Is it safe for the hosting node to run smart contract? What if someone writes a malicious contract and try to give instructions the hosting node?
Can smart contracts trust hosting nodes? Hosting nodes will have full visibility on what is happening during runtime. Can smart contracts safely handle sensitive information?
Is there "sandboxing" around Solidity to prevent this kind of malicious interference?
- Smart contracts run in a VM called the Ethereum Virtual Machine (EVM). Unless there are exploitable bugs in the implementation of the EVM, code running in there can't break out and do malicious things. Bugs like that are possible, but the EVM is not very complex, so bugs like this are unlikely. Note that smart contracts aren't necessary for there to be this sort of bug. A client written in C++ could store transaction data in too small a buffer and have a buffer overflow. Any normal transaction could then trigger it.
- Everything on the blockchain is fully public to anyone. So no, contracts can't handle "sensitive" (if that means "secret") information.
- The EVM is a sandbox.