CyberMiles’ Travis: Safety first
One of the greatest challenges for the Ethereum blockchain is security problems related to smart contracts. Studies have revealed that Ethereum smart contracts average 100 obvious bugs per 1000 lines of code. That is an order of magnitude higher than average non-financial software.
For CyberMiles, security is a two-pronged approach. We make enhancements to Ethereum both to prevent hacking from happening in the first place, and to provide a community-based consensus mechanism to recover lost fund and hold evil-doers accountable after the fact.
Preventive measures
We identified common patterns in past Ethereum fund losses, and prevent them from happening on the CyberMiles blockchain to start.
For example, on Ethereum, a lot of users have lost funds by mistakenly sending ERC20 tokens to the contract address, instead of a user account address. CyberMiles prohibits such actions by detecting and rejecting such transactions. Another leading cause of accidental fund loss is for users to send funds to contracts that already are terminated. CyberMiles detects, then stops, such attempts when processing the transactions.
There are many examples of such rules to make the CyberMiles blockchain more secure, and less prone to accidental fund loses. We will keep developing those rules as CyberMiles evolves.
Recovering lost funds
Even with the best preventive security, hacking and loss of funds could still occur. In the real world, police and law enforcement are responsible for recovering lost funds. It is not only the right thing to do for victims but also a deterrent to future crimes. In the decentralized world of blockchain networks, however, there is authority for “law enforcement.” In the history of Ethereum, two notable hacking events generated very different responses from the community:
- The DAO hacking resulted in a hard fork of the Ethereum blockchain in order to recover the funds stolen by the hackers. While the fund was recovered, the hard fork remains one of the most controversial decision in Ethereum history as it violates the “code is law” spirit of Ethereum.
- The Parity smart contract hacking resulted in EIP 867, which proposed an off chain mechanism to reach consensus and recover the locked funds. However, this EIP was ultimately defeated as the developer community did not believe it fits Ethereum’s mission and spirit. The lost fund is not yet recovered.
For CyberMiles, our approach is more pragmatic. We have designed an on-chain consensus process for validators to propose fund recovering operations, and then have all validators vote on such proposals. The proposal passes with 2/3 of validators voting yes, and the funds are recovered automatically as proposed in the next block. All proposals, votes, and subsequent recovery actions are recorded on the blockchain for all to see.
Technically, all of the proposals and voting are done via validator-only transactions submitted to the blockchain. The specifications of those transactions are available in the “governance” module of the web3-cmt toolkit. You can try them on the Travis TestNet.
Planning for long-term security
In the long term, we plan to make the smart contract platform far more accessible and easier to program than today’s Solidity programming language. Studies have shown that Solidity programs have far more bugs and errors than computer programs written in more conventional languages. The CyberMiles team pioneers in virtual machine innovations. Our long-term solution, beyond the Travis TestNet, is to bring modern software engineering into the smart contract platform, and make smart contracts much easier and more secure to develop and test.
Want to learn more? Just visit cybermiles.io.
