@liwi 18 January 2022 more from that month

最近在試著進一步了解智能合約 不意外的當然就是 EVM / solidity 那麼看到 selfdestruct 函式 Google 了一下以前似乎叫做 suicide EIP-6 裡寫：The primary reason for us to change the term suicide is to show that people matter more than code and Ethereum is a mature enough of a project to recognize the need for a change. Suicide is a heavy subject and we should make every effort possible to not affect those in our development community who suffer from depression or who have recently lost someone to suicide. 為了避免自殺字眼所以把保留詞改為自我毀滅 智能合約可以自毀這件事聽起來就跟區塊鏈的不可變易性很衝突 這篇文章測試了跟自毀後的合約互動是怎樣： https://betterprogramming.pub/solidity-what-happens-with-selfdestruct-f337fcaa58a7 再進一步去了解，selfdestruct 的提出大概跟 The DAO 事件有關，例如上面那篇文章引用的論文所述： “The DAO attack continued for several days and the organization even noticed that their contract had been attacked at that time. However, they could not stop the attack or transfer the Ethers because of the immutability feature of smart contracts. If the contract contains a selfdestruct function, the DAO organization can transfer all the Ethers easily, and reduce the financial loss.” https://arxiv.org/abs/2005.07908 The DAO 被駭事件導致了以太坊網路分裂成 ETH 與 ETC。被駭的原因是 re-entrancy 重新進入攻擊。要理解重入攻擊我覺得一個不錯的方式是實作這段程式碼： https://solidity-by-example.org/hacks/re-entrancy/ 大概就比如說某銀行金庫裡有大家存入的 100 塊。駭客先存入 1塊，那麼按照金庫規則他有領出 1塊的權益。駭客接著就（用合約）跟合約互動，要把 1塊錢領出。智能合約比對記錄，駭客有 1塊錢的餘額所以啟動放款。金庫送款到駭客的合約時會觸發駭客合約裡的 fallback 函式，而駭客在這個函式裡再次跟金庫送出提款要求，金庫回去比對，因為駭客合約位址存款紀錄還沒更新所以一查之下尚有餘額，於是又送款出來，如此一直循環到金庫被搬空為止。 後見來看是很低階的漏洞，但後見之明誰都會，不過他就發生了。而事實上，The DAO 之後，一直到至少去年九月都還有重入攻擊的案例： https://hackernoon.com/hack-solidity-reentrancy-attack 大概可以說，Solidity 不麻煩，麻煩的是 code audit 代碼稽核。說到 code audit，就想提一下 CryptoPunks 去年九月間自告奮勇 unsollicted 的 audit： https://dtf.is/audits/cryptopunks_dtf_assessment.pdf https://etherscan.io/address/0xb47e3cd837ddf8e4c57f05d70ab865de6e193bbb#code ...大概是想打廣告吧 XD 智能合約的一個口號是 Code is Law。The DAO 事件的駭客也認為他們所作所為是正當的、按照遊戲規則的，甚至說會對黑名單他們獲得的資產的交易所或任何機構提出告訴。法律都沒辦法完美了，更何況是 code，我想大概是這樣吧。去中心化某種程度上來說也是，最近 Polygon 的事件可見一斑。 總之 Solidity 跟智能合約的部屬門檻應該不算高 https://solidity-by-example.org/ 有很多現成教學範例可以部屬到測試網上實際操作 https://cryptozombies.io/ 殭屍遊戲製作教學也不錯 重中之重還是 audit 的部分