This is a partially philosophical question, by an Ethereum newbie.
When calling a contract, you send ethers to it. Before that, you checked of course that the contract does something interesting/useful for you and is worth of your cryptomoney. You typically do so on the basis of the written documentation of the contract.
But the author of the contract may deceive you, or may simply be wrong. If you're serious and knowledgeable, you check the source code of the contract. (And, if it not available, you simply never send your ethers to it.) Not only it is difficult, but it is not a proof that the compiled contract in the blockchain matches the source code you got.
It seems to me that there are only three solutions, none very satisfying:
- Compiling the source code yourself and see if it matches the binary. If it does, OK, if it doesn't, it may simply means you do not have the same version of the compiler... (If you do not have a compiler locally, you can use https://etherscan.io/verifyContract )
- Checking the binary, using techniques similar to what the reversers are doing when they analyze malware. Obviously very complicated.
- Running the contract in a local blockchain and test it as a "black box". Does not require you to understand the source code. But testing all the cases is difficult.
Is there a better solution? It seems to me that, without a safe and simple way to check contracts, it will be difficult to convince people to send money.
