0

I reviewed lots of contracts on etherscan and I have noticed lots of them are without published Solidity code. In my opinion there is no point of using/publishing a contract without the Solidity code, it breaks the whole concept of Smart Contracts. If one can not verify the Solidity code of Smart Contract he is interacting it, what's even the point of using Ethereum then ? Do you think it should be obligatory in some way to publish the associated code ? I know one can decompile the bytecode to assembler like commands, but uhhh it should be more transparent right ? I believe on the etherscan.io the published solidity code is not stored in the ethereum blockchain, but only in some interlan etherscan.io database. I know it would take a lot of space in the ethereum blockchain to store the Solidity code....

closed as unclear what you're asking by Achala Dissanayake, mirg, flygoing, Linmao Song, Richard Horrocks May 10 '18 at 7:22

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • Standards are very important for this reason, but also why lots of people have a distaste for smart contracts; they can get messy. In theory, a programmer could go and change some piece of contract code and the user wouldn't know (assuming the contract is modifiable). Users need incentive to interact with the contract in the first place and an established and trusted partnership. I would hope that the party interacting at least has access to abi. Then, that party should, at a minimum, understand each interaction. A contract blockchain sounds heavy. – blockstreetboi89 May 8 '18 at 18:58
4

Well...conceptually, just like real life, you should not accept or interact with a contract that you cannot read.

With that said, there are plenty of contracts out there that are not meant to be read by the general public. For example, If I wanted to write a contract specifically between you and me, there should be no obligation to publish the associated code to the general public. I would send you the code directly to review and it'd be up to you to use some sort of verification tool to review the code.

The smart contract sole purpose is to make sure every interaction/transaction with it is honored...not to verify the parameters set within the contract.

0

I agree with @reyHaynes.

Additionally, I would take exception to the idea that there's no point unless there's source code.

The harsh reality is that the EVM is going to run bytecode according to its machine logic idea of what "correct" looks like. The compiler itself can be a source of errors. Regardless of where it came from, the bytecode is what matters. Not all contracts are meant for all observers.

True, if someone wishes to earn the trust of others, then one way to do that is to publish the source code so we can understand it more easily.

If we're not meant to see and understand, hiding source is ineffective. It merely inconveniences a determined adversary.

Hope it helps.

0

While the other answers are correct in that in general there is not necessarily an obligation to publish source code for a contract not meant to be used by the general public, the more fundamental reason why there is no protocol-level requirement to publish source code is that this would require a protocol-level specification for the high level language.

The EVM is a language-agnostic machine. I can write code in Solidity, Serpent, LLL, pure assembly, etc. and all will work fine. Requiring source code means requiring everyone to use not only the same language but the same compiler version as well, making updates to the high level language very difficult.

Essentially, Solidity as a language changes very frequently, EVM changes very infrequently and so it makes far more sense to simply publish the machine code and let the developer publish source code out-of-band.

0

There are many smart contract applications of which the code should definitely NOT be made available to the public (i.e. those who are not associated with the contract). For example, imagine a contract where you can send your ERC20 tokens to and the only way you can withdraw those tokens is with a password, but it can be done from any address. This way you would not have to worry about losing your private key or anything because your tokens are locked in a contract. Would you want the code to be public so hackers can try and exploit potential vulnerabilities in the code to steal your tokens? No need to answer that question as it is rhetorical and I'm sure you get the point of this answer to your question.

Having said that, I do think it is important that smart contracts which communities of people participate in such as ICOs, ERC20 tokens, gambling applications and games should be made public.

  • If a hacker really wants to steal some ether from contract, he could decompile the contract, analyze it, and still steal your funds. Without the Solidity code it would be more time consuming, but still it is doable. It would be only a matter of time to attack it, this isn't any security shield. It's like using http instead of https, but one would encrypt the traffic for example with with base64... Not publishing any Solidity code with given deployed contract is NOT any additional security shield, it just does make this contract longer to break... – friko May 9 '18 at 11:20

Not the answer you're looking for? Browse other questions tagged or ask your own question.