Timeline for How are end-users meant to build trust towards smart contracts (and their originators)?
Current License: CC BY-SA 3.0
18 events
| when toggle format | what | by | license | comment | |
|---|---|---|---|---|---|
| Jan 21, 2021 at 19:03 | comment | added | Tom | If I were a malicious smart contract publisher, wouldn't I just put the clean 'source code' onto github for people to analyse, and then on deployment add in my malicious functions? You could still decompile the bytecode but I don't see how published source code necessarily creates trust. | |
| Mar 19, 2018 at 21:01 | answer | added | Kevin Larson | timeline score: 0 | |
| Jun 18, 2016 at 16:12 | history | edited | zanzu | CC BY-SA 3.0 |
edited body
|
| Jun 5, 2016 at 15:04 | comment | added | bortzmeyer | Duplicate of ethereum.stackexchange.com/questions/2877/… | |
| Jun 3, 2016 at 19:30 | history | edited | eth♦ |
edited tags
|
|
| Jun 3, 2016 at 16:07 | history | edited | zanzu | CC BY-SA 3.0 |
edited title
|
| Jun 3, 2016 at 16:02 | answer | added | zanzu | timeline score: 2 | |
| Jun 3, 2016 at 15:58 | vote | accept | zanzu | ||
| Jun 3, 2016 at 15:58 | comment | added | zanzu | Your open source analogy is an interesting one, and I believe effectively answers my original concern, albeit it reinforces the importance of the first two conditions in the above list. Interestingly, I do not believe this applies for the majority of contracts even with the current limited contract set. One additional point is that under the assumption that contracts can be securely related to (an) author(s), then over time end-users should be able to (rightly or wrongly) build trust towards the originators/authors without code inspection. | |
| Jun 3, 2016 at 15:35 | answer | added | Roland Kofler | timeline score: 3 | |
| Jun 3, 2016 at 15:25 | comment | added | Roland Kofler | people will not blindly trust any contract that is advertised in some reddit post. | |
| Jun 3, 2016 at 15:23 | comment | added | Roland Kofler | Yes 'brand reputation at stake' and 'state force monopoly' are the reasons you as a consumer know you can risk it With smart contracts it is an expansion of the open source security model It is a coordination game: I could cheat, but I could easily be discovered too. The consumers of smart contract will use risk/reward heuristics, and the most popular contracts will be examined by voluntary security experts, that want to have a reputation. The huge amount of TheDAO pull requests this weeks proves this ;-) | |
| Jun 3, 2016 at 15:16 | history | edited | zanzu | CC BY-SA 3.0 |
edited title
|
| Jun 3, 2016 at 15:15 | comment | added | zanzu | Right. The point though is that for every Solidity expert out there, there will be several more individuals that won't have a clue what they're reading if they see the source. Even if through some miracle everyone that can read becomes capable of inspecting Solidity code, the odds are that users will not be any more inclined to audit Solidity code any more than they inspect T&Cs associated with most services we use. In the traditional world, most users choose to blindly trust the service provider as more often than not they're dealing with a known brand, rather than some anonymous coder. | |
| Jun 3, 2016 at 15:09 | comment | added | Roland Kofler | Less likely but not impossible. And contracts with no source code will be less trusted a lot. So it will become practice anyway to publish it. | |
| Jun 3, 2016 at 15:08 | comment | added | zanzu | Publishing the contract's source is the choice of the contract originator. Clearly in the event that the originator chooses not to, then the third condition will be even less likely. | |
| Jun 3, 2016 at 15:06 | comment | added | Roland Kofler | The source of the contract must not be published. You can disassemble the EVM code and study it, so you need only case three. | |
| Jun 3, 2016 at 15:01 | history | asked | zanzu | CC BY-SA 3.0 |