Skip to Content
Blockchain

Ethereum’s smart contracts are full of holes

Blockchain-powered computer programs promise to revolutionize the digital economy, but new research suggests they’re far from secure.
March 1, 2018
Lynne Carty

Computer programs that run on blockchains are shaking up the financial system. But much of the hype around what are called smart contracts is just that. It’s a brand-new field. Technologists are just beginning to figure out how to design them so they can be relied on not to lose people’s money, and—as a new survey of Ethereum smart contracts illustrates—security researchers are only now coming to terms with what a smart-contract vulnerability even looks like.

This piece appears in our twice-weekly newsletter Chain Letter, which covers the world of blockchain and cryptocurrencies. Sign up hereit’s free!

Digital vending machines: The term “smart contract” comes from digital currency pioneer Nick Szabo, who coined it more than 20 years ago (and who may or may not be Satoshi Nakamoto). The basic idea, he wrote, is that “many kinds of contractual clauses (such as collateral, bonding, delineation of property rights, etc.) can be embedded in the hardware and software we deal with, in such a way as to make a breach of contract expensive (if desired, sometimes prohibitively so) for the breacher.” Szabo called physical vending machines a “primitive ancestor of smart contracts,” since they take coins and dispense a product and the correct change according to the displayed price.

Enter the blockchain: Today, the most common conception of a smart contract is a computer program stored on a blockchain. A blockchain is essentially a shared accounting ledger that uses cryptography and a network of computers to track assets and secure the ledger from tampering. For Bitcoin, that gives two parties who don’t know each other an ironclad guarantee that an agreed upon transfer of funds will happen as expected—that is, no one will get cheated.

Smart contracts are where things get interesting. Using a smart contract, two people could create a system that withdraws funds from one person’s account—a parent’s, let’s say—and deposits them into a child’s account if and when the child’s balance falls below a certain level. And that’s just the simplest example—in theory, smart contracts can be used to program all kinds of financial agreements, from derivatives contracts to auctions to blockchain-powered escrow accounts.

ICOs everywhere: One of the most popular applications of smart contracts has been to create new cryptocurrencies. A few of them have provided glimpses of a new kind of economy in which a purpose-made digital currency  can be used for a “decentralized” service, like data storage or digital currency trading. Investor excitement over the promise of such applications has helped fuel the ICO craze, which has raised over $5 billion. (What the hell is an ICO? ← Here’s a primer)

But hold your horses: Technologists still don’t have a full picture of what a security hole in a smart contract looks like, says Ilya Sergey, a computer scientist at University College London, who coauthored a study on the topic published last week.

Users learned this the hard way in 2016 when a hacker stole $50 million from the so-called Decentralized Autonomous Organization, which was based on the Ethereum blockchain. And in November around $150 million suddenly became inaccessible to users of the wallet service Parity, which is also rooted in Ethereum.

Sergey and colleagues used a novel tool to analyze a sample of nearly one million Ethereum smart contracts, flagging around 34,000 as vulnerable—including the one that led to the Parity mishap. Sergey compares the team’s work to interacting with a vending machine, as though the researchers randomly pushed buttons and recorded the conditions that made the machine act in unintended ways. “I believe that a large number of vulnerabilities are still to be discovered and formally specified,” Sergey says.

Keep Reading

Most Popular

Scientists are finding signals of long covid in blood. They could lead to new treatments.

Faults in a certain part of the immune system might be at the root of some long covid cases, new research suggests.

Large language models can do jaw-dropping things. But nobody knows exactly why.

And that's a problem. Figuring it out is one of the biggest scientific puzzles of our time and a crucial step towards controlling more powerful future models.

OpenAI teases an amazing new generative video model called Sora

The firm is sharing Sora with a small group of safety testers but the rest of us will have to wait to learn more.

Google’s Gemini is now in everything. Here’s how you can try it out.

Gmail, Docs, and more will now come with Gemini baked in. But Europeans will have to wait before they can download the app.

Stay connected

Illustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.