6

Is it possible to just copy someone else's smart contract? Say if someone has a profitable smart contract, what stops someone from just copying it to get a piece of the profit pie?

5

Yes, it is possible to just copy the code of a smart contract, and, perhaps to replace the beneficiary address. However, this might not necessarily be a big problem for the original developer, because, all things equal, educated users would always prefer an instance of the contract with someone being able to 'look after' it, e.g. fix issues, introduce new functionality, etc.

  • I agree that it should be possible to do this. But I'm curious how you'd accomplish it (say, using web3). – redsquirrel May 2 '16 at 14:27
3

Can you copy or fork someone else's smart contract?

Yes you can, technically. The bytecode (compiled contract) for every contract on the network is public, and anyone can deploy the same bytecode. The issue with this is that it's much harder to deal with bytecode than actual solidity/serpent/lll/etc code. You're going to have an extremely hard time changing or adding anything even mildly signifigant in the code. It is possible to for example, change the payout address of a contract, or a fee percentage, etc, but to do much beyond that is very difficult.

Is it open source code?

It's only open source if you post it publicly. Unless you do that only the bytecode is accessible.

1

Yes you could copy someone else's contract.

By a similar token though - Could you buy Microsoft software and strip out the part that does the verification of an authentic copy? Yes, you probably could. What's to stop people from doing that? Laws and end user licensing agreements. The risk of jail time or fines also discourages people from doing this. The complexity of disassembling binaries also discourages this.

I'm sure we will see "contract pirates" but maybe not in such great numbers as you might think. People tend to be ethical and prefer the easiest and official routes.

Say if someone has a profitable smart contract, what stops someone from just copying it to get a piece of the profit pie?

To try and prevent people from pirating your contract: You might construct the address for a call to .send() in parts or using a formula. (Where the result would be your ether address.) This might be used when an author sends a percentage reward to themselves. (But - given enough time and motivation, someone can reverse engineer anything.) Here is an example of that:

Done poorly:

contract SampleObfuscateReward {
    address public sendToAuthor;
    //Send the below function 5 ether
    function doSomethingUseful() {
        //Do something useful here with 90% of the 5 ether sent
        //...

        //For the other 0.50 ether, we'll send that back to the
        //contract author as a reward
        //The author's real address is 0xea3bdf18219227ab1bce7cf6b7fc366bdc2c59a8
        sendToAuthor = 0xea3bdf18219227ab1bce7cf6b7fc366bdc2c59a8;
        sendToAuthor.send(500000000000000000); //0.5 ether
    }
}

The resulting compiled code for the above becomes: (notice how the destination address is clearly visible and easily changed)

tag 5           function doSomethingUseful() {...
  JUMPDEST          function doSomethingUseful() {...
  PUSH EA3BDF18219227AB1BCE7CF6B7FC366BDC2C59A8     

Done better: (But further obfuscation can be done to make it even harder.)

contract SampleObfuscateReward {
    address public sendToAuthor;
    uint160 public testAddr;
    //Send the below function 5 ether
    function doSomethingUseful() {
        //Do something useful here with 90% of the 5 ether sent
        //...

        //For the other 0.50 ether, we'll send that back to the
        //contract author as a reward
        //The author's real address is 0xea3bdf18219227ab1bce7cf6b7fc366bdc2c59a8
        testAddr = 159411313365775918960571289062500000000000;
        testAddr = testAddr * 8388608;
        sendToAuthor = testAddr;
        //sendToAuthor is now 0xea3bdf18219227ab1bce7cf6b7fc366bdc2c59a8
        sendToAuthor.send(500000000000000000); //0.5 ether
    }
}

If you look through the compiled code, the address we're sending to does not appear there. The only thing that looks close to an address is:

tag 6           function doSomethingUseful() {...
  JUMPDEST          function doSomethingUseful() {...
  PUSH 1D477BE304324547AC327C5D072106EE800          

Be careful of using Solidity --optimize, it will undo all of this work and simplify static constants like this.

  • 1
    that microsoft analogy totally makes no sense. and try to be more rational while generating content on stackexchange. – Afr Feb 2 '16 at 1:01
  • @5chdn I've modified it slightly, I hope its clearer what I was trying to communicate. – linagee Feb 2 '16 at 5:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.