A word about smart contract securityWith all the news of hacked wallets, thefts, vulnerable ERC20 tokens, etc
I wanted to take a moment to provide some clarity (on how these things apply to BattleDrome) and our opinions/perspectives
First of all lets get this out in the open:
BattleDrome is NOT affected by the recent multi-sig vulnerability!Does this mean that the ICO Ecosystem, or Network is insecure? And we should stop investing in new startups?
NO! Definitely not! (if anything, it highlights the need for further investment, and development!). Though it does highlight things to be aware of as an investor (more about that later).
Ok, now that thats out of the way
Lets talk a bit about why that is:
So what exactly happened? How did the theft occur?Well youve all probably heard several posts about this, but here is a short version:
There was a small bug in some central library contracts used by (primarily) the default contract provided by the Parity client for users when they create a Multi-Sig Wallet.
This bug allowed an attacker with the right know-how to reset the wallet to a new state, which then allowed them to set themselves as the owner of the wallet (making it easy to withdraw the money).
Further details on the exploit itself can be found here:
https://blog.ethcore.io/the-multi-sig-hack-a-postmortem/How does this affect BattleDrome?It doesnt.There are 2 smart contracts in play for BattleDrome:
The FAME ERC20 Token (which controls FAME balance)
The BattleDrome ICO Contract (which houses the ICO funds, and acts as an on-chain escrow during the ICO itself).
Both of these contracts were developed from scratch. And we are not leveraging any centralized libraries in them (so no vulnerability to the delegate call exploit used in the Parity Multi-sig wallet), also the ERC20 address exploit is explicitly blocked in our Token code.
Did we do this because we knew there was an exploit and we knew a fix? No. Nobody saw this coming. In our case we simply wanted to take another approach instead of re-using the same old contract code everyones been using for the majority of ICOs out there. We thought we could do things differently, and wanted to take a stab at providing a more secure, trustworthy ICO for our investors.
So what does this mean for investors in the whole ICO ecosystem?Developer due diligence is important. Make sure your devs know what they are doing and arent just copy and pasting some existing code.
Code Review practices are important. Ensure your devs are reviewing/testing their code, and that they are conducting third-party code audits of any contract code before its published live on the main-net.
If this information isnt readily available, then ASK the developers to provide it. This shouldnt be an unreasonable request to ask someone you are about to invest money in to support their idea/cause/project.
The above said, we all need to be aware that the Ethereum Ecosystem is still very young. Think Where the Web was in the early 90s kind of thing. The tools, systems, and libraries need time to mature.
Its important to continue to pour more investment into the ecosystem, despite unexpected circumstances like this. That investment drives more talent, and mind-share into the ecosystem. Over time that leads to better tools, systems, libraries, procedures, best-practices, etc. And these things lead ultimately to mature methodologies that result in secure software.
Other thoughts & comments:Everyone likes to focus on how Ethereum is Web 3.0. But there is an important difference many others have called out. With Smart Contracts there is finality. You cant simply iterate or develop in a traditional agile methodology. Sure there are mechanisms you can use to reduce the impact of this, but ultimately a Smart Contract is a final thing once deployed.
This means that Ethereum Development is much less like traditional web application development today, and much more akin to things such as integrated circuit design, embedded system design or aerospace engineering. These industries still write code, but that code needs to be as close as possible to bullet-proof at time of deployment. Once its released, its final, and cant be changed (easily).
Ethereum is a new beast. The software industry has never seen anything quite like it. Developing immutable smart contracts on the blockchain has its own nuances, and complexities. We need to build up new best-practices that apply to this new paradigm.
These are all things that the BattleDrome development team hopes to bring to bear during development of our platform. Our team has experience in a broad array of development industries, which we can draw from as we find our way in this new ecosystem, including Hardware design, Integrated Circuit design, Enterprise Application development, Web Application development, Financial Sector, Military, and Aerospace.
Again, thank you for your support of our project, and we look forward to making this project (and our future projects) a great success with your support.
Keep the funding rolling into the ICO!
Also reminder, dont forget about our Community Program! There are still several bounties up for grabs! And referral bonuses!