6 ms·
What language are the contracts written in? Do you have a specification of that language? EDIT: Nevermind, I see in an another comment that you're using Solidi
by seagreen 10y ago
What language are the contracts written in? Do you have a specification of that language?
EDIT: Nevermind, I see in an another comment that you're using Solidity. Thanks for the answer!
Now I have a new question. What do you think about the claim that, "Solidity, while being an interesting proof of concept, is dangerously under-contained and very difficult to analyze statically." (http://www.stephendiehl.com/posts/smart_contracts.html http://www.stephendiehl.com/posts/smart_contracts.html)
- izqui 10y agoSolidity http://solidity.readthedocs.io http://solidity.readthedocs.io
- izqui 10y agoI think that Solidity is quickly getting ready for prime time and in 2017 we will see tons of very big and high stake projects getting deployed. That being said, there are already projects like http://rouleth.com http://rouleth.com that has been managing an over $100k bankroll with no issues for 8 months now. To sum up, if the needed security measures are taken, you should be good. And we won't be encouraging anyone to run a company with Aragon in production for the next months until proper security audits have been done.
- seagreen 10y agoPlease consider trying to get off of Solidity at some point. It doesn't matter how much auditing is done, if you're building on a shaky foundation mistakes will eventually slip through. Solidity is definitely a shaky foundation. I really admire projects like yours for their daring, but that needs to be backed up with hard engineering work. I would hate to see smart contracts go down the path of the "Internet of things" -- finally succeeding only to cause more harm than good due to compounding security vulnerabilities.
- semiel 10y agoSolidity is not an ideal language, but I also think that the ~deep concern~ everyone has about it is overblown. C is a pretty problematic language too, but plenty of reliable software is built in it. Engineering and testing practices are more important than bikeshedding the language itself.
- seagreen 10y agoA flagship Solidity product has already been pwned for $50 million dollars, leading to a hard fork of Etherium. This is not fake "~deep concern~", this is a real problem.
- semiel 10y agoIt was a badly designed app written by a couple of over-eager developers who didn't have any security plan in place. If you blamed the language every time a website got hacked, there wouldn't be any languages left.
- DennisP 10y agoDisclaimer: I write and audit Solidity for a living. The max-callstack issue isn't a problem anymore due to a change in the EVM. TheDAO was hit with a reentrant call. It's pretty easy to avoid that class of bugs by either (1) putting any external calls (including ether transfers) after all state changes, or (2) using address.send instead of address.call.value. Also, TheDAO was a very convoluted contract; better coding practices help a lot. Any contract that's at all hard to understand is a huge red flag for me. Solidity may not be a perfect language but it's rapidly improving, statically typed, and has a set of best practices which are fairly well known at this point. The current alternatives aren't nearly as well tested or reviewed, and don't have clear advantages anyway. There are various experimental projects for more advanced functional-style languages but they're not ready yet. There's also someone at the Foundation working full-time on formal proof systems.
- monkmartinez 10y agoAre you paid in Eth or some other form of currency?
- DennisP 10y agoI'm paid a salary in fiat but the company I work for prefers payment in ETH, with Bitcoin its second choice, and our clients are generally happy with that.
- seagreen 10y agoThanks for the info. Glad this stuff is being taken seriously by the core part of the community.