Crypto vs. the Bugs
Cryptocurrency has a bug problem.
Investors, startups and established players are all scrambling to build a future of “decentralized finance” — one in which transactions, contracts and assets can all be stored on encrypted public blockchains.
A blockchain is a type of distributed ledger, the technology that underpins cryptocurrencies like Bitcoin. But this technology has applications well beyond powering cryptocurrencies. Take smart contracts, for example. A smart contract is an agreement between two parties that is recorded in a distributed ledger and executes automatically when certain pre-agreed conditions are met.
For example, a retail chain can use a smart contract to automate payments to its suppliers. The suppliers gain certainty about payment terms, while the retailer gets to automate this vital business process.
The problems that arise are not in the blockchain that records these transactions and contracts. More often, it’s the apps that sit on top of that layer, which make the creation, storage and execution of these smart contracts more user-friendly and efficient.
To cite just one recent example, a bug in the Solana smart-contracts platform back in December put $2 billion at risk before it was patched. But that was a lucky catch — according to some estimates, $14 billion worth of cryptocurrency was stolen, scammed or hacked in 2021. In February hackers made off with $625 million of crypto by hacking what’s called a “cross-chain bridge” — a platform that allows people to transfer assets between blockchains.
These crypto “heists” often rely on what security types call “social engineering.” That is, the biggest flaw in the system is often the greed, ignorance or laxity of one of the humans in the chain — the unreliable creature between the keyboard and the chair. But as in Solana’s case, software itself can be a serious vulnerability.
As the uses of blockchains multiply, more and more value passes through them or is stored on them, and the attack surface expands at least as quickly as the amounts involved. We can only do so much to improve the humans’ defenses against the black arts of social engineered hacking. But if decentralized finance is really going to be the future, we must enhance our ability to identify, track and stamp out bugs in the software that connects us to the underlying blockchains.
Software development is inherently messy and can be extraordinarily difficult. On our mobile phones, in our gaming and entertainment, and even in productivity software, we’ve come to accept that there will be bugs. The worst sort are the “phantom bugs,” which recur but which can’t reliably be reproduced. This makes them incredibly hard to stamp out. Some of them persist for years before they’re isolated. But we can’t afford “game breaking bugs” in financial software. If the retailer in our earlier example is going to entrust its supply chain to smart contracts, it has to know that those contracts won’t get executed in error, before delivery has been secured.
On the hardware side, chipmakers have long had a zero-tolerance approach to “unexpected behavior.” The upfront costs of tooling up a fabrication plant to churn out chips by the millions are just too high to risk baking a mistake into the chip design. Bugs are ruthlessly stamped out before a new design ever goes into mass production.
For decentralized finance to really take center stage, we need to be able to achieve similar levels of precision in software development. The cloud-based development environments in which many new de-fi apps are being built are capable of achieving this, but the products to do so don’t yet exist. In part, this is a cultural problem—software engineers, even if they’re loath to admit it, have become accustomed to letting their customers act as bug hunters. That’s too much to ask when asking customers to entrust their money to these platforms.
Decentralized finance has enormous ambitions, and the potential is real. But to get ordinary people to entrust their hard-earned money to “trustless” de-fi platforms, we need to make the software that runs them trustworthy. If we can do that, then maybe we can start trying to figure out how to make people more trustworthy too. That, unfortunately, is not a problem technology can solve.
Adit Singh is a partner at San Francisco-based technology investment firm Cota Capital.
