Bitcoin and chains · 09 / 86 · 3 min

Ethereum and smart contracts

A smart contract is a program on a chain. People send it transactions. It follows its code. Code is not the same thing as fairness, and someone may still be able to change it.

Code and the key behind it

A smart contract follows its code. If someone can replace the code, the rules are theirs.

A worked case

A person deposits into a protocol because the docs say the contract is audited and immutable. The address they used is a proxy. A week later the admin points it at new code. The audit was of yesterday's program.

What you are calling

When you use a decentralised app, your wallet sends a transaction to a program. The program can move tokens if its rules, and your approval, allow it.

Who can change it

Some programs are fixed. Some have an admin key, a proxy, or a vote that can swap the code after you have deposited. Code is the rules only if nobody can replace the code.

Read the upgrade. If you cannot find who can upgrade it, assume someone can until you learn otherwise.

A world computer, and a program people rewrote

Ethereum's public white paper describes a chain that can run programs, not only move a single coin. People call those programs smart contracts. They are not smart, and they are not contracts in a court's sense unless a legal system says so. They are code that runs when someone sends a transaction and pays for the work. The code will do what it says, including a mistake, for as long as that code is the code at that address.

The DAO, already the consensus story, is the ethereum story too. The program held the money. The call drained it. Then a hard fork moved the majority of the community onto software that undid the drain. If you deposited because you believed nobody could change the rules, July 2016 is the month that belief met a loss large enough to move the social layer. Many contracts since then are written so an admin key or a proxy can swap the code without a dramatic fork. That is easier, and quieter.

Before you deposit, the question is not whether ethereum is the world computer. It is whether this address can be pointed at new code tomorrow, and by whom. An audit badge does not answer it.

Read it yourself

These links are the record. They are not a recommendation, and they are not instructions. A news story or a court paper can still be wrong about a detail. The check does not change because a famous name is in the story.

Apply the check

Open a question. The line is about this topic. It is not a verdict that anything is safe.

Check yourself

Does code is the rules mean nobody can change the app?

No. Many contracts can be upgraded by an admin or a vote.

After this you can ask whether a contract can be changed after you deposit, and by whom.