allocated between the parties, and possibly with any third party developers or insurers of the smart contract.

A blockchain-based smart contract is visible to all users of said blockchain. However, this leads to a situation where bugs, including security holes, are visible to all yet may not be quickly fixed. Such an attack, difficult to fix quickly, was successfully executed on The DAO in June 2016, draining approximately US$50 million worth of Ether at the time, while developers attempted to come to a solution that would gain consensus. The DAO program had a time delay in place before the hacker could remove the funds; a hard fork of the Ethereum software was done to claw back the funds from the attacker before the time limit expired. Other high-profile attacks include the Parity multi-signature wallet attacks, and an integer underflow/overflow attack (2018), totaling over US$184 million. Issues in Ethereum smart contracts, in particular, include ambiguities and easy-but-insecure constructs in its contract language Solidity, compiler bugs, Ethereum Virtual Machine bugs, attacks on the blockchain network, the immutability of bugs and that there is no central source documenting known vulnerabilities, attacks and problematic constructs.

References:

https://www.ibm.com/topics/smart-contracts

https://corpgov.law.harvard.edu/2018/05/26/an-introduction-to-smart-contracts-and-their-potential-and-inherent-limitations/

https://ethereum.org/en/developers/docs/smart-contracts/

https://en.wikipedia.org/wiki/Smart_contract

https://blockgeeks.com/ethereum-smart-contract-clients/

https://web.archive.org/web/20170730133911/http://iqdupont.com/assets/documents/DUPONT%2D2017%2DPreprint%2DAlgorithmic%2DGovernance.pdf

https://www.freecodecamp.org/news/a-hacker-stole-31m-of-ether-how-it-happened-and-what-it-means-for-ethereum-9e5dc29e33ce/