<story><title>Smart Contract Security Field Guide</title><url>https://scsfg.io/</url></story><parent_chain><item><author>photonthug</author><text>Escrow is the simple thing.  Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys.  How to proceed without the transaction requiring trust between people who don&amp;#x27;t know each other?  If you physically get the car&amp;#x2F;house&amp;#x2F;keys, what guarantees that title was transferred as expected?  Depending on the cash volume and the jurisdiction, there is basically no established mechanism for doing this peer-to-peer.  If you&amp;#x27;re &amp;quot;lucky&amp;quot; then you see a whole industry of middle-men created around trying to solve &amp;#x2F;skim on this, which then increases the costs of transaction (say realtors or car dealerships).  If you&amp;#x27;re unlucky, then there&amp;#x27;s simply no way to have a trust-free transaction, and you just weigh the risk and take it or leave it.&lt;p&gt;This does seem solvable, right? Because there&amp;#x27;s only a few APIs (bank transfers, title queries) that are involved in a fully automatic escrow.  Such escrow could be provided as a free service by the government, or it might be pay-per-use (and simply cost less than markup from dealerships&amp;#x2F;realtors).</text></item><item><author>hn_throwaway_99</author><text>Wish I could upvote this more.&lt;p&gt;I&amp;#x27;m a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research.&lt;p&gt;The thing that is striking to me whenever smart contracts come up is how &lt;i&gt;extremely rare&lt;/i&gt; it is to be just presented with a simple, understandable, real-world use case that is an improvement over existing alternatives. Instead, so often you get:&lt;p&gt;1. Long missives about how the technology is really cool, but that completely sidestep the original question: show me a simple example of what a smart contract is used for.&lt;p&gt;2. Lots of examples &lt;i&gt;that are only relevant to crypto in the first place&lt;/i&gt; (i.e. just speculating on valuation movements in crypto). What I mean by this is that the purpose of finance (at least the intended purpose) should be to provide capital for &lt;i&gt;real&lt;/i&gt; goods and services. Pretty much all of the smart contract examples I&amp;#x27;ve seen are just, for example, triggers related to the prices of a bunch of different tokens.&lt;p&gt;I would honestly be thrilled if someone could just give a simple example of someone actually using this stuff in the real world.&lt;p&gt;OK, please commence all the &amp;quot;HN just always hates on crypto&amp;quot; non-responses... (this last sentence is sarcasm but also born out of frustration of getting straightforward answers in this domain).</text></item><item><author>duxup</author><text>Can someone give me a good use case (even better if you&amp;#x27;re doing it yourself) for a smart contract?&lt;p&gt;What is anyone doing with them that they find really handy?&lt;p&gt;I&amp;#x27;ve never been able to understand how it gets used &amp;#x2F; why you would use smart contracts.  I&amp;#x27;ve googled and read... still don&amp;#x27;t grok it.&lt;p&gt;I&amp;#x27;ve seen so many &amp;quot;benefits&amp;quot; listed, but none make sense to me as far as the process you go through and how it works out in the end.   Often it&amp;#x27;s described as a magic thing that eliminates the use of &amp;quot;intermediaries&amp;quot; and so on.   I suppose that is true but you only get to that by going through all the complexity of from making sure someone writes a good contract &amp;#x2F; getting folks from the outside to review and validate it and so on.   I&amp;#x27;m not sure that saved a lot in the end.&lt;p&gt;Much like a most things blockchain I find these ideas (not bad ones) and then the practical usage ... much less than ideal.</text></item></parent_chain><comment><author>hn_throwaway_99</author><text>OK, great example, so I&amp;#x27;ll explain why a smart contract couldn&amp;#x27;t work here at all.&lt;p&gt;So, to start, going to be clear I&amp;#x27;m using your specific example of &amp;quot;escrowing funds on purchase of a piece of real estate (and I mean actual, real, real estate)&amp;quot;. Simple enough. But, at the end of the day, who is to say &amp;quot;the keys you gave me are really the keys to the house you said you sold me&amp;quot;? That is, there needs to be some way to import to the smart contract ecosystem &amp;quot;yes, these are the keys to the house he sold me, and yes, the seller is the unencumbered title holder of this house&amp;quot;. There is no real way to do that without some sort of oracle, and then you&amp;#x27;ve just moved the problem back a step (i.e. you need to trust the oracle).&lt;p&gt;I happen to think title insurance is vastly overpriced in many states, but that&amp;#x27;s not the same thing as thinking that title companies (who normally do escrow in the US) don&amp;#x27;t serve a very important purpose. Most importantly, they ensure the seller is the actual title holder. And I can hear the crypto fans saying &amp;quot;Well, if you just held that title on a blockchain, there would be no ambiguity about who owns it.&amp;quot; But that just pretends that all the real world examples don&amp;#x27;t exist, like a contractor who puts a lien on a house because he claims he wasn&amp;#x27;t paid. Also, in the real world, if someone steals the key to your house, it&amp;#x27;s not usually that hard to evict them and change your locks. In the crypto world it&amp;#x27;s &amp;quot;sorry, finders keepers&amp;quot;.&lt;p&gt;So again, this simple example just falls apart on further inspection. Very happy to hear why any of the rationale I&amp;#x27;ve given above is not correct.</text></comment>
<story><title>Smart Contract Security Field Guide</title><url>https://scsfg.io/</url></story><parent_chain><item><author>photonthug</author><text>Escrow is the simple thing.  Suppose you want to buy a house or a car, and you show up with a bag of money and someone else shows up with a set of keys.  How to proceed without the transaction requiring trust between people who don&amp;#x27;t know each other?  If you physically get the car&amp;#x2F;house&amp;#x2F;keys, what guarantees that title was transferred as expected?  Depending on the cash volume and the jurisdiction, there is basically no established mechanism for doing this peer-to-peer.  If you&amp;#x27;re &amp;quot;lucky&amp;quot; then you see a whole industry of middle-men created around trying to solve &amp;#x2F;skim on this, which then increases the costs of transaction (say realtors or car dealerships).  If you&amp;#x27;re unlucky, then there&amp;#x27;s simply no way to have a trust-free transaction, and you just weigh the risk and take it or leave it.&lt;p&gt;This does seem solvable, right? Because there&amp;#x27;s only a few APIs (bank transfers, title queries) that are involved in a fully automatic escrow.  Such escrow could be provided as a free service by the government, or it might be pay-per-use (and simply cost less than markup from dealerships&amp;#x2F;realtors).</text></item><item><author>hn_throwaway_99</author><text>Wish I could upvote this more.&lt;p&gt;I&amp;#x27;m a reasonably intelligent person. My job requires me to learn complex technical details about a bunch of different domains - it may take me a while to grok it all, but I usually can once I do my research.&lt;p&gt;The thing that is striking to me whenever smart contracts come up is how &lt;i&gt;extremely rare&lt;/i&gt; it is to be just presented with a simple, understandable, real-world use case that is an improvement over existing alternatives. Instead, so often you get:&lt;p&gt;1. Long missives about how the technology is really cool, but that completely sidestep the original question: show me a simple example of what a smart contract is used for.&lt;p&gt;2. Lots of examples &lt;i&gt;that are only relevant to crypto in the first place&lt;/i&gt; (i.e. just speculating on valuation movements in crypto). What I mean by this is that the purpose of finance (at least the intended purpose) should be to provide capital for &lt;i&gt;real&lt;/i&gt; goods and services. Pretty much all of the smart contract examples I&amp;#x27;ve seen are just, for example, triggers related to the prices of a bunch of different tokens.&lt;p&gt;I would honestly be thrilled if someone could just give a simple example of someone actually using this stuff in the real world.&lt;p&gt;OK, please commence all the &amp;quot;HN just always hates on crypto&amp;quot; non-responses... (this last sentence is sarcasm but also born out of frustration of getting straightforward answers in this domain).</text></item><item><author>duxup</author><text>Can someone give me a good use case (even better if you&amp;#x27;re doing it yourself) for a smart contract?&lt;p&gt;What is anyone doing with them that they find really handy?&lt;p&gt;I&amp;#x27;ve never been able to understand how it gets used &amp;#x2F; why you would use smart contracts.  I&amp;#x27;ve googled and read... still don&amp;#x27;t grok it.&lt;p&gt;I&amp;#x27;ve seen so many &amp;quot;benefits&amp;quot; listed, but none make sense to me as far as the process you go through and how it works out in the end.   Often it&amp;#x27;s described as a magic thing that eliminates the use of &amp;quot;intermediaries&amp;quot; and so on.   I suppose that is true but you only get to that by going through all the complexity of from making sure someone writes a good contract &amp;#x2F; getting folks from the outside to review and validate it and so on.   I&amp;#x27;m not sure that saved a lot in the end.&lt;p&gt;Much like a most things blockchain I find these ideas (not bad ones) and then the practical usage ... much less than ideal.</text></item></parent_chain><comment><author>duxup</author><text>One theory I have about all this is that doing deals with zero trust is that ... people don&amp;#x27;t want to do that ... and no matter what you do there&amp;#x27;s going to be this whole process around these transactions to provide some assurances and so on.   On the surface all this title company stuff is silly and it is, unless there&amp;#x27;s a real problem with the title and then you want it.&lt;p&gt;These are human problems.</text></comment>