0

Since a smart contract executes code, is it possible to execute malicious code, introduce bugs and generaly create problems for the platform?

If yes, how can this be avoided?

  • Yes; the DAO hacker (blog.ethereum.org/2016/06/17/… and what-is-ethereum.org/2017/08/05/… and hackingdistributed.com/2016/06/18/analysis-of-the-dao-exploit) exploited a vulnerability in a contract by writing his/her/their own malicious smart contract. This has probably resulted in the biggest public problem for Ethereum (resulting in the Ethereum Classic split). This can be mitigated through lots of code auditing and testing. – lungj Aug 8 '17 at 17:36
  • Besides the straightforward answer "Yes", this is much too broad a question. The equivalent is asking "How do I stop my web app from being hacked?" Do you mean to ask about specific resources to read, or analysis tools to help catch issues, or what the Ethereum Foundation is doing to help reduce security issues going forward? – carver Aug 9 '17 at 0:20
3

The Ethereum EVM is turing complete. This means that anyone can program anything they want. I sometimes teach Solidity programming, and I purposefully write code that allows me to steal my students' ether. I do it on purpose to show them how careful they should be.

You should never interact with a smart contract without first understanding the source code. Trust no-one. The beauty of immutable code is that if you review it before you interact with it, and you're satisfied that the code doesn't steal your money, then there is nothing that can later happen to the code that can change that.

In a certain sense, yes--people can write evil code.

Should you ever fall victim to that evil code? No. Because you always read the code, and you think carefully about what the code does (who can get the money out, how can they get the money out, can you get your own money out).

Will people actually read the code in the real world? Probably not, but they should probably hire someone else to read it for them or join only high-profile contracts that others have reviewed.

Never interact with code that you don't know is good. If you do, you deserve to lose your money.

  • Since the actual contracts are stored on the blockchain how is it possible to view the code as it exists on the blockchain and not the code as it is published at another location like github? – CathalMF Jan 31 '18 at 17:48
  • 1
    When you compile Solidity code, it gets turned into EVM byte code. You can query the Ethereum node for the byte code at a particular address. If the byte code as compiled from the source code given to you by the developer or gotten from GitHub does not match the byte code returned by the node fir that address, the source code is different than what is actually going to run. – Thomas Jay Rush Jan 31 '18 at 19:48
  • Is there any way to decompile the byte code back into Solidity? – CathalMF Feb 2 '18 at 9:45
  • Not to the point where you could prove it was the same code. There are decompilers, but they wouldn’t be able to reproduce the original code. – Thomas Jay Rush Feb 2 '18 at 11:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.