@Eth here references how "...a dapp can effectively have two back-ends..."

In other words how can a user trust they are receiving trustless data?


If you want to be sure that the dapp is showing you the data that it claims to be showing you, you need to check the source code of the dapp.

Currently dapps are often hosted on someone's website or - only slightly better - on a github.io site. When they're doing this it would be quite easy for the host to change the source code and make it do something else.

Wallet software like MetaMask can mitigate this somewhat by showing users what they're doing before they send transactions. But even here, there are lots of ways you could imagine someone could be tricked into sending a transaction based on bad information, and it's also hard for them to tell what kind of transaction they are sending. A lot of the UX problems here are unresolved, and there will be SFYL while the world learns how to do it right.

Another thing that will probably ultimately help is tamper-proofing the deployed code, and using smart contracts to enforce the process by which code gets put in front of the user. If you load your code directly off IPFS, or you have a browser extension that hashes the code it's got, you can reduce a software version to a single hash. You can then have a smart contract that requires a deployment to go through a particular process; For example, code needs to be published for x days before deployment and people can object on payment of a bond, or that it needs to be signed off on by developers x, y and z, etc.

It may also be useful to have standards and patterns to make it easier to review deployed dapp code. There's a lot of chaos in JavaScript that gives you places to hide nasty things.

| improve this answer | |
  • I find this simultaneously fascinating / horrifying / challenging (in a good way). You've covered the broad strokes, but open questions like: "byte code matches the source code check" , but, returned button action matches the contract call? I'd like to see the assumed Reddit-threaded "Great Debate on this Topic" and maybe more about your IPFS hash scheme – Zach_is_my_name Mar 29 '17 at 4:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.