For every problem that smart contracts solve, they seem to introduce another. In a week in which EOS has made news for all the wrong reasons over a RAM vulnerability, a code auditor has revealed the prevalence of smart contract bugs. Security firm Hosho, which has forged a new partnership with community managers Amazix, has found that one in four projects contains critical vulnerabilities.
$1 Billion Is No Guarantee Against Bugs
25% of All Smart Contracts Contain Critical Bugs$1 billion. That's the amount raised by the projects whose smart contracts Hosho has audited. The security company claims to have audited more smart contracts than any other industry player. Despite the significant human and financial resources at their disposal, many of these projects would have been crippled had they neglected to have their code thoroughly scrutinized. A quarter of the projects Hosho has audited were found to have critical bugs, and some 60% of all projects they saw had at least one security issue.
Ethereum, the ICO economy's go-to launchpad, has been the worst affected, with stories abounding of exploitable code that's led to hundreds of millions of dollars of ether being stolen or locked up. While smart contract platforms such as Stratis are pushing the availability of debugging deployment suites and professional decompilers that come with using C#, Ethereum's Turing-complete system leaves greater margin for error. Identifying and eliminating all potential security holes is a Sisyphean task, and one which even experienced Solidity developers struggle with. Enlisting the support of a third party specializing in smart contract audits, while not foolproof, is the best bet against shipping bug-filled code.
Smart Contract Testing as a Service
While it is industry practice to have smart contracts audited ahead of a tokensale, projects that have yet to raise funds may be tempted to cut corners and skimp on this task. Doing so can prove fatal, however, with the worst bugs leading to wallets being drained, or buffer overflow exploits being manipulated to alter account balances. Several Ethereum-based projects have been forced to conduct token swaps after screwing up their first attempt at a smart contract.
In EOS land this week, all energies have been focused on patching a RAM exploit that's recently been detected. It allows a malicious user to "install code on their account which will allow them to insert rows in the name of another account sending them tokens. This lets them lock up RAM by inserting large amounts of garbage into rows when dapps/users send them tokens."
Amazix, the preeminent community management and consultancy firm within the token economy, has now partnered with Hosho to offer its clients smart contract auditing. "In the absence of industry standards, we see smart contract auditing and penetration testing to be essential components of good security in blockchain systems," said Amazix CMO Kenneth Berthelsen. "In our view, there are no better qualified people to do this than Hosho engineers."
Proponents of cryptocurrencies see smart contracts eventually infiltrating everything from insurance to dispute resolution. Before that can happen, developing trust in the code that governs them will be crucial.