Devchain 7 Nov 2017

and [Music] and so hello everybody my robot them - it works it for my databases and I will talk today about security traps in particular you mention about general areas where we are in the in the blockchain so we check how many of you are familiar with validity because you will do some code snippets with a solidity how many of you are familiar with programming in general ok I hope you get it so just to give you the perspective about the market and why this traps so basically the market is pretty spicy as you can see the market value of Bitcoin itself is hundred twenty billions of dollars and with a growing period when t 8 billions repost 7.9 billions and because and 1,200 other outcomes listed on iphone my market cap so since there's all this market is so open its being really attractive for granted and that's why it's really important to see that everybody is addressed and every year since there are more and more people in a crypto more and more business publishing or doing the business and we are more exposed more spicy for for the dresses and we can see exponential growth everywhere by what I mean by a crowbar in the crypto world but in general the i-team 2015 and in the u.s. yes we can observe that every 10th person is a victim of some itis IT branch there were 48 Twitter losses for corporate so it's a huge topic and now if we don't talk to the open one of the cryptocurrency projects it's like putting everything you have yeah to an open network of course the network is so this is supposed to be secure but the developer the human behind it is not and that's why it's so attractive to many so the T's are there yes it's not that they are coming from because of the spicy cryptocurrency war yes they already exist so if we can just divide what kind of batches are there and we can we can talk about social practice i tickles and a smart contract so last week there was an IC or chain detail about the security and Najib he made a great presentation about the social aspect social aspect and the ICO aspect of the security here is it seems as since this is a deaf gang we would like to focus more on the Engineering part of it in particular the high tea culture has my contracts and the most popular let's say Network for basically doing the business in fact and in 2007 seventeen already we could observe that the criminals so one percent of the total market value of material so if you remember it's twenty eight billion it means that two hundred one percent of the total market value to go to a balanced and a bank use one percent just of them because of the no one nobody will not be prolific say yes okay we are better because we do something half percent this will not work for any banking industry and so here you would like I would like to present to show you yes like mitosis company was behind us you know IT falls and IT branches and by the way that that the beat control is estimated to be even higher and but this goes of the interview mostly it goes for the for this IT post on the Bitcoin on the other hand it goes most people for the social social aspect so stealing the wallets doing the fishing and so on yes and now in fact the coinbase note is you can see on the bottom and they say that on this fabulous they made a marriage basically from last two three years my dad there is a contest accounts all those videos five minutes every of the each of this year and this chance most people the beach when Don says in fact because Biffle is the market volume of the fitment one base is the biggest one okay so let's talk about the smart contracts why there is this huge risk the high risk on the smart contracts itself because this is the part where we can do this IT oh yes there is no software which can be bulletproof and there is no other software which can verify the other software that that it works this is impossible and a smart contract special queue because they could contain the found pumps they can manage the house and once we can break a smart contract yes we can get the access and transfer the stamps in that last week okay very nice experience after the icefield change event yes when I was just promoting hard boards saying ok why we need the hardware wallet if we can just put and put the money into contracts on it or some company so as you could see as the coinbase is salvages talk to be fortress in the US the Gmail for the email the wallet for the for the crypto vault yes you can't secure this social network and for the smart contract itself when we make the public everybody can look at them so in the context everybody some of the notes that you own that you have an account you are already affecting yes probably the hands of bottom which you try to spy you in and make some completion of social attack and the smart contract is the same since there are public all the company's projects which are based on the blockchain if they count about the reputation they also have the nowadays we leaked the world where we want to make something public if I would publish a contract and you can't verify it yes it's already or maybe just come you shouldn't invest in this so big majority of the projects we observe happens on the blockchain on the basis that they're open so everybody can verify and check what's actually happening there and this is the future of this ice cube boom yes that we can fast because somebody made the analysis it's open and it works so it was say most of the cases accepted there is a back and nobody spent enough time to find it and this is the part I would like to share with you so it's a solidity is a little bit these are design errors it makes pH before look like a work of genius so basically what it make like we give you the language you can you can operate which looks like being an easy easy thing so one of the design decisions for the solidity was it should be easy to consume by the programmers and they make it JavaScript life which means that it's very hard to prove something and solidity and of course it's not JavaScript yes so it's it's the main language but the way I'm structure eyes it's not functional in a way that there's a strong type type in there is a sonic semantic operation on top of that it's like making the operational statement so something like PHP guys would look like when to increase before back ten years ago yes we would think about actually doesn't work or not they would only see observe the effect or one use based on one test yes press ENTER refresh okay works great our permission and it doesn't matter if its operational super expensive or want it works on in this particular case so solidity is kind of similar here yet you can pretty easily do the do the job yes there are tons of straps and have a claim Kiran will convince you that solid it is a dangerous language so first of all I guess that seems authority of you right the hand of programming so you know what is it this yes somebody wrote in this probably will connect it to some object oriented and and so preference so when you see this the solidity and the method collect this dot set X and then we'll teach you like when you get twenty minutes or a lamp solidity in twenty minutes yes you could think that those two guys are the same so calling in the contract disk of set X and said X there is no way compiler nothing change and check it if you were using it correctly or not I mean this is just an example the singular intuition your face at almost every step and compiler doesn't help you at least now so let's go for this use case and look in this is no more detail solidity itself doesn't come with kind of a standard light driving which we are now I would say familiar take the one language when the Parliament be expected to use a standard library which works which we trust and it's solid so let's take a sample of string everybody know whenever you do something you do the identification string is one of the most popular type in any programming language probably just next to them and the numbers and in solidity if you want to basically connect to strings if you want to check have the brackets mark some regular expression it doesn't exist yeah so you are again now face to many error from things like you don't think about when doing normal coding yes so how many of you for example do some right like recently write a function to check it one string as a suspect substring of another string probably like last time you did it was in the university and we could would like to do it without the test and whether you could do like a simple error because we didn't check some edge case is empty whatever yes or take the minimum and this is where it goes back to this PHP for yes a night we are trying to get something super simple and expect that it will work but can you just pay unexpectedly once the contract is there with co-creation you are not supposed to change it so there are many things you will have to do by hand and probably most of us know like the programmers that usually yes the Box the most stupid backs are the easy things because we just think oh yeah and I did hundred times I don't need to write a test about it because it's so simple yes and so let's talk about the arithmetic so the blockchain what we think that is designed for economics financial management so I said that you know we have strange remembers immaterial probably most of them of the project are dealing with the finance and do you think there exists any banking system now language or a library which treats the numbers as only integers and that not yes they either can a specialized type or for having decimals so being like no hundred percent accurate yes or they just do a double store or this kinds of things yes in solidity guess what you don't have the floating points you don't have decimal so everything is a stupid integer and of course you don't want to have a say $1 because they say 1.11 yes because I need you you know that you don't notice any project you need to divide it into the same into divided so what's happening we just say okay back 1 Peter yes it was 10 10 power 18 yes units so we do the the decimals artificially yes we implement decimals as integers and what's happening what if somebody forgot about it what if somebody does you know do something differently well we have an Excel and let's look at this example here so the first line is technically Maki simple math or addiction ami it's an address to the unit and called balances so quite basically the idea is yes we map yes who owns how much time and we saw natural numbers and let's say that we want to have a simple function increase the balance so somebody wants to increase the time okay pretty simple yes where is the back yes that's good any other so yeah it's a very good catch over so let's say this is you and I would have another example for that and there's a sign over crow so if you want to increase the balance and make this function I know somehow don't only the older balances ten more accountants incorporate with that and of course we know that we can't go back the changes then what we can do q yes we can increase the balance that's good the second yes it's the other problem we can go the result of this operation can exceed the maximum amount which you can store in a union get negative yes so we need to require check if it's the bigger or equal zero and here's another example let's say that this highlight over comment so in that 8-bit integer and so it said that the maximum number you can store is 265 so we need to make sure that next part about making this errors is because we always want me do the coding here each operation cost us a money as we cover the gas so another is that we program evil to optimize these operations and reduce the number of the Corrections we do like programming language yes everybody will teach you that structure rise make the correct variables and so on two separate functions here you need to do that okay if you do it like wrongly that the function could cost twice as much just only because you take X to the target variables so you can add a move this yes okay that was required for complex putting these things together and in fact this is the right great way to to write this contract the dysfunction yes this one will protect you the overclock and it's gas optimum so that it is not obvious and pH before and the pigs before white people to it just so simple have a parrot so what is this anybody like you know any java world or whatever fight on two-dimensional around a two-dimensional array but how would you put this dimension like the fact we have five hours of of slices or slices of byte arrays of arrays with focus on that which is my mother's the networks which dimension is the dimension or the second dimensions okay and now the fifth dimension here and the trick is that when you declare it fights in the first dimensions but when you will access it it's opposite and so again syntax loops neck it's familiar yes you can get it because you already two different sites well well put a man enough attention again strapped for and if you jump to the right this edge step again so here in this exact ways - loops what's wrong with this load oh yeah we just want to increment so we can erase the factual text italic and we want to do each element of the array yes we okay it should be instead of eat it should be let's say okay this is not a good example it's fine I got subject is different in my practice okay so we just reassigning the elements now a yes second parameter is named RI and inside you use a but yes [Music] but if I was happening it's here so we have the tiny e as a default type for 0 and so it's 18 the default type is like the smallest stack which can hold this value so this will be attained what does it mean it can hold on name to just up to 255 or they need to move the Union right yes the K system is the limit of small and if the array has more than 288 element this book will never stop just still critic circulating all over all over again until we will run out of gas so okay we can fix it yeah we can say ok gather in 8 so we know that will stop I mean this is what how how it works those are two cases tested by solidity and yes maybe the last example because and the time is over so this is a standard TRC 20 function so the goal of transferred from is basically to transfer the fans from one account to the other one and let's assume that we can do it okay so it was a simple text yes I am a figure than zero and then we do the operation yes so we subtract fmeca from the source account to the destination and here basically what is this line saying that we will fall and even otherwise top you can see [Music] so and they'd be able to smoke you I will just give you the hint that are many more than one more than my back can be overflow on balances to the work interpretation of the transfer from because it takes only owner can executed okay so this contract my amazing PR sequential token invest money into to my startup as the functions once one yeah okay on the owner can execute this function so what's happening so you put the money yeah everything is the accounting works the ICO is over and mean the owner and the transferring or your tokens and my accountant put the business quickly then exchange it Senate whatever yet so again yes and by the way this kind of bad like on the owner which looks that way yeah yeah it's okay it's okay was that not exactly this thing but the same in the same concept with the various particle apps where they where they Wallace thanks much to their contract yes got broken and stone and all around hundred fifty billion seconds comedians so I mean you can see that yeah it's it's stupid but it happens in the real world okay so this is the part 1 enjoy it and if you do please write it out on a Facebook on the stack and we can go for them to make a sign about yes there are for example second hour Viper now is to Superman the second Vitalik I think he is by himself I'm contributing to it ok [Applause] okay please explain us our is looking at [Music] next December hopefully confusion so I discovered with [Music] my guess the question is how many developers idea but there only yes in fact is great to have a bunch of technical guys but my question was at one point in time mortgage is great the technology but is there someone using it if there's some money in research I have found examples that are really introduction I'm not sure if you are well any other examples that are ready to be used the art science case which i think is quite an interesting one I would use it if I would go from the traditional rights I am so the subject for the case for business oriented so feel free to jump in if you have other examples of critius sorry the power to smart insurance on eternal option and obviously the backside is case I guess this one is connected now again I know what Roberto is doing but I'm coming more from business so I'd like to understand what's the value I didn't rope chain so many have a look at the right insurance that has been put in place by hasta it's mainly a smart destroyed by broke chain and what maybe the customer is getting in fact there are many advantages if I were to put it correctly and I think also a number of people's coming from McKinsey the loyalty of those companies that are defining depicted Friends of the industries and mainly when they look at the insurance and it might be travel insurance it might be whatever type of insurance name it where there is it what the guys learn to me there is a trust issue and the probe chain is not that expensive as we'll compared to a simple database yeah it might be and mainly is provide customers initials it means to management in a transparent responsive and a magnet and this is quite important so I'm not sure if you have right too late and you're trying to get the money back this is a really really really we are all right thing in yes between doing the documents contacting the airlines and getting your money and buy me months very good mode the single thing that protein is resolving when we look at the five insurance it's like paying for the claims yeah so the payments are triggered automatically when certain conditions permit yeah in our case you want be the fact that we didn't I and third thing is that the place and the customer nation is stored on the roaches so we no longer look I guess with couple of exceptions that explaining the president's activities somehow capita and as a businessperson I guess the most important thing is that if we look at the customer experience which is the most important thing because of the technology that we are using is like giving the customers a better experience and this is something that I guess all of us we expect from whatever product of the room working now from my what I call technical perspective as far I can go into technical details the way that it's working is quite an easy I never activated so mainly they have a mobile application if I get a website which is responsive so you can go boy say you go out there you fit in your ticket number you fit in your name and then they propose you to buy the insurance yeah and maybe they give it an example you're gonna see it in the next slide you pay like five bucks for a travel insurance if your flight is delayed for two hours you get back hundred bucks which is not that bad so they have this mobile application obviously they have a smart contract in place and then they will realize part which is my police can explain it better and then everything is connected in real time with a AP is coming from the public databases so once you have applied that it's alleged the public databases are updated and we are wearing KPIs to get this information so as I was saying the smart contract is connected to the global air traffic capability so as soon delay the composition is triggered automatically and you can think of many use cases like this one because I guess you guys you like to develop but you like also to get some money at one point in time with the development this is how the insurance look like and what I found also quite interesting many when we talk about insurance is that the amount of conversation that is this place is exactly what you're paying yeah so there is no hidden cost for me it's a quite quite an interesting point also so once you submit your requirement to get this insurance everything is the road chicken sauce somehow is gonna stay there for the end of the ride if I trust my colleagues and then if you stress that until hell freezes over obviously they are stuck for example they cannot change the terms of the equity issuance by so again this is the mainly the business logic that they they have behind the scenes so if your plan is made more than two hours again probably databases that this information will be very organization and the fact is suddenly the smart contract if I look at the conditions they have many condition and then they have different type of insurance depending on the how much time you're on Fridays palladium now the application is alike so it's on like September 2017 this is the website this is the page thing kind of what I explained you may need from a business perspective as this is a better operation they are covering only two flights from us to do good Atlantic quest but what they are saying is that they come for the rest of the world by 2080 so it's just to give you in fact a short example is broke changing the insurance industry obviously where the money goes any questions for any of these again I don't work for answer I have not been involved in the project so no I just did that the beginning I was but still you think there is another market for less than two hours because if you have these five dollar premium for payment of 100 I think there's a whole market of less than two hours that is not used as well and does that would that come with that imply also the civil counseling of the fight Mike Dugan is stupid question but since its most attracted he's coming mother he is not stupid at all the question now the question I guess is more related to if those eight years they are really real time and you can get the information in less than two hours yeah cos made it the problem is like hopefully at the information right so I wouldn't see any technical issue for it less than two hours now from a business perspective for AXA I'm not sure oh he's a good it is for me but yeah definitely everything makes sense as long as you manage to get the information in real time and you're smart contract as this the right condition the three get the payment or something else with a nation's great marketing we do you have a customer choosing easy he's kind of insurance and pinion a higher premium if he wants to be truthful less than two hours and the lower premium if you want but they have shown the interface so if I did all the documentation because I don't have a site you need to have tremendous it's not you need to have a pipe it runs at elastic like the content I don't plan to have one in the near future but you can choose between the different plans is if you look in here you see they have this point I just realize my code right so in here you can choose the different types of issues that you want to happen if you look at the conditions that they are showing in this pistoi you see that yes so it's vitally lessons hours more than three hours relevant to that question actually what is the financial benefit of as that to have this on the blockchain for example but I think a great part of prophet Elijah is people not claiming the case when a flight is delayed that's how they earn a lot of money now if everything is triggered automatically then as I'm gonna lose money right of course they save a few people working on the paper documents you know especially even in case and everything but you know they will have to pay out a lot more I mean it's for the plants of course but funny if the company basically say it's let's not go on blockchain and should you know keep our business like that we become be math we are basically in the end I think it's really the benefit in the cost whether it makes sense I'm sure it will make sense in the long to wait for copies for access because they can get like the better branding the company is also customer experience is really so r01 I know where we are as mentality so maybe Pharaoh Moses this is a huge difference in the customer experience maybe they can annoys I'm sure they but even if they lose a bit of money at the beginning [Music] any one of you knows of any application or line ready to be used production not start on what I see [Applause] [Music] well the goal like so change need to share the knowledge I kind of shaking the traditional investment so as you can see is that since the beginning of the year we have with the more than 300 ice fields launched that have raised three millions of dollars so during our first book a certain area we discussed about what is a nice view so we had the chance to you have snacks with words the difference between PC and SEO as well I peel we had also we shall then start up in San Francisco and he shared with us he explains the steps to go through a free committee and yes you how to do as a starter then our second event last week was about security and Ice Cube so we have the job exit a cosmopolitan blacks who came to share this view and yeah because this this stuff that has been kind of attempt with weeks tiger attack attack sorry the head of cyber security at Gap who shared the cyber security aspects how to protect how to protect a nice you know how to protect or what ads and everything we have two more events one in December the next in January we hope because we just want to share the knowledge and our team so our team there is the city that that connects all so it's you and he's also saying there is being sound well I have ten years of experience with doing also actually and currently a PhD with lesser burden economy and politics we're going off the blockchain relation aspects [Applause] [Music] and handsome so there will be two groups so basically one will be lead by me and John Franco and we will try to improve a heart coin so it's a kind of open source project which is a proof of concept of a promotion like a shellack promotion royal reality coin where we can exchange basically look at some this comes and this will be basically recording another one will be more tunic need by xoring and crystal they will be to show me how to do manage to wallet so basically the operation of the wallet and just one idea with a good goodbye basically and now we will have a pizza so just talk to us and by now who is that who is interested in which one let's say suppose interested in a word management okay who's interested in coding okay so it works so we must probably to do when it's passed here in this space you have already probably let me just become there make sense man it's like a break at a party [Music] right [Music] you're alive on YouTube can you give me the hash of the wall [Music] it's time