4

Today I was talking to a company to work for them as a Smart Contract developer. The thing is that they asked me if I have any insurance in case there's a bug in the Smart Contracts.

Do we really need insurance as Smart Contract developers? Can someone report me for a Smart Contract bug that caused people to lose Ether?

3

I believe that they are referring to 'Professional Indemnity' insurance cover.

Having an insurance policy that covers a professional for their work is important because it allows them to offer services without having to build in the potential costs of any mistakes they might face in the future. This means that they can be covered for contractual stipulations that might go above and beyond the normal legal expectations, for instance. Furthermore, a professional indemnity policy can also cover the legal costs and expenses that might be incurred as a result of a legal case being made against a professional for their mistake.

I doubt there is any precedent for a Smart Contract developer being sued for a mistake, yet, but there are examples of software developers being sued for mistakes that they have made, so it is a very real risk.

The contract that I work under, as a software developer, stipulates that I must have insurance in place to fulfil the terms of the contract.

I can't give you any legal advice, but I would say that if you Google for whether you can be sued for developing bad software, you will find that it isn't unheard of.

3

You do not need to have insurance to write a smart contract. (Obviously: you've written a smart contract before and you don't have insurance)

However, your potential client may require you to indemnify them. Thus, to be eligible to write a contract on behalf of this company, you may be required to indemnify them -- this would be a term of the contract you have with them. It is not unusual for contracts to include a non-performance penalty for failure. If you are a small company, they may insist you have indemnity insurance because you can't squeeze blood from a stone. Even if you're part of a larger company, they may insist you have indemnity insurance to make it easier to obtain compensation in the case of a mistake. Or they simply may require it from all contractors performing certain functions simply for uniformity (instead of having a big company contract and a small company one). Clients requesting such a thing probably know that good software isn't cheap; if they're not willing to pony up for things like written requirements/specs; internal code inspections, automated testing, integration testing, and other V&V; and other good practices, then run away. If you're not able to provide those things, then run away; those are the sorts of things people often go to companies like IBM to provide.

Such insurance is probably not the norm in the software world, but when dealing with situations where failure is costly, I would expect this to be much more commonplace. If your contract allows for it (either explicitly or by omission), you can almost certainly be sued.

1

Of course, you don't need that insurance. Developers are human. They make mistakes. And so do the reviewers who audit the code. It's a nonsense to blame one person for the money you lost due to hackers attack. Mistakes are routinely made in programming. All programs carry the risk of developer error. As stated in this article: https://medium.freecodecamp.org/a-hacker-stole-31m-of-ether-how-it-happened-and-what-it-means-for-ethereum-9e5dc29e33ce

"We would do well to take a page from site reliability practices at companies like Google and Airbnb. Whenever there’s a production bug or outage, they do a postmortem analysis and distribute it within the company. In these postmortems, there is always a principle of never blaming individuals.

Blaming mistakes on individuals is pointless, because all programmers, no matter how experienced, have a nonzero likelihood of making a mistake. Instead, the purpose of a postmortem is to identify what in the process allowed that mistake to get deployed. ... Even organizations like Google or NASA make programming mistakes, despite the extreme rigor they apply to their most critical code."

As a Solidity developer myself, I could tell that it is very hard to code a secure smart contract. A developer should think 100x times about every line of code and hacker only needs to find one vulnerability or even have some luck. So my suggestion is to keep away from such companies as probably they don't understand how hard smart contracts developer job is.

1

Fascinating question. I'm a lawyer and I'm working through this topic at the moment. It depends if you are working as a contractor or an employee. As an employee, your employer would usually be the respondent to any law suit, although if you were grossly negligent your employer might sue you. If you're a sole trader contractor, then you personally would be liable - or if you're a limited liability company, your exposure would be only to the value of your company's assets. You are right, there is little specific precedent, but if you create a smart contract that has a bug in it that costs the client a lot of money, why wouldn't they sue you to get whole? I'd ensure my employer was insured for this, or if a contractor I'd get cover. I hope that helps - just add the price of the insurance into your operating expenses for the job and factor it into your quote.

1
  • Upvoted. An answer to a legal question from a lawyer :) (Yes, I realize there is an implicit disclaimer that this is not legal advice) Welcome to the community! – lungj Oct 11 '17 at 3:20
0

Generally speaking any company which ask for an insurance to programmer is not a good company to work with because they do not understand the problem.

The only insurance which works is to have the ability to share the works of programmer and/or to have significant design review during the project and a significant test phase before production. In absence of this thinking that you can have your money back from the programmer’ insurance is a bad quality plan.

As a free lance programmer you should be sure to transfer liability to your customer by means of the acceptance, giving a limited warranty on your work. You remain liable for negligence, but we are not discussing about this.

As employees you definitively do not have to have any insurance, it is not up to you to pay for it.

0

In theory yes, especially if the damages are large. There are some upcoming legal tools available in some jurisdictions that can protect developers, most notably the legal personality for DAOs in Malta.

Generally, it would be wise to have audits performed before smart contracts are deployed, and use tools that can check for vulnerabilities such as contract-library: https://www.contract-library.com

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.