3 ms·

Over time, there will be old smart contract code that is trusted because it has been used for so long, and there will be new code that is less trusted because i

Over time, there will be old smart contract code that is trusted because it has been used for so long, and there will be new code that is less trusted because it is new. Time will ensure that smart contract code that is flawed will be discarded and forgotten, or blacklisted, so it will be safe to assume that any old code that is still popular is trustworthy. Time will also ensure that popular code is well understood by experts who would be in a position to detect and understand any problems in the code. The problem of buggy software will continue to exist for new smart contracts that are introduced and manage to capture value quickly, but as the ecosystem matures and more niches are filled, new code will be less likely to attract large numbers of users, so the scope and impact of any bugs in that code will be much less. Eventually an equilibrium will be reached whereby survival of the fittest ensures that the smart contracts most people rely upon can be trusted. Effectively, some smart contracts will build brand value, and people will be able to rely on the reputations of these smart contracts. Some people may take a risk on a new smart contract and loose (or win), but most people who follow the heard will not have a problem.

GhostVII 5y ago
The problem is that it is totally possible for there to be a hidden bug in an old smart contract that everyone trusts. And only a single bug like that can destroy the entire ecosystem. It's not enough for trusted smart contracts to be less buggy, they have to be so secure that they don't have any bugs ever
- legutierr 5y ago
  Yes, the process I described above would not be sufficient to ensure that smart contracts are perfectly safe, with zero exceptions ever. It is also important that scrutiny be applied to these protocols, and I imagine that at some point DeFi protocols may be be subject to regulator audit and approval before they are opened up and made available for use by retail customers. If the right people pay enough attention to the implementation of these protocols, then it should be possible to trust them. Also, if you yourself are risking significant funds, it wouldn't be a bad idea to personally review and understand the smart contract code. That being said, over extended periods of time (decades), long-lived smart contracts will tend to be safer, and insecure smart contracts will tend to be identified as such. If enough value is at risk, and if enough time has passed, then it is extremely unlikely that an exploitable bug will exist that has not already been exploited. Keep in mind that as a general rule smart contract implementations are immutable, so any bug that exists within a protocol is typically a bug introduced to the protocol when it is first deployed. There are never any "new" bugs that are introduced to an existing smart contract; if a bug emerges after a long period of time has passed, it is a bug that existed at the beginning but had not been previously identified. At a certain point the passage of time will have reduced this risk below a tolerable threshold that is more than outweighed by the value that people get from using the software. So in practical terms, in the aggregate, such long-lived systems could reasonably be treated as secure.

GhostVII 5y ago

The problem is that it is totally possible for there to be a hidden bug in an old smart contract that everyone trusts. And only a single bug like that can destroy the entire ecosystem. It's not enough for trusted smart contracts to be less buggy, they have to be so secure that they don't have any bugs ever

legutierr 5y ago
Yes, the process I described above would not be sufficient to ensure that smart contracts are perfectly safe, with zero exceptions ever. It is also important that scrutiny be applied to these protocols, and I imagine that at some point DeFi protocols may be be subject to regulator audit and approval before they are opened up and made available for use by retail customers. If the right people pay enough attention to the implementation of these protocols, then it should be possible to trust them. Also, if you yourself are risking significant funds, it wouldn't be a bad idea to personally review and understand the smart contract code. That being said, over extended periods of time (decades), long-lived smart contracts will tend to be safer, and insecure smart contracts will tend to be identified as such. If enough value is at risk, and if enough time has passed, then it is extremely unlikely that an exploitable bug will exist that has not already been exploited. Keep in mind that as a general rule smart contract implementations are immutable, so any bug that exists within a protocol is typically a bug introduced to the protocol when it is first deployed. There are never any "new" bugs that are introduced to an existing smart contract; if a bug emerges after a long period of time has passed, it is a bug that existed at the beginning but had not been previously identified. At a certain point the passage of time will have reduced this risk below a tolerable threshold that is more than outweighed by the value that people get from using the software. So in practical terms, in the aggregate, such long-lived systems could reasonably be treated as secure.