How to Make Ethereum Really Trustless? by Alexander Praetorius, Nina Breznik (Devcon5)

[Applause] part of the foundation for the past three years or so and for two years working with really steep and for the past eight months between working on this topic how to make doing more trust lists so I will show you what we see as a problem and then hopefully post at your includes in blue but you see as a problem and how what's missing you maybe suggest what you need to do so that as a community we bring to these things forward and make it more justice okay so that's basically just a small introduction and there are many ways to introduce this but there years at least represents the end of a tab and you can open my wallet we never started making an interaction and of course if you execute contracts the way it does and there is no magic administrator like you do anything about it but the thing is still as a user when you direct look at that then yeah you have some expectations what this is going to do and what the conflict is all about but if you don't have a source there's no way of easily verified it may be your wallet will show you some data before you confirm the transaction but generally it's not so easy to say is that what you are seeing and doing actually what is happening behind the scenes and even if you do whole secures it has it in order to that I mean there's so many from having made a source code that is verified that you know that this source post is actually the one that is to contract address that you interact with to isn't as it analyzes in audited I mean there's many different levels and the situations can improve to over what it is then because if we don't do that then basically you could use aetherium as an alternative hosting solution in AWS I have my back-end I'm using it as a back-end and supposed to be trustless in the end you actually have to trust then yeah that's that's not a good situation to be so right so we have also some numbers and we have the suppose there's or basically it has already a little bit older so the numbers should be even higher but like we have a lot of developers that come in touch a tryout learn about Ethier in the broader ecosystem everyone $50,000 she a lot of them in every every month like I mean depends it changes but like it's 1.5 million contractors are getting deployed to the chain and 10 10 more than 10 million convicts are on Chamberlain actually it's even more because the latest little older sole convicts getting comes up be published and every day also those numbers are fluctuating but likely 1.2 million contract calls per day so that's actually a lot are and the thing is that just when it comes to very resourceful there are when you are may be familiar with ether skin but generally like in 2007 the millions so of course also some contracts deployed many times over but still the situation is not really as good as it could be and we were thinking what we maybe can do audits to do it so the thing is yeah so what is also very important here like we have all these numbers but the problem is that apart from either scan there is no other place where we could explore or or verify source codes so that means that it's port on a centralized place and if they decide to open that means we have a trusted system where we have to trust the contracts well we don't have access to this contract and we have to ask ourselves is there even incentives to share this religious or scope or what can we do to find out what could be the incentive and as you mentioned there is only a couple of thousands of them but we have like over 10 million of contracts currently working so how do we get more rarefied circles and sicinius we were thinking maybe if we have like a neutral place that could be used to explore and find information whether there is this verified whether it has been analyzed whether it has been audited maybe multiple times at different parties there's so many so many things that you might want to know or maybe you're an end-user you interact with the tap and it uses a smart contract or you multiple ones or your developer and you want to use live reason maybe those legs that we ordered it or not maybe the source premier everything is audit about the contract itself makes calls to other contracts so it's not kind of disaster but then you also need to know about those contracts and there's so many different situations that basically that needs a political system of projects and organization and they all are active in slightly different fields but I think they all need to work together because there's a lot of different aspects to this problem so the thing is so that's the noodle is so crazy we need to collaborate and there is many ways in which we can do it one way in which we were thinking where to have like some kind of open API standards in in ways that we can basically use the tool to different projects services or libraries or whatever they are all and mesh mesh them and to improve the situation because one project alone it's hard for them to change everything like ether scans all the contracts but there's auditors but the NIA also that developers and everyone and then your auto wallets so every everyone has the user basement has some kind of expertise and you maybe change something you have like a standard or a way of Weasley's across those different kinds of organizations and like each project alone might have a hard time doing it because it requires others to make it also change so let's make way the straightness but as good as it could be and yeah like you have it scalability centralized this is where you started this project from smart control codes which is basically a peer-to-peer database and a search engine for verified source code so I mean let's just go over quickly so here's maybe this could be a point where we can try out to improve the situation and there are multiple aspects to this like one is we have a lot of data that is I mean for example for the server for the source code as such we could publish them and then you have a way of retrieving them and maybe verifying them but like still there's a lot of auditors and also the wallets that might want to show certain information about this and can we publish this doesn't need to be updated maybe a certain contract is updatable or there's multiple bursts and one has been wanted but the next not or maybe you don't only want to use part of the contract functionality maybe interact with like two functions and those maybe have been augmented audited even though the rest has been updated and all these things we need to do and because the data is always changing I mean when you defer the contract that particular kissing you talk about the whole list of conflicts there will be always new contracts and also maybe new versions of contracts so in order to get all the also with the audits that's kind of the same like if you depart it may be the next version of your contract so all these updates need like a mechanism that you can also easily update and interact and still even though updates are possible you want to be able to trust or have it as trust business possible say how do we do that like that the idea about this database is that we have first of all like a neutral place so you could of course use the peer-to-peer network to retrieve all these kind of different information but also if you ever have an organization like as an auditor for example it could have your own copy of the data set but penetrated so for example you could say these are all the ones that I contracted be audited when those kind of under versions and then this information could be used on one place like this search interface to display all the contracts that have been audited by whom they have been audited to which versions and there might be updates coming to this but every every node of the database under hosted by one particular person organization could update their annotations and all these different data basically is merged or or shown in like a mixed mixed way so that's why we also have this second part that connect maybe I assume that many of you might remix as a in-browser ide and it happens not the only project but they have this approach of having plugins and we want to see how we can maybe make it so that all these different like whether they are wallets or whatever is their app or software they're using that we can connect them together in a way that like maybe as a particular app or or whatever whatever the software is wants to reuse the code or maybe we on the smart computer phones would allow the connection or embedded suite goes both ways when plugin usually as a standalone thing is relatively business it only works as a plugin for something but we want to be able to connect things so then that way let's say a monitor that displays their audited contracts that could retrieve data from the or making their tools to analyze them so you can use the database to import that data to show it on their page but the other way around is also possible such a search engine could or the search interface code to display or even offer those kind of services to to to for example analyze the the contracts and give the user or even offer the service like there's an auditor that offers a certain service and it could be because it could be a way for for users to discover audited contracts and the way and because we want this database to be chewy Center so everyone can run an old we're using that propellant which can handle dynamic data sense so because there is a database that and we are constantly publishing new information we can sadly not use IBF expertise or it doesn't come out of the box but as Kristin will later show the the source codes will be stored on my business probably or possible solution but then we convert them and display them in this database for everyone yeah this is like I mentioned well it's not a test but also of course developer tools if they support publishing source codes like as an opt-in or maybe ideally as an opt-out mechanism that would also be useful so somebody who really doesn't want to publish their source code you thought you could always put in the effort to T compile it to figure out because the source code prevent to be small because anyway expensive we have a little story in computation going on in the chain that would be of course very useful to know we just picked like from each category that we see a few I mean not random but like almost like that there's many more organizations or projects in each of those categories but just to get like a feeling what we are what are all the different players in the ecosystem that could contribute and to improve the status quo but yeah that's we would love to discuss to to get more input to maybe update or make the perspective of this a little broader yeah so there are CDC developers so people could eventually decodes then you have taps basically like business owners or someone who makes a concept of how how this elliptical truth work that tools which enable publishing to the network which basically they could also publish to the database and then everybody could see what is actually the source photo of the that they're using security auditors of course taking care of that the contract is secure because verified means only then it does that it's supposed to do but it doesn't mean it is secure so it can still have some bugs or something then we have infrastructure projects which basically [Music] enable that this whole thing exists so to search for for things and to publish and broke and eight explorers which are basically running notes and getting information boh-chan because every one of us wants to get this information it's hard so we need to run it for like months so we have of course like Washington student and bullets of course because hasn't be the ones displaying this information that is so what we wanted this is like a short introduction but we do and how we are thinking about things but not we would like to hear something from you like I don't know how do you see the ecosystem maybe we didn't even manage to capture all the main actors and we forgot something what are you doing in the space and what is your role in mysteries like how to build trust so I am David I have a phone that transnih Joe s which is the kind of open-source version of Android so I use Android applications a lot but I want to use a whole that crypto wallet and a lot of times I can't download a free soul that they became from anywhere else only from pirated from Google Play not very many publish only on Google Play or if I can get the apk from their github or from someone else the UK is not signed with the duplicate they don't even have KGB came for their releases so I can't really verify its really whatever that download is really what was meant to be installed on my phone so like this is my reach out my my cry of cows so please learn a GP make a PGP signing fee and always sign your releases and close to publish a post of publish a pk's on github like this website and this place if you can and have the bandwidth for it publish your application on f-droid such as my friend leaky does with his wallet police because like when I'm thinking of how to make this persistent trustless I believe that is a crucial point of trust you know the applications that you put in your your devices so yeah that's what I wanted to say and thank you for attention like many more everything all that like all the software that enable enables this to work I mean many things are published in certain to the app stores but of course ultimately github we have a lot of things and the addition of course always be annually signed and the keys should be known the team of people that publishes so that they can actually verify that what we use is coming from the right sources and this working just the thing I think that basically we cannot do this with a microphone because this is gonna be crazy should be just like start I think the single most effective thing we could do is the compiler publishing the source codes [Music] what's the name of that thing you were telling me about the swarm hash weed and then actually publishing the source to swim without as a default I think if we've made that the default then 99% these pieces of source code will be available because I'm people wouldn't turn it off and it would also promote an idea that we should all be publishing all of our source code and we should all be interacting with smart contracts that have published source code so we make the community ethos that the code is there and if somebody wants to turn it off then I would look at them and say why did you turn it off but I think that's the most effective by far I think trying to get people to volunteer you're gonna end up four years from now with 3,200 published smart contract so priests work so Chris no why is this not a people what are the obstacles I think the compiler is unfortunate the right tool to do this and the main reason is first you do not know whether the source code that is currently being compiled is the final thing that will be published or some random people are just testing some stuff and second the compiler may not even have access to the network and the results might be the compiler is used to generate bytecode and the bytecode is moved somewhere else and then published is okay so I think the tools that do the small current deployment should do that I think it should be the default yes is there any efforts to communicate that to the people that are writing that code I'm talking to them yes I think the deployed bytecode of every smart contract has a hash of a JSON file at the end and this JSON file contains information like here the ABI the compiler that was used to to compile the source code and also yeah link hashes to the source code so the the integrity of all this is not the problem the product is the data availability here and I think if if we could get to a point where people publish that information at the point of deployment then also the user experience of wallets for example would greatly improves not only because you have access to the source code but only because you have access so this this JSON file contains an interpreted ABI and also the nut spec comments of the functions so whenever you have a whenever your wallet asks you to confirm a transaction it should not display this garble hex string of data it should actually fully decode all the function parameters and display the nut spec comment that is associated with this function I mean they for example wallets they couldn't display like if the data was available so if tools only if we generally like establish this as a like a mind said that it would be better for everyone if we had this horse tool because the theory was meant to be trustless that's kind of a missing link and if we don't do that and why we do all this in the first place then I can also just go back to how things always work but ok so if we if we have that and we maybe have the tools publishing business we are getting more source code and this is also pretty cool because then wallets could of course display a certain transaction is happening with like a contract where at least the source code is known but then I clearly also any like auditor or said any any security related project could could analyze the source code easier because there's many of innovative or even published like a kind of annotation in which form that's the question but like basically having an opinion that this source code has been audited and ideally we also get to standards like what what does it mean level of auditing happened and was abolished by one Morgan's age or many and he said like even at the break even is so many metadata that could be generated that basically have like additional information because the source for the search is like a good first step so they're the leases for the future what about for the possible were to working with all the think they're like yes oh yeah so I'm an assault we are security auditing company and typically the majority of clients want to publish the fact that they have partnered on it and also want to publish a full audit report right which is uncommon compared to other industries and so it would I think it would be great to highlight most positive and negative examples recently there was a good next I mean the famous negative income which was there right where people looked into the contract and were like yes definitely a proposition and you could warn the user say like please don't put any more money in because at the time is their vulnerability square population people are still putting more money in like some people were saying it was money laundering for this is another issue and so yeah I think it would be great to kind of have like a they could probably be like three different things like it would be like a check mark like audit and when you click on the check mark you see like before report or they could be like a warning and these could go to different sources right like so I mean ideally of course this should just be us enough people should just all trust us because this one's the idea but like would be great anyway so yeah like any they could be you might check mark and then you go to the difference and like so that anyone can provide their community but do you also ordered' sometimes like some calls it is not like coming from the client but you just analyze it anyway yeah so we often have dependencies that are already existing right so like some client code is using I don't know compound or maker or whatever so existing dependencies between them both edges and do this data anywhere like so this is in your oh I mean we were thinking like if there was a standard I mean there's only one tender like butter I have a model in what levels and what does that what kind of guarantees does I communicate but another one a format like the data is standard then maybe for example I mean how perfect that will be useful but generally wallets could use it too just like the basically movie as the disposable exists but like what about does it hit that doesn't has it been audited so they could be present data from and a notice of standardized format so they can display that and hopefully all the wallets which was the same standards our users used to this is how it looks and that's what it means and maybe believe me I can see one change in any maybe Rock Explorer or whatever but this is how expenditure but also you know version published source compacted wallets would integrate this this will also create another like pressure to maybe or in sensitization to publish source because of users every time they confirm now see oh I'm interacting with all the time the context of that kind of give me like a warning or something it hasn't been take the source that doesn't even exist or maybe then later on okay it has been audited but what do you mean is it like how how in-depth has it been audited and the maybe users who changed their behavior and I either demand we switch to alternatives have it better maybe I'll publish or get an audit remix we are discussing basically like what are the problems in the moment in there do you have any ideas why to be better like you are working abroad yeah yeah I also feel that publishing like an opt-out it seems a bit it's a large assumption to make yeah it's someone working on and on something sensitive the truth we published and you just push it because the interesting change of walks that seems a bit but I think all the end it's I think it's a great idea there's something halfway between not publishing and publishing the source you can publish the function signatures and the encoded basically the thing that you would get from the API I you don't have to publish the entire source just publish the API just the strings of the function and their corresponding encoded value to four-fight encoding and then that way they could be a wallet could decode the function but you want you wouldn't have published a person of source code but not the eventually published something that's public anyway so you can even publish the meat identify with all the source code yeah then you have I mean that also includes net spec which might be sensitive yes I mean anything is elevated you just go in there by coding you look at the function selector so we're not anyone I'm very technical but you'd be helping the non the less technical is there a way to I mean if the deployment process is an interactive process then that tool could also just ask where you have to answer with yes or no yeah like in an interactive process yeah but it's just scripting and dancer burden if you're developing something sensible and you forget to check the box probably shouldn't be developing sensors reading functional stuff I couldn't I think you should just pay them security we would play everyone but where is the problem I mean I think that's like education without it people just knew that this is important they could win it or it's like to make it easier by the really good so it's just easier because people have a lot of things to do I understand and it's just an extra step and they were kind of finished about there's an extra step so it would be nice if it gets just easier and ideally that give up our soul medically transition phase the first in the content like everybody's like used to that like allosteric on dislike playing visible but like when comes back ends there was never the case and now not changing or smart contracts and new we mentioned that function is being displayed there's an optimization and compiler which will just reduce the size of your contract by taking the contract names Act that's what the function names are so people start turning them on to save on gas or ugly so you can't really rely on was a function in support of the English so these French we don't understand it comes up into false in the end like what's all because 90% of people probably wouldn't choose to do those types of things so it would improve the situation yeah this Way's whatever we're not having something like them about the secret sauce tackle something like that where when you're writing the code beause this money in the secret sauce okay it's it's closed yeah it has I thought we can't reveal this so I just wanna see what sort of a kind of a whole contract developer observing so you can actually declared as there's a few reason why is because it's amazing [Music] website and with we upload to the website we can use the and then with a decoy and they can they also use the harm the harsh and detect whether the loan nicole has been published if yes we can say where you you can use the building as sent to the smoke option so not only Jesus can help sense I suppose so what was it provides for users we have you and so we and compatibility will fight and that would centralized database but what is more important we have been going to get all these contracts and we have no records so this means that everyone can can get the copy of works counted get verified source coronation ten thousands of contract something like that yes and everyone is in one part that everyone can get this is so this is our current vision of decimalisation right so everyone can physically power database so but what it was we would like to it in order to increase tourism meet you on forums somewhere else how to verify how how is it easy what instruments we can use for verification the second one is based on assumption this user will always forget to verify says thus we need to somehow to invent a verification step in to say all development tools we have disco publications like bangkok brahmam reason life so to develop vacations release a right as soon as you publish metadata and source code verification automatic you've done an additional seven swarm and ftfs yes and that's also the hope so as soon as we publish this then block explore us so you don't need to go to the block Explorer to verify your contract the block is quite sure the tools need that are like our thing isn't so good useful for lot of these problems it's just like standardized data format like the source to ApS also specifies like deployment data so you can also determines getting this like strong verification you can add like watching deployments seeing that you're interacting with like the die is missing after like whoever's wallet address and so yeah check out EPM we're in brownie we're in remix people plug-in bring truffle it's just like a very good way to pass around safely your smart contracts love to see more integration Oh website documentation never registered isn't one way to do it to actually have the you directly if I'm able to build that's contract and it's by Brandon to or with what's deployed there whether they're everything about it I know all the dependencies and stuff like that so I do anything officer to verify to run all the tests and to do that you know the project and they get convinced that I could get that code and I can build it and it's exactly what's deployed I can do anything that I like there we have a great one of the big points that we were really worried about the dependency tax some changes one of the libraries that we use it gets into our cable in stealin it's a guy brings a little verify to verify on all that appendix is that nobody changed anything without our knowledge but that's in the bill tours and that's that's well away from what their users on the scene but if you couldn't if someone rebuild it and you get identically wants deployed and you can automate other is the ability of dependency and also how about having a proxy smart contract and changing the business logic is very good in the sense of like it matches actual but another thing is yeah is it safe and all this additional information or is it using Oracle's and like is it depending on Oracle's so that the users know that they're interacting with something that maybe so we would like to be able to I mean it's not undergoes is just an interface that what we want to focus on mainly is the database so the source code but now such situation changes and publish the source form and all them are available now the question is where do we get this of all of them so maybe there can also be a solution for this and then you can start annotating memory because once we do better if you got them to come to you they can continue because you actors say so then it says verify this I can see you marketers together little while okay big apartment Cisco have to be here in my office do you have a pencil give you a word like our database that's it if there's one point be erased videos and then if you run your note you can add more data and I run my note and I can see I have this you incentivize the actors within it so that they can each earn money right so that way they want to grow the system so they continue to get ready quite people getting requesting wouldn't reports and so they can charge for the order yeah so that's it and so yeah so that gives an incentive for the order to write notes in order as many things as possible and then make this available and also the people who wrote the small contracts if they do them correctly they get a share of the reward right so that's that's another challenge but it seems for example see this even in all the smart contracts per for example but adding something to the developer tools could be published IPA pesos one and of course unchain we have and of course the metadata to and the mum chain we have like a hash to verify that this is the right method later still where do I get the best of all of them so we will be good to also find one way to publish the list of or all the liens [Music] that sort of language like and figure out the address but then I publish it on the chain and now somebody detects that there's a new contract unchanged but how do I know where that source for the sport I mean it's start now and if I have the source like the hope is that the deployment tools publish it tools for my PFS and you can grab it why are the metadata and the link in the metadata and then keep it persistent in that big day like me today from the hash link in the back room uh-huh so the hash thing in the white coat contains the address of swarm or activist for the me turn it on alright so then that will be perfect so if that happens and all that useful published then go watch it later I cannot separate and slowly pull them all into them into one database and in the system we are using virtual controls torrent systems for the more pious they are you can update that forever doesn't change so for example auditors could run it and make their annotations so they can say okay this one is audited up to that level and so on but also making other organizations could start saying I am a change this contract into somebody somewhere on the constant contact state some money because they want an audit but maybe I was too expensive so maybe publish that then it could retrieve all these data and see how there's like a lot of contracts that have states we just show those and make a little registration think that's an interesting come back with a library that has certain things that we produce with other smart contracts and now this one seems to be in very interesting library let's take more and then maybe also auditors could use that to bid to actually do the audit and then get paid from that and so that's the additional things and this one is like figuring out if somebody's ready to sense the money to pay for an order another would be publishing like author organization they're just creating like you your own mattress then you can like different like this contract and credo also from Network paintings actually device without the leading question about staking like Nikita oh I I built this convection oven at the recall all the contractor building is another weapon my thought is to finish everything just single building on rifle what a huge part of our effort is working on something we call tokens with is it's open source and mechanization but basically is a selenium powerful smart contracts so within the if you want to make a call right by inviting it by declaring in Excel that means we have to specify exactly what is the function main [Music] so one thing it helps is when the user makes a within the wallet which supports eventually we can display the function in the admins what if that so you can see my single inactivity which is what it means because it is built and transported as one single program we can let author of the XML site expression trust Squad contract so when the user use it you'll be like using a web browser in visit website you see lock and you can click on the mark and see that this is verified by you and this is a certificate for this there may be standards in certain ways of doing things we cannot rely on any centralized Authority Google say is it certified or not no this is based on a chain of trust because you can trust that the signer of this Wow is asserting that this smart contract can be because as a user when you use equality we're not going to get the sauce contract it's very unlikely source code and even if you can find the source code for expand contract how do you associate that back to the button is really key is that going to call this one but if you see a lot like when you are in the web browser you see that it has a very HD TLS certificate then to a certain extent because we know that this certificate is issued by say very signed by train of trust you trust that this website they say they are and we can trust anything by product for this website using your chain of trust so you wouldn't have to use you know regular CSS if you've got CCGs elliptically signing up seven you just sign by it could still be sued owners like there if you've got if you control an address and there's a private key [Music] [Music] [Music] they're pretty but we also have like fire also but what we focus is more developer-friendly wait the reason for that is actually we care about the privacy so what we have was like we have to publish all the source code but most of our clients you might be like it's pretty immature but then he doesn't want to share their code before publishers because yeah so we have to fill some technology or which is keeping liquid crises so what we expect from the source code is some good pattern not just source good exact but more an abstracted could like intervener video like uses like that so we expect it and then make a signature of that and then we just give and the clients it just that signature so based on our database we just starts from academics so we just need with no source code so it's similar to the traditional Java software and games vulnerabilities or the algorithm contact so it could be achieved more good privacy first all the signature from that we best from the trust business I was thinking that maybe offered that nobody else's like focus on this more or more decentralized so clear to anyone I mean the way it's it's maybe a little early but like the way we were thinking about supporting that kind of keeps kids like if you want to publish the contract with an full audit or maybe you just want to say that contract that is behind an ad versus private but we have an audit department that we share fully or or just like parts of it maybe your future you want to share more or you share it the next time this is your database no it's open source in London you have global public address as a public key and you it's a it's like a torrent which means you can start adding all this information so that but everyone what's are running the same note you might also hear auditors or other parties that can do the same [Music] in the others too and the most important thing is this like nobody is one maintainer and there is not like database of everything everywhere but nobody collects them or if they do then they have like a crazy power because then they have all the data so this kind of system will help us that we all share this data if we go means to do something like this or you can find better ways thank God I mean but this is an our suggestion so very beginning but you have one product in your delivery of that contract so the author could pop continuously published two different versions and it would all be available version controlled through all the different versions over the life of the contract and because they're in that same standard system you could for example not publish the entire source code but they if you want to do that you could basically point to that address of that source code and annotated and advantage will be controlled by your private key well update of the source code is controlled by the private key of the author and/or organization further [Music] offer interactive video community to development the solution or part of the solution to be part of the protocol itself let me imagine this a compiler the compiler is standard when compiled a small ultra it's going to generate a state and isn't in this contract is certified or not available at certification / - embedded functions out-of-the-box coming from the compiler that's changed the state of the level of certification so this is in the protocol name whatever company that's benefits from this change because because then we have to trust certain parties but if you mean verification in the sense that we have accessed that this address we can easily forceful these eventually as you said there are problems like first consolidate availability promise compiler cannot publish it doesn't believe on the internet so it's not also practically not say all that you are gonna generate the byte code are showing out of in the actual practice because it's much more [Music] yeah [Applause]