by Manuel Araoz
Last week, we saw one of the biggest hacks in the history of smart contract applications. ~30M USD were lost due to a simple programmer error, leaving critical functions open for anyone to call. It’s high time we get serious about writing secure contracts, if we want decentralized applications to reach their full potential.
In the early days of computing, writing code into machines was a difficult and inefficient endeavor. There were few tools and resources available for programmers, and specialized magazines were the main distribution media for software. Major operating systems were not yet available, so each computer model required machine-specific knowledge to be programmed. This is what it feels like to work with smart contracts in 2017.
The State of Smart Contract Programming
Ethereum changed the world by creating a distributed global shared virtual machine known as the EVM. Anyone can now use this virtual machine to run programs that handle real money and formalize contractual relationships via code. The promise is huge: we’re creating a new global and natively-digital economy based on software.
Still, the tools developers are using to build towards this fantastic vision are very rudimentary. Once a contract is deployed, there’s no way to upgrade it, even for security reasons, which means applications can’t easily upgrade with new features and fixes; instead of calling standard libraries, application developers are copy/pasting code with each deployed contract, increasing deployment costs and margin for error; and, last but not least, debugging a contract’s failing function calls is hell with current tools.
Overall, the rate of innovation in building decentralized applications is limited by the manual and duplicative efforts projects must make to ensure basic usability and security.
Much like in the early days of computing, where operating systems enabled the development of feature-rich applications, the same is needed for the development of complex smart contract applications. We need an OS for the EVM.
What is zeppelinOS exactly
zeppelinOS is an open-source, distributed platform of tools and services on top of the EVM to develop and manage smart contract applications securely.
What would an EVM operating system look like? We thought about four main components, but other functions may arise in the future, as the industry evolves:
- zeppelinOS Kernel: an upgradeable and community-governed core of functionality provided by an on-chain smart contract library that developers can call for standard and common functions in their applications. The initial version of this is the current OpenZeppelin framework, migrated to library form. Shared code for smart contract applications to use, with curated opt-in security updates based on the proxy library pattern.
- zeppelinOS Scheduler: Every transaction on the Ethereum network is initiated and paid by a user. This places a limitation on the kinds of things a smart contract can do and sometimes creates unfair situations. For example, when executing a transaction via a standard multisig contract, the last owner to confirm it will trigger the actual call and pay for its gas costs. Or, if a crowdsale has some finalization logic when the cap is reached, the last token buyer will pay the gas cost of executing that. The zeppelinOS Scheduler will enable async execution on the EVM where a contract can request asynchronous execution of a function and anyone can pay the gas costs and be rewarded for it.
- zeppelinOS Marketplace: To catalyze exponential growth among decentralized applications, smart contracts must be able to interact with each other in a standard way. Imagine if Augur could talk to 0x to enable prediction market forecasting in any currency, all done using an Aragon company. This kind of interoperability would accelerate progress across the space, helping developers take the ecosystem mainstream, faster. Our proposed solution is to build a marketplace of inter-contract services natively inside the OS.
- zeppelinOS off-chain tools: As an addition to the on-chain services offered by zeppelinOS, the platform will provide a set of off-chain tools aimed at simplifying the development, debugging, testing, deployment, and monitoring of decentralized applications.
At Zeppelin Solutions, all of our efforts are focused on solving the technical challenges of smart contract application development. We’ve worked with dozens of projects on security audits, smart contract upgradability, contributed to improve and test development tools, and enabled interoperability through our OpenZeppelin standards and security patterns. We are developers ourselves. We believe we know how to make the smart contract development process better, easier and more robust.
We invite you to help us make this happen.
