I haven’t written a blog post about Bitcoin and the blockchain for quite a while, mostly because I spent most of my BTC energies in this First Monday article with Chris Marsden. This blog post will act in part as an introduction to the concepts for those not familiar with the technology, but also it will describe what is going on with the blockchain, particularly the latest multi-million hacking attacks, so apologies in advance for some basic descriptions.
Decentralization and the blockchain
One of the guiding principles of the Internet is decentralization, this pertains to a system “where some decisions by the agents are made without centralized control or processing.” It is often remarked that no one is in charge of internet and everyone is, and while we can argue whether the Web is still decentralized, the fact that there is no absolute central authority making decisions is still a very important element of its reach and robustness.
Centralized v decentralized system
Decentralization is also one of the most basic features of cryptocurrencies such as Bitcoin. Cryptocurrencies are a digital form of transferring value through cryptographic anonymous keys with no central issuing authority. It’s easy to see the potential appeal of such a currency for illegal uses, which is one of the reasons why most transactions for illegal goods and services on the dark net use Bitcoin. These currencies rely on the blockchain, which can be explained as an open decentralized and distributed database that contains a record of all of the transactions undertaken with the cryptocurrency, forming a resilient and tamper-free public ledger. Those participating in the scheme are using processor time to verify transactions, and can be rewarded with currency for their efforts.
While it is clear that Bitcoin has had a bumpy ride during its relatively short existence, the underlying technology of the blockchain has remained as one of the potentially most valuable features of the first cryptocurrency. The potential for having an open and tamper-proof record of financial transactions is evidently appealing to many institutions, with several banks becoming interested in the technology. Just yesterday, a group of seven banks claimed to have successfully moved real money across borders using blockchain-based technology.
Ethereum and DAO
Of all the blockchain projects, one has risen in the last few months as the most promising, and this is Ethereum. This project was created with the idea of using blockhain capabilities to conduct smart contracts. Imagine the features of the public ledger used to verify contracts instead of currency transactions. Because it is a platform, it allows developers to create their own applications that use the Ethereum blockchain, while this is a crude analogy, one can think of Ethereum as an operating system that allows third party apps, something akin to iOS or Android, but it is also highly decentralized in its operation because it relies on the people using the blockchain and mining value in the shape of ether. Here’s an excellent example of the potential uses of Ethereum:
“Let’s say that we want to organize a small conference. We need 100 people to sign up and pay/deposit money, so we can rent a hotel and such. But if not enough people sign up by a certain date, then the deposits need to be refunded. With Ethereum, we can write in a JavaScript-like language to code up this contract. It’ll guarantee that everyone will get a ticket to the conference, or everyone will get their money refunded, depending on how many sign up.”
Ethereum rose to prominence quickly because of its capabilities as a development platform, and various applications arose to take advantage of its potential for smart contracts. IBM has started developing an application called ADEPT, which will power Internet of Things transactions. Augur will use Ethereum’s blockchain as a predictive tool by allowing people to trade on virtual shares in the outcome of future events.
But of all of the potential applications, the one that attracted most interest (and funding) was the DAO, the Decentralized Autonomous Organization. As the name indicates, the objective of this application is to use smart contracts to help in the operation of decentralized organizational governance, in their words, it “leverages smart contracts on the Ethereum blockchain so that anyone, anywhere in the world can be empowered to participate.”
Imagine that you have a startup that wants to hire help quickly and efficiently in order to scale operations. Currently, you have to negotiate with each contractor individually, and this takes time and money. With the DAO, you would pay ether (ETH, the Ethereum currency) into the DAO, and at the same time you set terms and conditions of what you want the contractors to do, while the ETH is held securely. The contractors participating in the DAO define the parameters of their contract in code (business model, payment, operational parameters), if the contractor code meets the DAO code, then there is an autonomous smart contract formed, upon completion of which the DAO releases payment.
It is the potential to make contract formation easy what propelled Ethereum as one of the hottest cryptocurrencies in the world, and the DAO as its most popular application. One of the interesting features of the DAO is its centralized governance structure. Those who support the DAO receive voting rights in the shape of DAO tokens, as well as possible dividends in the shape of ether. The DAO is ruled by the voting performed by those participating in the system, making it a completely decentralized governance model.
Problems with decentralization
So far so good, but while it is easy to see why the decentralized model could be appealing, developers quickly learned that smart contracts are as smart as the people who draft them, and small mistakes can have nefarious consequences down the line.
As described above, the DAO operates as a public pool of funds holding several million of dollars worth in ether, and only those participating in the scheme or those completing contracts can withdraw funds according to the pre-established terms of their participation. Using the pool analogy, you can imagine several hoses being fed by the pool, each with a tap that opens and closes using pre-defined conditions. But there was a bug in the code that allowed malicious participants to call recursive functions upon the closing of a transaction that allowed the tap to remain open, and in theory it would let them drain the entire pool. Hackers exploited the bug, and were able to drain millions from the DAO (approximately 3.6m ETH according to reports).
Here is where decentralization proved to be a serious problem. Because the DAO is fully decentralized, there was no way in which a central authority could stop the hack other than re-writing the underlying code. Ether can be traded for “real” money in exchanges, and the attack meant a severe drop in the price of ETH, so many exchanges stopped trading. Ethereum’s creator, Vitalik Buterin, wrote a blog post in which he urged miners and developers to stay calm, and most importantly, asked exchanges to resume trading in ETH. But to me the most interesting part of the blog post was when he assured that there would be a fork in the software to fix the bug, but then said “wait for the soft fork code and stand ready to download and run it if they agree with this path forward for the Ethereum ecosystem.” This is very indicative of the strengths and weaknesses of the decentralized system, as even the creator of Ethereum did not have the power to enable a change in the code without the permission of those participating in the scheme! So the issue of the fork, pretty much the plugging of the hole, the fixing of the bug, became a political issue because it would be a centralized action in a decentralized environment. As explained here:
“One solution is to roll-back the blockchain before the theft. Of course, that means screwing over everybody who made a transaction since then. You’d be screwing people out of $1 million in order to compensate the theft of $100 million. This is, of course, the type of corrupt thinking that gets us into banking failures in the real world, as we screw over everyone else in order to protect those banks who are too big to fail.”
The Ethereum development environment is filled with anarchists, libertarians and crypto-anarchists that see such centralized decision-making as anathema to the very ethos of the blockchain. So a number of developers got together and conducted a white hat attack on the DAO to remove funds and place it in secure location to keep it from the black hat hackers, they managed to remove over 7 million ETH from the pool. But right after, the hackers were able to use the same vulnerabilities to drain the protected funds. Moreover, the hackers released a statement mocking the DAO by claiming that their actions are entirely legal because they are “making use of this explicitly coded feature as per the smart contract terms”.
This brings us to another interesting aspect of the DAO exploit. Most people have been using the words “theft” to describe it, but the hacker’s words are quite interesting in this respect. Is this really a hack, or is it a feature of the smart contract? As this interesting article explains:
“However, according to the DAO’s own legal contract, there is no such thing as theft and the intent is completely unimportant — the only important and relevant thing are the smart contracts themselves. Consequently, there is no real legal difference between a feature and an exploit. It is all a matter of perspective.”
So the problem is that rules are set in code which cannot be changed quickly because of the decentralized nature of the system when they have been found to include a mistake. In an excellent analysis of the DAO hack, Matt Levine points out that “the words ‘hack’ and ‘theft’ make human, normative presumptions about how you’re supposed to use the DAO code. the code doesn’t care. The code can’t be ‘hacked’. It can only be used”. He continues to comment that the legal system has “pleasantly redundant system of safeguards so that investors usually get more or less what they expect.” While some see Ethereum and the DAO as the end of lawyers, we are witnessing the reason why traditional laws are still useful, in case something goes horribly wrong, you can sue. It is unlikely that the DAO hack will be even prosecuted in court, even if it involves millions of dollars.
Centralized decentralization?
So should we forego decentralization altogether? Is Ethereum doomed? I do not think so, but those who have been singing the praises of the blockchain should take a step back and look at the reasons for using distributed ledgers in the first place. The inimitable Sarah Jeong joked on Twitter: “dystopian short story where everything got put on a blockchain and now it takes 3 hours to start up a car”. The reason to use blockchains should not cause things to become slower, less secure and more expensive, even if the idea of using the latest buzzword technology may be tempting.
What appears more likely to happen is that the successful blockchain implementations won’t be fully decentralized. As mentioned earlier, a group of banks have claimed to have successfully used blockchain technology to distribute money across borders. This scheme is using a very specific type of blockchain called Ripple, which has been created with financial institutions in mind. While it uses many of the features of other blockchains, it is clear that not everyone can participate. While Ripple is a decentralized network that requires no central operator, only participants can make transactions, making it more secure than open and fully decentralized systems. Third parties can connect to the network, but only through APIs, providing a one-way interface that cannot make changes to the system, maintaining the validity and security of the transactions.
Concluding
So at least for now, more centralized blockchains seem to be the way forward for businesses. I am not claiming that open and fully decentralized Ethereum-like blockchains have no future, but developers will have to think harder about security, scalability and the potential to fix problems when something inevitably goes wrong.
0 Comments