[ad_1]
In early September, Gemini Trust, the cryptocurrency firm founded by Cameron and Tyler Winklevoss, announced it had been approved by the United States and was set to be a set of digital tokens linked to the value of the U.S. dollar.
The tokens, called Gemini Dollars, can be heard from the Ethereum blockchain with the help of the specialized programs called smart contracts. To confirm its tokens are actually backed by traditional dollars, Gemini released a report from an independent accounting firm. The company also released a separate audit report, focusing on the underlying software code, from a New York security firm called the Trail of Bits.
"Trail of Bits CEO Dan Guido wrote" The goal of the assessment was to be an attacker to perform only for the issuer, Gemini. " fixed.
For the first time in a series of projects, it will be possible to provide a solution to the security of the market. Smart contracts are specialized programs run by the computers that power blockchains, usually with the power to receive and distribute cryptocurrency or other digital tokens when certain conditions are met. Trips inexperienced programmers.
"Really, coding smart contracts is a whole, different new paradigm," says Mehdi Zerouali, a director at the Sydney blockchain software and cybersecurity firm Sigma Prime.
"There's some bugs that are egregious"
All software can have bugs, but since smart contracts are often the only way to determine who owns valuable cryptographic assets, flaws in their code can be particularly disastrous. And naturally, if they're found, they can be exploited by hackers looking to steal digital funds. Companies have raised more than $ 20 billion through ICOs this year alone, according to the ICO tracking company CoinSchedule.
"There's some bugs that are egregious," Guido tells Fast Company. "If you make them, they are also highly visible to you looking at your smart contract code."
The most famous of these issues was the DAO, standing for distributed autonomous organization. In 2016, hackers used bugs in its code to off about $ 50 million in cryptocurrency, though the Ethereum blockchain itself was later tweaked to return the stolen money.
Since then, security experts have been working to find out what causes smart controls to fail. They are also conducted audits, often released publicly, and can be reassure investors and end users that they will not lose their money to a programming glitch.
Trail of Bits has released a number of open source tools to analyze and test programs in Solidity, the programming language used to craft smart contracts. The standard tools for developing Solidity programs are so popular, they say they can allow bugs to slip through to specialized software, says Guido.
"He says."
When smart contracts fall prey to stupid errors
Smart contracts can fall prey to some of the same types of bugs that can affect other software, like basic arithmetic errors or programmers accidentally reusing the same variable name for multiple values. Can be affected by special classes of errors: limitations on computing power available to blockchain code can be exploited to trigger denial of service Caps on the sizes of certain numbers, back to zero, similar to the infamous Y2K bug. That may be a result of a few pennies or even negative balances being treated as hugely positive.
"Un afefe code can be detected with an automated analysis: without a human intervention," says Petar Tsankov, cofounder and chief scientist of ChainSecurity, a Swiss startup spun out from the prestigious technical university ETH Zurich. ChainSecurity has developed a tool called "Securify", which can quickly become a spot and flag potential issues in Solidify code.
The other phase of a security audit is likely to be seen in the first phase of a security audit.
"Typically, there's a lot of informal documentation on what the contract is supposed to do," says Tsankov.
Then typically comes a mix of human and automated tests to determine if it is possible to get the contract to violate its specifications. Trail of Bits has developed a tool called Echidna that can execute smart contracts with a variety of inputs. When they are found, security testers will flag them for developers and help to make sure they're resolved well before they are deployed on a live, public blockchain.
Security firms generally say their clients are getting better at writing It's a pattern that has been seen before in other corners of the tech industry including the web itself, as Zerouali says.
Crypto startups that at one point only needed audits for the contracts behind their initial coin offerings are now using their ICO revenue to build out more sophisticated offerings. And those include more intricate smart contracts that need to be audited for the bugs of their own, says Tsankov.
"Now, they all start coming back to us," he says. "The level of the complexity is very quickly rising."
[ad_2]Source link
