Smart Contracts Throwdown: Javascript vs Python - Greg Markou and Bryant Eisenbach

so we're here to kind of have a little debate uh greg and i always chat back and forth on twitter about javascript versus python and which uh which language is better for developing in web3 and uh we kind of want to just put on a show for you today so one of the first things i want to ask everybody here is uh you know because we're talking about smart contracts and smart contract languages how many of you are familiar with javascript smart contracting language anybody anyone yeah we got one back there yeah interesting do you want to come on up because like i'd love for you to talk about it uh there is no javascript one uh you know the talk title got a little a little got a little messy yeah um but there is a python one there is and it's really good in viper viper um but we're not here to talk about vipre it's more about how you develop smart contracts developing smart contracts very high security activity writing the code in solidity or viper is really only about 10 of the work that you're actually supposed to be doing the rest of it is the framework around how you test and deploy it at scale so i'm of course the python maxi in this uh in this chat um i think python is the best framework for developing and testing and deploying smart contracts because uh the data science community and cyber security communities are very used to working in python but greg disagrees yeah i mean that's like cute but you know have any of you guys tried to use python like python python python what do you type in your cli because the first step to using vipre requires python three point two well it's deprecated two is deprecated yeah see this is a problem nobody knows how to install python well installing is the hard part once you get past that initial bar it's like the easiest language in the world in fact it's the number one most used language in the world according to ieee i looked this up this morning but every browser runs javascript okay okay if you want to counsel log debug your smart contracts then i guess you could use that but that's why we have hard hat you don't have that well what if we just built a real debugger wow might drop um so we really didn't plan this talk at all um we were just kind of bsing up here but if anyone has any questions about like what are the differences between using javascript or python you know pipe up with questions we'll we'll get you in there yeah this is also probably a good time to talk about like probably tools as well um and where you there's a lot of tools that exist nowadays in the you know smart contract space that perhaps a lot of people don't know about forge um and even just like uh yeah so they do apert's uh just you know releasing this week uh full out of beta um but we're a python based smart contract development framework and really like the the framework is there to support you writing tests we use pi test which is a venerable testing framework uh very mature very robust for cyber security testing and i think a lot better than anything in the javascript ecosystem for testing which is why we picked python again if you can install it um no but for real uh like the one thing we do have in the javascripts community which i think a lot of people need to learn about is um you know georgios's library forge the thing is incredible you know uh there's a stat out there basically that helps you basically run your tests um you know if you have dap tools which again unfortunately python doesn't have dap tools so you can't even can you even write tests in vipre you can write whatever you want in viper sure that doesn't make sense it's not optimized like forage or death tolls is but you can write the controlling case if viper is too new you can write a contract lace it together and deploy and run your test that way i don't know that's all that forage is doing yeah but forge can reduce build times um there's a really good stat out there you know uh maple finance not sure if anyone's familiar with them they went from a 10 minute testing cycle to about like 45 seconds um and you just don't have that in python yeah that is true i i can't i can't beat that we uh we built a github action that reduced our uh testing run times from six minutes to one and a half but getting to that 15 seconds it's going to take a bit of time now one thing with vipre that we should talk about is readability yeah so um one thing i really harp on um pretty heavily is that smart contracts should be readable so a lot of people that write smart contracts they spend a lot of time doing gas optimizations and that actually makes your code harder to read harder to audit and less secure so you know gas optimization is important you should you know use it with care but if you're going deep into assembly and solidity it's going to be very hard for an auditor to understand all the internet connections within your contracts so with vipr we disallowed assembly writing and assembly because there i had not seen a safe pattern to do so um but yeah so like when you're thinking about design you should be thinking about reading because 99.9 of the usage of your contract is not going to be somebody leveraging it in their own design it's going to be reading up on how to use it how to work with it security authors need to read it so they can understand your code public bounties they need to read your code so they can apply for your bounties and help protect your code live in production uh reading reading reading is really the the fundamental theme here yeah um i think scoping's one of the big ones there like in the last little while that i've been using it it's been really nice to understand where global variable state's affected versus local state modifiers are you know on top which is also really nice doesn't clutter the constructor yeah modifier does not rug actually rugs right um but you know since we're here at denver it's a little bit more newer people showing up we should probably dive into kind of like an ideal path forward because maybe diving into viper is not the first thing you'd want to do due to the like nature of the tooling and that exists and that's why i like javascript's really good because it's the most successful language that exists to this day right your grandmother who goes on facebook she has access to javascript so there is a use case there as why it's valuable and you know if you are new to the space and you want to jump in it's probably the best place would be to start in hard hat something like that and learn the fundamentals of how these testing frameworks work but the minute you actually want to start getting real optimizations and real you know power out of it that's where vipre works works well but there's a caveat i would even maybe push back on that because uh most most schools and universities now are teaching python as part of their curriculum they've moved on to from java to python uh so python is like most people's first exposure to programming it's also one of the easiest languages to learn which is probably why it's one of the most popular until you don't know where your statements end until you can't install it until you just can't read it curly braces are great you just can't get better than that um but yeah the the python tooling for many years was kind of under supported in the web3 ecosystem uh just now you know that's what our company is trying to solve help making python more accessible in web3 for development purposes and particularly for data scientists one of my big thesis behind ape works is that data scientists have been supremely undersupported in the web3 ecosystem and yet the duality of that is the data produced by these smart contracts are some of the most valuable parts of uh using smart contracts in production you're watching token flows you're trying to understand like what's happening with a particular protocol the ability to deeply analyze the data that those protocols produce is like number one for me that's a good point let's talk build sizes on the output let's compare you showed me some statistics yesterday of which contract oh yeah so i've been developing an erc 4626 yield bearing vault standard with some fellows from rory and yield protocol i think and i did a side-by-side comparison of viper implementation versus a solidity implementation using open zeppelin erc20 token and literally a fifth of the size of the byte code the viper version it cuts it by 80 that's pretty crazy to me now because everyone's going to ask [Music] this is kind of why developing drive ships nicer than viper how many auditors can actually tell you if your code's safe if you had asked that question two years ago not many auditors were familiar with viper but with uh chain security coming back on the scene they're the number one viper auditor so if you are riding a viper project chain security would be my top pick for um auditors to look at your code but more people are learning it um and your top pick for solidity auditors are still chain security chain save wait what's in your back pocket here magic okay we really did not plan this at all um but yeah so you got two you know you know deep web 3 experts we've been in the scene for quite a while if anyone has any questions please pipe up because we're running out of things to talk about