Since assert corresponds to conditions that must never happen if the smart-contract code is correct my intuition tells me that someone calling an smart-contract that raises an assert must never be "punished" with gas expenditure since caller was not to fault. (Maybe nodes ought to black-list smart-contracts raising asserts and/or a mechanism be in place to allow to redirect new version/patched contracts with no assert).

On the opposite require corresponds to checks on the input data to functions, so my intuition tells me that invocation with incorrect data ought to be punished.

I think there is something I do NOT understand, or I just completely misunderstood the original intention of assert vs require.

  • Could you elaborate on "Also, as I see it, an Ethereum attacker aware of code that evaluates to false for a require for a range of input values, can easily prepare sort-of DoS"? What form would such a DoS attack take? Who would benefit and who would be hurt? – user19510 Jun 11 '18 at 14:24
  • @smarx I'll just removed this part, to make my original post more specific – earizon Jun 11 '18 at 16:26

A failed transaction always costs the sender gas. If it didn't, anyone could mount a denial of service attack against the network by submitting a lot of failing transactions for free.

The difference between assert and require is in how much gas is consumed. assert (or throw) consumes the remainder of the gas limit set in the transaction, while require (or revert) only consumes the amount of gas already used.

As to when to use which: require is always friendlier in terms of gas consumption. I have not seen a compelling reason to use assert.

The (weak) argument I've seen is that it's nice to differentiate between things that are expected to happen versus things that aren't so static code analysis can help prove that it's impossible to reach asserts (but not requires) in the code. And if the asserts are truly unreachable, there's no downside to the extra gas consumption.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.