Original author: Carl Hua, Partner and CTO of Shima Capital
After the recent Curve reentrancy exploit, I reflected on my experience at JPL NASA, where I learned key principles for developing reliable and resilient software. These insights are now more important than ever for the cryptocurrency industry, for the following reasons:
Ultimately, people only truly care about two types of software: software that can kill you, and software that can make you lose money.
In the critical software of any spacecraft, the majority of the budget (80%+) is not allocated to development itself, but to integration and testing. If the software fails, the spacecraft will come crashing down – be it a fighter jet, a drone, or a spacecraft.
- Stanford Blockchain Club How does Lens Protocol build an open on-chain social graph?
- EigenLayer – The Most Ambitious Restaking Protocol of 2023
- What kind of future can Vitalik Buterin’s emphasized account abstraction bring?
Most of the code in spacecraft software (if classified as critical modules) adheres to extremely strict testing/development standards, such as DO-178B Level A. Not only is every line of code tested, but if there is nested logic, each logical condition is also specifically tested.
At JPL NASA, the idea of writing advanced spacecraft software is not about writing the most beautiful, clean code, but about writing code that is easy to unit test. Why? It’s simple: when you send a spacecraft into space, you only have one chance, and no one wants to take the risk of a high failure rate. This is the same logic as with blockchain, as immutable code is its important feature, and we only have one chance to correctly use our funds in each transaction, so why not take the development of dApps more seriously?
Despite strict development, testing, and code auditing processes, these measures are obviously not enough to mitigate all errors and attacks, as it is practically impossible to eliminate all runtime errors through testing and auditing. So how do we protect our software from failure?
Runtime Protection
Runtime protection is a security technology that protects software applications from malicious attacks during runtime. Its principle is to perform real-time detection and analysis of the actual behavior of the code to protect the program from the impact of malicious data and attacks.
Runtime protection for high-reliability software requires a significant investment and design, as it is the last line of defense to ensure that the software does not enter an unknown state or fail. This is not just an argument, but a practice that has been verified for decades.
Today, in Web3, I believe that DeFi applications need the same high reliability and should consider the same approach. However, due to its potential limitations, the EVM is not designed to handle complex tasks such as runtime protection. So how do we provide runtime protection?
One way is through Aspect-oriented programming, which is designed by the Artela blockchain network. It can switch execution contexts within the lifecycle of any smart contract transaction to perform advanced checks on the real-time state of the program. Artela provides a unique design for runtime protection by combining Aspects with EVM compatibility, and it has the potential to become the future foundation for secure cryptocurrency smart contracts.
Like what you're reading? Subscribe to our top stories.
We will continue to update Gambling Chain; if you have any questions or suggestions, please contact us!
