Decentralized Apps and Smart Contracts

This chapter focuses on the security aspects of Decentralized Applications (DApps). It shows the best practices to be adopted when developing, creating, and executing certain DApps such as smart contracts. The reference platform for our analysis will be the Ethereum environment, as it represents the most widespread platform for the development of DApps. However, most of the concepts that will be described are easily extensible to other development platforms.

The topics covered in the chapter are as follows:

• Introducing DApps
• Introducing smart contract fundamentals
• Creating secure smart contracts
• Executing secure smart contracts

Let's start by analyzing what a DApp is.

Technical requirements

The code files of this chapter can be found on GitHub:
https://github.com/PacktPublishing/-Securing-Blockchain-Networks-like-Ethereum-and-Hyperledger-Fabric/tree/master/Chapter06

Check out the following video to see the Code in Action: https://bit.ly/2VbhqMK

Introducing DApps

Much of the attractiveness represented by blockchain technology is linked to the possibility of implementing safe and transparent solutions to solve common problems. We can develop DApps to exploit the characteristics of transparency and security made available by the blockchain. This development strategy is thus considered consistent with the logic of decentralization that it is possible to implement with blockchain technology.

In traditional software solutions, data is stored within a centralized server, and access to data is allowed through predefined application interfaces. As such, the architecture of traditional software solutions constitutes a single point of failure.

With the blockchain, however, the data is distributed in a myriad of nodes, in a redundant form, thus preventing the possibility of loss and corruption of the information stored. On the other...

Introducing smart contract fundamentals

Smart contracts were first theorized by Nick Szabo, defining them in a 1994 article (available at http://firstmonday.org/ojs/index.php/fm/article/view/548) as an electronic transaction protocol designed to execute the terms and conditions of a contract without depending on trusted intermediaries due to the minimization of execution exceptions.

These objectives are achieved by automating the contractual clauses embedded into the software and made self-enforcing by resorting to automated settlements, without the need for legal systems or trusted intermediaries.

Originally, smart contracts were implemented in limited form in Bitcoin, through the use of scripts developed in a non-Turing-complete language. Scripts allowed the transfer of Bitcoins between users of the network without the need to resort to reliable intermediaries.

In the next section...

Creating secure smart contracts

To create smart contracts on the Ethereum platform, it is necessary to write the code in one of the supported languages (Solidity is the default language), then compile the code, thus obtaining the bytecode for the EVM, and finally deploy the contract on the platform. Unlike other blockchains (such as Bitcoin's), Ethereum supports the development of smart contracts through Turing-complete programming languages.

In the following section, we'll see the consequences of using Turing-complete development languages for smart contract security.

Developing smart contracts with Turing-complete languages

Ethereum was the first smart contract development platform to allow the use of Turing-complete...

Executing secure smart contracts

As we know, smart contracts in Ethereum are executed within the EVM. The EVM is a virtual machine that also acts as a sandbox, thus preventing smart contracts from directly accessing the network and other shared resources of the blockchain. To update the data stored within the blockchain, the only viable way is therefore to instantiate a transaction, which must be validated by the network nodes. Transactions can also be instantiated by smart contracts.

In the following sections, we will see the best practices that we can adopt to ensure the security of transactions within smart contracts.

Best practices for smart contract security

Smart contracts represent a relatively recent innovation. Therefore...

Summary

In this chapter, we introduced DApps and their characteristics. We explored the fundamentals of smart contracts, with particular reference to the Ethereum platform. We understood the potential risks associated with the presence of software bugs in smart contracts developed with Turing-complete programming languages. We also learned how to create and execute secure smart contracts using the best practices for assuring smart contract security.

In the next chapter, we will deal with threat prevention and analysis of the most common attacks targeting DApps.