Reviewing Ethereum Smart Contracts
It remains a complete embarrassment that Ethereum is based on a home-grown trainwreck of a programming language instead of one of the existing well-supported, battle-tested verifiable programming languages out there. Honestly, they could have used C and been better off because of the amount of C verification tools out there - Solidity hardly seems safer than C and its compiler has a history of potentially catastrophic newbie mistakes [1]. Note that some of these bugs are in <i>an optimizer</i>, something a security-focused package handling money shouldn&#x27;t even need, especially if it risks compromising correctness of the contracts.<p>People talk about Solidity being JS-inspired, but simply using JS would have also been better, because there is verification tooling out there for it, along with compression tooling to make it smaller. And people can use higher-level to-JS compilers like Typescript to get stronger safety assurances if they wish.<p>Any claims that performance justifies the use of a home-grown language are also absurd: High-performance trading firms like Jane Street make use of verifiable functional programming languages like OCaml despite the importance of speed &amp; latency in order to turn a profit. [2]<p>No amount of effort from security researchers is going to completely compensate for the fact that the people running Ethereum have incredibly bad taste and make poor decisions. I remain concerned for people who put their wealth at risk investing in smart contracts because the average contract probably has unnoticed issues.<p>[1] <a href="http:&#x2F;&#x2F;solidity.readthedocs.io&#x2F;en&#x2F;develop&#x2F;bugs.html" rel="nofollow">http:&#x2F;&#x2F;solidity.readthedocs.io&#x2F;en&#x2F;develop&#x2F;bugs.html</a><p>[2] <a href="https:&#x2F;&#x2F;www.janestreet.com&#x2F;technology&#x2F;" rel="nofollow">https:&#x2F;&#x2F;www.janestreet.com&#x2F;technology&#x2F;</a>