Thinking About Smart Contract Security
&gt; The reason for this fundamental conclusion is as follows. All instances of smart contract theft or loss – in fact, the very definition of smart contract theft or loss, is fundamentally about differences between implementation and intent.<p>This is, I think, to its core the fundamental problem with any kind of rigid language in contracts. It&#x27;s nice to see an acknowledgement of its existence, but disappointing to see <i></i>no<i></i> acknowledgement of its severity. We see this all the time, not just in code, but in law and policy as well: an overly-prescriptive law can be just as problematic as an overly-vague one. And imperatively written smart contracts are about as prescriptive as you can get.<p>This is of course in addition to another critical shortcoming for smart contracts: they are capable only of interacting with informational assets (of which &quot;money&quot; is a subset). You can&#x27;t possibly create a smart contract to purchase a house, because at the end of the day the person that physically occupies the house is in the position of power. Any smart contract enforcement mechanism would necessarily rely upon some outside system, which defeats the whole purpose of the thing in the first place.<p>I have high hopes for cryptocurrencies, in no small part because they inherently deal with only information (again, money is a subset thereof). But I&#x27;ll be honest: I remain extremely skeptical that smart contracts <i>as we currently understand them</i> will ever see general adoption. It strikes me as an emotionally understandable, but rationally ill-advised, radical departure from hundreds of years of political philosophy and sociology... not in a way that inspires the term &quot;disruption&quot;, but rather in a way that evokes &quot;out of the frying pan, and into a boiling pot of lava&quot;. I&#x27;m all for &quot;a better contracts system&quot;, but given that a contract (even one with a non-human entity) is by its very definition a social instrument, I just fail to see a reasonable way forward for what is essentially contractual bytecode.