4 ms·

The standards only really define what should be done at the interface or what the function inputs and outputs should be, but don't really define the internals o

The standards only really define what should be done at the interface or what the function inputs and outputs should be, but don't really define the internals of the functions. For example inside of a malicious approve function call, you could hardcode a list of popular addresses that also approved those tokens if the msg.sender is holding (balanceOf calls) them and even potentially then have transfer functions calls inside of the approve function call for the malicious token. For me, its only scary if one regularly interacts with tokens they haven't bothered to look up for the source code for. People really shouldn't be interacting with contracts if their first time hearing of it is from looking at who randomly airdropped them a token with a domain name in it. But hey, people regularly do stuff in crypto that i just think "wtf arw the thinking", so w/e.

exo762 5y ago
Both of you are wrong. ZK fundamentally does not allow to hide the rules (the code). It only allows to hide particular executions. So yes, while you can have an ERC20 interface and some censorious garbage inside (I look at you, USDC), you can't hide that fact from observers.
- cinquemb 5y ago
  The issue is that there are people blindly interacting with malicious contracts, which is more of a social problem and not a technical one. There are people now who for example, don't approve random token addrs that they haven't decompiled or which had the source available… i know, shocking… Did you respond to the right chain of comments, none of us mentioned anything related to ZK solutions (chains line mina or rollups or otherwise)?
  - CrazyStat 5y ago
    "It's not safe to use web3 unless you're comfortable analyzing decompiled source code" is a super good sign for the future of the ecosystem.
    - cinquemb 5y ago
      > "It's not safe to use web3 unless you're comfortable analyzing decompiled source code" is a super good sign for the future of the ecosystem. Plenty of people don't de-compile or read the source, don't engage with random tokens credited to their address, and the ecosystem around using "smart" contracts has grown since 2015. Not my problem if people want to use/trust something else (others audits for example) without putting in any work to learn/observe themselves and engage with random stuff. That's their problem, not mine. Some learn better after going through school of hard knocks anyways. As a society, we have expected more and more people to learn how to read and write for basic literacy over hundreds of years. Those who know how to read and write code will have a leg up for that expanding literacy set for engaging with digital things and those who don't will be left behind esp as more aspects of life are governed/mediated through code and this goes beyond the whatever is being branded as "web3". If you don't wanna use it, you are free not to (unless in the case someone hacks your devices from across the world, you don't engage in backups, and the only way to unlock it is to buy some tokens to pay them off; then its just hard choices to make).
      - CrazyStat 5y ago
        > As a society, we have expected more and more people to learn how to read and write for basic literacy over hundreds of years. Those who know how to read and write code will have a leg up for that expanding literacy set for engaging with digital things and those who don't will be left behind esp as more aspects of life are governed/mediated through code and this goes beyond the whatever is being branded as "web3". We have. We've also extended protections for people lagging behind, for example by putting restrictions on what kinds of contracts can legally be entered into and voiding contracts that one party could not have reasonably been expected to understand, or entered into under duress or undue influence. None of these protections exist under "smart" contracts, which is exactly why we can't and won't allow code to govern or mediate life as web3 envisions. Your dystopian vision of "oops, you lost your retirement savings because you didn't decompile that contract before interacting with it, too bad", or "oops, you lost your retirement savings because someone beat your wife with a baseball bat until you handed over your private key, sucks to be you"--in short, the dystopia of "code is law"--flies in the face of thousands of years of jurisprudence and civilization. Once the goldrush hype wears off people will realize how heinous the fundamental idea is and dump it in the gutter of history where it belongs.

exo762 5y ago

Both of you are wrong. ZK fundamentally does not allow to hide the rules (the code). It only allows to hide particular executions. So yes, while you can have an ERC20 interface and some censorious garbage inside (I look at you, USDC), you can't hide that fact from observers.

cinquemb 5y ago
The issue is that there are people blindly interacting with malicious contracts, which is more of a social problem and not a technical one. There are people now who for example, don't approve random token addrs that they haven't decompiled or which had the source available… i know, shocking… Did you respond to the right chain of comments, none of us mentioned anything related to ZK solutions (chains line mina or rollups or otherwise)?
- CrazyStat 5y ago
  "It's not safe to use web3 unless you're comfortable analyzing decompiled source code" is a super good sign for the future of the ecosystem.
  - cinquemb 5y ago
    > "It's not safe to use web3 unless you're comfortable analyzing decompiled source code" is a super good sign for the future of the ecosystem. Plenty of people don't de-compile or read the source, don't engage with random tokens credited to their address, and the ecosystem around using "smart" contracts has grown since 2015. Not my problem if people want to use/trust something else (others audits for example) without putting in any work to learn/observe themselves and engage with random stuff. That's their problem, not mine. Some learn better after going through school of hard knocks anyways. As a society, we have expected more and more people to learn how to read and write for basic literacy over hundreds of years. Those who know how to read and write code will have a leg up for that expanding literacy set for engaging with digital things and those who don't will be left behind esp as more aspects of life are governed/mediated through code and this goes beyond the whatever is being branded as "web3". If you don't wanna use it, you are free not to (unless in the case someone hacks your devices from across the world, you don't engage in backups, and the only way to unlock it is to buy some tokens to pay them off; then its just hard choices to make).
    - CrazyStat 5y ago
      > As a society, we have expected more and more people to learn how to read and write for basic literacy over hundreds of years. Those who know how to read and write code will have a leg up for that expanding literacy set for engaging with digital things and those who don't will be left behind esp as more aspects of life are governed/mediated through code and this goes beyond the whatever is being branded as "web3". We have. We've also extended protections for people lagging behind, for example by putting restrictions on what kinds of contracts can legally be entered into and voiding contracts that one party could not have reasonably been expected to understand, or entered into under duress or undue influence. None of these protections exist under "smart" contracts, which is exactly why we can't and won't allow code to govern or mediate life as web3 envisions. Your dystopian vision of "oops, you lost your retirement savings because you didn't decompile that contract before interacting with it, too bad", or "oops, you lost your retirement savings because someone beat your wife with a baseball bat until you handed over your private key, sucks to be you"--in short, the dystopia of "code is law"--flies in the face of thousands of years of jurisprudence and civilization. Once the goldrush hype wears off people will realize how heinous the fundamental idea is and dump it in the gutter of history where it belongs.