In Ethereum it is very easy to audit a smart contract as its source is posted in the blockchain. In EOS, the generated web assembly code is published. In this case, how can we check if the published contract corresponds to a particular source code?
Add a comment
|
The process is not different from Ethereum.
First of all, on Ethereum the smart contract source code or ABI is not posted in the blockchain. Usually the source code is posted on Github. A verified repeatable build on the smart contract can be easily done on Etherscan service, that is a privately run company from Malaysia.
The process of checking source code for EOS and Ethereum are similar, albeit I do not have yet details how to make the process very user friendly.
Get claimed source code of the smart contract (Usually in a form of a git revision)
Get compilation (compile switches) and deployment input parameters (constructor args)
Recompile the source code
Check that the compiler bytecode output matches the bytecode deployed on a blockchain
Extra: Check that the contract state matches what is promised in the external specification (dates, addresses, etc.)
This is not different from any reproducible build methodology.
“EOSpark.com launches EOS contract source code verification” see this article.
