O
Obyte
Guest
The term "smart contract" sounds quite sophisticated in itself. We might even be led to believe that it’s something so "smart" that it cannot make mistakes, unlike humans. Yet, ultimately, it’s nothing more, and nothing less, than a very human invention. Smart contracts can make dumb mistakes—and they have, time and time again.
Let’s remember that a smart contract is a computer program stored on a crypto network that automatically carries out rules when certain conditions are met. Someone made it. That someone is often a human developer, who can make mistakes, especially if the programming language is particularly difficult.
So, a smart contract isn’t that “smart.” It’s just a little machine that follows instructions, whether those instructions lead to the intended result or send everyone down a rather unfortunate rabbit hole.
We can explain this by imagining a physical vending machine. You want a snack, you pay, press a button, and voilá. Now, there’s an engineer behind that vending machine, so in another world, that engineer was sleep-deprived and messed up a small calculation while building one of the parts. That little error now causes your snack to get stuck before coming out. There’s no easy way to fix that, if any. It’s the same with smart contracts.
They’re complex (and immutable) pieces of code. Complex pieces of code are prone to include bugs and execute those bugs with impressive consistency. A common problem is faulty business logic: when an instruction seems good in theory, but fails in practice. It can be a flawed reward calculation or a rule that allows someone to extract more value than intended, for instance.
Access control can be another issue. In this case, a smart contract gives unauthorized access to sensitive functions. In 2017, for instance, an unauthorized developer was able to access and own a shared library in the Parity Wallet. They panicked, deleted the library, and that resulted in over $280 million in ETH still frozen to date. Oops.
Another type of potential vulnerability is reentrancy, where a contract is ‘called’ again before it finishes updating its state (and its actual balance). The infamous 2016 DAO hacker used this bug to unexpectedly withdraw 3.6 million in ETH from that smart contract. This even led to the creation of Ethereum Classic (ETC).
A third risk comes from oracle manipulation. An oracle offers external information to a smart contract (i.e., sports results and prices), and its manipulation could be catastrophic. This way, a smart contract, while being perfectly correct itself, would rely on incorrect or manipulated outside data and may execute its rules while acting on bad information.
You don’t need to be an expert developer to avoid these ‘dumb’ mistakes or to use a simple Dapp from your wallet, but there are some things you’ll need to check first. It’s important to Do Your Own Research (DYOR), always.
Start with the official website and social media accounts of the project or network you want to interact with, and go from there. Check their team, their documentation (there should be a whitepaper, even if you don't understand it), and their reputation.
Security audits of their smart contracts should be available. In these audits, external teams of experts check the smart contract code carefully and give their approval, so you don't need to read all that code. They prepare a report with their findings and recommendations. However, they're still human. This doesn't guarantee that the smart contract is 100% safe, but hey, is a great indicator.
Furthermore, more recently, the latest AI tool models—such as Mythos and EVMBench—have been able to detect bugs much faster than human developers. This ensures greater security for smart contracts in the future.
A bug bounty program in place is also a green flag. Obyte, for instance, offers up to $50,000 as a reward through Immunefi for finding critical threats on its network and contracts. Besides, human-readable smart contracts in the Obyte wallet are less prone to errors, and a preview of the transaction results is provided for each interaction with a DApp.
Well, nothing is perfect, but smart contracts try. A large number of them are constantly audited and reviewed by their own open-source developer communities, so ‘dumb’ errors will increasingly diminish over time.
Let’s remember that a smart contract is a computer program stored on a crypto network that automatically carries out rules when certain conditions are met. Someone made it. That someone is often a human developer, who can make mistakes, especially if the programming language is particularly difficult.
So, a smart contract isn’t that “smart.” It’s just a little machine that follows instructions, whether those instructions lead to the intended result or send everyone down a rather unfortunate rabbit hole.
When “Smart” Code Gets Things Wrong
We can explain this by imagining a physical vending machine. You want a snack, you pay, press a button, and voilá. Now, there’s an engineer behind that vending machine, so in another world, that engineer was sleep-deprived and messed up a small calculation while building one of the parts. That little error now causes your snack to get stuck before coming out. There’s no easy way to fix that, if any. It’s the same with smart contracts.
They’re complex (and immutable) pieces of code. Complex pieces of code are prone to include bugs and execute those bugs with impressive consistency. A common problem is faulty business logic: when an instruction seems good in theory, but fails in practice. It can be a flawed reward calculation or a rule that allows someone to extract more value than intended, for instance.
Another type of potential vulnerability is reentrancy, where a contract is ‘called’ again before it finishes updating its state (and its actual balance). The infamous 2016 DAO hacker used this bug to unexpectedly withdraw 3.6 million in ETH from that smart contract. This even led to the creation of Ethereum Classic (ETC).
A third risk comes from oracle manipulation. An oracle offers external information to a smart contract (i.e., sports results and prices), and its manipulation could be catastrophic. This way, a smart contract, while being perfectly correct itself, would rely on incorrect or manipulated outside data and may execute its rules while acting on bad information.
What Can Users Do to Avoid Faulty Smart Contracts?
You don’t need to be an expert developer to avoid these ‘dumb’ mistakes or to use a simple Dapp from your wallet, but there are some things you’ll need to check first. It’s important to Do Your Own Research (DYOR), always.
Start with the official website and social media accounts of the project or network you want to interact with, and go from there. Check their team, their documentation (there should be a whitepaper, even if you don't understand it), and their reputation.
Security audits of their smart contracts should be available. In these audits, external teams of experts check the smart contract code carefully and give their approval, so you don't need to read all that code. They prepare a report with their findings and recommendations. However, they're still human. This doesn't guarantee that the smart contract is 100% safe, but hey, is a great indicator.
Furthermore, more recently, the latest AI tool models—such as Mythos and EVMBench—have been able to detect bugs much faster than human developers. This ensures greater security for smart contracts in the future.
A bug bounty program in place is also a green flag. Obyte, for instance, offers up to $50,000 as a reward through Immunefi for finding critical threats on its network and contracts. Besides, human-readable smart contracts in the Obyte wallet are less prone to errors, and a preview of the transaction results is provided for each interaction with a DApp.