3

How do smart contracts established trusts? Is it more of a social thing - ie a lot people know that this contract from this protocol has this address, or is there a more trustless, way where someone can confirm the authenticity of a smart contracts?

I mean there are some popular smart contracts in ecosystem, from Compound, Aave, to Uniswap etc. How is their authenticity validated? Only social consensus? or something else?

What about the smart contracts that don't end up getting popular to have a good social consensus to establish authenticity? How do one trusts those?

Improve this question
2
  • 1
    Mos of the good companies verify their smart contract and publish audit report from a verified auditor like certik.
    – Safi
    Mar 13 at 13:10
  • 1
    so trust is not totally eliminated in web3 then...maybe minimized, but not all things can be verified. because here i need to also trust certik
    – Finlay Weber
    Mar 13 at 13:40

2 Answers 2

Reset to default
2

It's a combination of the following:

  1. Social trust: TVL (number of users and payment volume), engagement on Twitter, activity on a Discord server, etc.
  2. Open-source verifiability, i.e., having the source code verified on blockchain explorers such as Etherscan and Sourcify, as well as publishing the smart contract repository in a git hosting platform like GitHub.

I don't know any successful web3 project that doesn't tick both boxes.

Improve this answer
7
  • for the second point...is it not easy to create a clone? And in the absence of the social trust, it becomes impossible to then verify. In web2 how do I verify that I am talking to a google service for instance? I could look at the domain, and also there is HTTPS. In web3 there seems to be nothing parallel?
    – Finlay Weber
    Mar 13 at 12:53
  • 2
    Source code verification is the closest thing to HTTPS for smart contracts. Speaking of HTTPS though .. you're also relying on a web of trust for the keys that underpin its security.
    – Paul Razvan Berg
    Mar 13 at 14:14
  • 1
    You can always verify yourself if you do not trust others
    – Mikko Ohtamaa
    Mar 13 at 19:09
  • 1
    There are successful Web3 projects? Last I checked they're all ponzis built on ponzis and the house of cards has come tumbling down drastically
    – ScottishTapWater
    Mar 13 at 21:26
  • 1
    @ScottishTapWater at Sablier we're striving hard to make a web3 product that solves a problem. Don't throw the baby out with the bathwater.
    – Paul Razvan Berg
    Mar 14 at 10:42
1

When you say that you "trust" the smart contract, there are a few things that this could mean. Here are a few I can think of, ordered from most to least technical:

  • Trusting that the bytecode deployed on the blockchain matches the source code: the Solidity compiler is deterministic, so if I deploy a smart contract, and then I tell you "here is the source code for that smart contract", then you can compile my source code and see that it matches the bytecode on the blockchain.
  • Trusting that the smart contract is controlled by the right people:
    • if the project is large enough, then you can look at the history of transactions with that smart contract; if I deploy a copy of a big project's smart contracts, then I'd have to also generate more transactions than their project has in order to fool you, which is financially infeasible.
    • if you know the address of a person who is responsible for the smart contract, then you can see if the given smart contract was created by the same person, and/or you can see if they have ever executed a function that only the owner is supposed to be able to execute.
  • Trusting that the smart contract's code doesn't have bugs: for this, you can read the source code, or rely on an analysis made by someone else (also known as an audit). If the code was designed with this in mind, then it could be possible to use formal mathematical methods to prove properties of the code, like "it will never loop more than X amount of times". This is quite difficult, because there are typically a lot of moving parts in the code, and keeping all of them in your head can be challenging.
  • Trusting that the code does the "right thing": for this, you need to look at what rules are enforced by the code, and how those rules translate into real-life consequences. ("Rules must always be evaluated by their power to oppress") This requires you to look beyond the code and into the wider social context of the technology, and requires a "systems view" of that context. Several upcoming technologies, like AI text and image generators, facial recognition, self-piloting machines, and algorithmic social networks, are currently being evaluated on the topic of whether they would do the "right thing" for society as a whole.
  • Trusting that the project is not a scam and/or won't be abandoned: this is outside the scope of blockchain trust, and is instead more of a question of investment advice. It is as hard to prove this for a blockchain project as it is for a conventional startup -- potentially even harder, because of the pseudonymity inherent in blockchain technology which makes it easier to perform fraud without consequence.
Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.