Smart Contract Security - Incentives Beyond the Launch

31. říjen 2018

Řečníci

O prezentaci

To mitigate security issues that were quickly evident in the deployment of smart contracts, developers have tried a wide variety of security techniques. Standard when deploying new contracts is manual review by an externally contracted company/individual, often with verification tools. In many ways this has been a success, reducing observed security incidents. In this talk, we take a look at how unique incentives in smart contracts affect the process of securing them. Smart contracts are often non-upgradeable: enshrinement at release encourages security processes that end after a contract is deployed, leaving blind spots in long-term security guarantees against evolving threats. Pressure to ship often leaves critical guarantees out-of-scope of external reviews, and auditor incentives discourage detailed, fundamental criticisms of contracts' protocols. We explore flawed mechanisms whose obvious security flaws cost users millions today, even though such flaws are often out of launch audit scope. We empirically quantify the size of this problem, highlighting major issues with all smart contract voting and all decentralized exchange protocols. We conclude by exploring systemic risk, discussing mechanisms whose flaws could one day go beyond affecting their users to threaten the stability of all dapps. We conclude with lessons learned for security conscious dapp developers.

Organizátor

Kategorie

O organizátorovi (Ethereum)

Next generation programming platform for decentralized applications.

Uložení prezentace

Měla by být tato prezentace uložena po dobu 1000 let?

Jak ukládáme prezentace

Pro uložení prezentace do věčného trezoru hlasovalo 0 diváků, což je 0.0 %

Sdílení

Doporučená videa

Prezentace na podobné téma, kategorii nebo přednášejícího

Zajímají Vás podobná videa? Sledujte Ethereum