Just as poorly written contracts can wind up hurting the parties that use them, poorly coded smart contracts are no different.
The recent failure Distributed Autonomous Organization experiment, which was powered by smart contracts, demonstrated that poorly coded contracts could cost users tens of millions of dollars or more. For those contracts that Wall Street looks to implement, the costs could be staggeringly more.
Writing smart contracts, the computer code that automates various transactions before writing them to the blockchain, is a young discipline that is going through its own growing pains.
Augur, a smart contract based experiment currently in beta, is making sure that the code which eventually will run its distributed Ethereum-based prediction platform, has decided to leverage the National Aeronautics and Space Administration’s and the Motor Industry Software Reliability Association’s expertise in writing secure computer code.
“NASA has done a ton of research on writing code as secure as possible since a crash could cost human lives,” said Joey Krug, co-founder and core developer at Augur.“What they found was that although security audits are helpful, the people who created the code are more likely to find a vulnerability in the system, which makes intuitive sense.”
However, security audits still have a significant role to play and Augur plans to conduct third-party security audits of its code, according to Peronet Deseignes, special operations at Augur.
To help security auditors identify potential vulnerabilities, NASA’s research suggested making the code as easy to understand as possible, added Krug. “It helps the vulnerabilities stick out.”
Another commonly used tactic for securing code is using bug bounties, rewards for discovering and reporting vulnerabilities, which Krug noted that the DAO did not use.
“If they had offered a $10,000 bounty, I think there would have been a greater than 50% chance that someone would have found the vulnerability, he said. “Some academics came close to finding the issue but turned away because they thought since there was so much money involved with the DAO that someone would have found any vulnerabilities. If there was a bounty, they might have spent an additional hour on their analysis and found it.”
If a vulnerability still makes it through to the final code, Krug suggested including the ability to upgrade the smart contract without requiring changes to the underlying blockchain on which it operates.
“If you look at the DAO, they could not upgrade their contract to fix the problem,” he explained. “Instead, they had to have the entire Ethereum network change. If you can upgrade your contracts, it makes it a bit easier to recover from security issues.”
Augur expects to use a portion of the approximately $5.3 million is has raised so far to finish developing its platform and conduct the necessary security audits as well as continuing its legal research and the eventual care and feeding of the platform once it goes into production.
More on Smart Contracts: