Sourcify: Towards Safer Contract Interactions for Humans

Transcript

all right is this on yes great hi everybody my name is franziska heintel i work for the ethereum foundation mainly in the solidity team and today i'm going to talk to you about safer contract interactions for humans and how we can actually get there so let's get started but before we dive uh right into the topic i want to ask you a question um do you remember this title page of the economist it's uh probably four years ago or like quite some time ago the economist put out this newspaper and called blockchain the trust machine and this is what i want to challenge

with you today in this talk our blockchain's trust machines is the way how we currently interact with blockchains a trustless way or a trusted way and what can we do to improve it so first question can blockchains be trust machines absolutely yes if they are designed in the right way so that's where i put maybe but should we blindly trust blockchain applications just because we think blockchains are trust machines absolutely no i mean actually this is a no-brainer but what we're seeing right now is that everybody trusts them and everybody just uses them without actually verifying um is this a trust minimized

sort setup so yeah how can we achieve trust minimized um interactions with depth this is what we will talk about today you might be wondering why this weird title why does she say for humans that's because we all know blockchains have a lot of various different opportunities how they can be used and some of them might be machine to machine or what to bot and that's not what we will focus on today because machines speak different languages than humans do and today from the ux perspective i want to talk about how can we make this safer for humans and how can we translate it into a language that humans can understand yeah and also

friendly reminder on the side i know this might be a surprise for some of you but not all humans are developers in fact only 0.3 percent of the world's population are developers so when we talk about ux we should talk about a language that also non-technical people can understand okay so what we learned so far is don't trust anyone but currently really how i mean if you used any web3 application in the last one year or even last three years doesn't even matter you might have encountered something that looks like this or like this these are actually two screenshots from metamask

right here they show me hex data 196 bytes 900 bytes great i have actually no idea what i'm doing and this is why in the sourcified team we used to call this process yolo signing you only live once signing because actually you have no idea what you're doing you trust the app that it will do what you want it to do but you're not sure um this process can be also compared to basically driving on the highway with a blindfold on we all do it today here a few more examples um i'm not uh doing this to blame a particular project or to blame it hamas this is a systemic problem so it has nothing to do

like in that sense and how they set it up i'm just trying using these screenshots to make a point um here for example i can't even use the application before i sign a message and the message is i mean let's have a look at the message this this is a nice message right i mean would you sign this do you understand what that means i i for sure don't but the issue is i don't find out anything else about zdep before i sign this message and that shouldn't be the case second example really really amazing app ens uh we probably all know it here i for example wanted to prolong my e s domain for one year um i see what i want to do in the web interface

but once it pops up in metamask all i can see is hex data 332 bytes i mean in this case at least i see the function type renew but that's really all the information i get and i don't think that is enough for us to call it a trust minimized setup i can actually not verify anything in there okay so we see the trust issues are big they are there and if some of you attended ecc last year and watched chris reitviesner my colleagues talk you might remember the slide i put a screenshot here um there's lots of different trust issues when we try to interact with depths and my argument is basically i want to take this even one step further

for non-developers it is even harder because as a non-developer i would not even ask my question myself the question do i call the correct function i mean as a non-technical person i am like what the is the function right so the only thing that i'm really asking myself is is this thing doing right now what i wanted to do did anybody who knows more about this check it and also can i consider it safe to use yeah the good news are there is a way to make this all better the bad news is it is a bit more complicated than we would have wanted to be but yeah let's have a look at that um so how can we achieve trust minimized interactions there's basically two very

important components that go hand in hand one is voice verification and one is code commenting and i'm going to explain both of you today because i'm not sure who is more technical person or more a non-technical person so source verification is basically in blockchain the process um in which you verify that the source code that has been um transformed into bytecode and then has been deployed to the blockchain is actually the source code that they uh the the dev developers open sourced and that you think you are using yeah so here we are talking about bytecode reproducibility that is very important because we want to know what we are using

and whether the code is malicious or not right the second point is code commenting this is especially relevant for user facing functions which means that basically when dev developers are developing an app they should add comments to this function and explain what it does because if we have this information which is also called netspec that's a special format to do this commenting then we could in the next step display it in wallets and interfaces so that people actually know what they are doing and don't encounter hex strings so yeah um here it's um shown in emoji equations basically there's only one way how this thing can work and this is uh when we combine these two elements that i just described before

because in any other case uh the solution is very sub-optimal let's look at the first one the code is verified and open source but the end user does not understand it that's basically the example i just did in the beginning that's bad because i really have no idea what i'm doing the second case could also be i get some sort of human readable information in the wallet maybe they display some sort of translation from the hex data but the code isn't verified and it's not open source so i can really not know whether the description that gets shown to me is accurate that is also very bad maybe even more dangerous um so yeah in the end only one thing works and that is when the code is

verified and open source end end users can understand it that would be awesome so yeah let's see how do we get there meet sourcify sourcify is a project that has been initiated roughly one and a half years ago by christmas and roughly the solidity team and it's first and foremost a decentralized metadata and source code repository we support several efforts to foster adoption of open source source verification as you might have noticed before we promote the usage of metadata files and net spec comments both of these things i'm going to explain later and you can consider this a base layer

which will allow other tools to basically make use of the data that sourcify stores and also where other tools can be built on top of but also that will be explained later and yeah the main purpose for the more technical people in this room is to keep metadata and source files available via ipfs and prevent that the links in the byte code turn into dead links so what the heck is a metadata file i hope the dev developers i know you know what it is but i will briefly explain it basically in solidity version 0.4.x very long time ago a feature was introduced that is called metadata file or metadata json

and basically what it does is that at the end of the byte code the bytecode is the part that gets compiled when you write solidity and then you compile it then the result is a white code so at the end of this bytecode you find a hash and it shows you or hex data that shows you the used compiler version and a swarm or ipfs hash and if you follow that link you can find a lot of things that are very important for what we are talking about the full compiler version complete abi of the contract developer documentation user documentation also called netspec and the compiler settings to recompile the code to the bytecode yeah unfortunately right now the power

of these metadata files is still not leveraged and that is why i'm standing here and trying to spread the word about it what is netspec netspec is basically a form of code commenting it's short for ethereum natural language specification format and that means it provides rich documentation for functions return variables and more in the form of comments and that can be categorized in developer focused comments and you end user focused messages and especially today focusing on the end user focus messages they are crucial to users since they are the part of the information that in the example in the beginning could be displayed in the wallet so that i

actually know what i'm doing instead of looking at hex strings yeah you can see an example of how that could look like here so basically on the left we see again the hex data and on the right we see how this could look like we would see what function type it is what arguments it has so in this example we want to again renew an e s domain and we see the name of the ns domain we can confirm the duration we see basically what the description of this function interaction is and even better we also see that the source code and metadata files have been verified on sourcify and if i would click on a link here

i would probably see some sort of contract repository where i could even look at the source myself if i'm a developer so that would be a much more informed decision that i could take here in terms of do i really want to interact in this way or not okay so so how do we get there and what does sourcify currently do to um to help us get there the biggest part of sourcify's currently in automatic monitoring and verifier service that is actually a super handy thing because right now developers if they want to verify their code they have to go to etherscan or to other services and they have to upload all their sales files and it's

sometimes a very long and annoying process and this automated monitoring and verifier service what it does is basically it listens to the blockchain into newly produced blocks it checks in the blocks where the new contracts have been deployed and if yes then it follows this hash that is in the byte code to find the metadata and then to basically make sure that this metadata doesn't get lost on ipfs and then the next point the contract repository basically puts all these files in the contract repository including the metadata um like the api and uh yeah then the data is safe doesn't get lost and wallets or other tools could use it

and that all actually without the developer needing to do anything under certain circumstances but you can also manually verify your contracts for example you deployed a contract before sourcify was out there or maybe you didn't have your source code published so so if i couldn't find it in these cases um you can use the manual verification interface or also one of the several verification plugins that are out there in ides like remix and hardhead also at this point a huge shout out to the community contributors that also help us with this it's not only the core project but we really have an awesome community as well who supports us and lastly there's a fetcher which means you can as a user or a curious person

input the contract address and check whether this contract has been verified and if yes it will again lead you to the contract repository yeah if you have seen last year's talk you might be wondering okay it's been a year what have the guys been up to is there anything new it actually actually there's a lot of new stuff we had a complete ui revamp we are actually even working on a new iteration right now we have added support for many more chains of course we support ethereum and all ethereum test nets but additionally to that also added support for cello avalanche binance polygon you name it we have more plugins and integrations now like hard hat remix blog scout we have a cli

creation code database support for libraries and immutables and the option to reuse existing files uh if you have no clue what that means then don't worry because then it doesn't really affect you okay yeah sorry that this uh gif is so blurry but this is basically a little video of how you can use the manual verification interface um to verify uh your code and in this example basically all i did was input a contract address to check whether it has been verified and it showed me in the beginning yeah so basically i choose the chain here i input the contract address i click verify without uploading files because i just want to know whether it

has been verified okay has been verified amazing so i click on the repository link and i see it has been a full match which means also metadata is available and i can see all the data in the contract repository that sounds amazing right problem is we cannot do it alone we have uh build it as it stands right now but actually uh we need to the whole ecosystem to work together on this to make this a reality and to actually have the end users benefit from this before i rant about what the ecosystem should do i want to give some shout outs to very great initiatives that are already now and today working towards safer contract interactions

we have an block scout integration where basically you can already see whether contracts have been verified if you click on the code tab there's amazing hardware wallet called keystone wallet which actually leverages the 60k contracts that are in the cersify repository to already today display this information that i just showed you on the meta mask screenshots so basically in this example you could already today see way more human readable information before you have to sign a transaction because they make use of the metadata files that are in the source in the repository of sourcify and then also other amazing initiatives good plus has been uh

endlessly working on how to make making contract interactions more safe and deb note has been thinking with us about how we can decentralize the society service more okay so let's look at what people can do to bring this to everybody firstly what can web developers do very easy and straightforward use netspec to comment your code so this means for all end user facing functions right there in the netspec format if possible what the function does in human readable language then secondly use auto publishing which basically means every time you deploy a contract the source files and the metadata files

get uploaded to ipfs automatically and yeah lastly verify your code which means upload your source code files and metadata files for example using sourcify but in the very best case it gets already uh caught by the automated verifier service and you have to do nothing but that only when all the files are available okay what can the broader ecosystem do there's lots of stuff actually deployment tools and ides shall encourage auto publishing that i've described before or even make it the default i think we are all open source enthusiasts here and people that do not want their code to be open source they should go the extra step and

disable whatever auto publishing functional wallets can display human readable contract information in by making use of basically abi and sources that are for example available in the society repository the ecosystem can help to expand net specs that's the format that i've talked about before it's currently not perfectly specified and yeah we would really appreciate the ecosystem to jump in here to give us feedback and to even help expand the specification format further and also give wallets confidence to actually display this human readable information of the netspec so basically by verifying it

uh via services like sourcify block explorers can add social file support and organizations can help host the data because it's growing quite big and we want to stay decentralized and yeah for what users can do i really only have one question but it's a or one ask it's a very simple ask and yeah i really ask you all to shout it from the mountains do not use unverified code it's as easy as that yeah i actually stole a flowchart here from nick i made you a flowchart have they published and verified the source code on of their contracts i edit on sourcify um yes maybe use them because you guys know

we can never be sure it's not a guarantee for everything no definitely do not use them and that's right now unfortunately not the case so please go out there educate and also follow the best practices yourself what should you take home from this talk no matter whether you are deaf or user always verify your contracts or always check if they have been verified and also even more important demand verification so if you bump into an app and you realize they haven't verified their code tweet at them go to their support channel if you know somebody from the developers talk to them and tell them

hey your your code is not verified i'm not going to use this unless it has been verified um yeah raise awareness for the safety risks because otherwise we will never get there and for the more technical people pin the society content on ipfs join us in the calls we have a weekly call you can contribute code if you like and yeah generally help us decentralize socify yeah with that i'm already almost at the end of my talk let's stay in touch we have a website it's sourcify.def or in the web3 socify.eth we are on github we are on twitter at sourcifyeath and i'm on twitter at francie and you can join the conversation in

discord or github they are bridged and you will find the discord invite in the message of our twitter and last but not least a huge shout out and thanks and credit to chris eddie fabian yakov and lee they are the ones with the vision they are the ones who built cersify i'm only the messenger today and yeah vic thank you and of course to you guys i'm not sure if we have time for questions okay thanks a lot for the talk uh in the gif where you showed

the verification process and you upload the smart contract containing the nut spec comments so it's clear how you check the smart contract versus the byte code on chain but how do you ensure that the net spec comments are genuine do you mean how the verification works yeah especially of the nat spec yeah the netspec is part of the metadata file as far as i know so you can basically uh when you recompile everything that should be included but i'm not technical so maybe you ask the guys that sit here in the front oh yakov do you want to respond one second somebody will give you an answer

uh hi i don't know who i'm answering too yeah yeah yeah you can never be sure that the developer didn't write something misleading in the net spec but we can only verify that that code was published and deployed so there's that thanks a lot yeah i forgot about that but now i remember it myself basically that's why open source is so important because we assume that everybody is open source it's out there in the wild other people can see it so you could basically call them out but yeah it relies on basically the developer network to work together and somebody actually looking at it other questions

hi i was wondering if a source fire would work for other languages than solidity say if one day there is something replace solidity for ethereum um i mean solidity uh cersify in general is like a project that is bigger than uh just the components that i've mentioned so far so i think at its core is the effort to really raise awareness in terms of open source source verification and uh code commenting so sourcify will always be there for other languages as well right now in this uh recompilation process and automatic verification process we only support solidity

but with my minor technical understanding i would guess we could also support other languages but um yeah that's not planned or on the pipeline in the newer future future as far as i know yeah hi uh thanks for your talk so i liked one of the examples uh which involved the decay layer so layer two in your in your example so showing that it's hard to verify what they do and i think that in the future we might have a lot of a lot more of those layers happening with hashes basically that you have to validate which are parameters of another transaction so is there a way to deal with that we socify like linking

several transactions together or describing that the parameter is a hash of something else or is there a way to basically make those kind of boxes and linking stuff together i'm not sure if i understand the question correctly oh okay we can we can talk later yeah so basically we added support for side chains that are like layer two solutions so that is already there but i'm not sure what you mean with the linking parameters i just have a small suggestion it seemed

like in the demo you have to drop files right why can't you just put like a git repo on it to speed up the process so that way i don't have to download and then right you just get the url and that's it yeah um yeah um i'm not sure if we were thinking about that already but uh yeah i see thumbs up so yeah we can think about that okay seems like there are no more questions thank you guys you