Why the smart-contract audit doesn’t work?

The market of smart-contracts has been growing since 2017 and the growth will continue in the future with the industry development and the Ethereum blockchain in particular.

Since its inception, over 1.7 million smart contracts have been created on the Ethereum blockchain by over 66 thousands of unique developer addresses. Of the 1.7 million contracts created, over 500K are “active” contracts that have had “traffic” in the form of transactions.

Smart-contracts are used for many purposes: ICO, DAPPs, investment funds, decentralized exchanges.

The most important task in developing smart-contracts is to ensure a high level of protection and code quality. Otherwise, you may suffer significant losses, as was the case with some organizations in the past.

Nobody protects user’s assets! Nobody held materially responsible for audit results.

There is also too much fraud in this sphere. For example, Parity Ethereum wallet lost $ 30 million due to vulnerabilities in smart-contracts. For the same reason, Satoshi Pie lost 32.4% of its shares. In 2016, the attacker hacked the DAO and stole $ 50 million. These cases clearly demonstrate that even a small error in the logic of a smart-contract can lead to sad consequences. That is why the audit of smart-contracts is the most important part in the development.

At the moment, some DAPPs have a huge amount of ETH on their wallets Gods Unchained, Vdice , Etheroll , Powh and a low quality or knowingly misrepresenting audit could result in losses for all investors and users.

But even a smart-contract audit won’t protect users from losses. In fact, an auditor can’t be held materially responsible for his/her analysis in case of some mistakes. Currently, the audit has a character of recommendation and the only thing smart-contract users can do is just to believe in the reputation of auditors. Nobody protects user’s assets! Nobody held materially responsible for audit results.

REGA views the opportunity to create a financial instrument which will enable to protect assets of the Ethereum Ecosystem users, shield them from scam auditors and possible collusion.

It will also give an opportunity to real experts to work effectively and protect their clients. The system is worked out on the fiat market long ago. It is called: “The insurance of professional responsibility”. In the event that we’re talking about crypto economy this can be a Fund built with Crowdsurance platform technology. It will use the hierarchy of autonomous pools founded by auditor’s assets, outside investors and smart-contract users. If a smart-contract is audited by an expert, then each smart-contract user will get a coverage of risks from hacking and backdoor. The value of such protection is defined by the share of a particular expert in the Fund. We believe that it’s possible to get a 10x coverage regarding the expert’s share in the pool in case of a proper development of this idea.

Of course, such product has weaknesses (the payment time after the case). So we suggest the following option. In terms of the realization, everything could be built on the crowdsurance smart token and for sure it will look very neat and tidy.

Smart-contract users which has an audit and auditor’s responsibility protection will receive an additional ERC721 Token with a Claim function. The Claim function enables to notify the Fund of problems and in the case of receiving a few Claims there would be an expert commission composed of auditors and the Fund’s operator (REGA Risk Sharing) for the problem status determination. The expert commission won’t decide whether pay or not to pay, it will determine the fact of loss from the smart contract. The compensation will be reserved in the moment of receiving the Claim and the payment will be performed automatically.

All project participants are clearly interested in fulfilling obligations to users, since only the fact of fulfillment of obligations will support the functioning of the entire system. One case of abuse or default will stop all work forever. And all participants must understand this.

We’re sure that this decision will increase the market security of smart-contracts. It will also create a favorable investing climate for companies which were audited.

And moreover, this decision will be understandable for smart-contract users thanks to realization simplicity.

Auditors in their turn, will receive the instrument showing their professionalism and the quality of work. And moreover, this decision will be understandable for smart-contract users thanks to realization simplicity. We invite all interested parties to cooperate ⬇️

https://etherscan.io/directory/Smart_Contracts/Smart_Contracts_Audit_And_Security

Author's contacts:

LinkedIn

Telegram