All articles

I am posting this previously unpublished post now because I’m clearing out my drafts folder, and I didn’t want to simply delete the post. I wrote it soon after the DAO hack, but before it became apparent that the White Hats rescue the remaining ether in The DAO (or as some have called it “safely steal the ether”). The post is probably only interesting for historical reasons. References to days of the week in this post are to be read as meaning the week of Friday, June 17th.

Introduction

In this second installment of a multi-part series of articles analyzing the nearly 170,000 interactions with “The DAO” smart contract, we discuss the contract’s “Creation Period.” Previously, we presented an overview of The DAO’s lifespan. In that overview, we identified four distinct timeframes: the Creation Period, the Operational Period, the Post-Hack Period, and the Recovery Period. In this installment, we focus our attention on the Creation Period. Future installments will analyze each of the remaining three periods separately.

…or How I Learned to Love the Input Data Field…

Introduction

In this three-part series, we analyze the nearly 170,000 transactions made against the ill-fated smart contract “The DOA” since its inception nearly five months ago. The DAO is dead. This series may serve as part of its eulogy.

The DAO lived through four distinct time periods, each characterized by different user behavior, being (1) the Creation Period, (2) the Operational Period, (3) the Post-Hack Period, and (4) the Recovery Period. This first part of our series gives a broad overview of these periods and is followed in the coming weeks with two more installments presenting further details.

In the wake of The Great DAO Debacle of 2016™, there have been many articles and blog posts concerning the need for the community to write more secure Solidity smart contracts.

One such article is Writing More Robust Smart Contracts by Elena Dimitrova of Colony.io. Here, Dimitrova discusses the use of function modifiers to verify — prior to a function’s execution — both the initiator of the transaction and the input to the transaction. The gist of the article, if I may summarize, is that by using readable and easily understandable modifiers, one may increase readability and help to insure that the function will execute only under certain conditions. This is an excellent idea, obviously, and one that all of us should follow.

I’m building a piece of software called EthSlurp. It’s a blockchain data scraper. It runs from the command line and takes various parameters such as an Ethereum contract address, an output format, a date and/or block range, and various other options.

The most salient feature of EthSlurp is its ability to convert a transaction’s input data (which is usually seen as unreadable hex) back into human readable text.

Every ethereum transaction carries with it an arbitrary amount of data in a field called input. The input field is one of the nuggets of true genius behind what Vitalik Buterin did — Bitcoin also carries input data in each transaction, but only 80 bytes worth. With Ethereum, the input data can be as long as needed. Ethereum sends function calls to smart contracts in the input field. In fact, the byte code of the smart contract itself is sent in the input field of the transaction that deploys the contract.

I used EthSlurp to scrape every transaction from The DAO since its inception. This first chart shows those transactions distributed by hour. There are more than 121,000 transactions:

As you can see, the transactions are relatively evenly distributed throughout the day. This is to be expected because the DAO token holders are presumably distributed evenly across the globe. This makes perfect sense.

So What?

Recently, a user called kumavis on TheDAO slack published a list of accounts that he thought may have been related to the attack on the DAO. Here is that list along with names kumavis provided for each account:

I am obsessed with the DAO. I spend a ridiculously large amount of time thinking about it, reading about it, and trying to figure it out. The most interesting thing to me is the data. The fact that the smallest transactions —both into and out of the DAO — are recorded forever is very interesting to me.

Ever since I got into Ethereum, I’ve been trying to figure out how to get at all that data. I’ve been hacking for weeks. I’ve diven (doven? dove?) into the depths of the core code. I’ve studied ‘geth,’ ‘eth,’ ‘mist,’ and ‘web3.’ I’ve learned how to use RESTful APIs and JSON. I had no idea what I was doing, but I knew what I wanted — I wanted that data.

When I was nine, my Dad took me to a Phillies baseball game for my birthday. I don’t remember the game, but I do remember that he yelled at me for not being careful with my money.

We were in the hot-dog line, and he asked me if I still had the money he gave me earlier, so I pulled four crumpled one-dollar bills out of my pocket. Two of the bills fell to the ground. Someone walking past accidentally kicked them, and I had to scramble to get them back.

Apparently there are two types of software engineers in the world. One type writes code, pushes it out into the world to see how it works, keeps track of the bugs, and then goes back to drawing board, re-writes the code, fixes the bugs, and re-releases. Write-release-fix, write-release-fix. A never-ending circle.

The other type of software engineer seems to be able to write code once, and because it was carefully planned and carefully implemented, it runs correctly forever. Write-release-done.

“The DAO” has been in existence for about a week, and besides the obvious pending decision concerning slock.it’s proposal for the USN, another major decision looms over the group. This decision will test the ability of, perhaps, as many as 10,000 people to come together, anonymously, and make a long-lasting decision. Let’s just say I’m a bit skeptical.

The locus of discussion on all issues related to “The DAO” (which is not its official name) is http://forum.daohub.org, which is the official-but-not-official home of “The DAO”, an organization-that-is-not-quite-an-organization.