Can someone explain to me how on earth Ethereum is still a thing? People have lost hundreds of millions of dollars in the Ethereum ecosystem, many due to basic flaws in the "Solidity" language. For example, last November $280 million was frozen in Parity wallets because function visibility defaults to external rather than internal (see the previous HN discussion here[0]). Just for fun, I was looking through the Security Considerations[1] in the Ethereum docs, and here are two so-called "minor details":
- In `for (var i = 0; i < arrayName.length; i++) { ... }`, the type of `i` will be `uint8`, because this is the smallest type that is required to hold the value `0`. If the array has more than 255 elements, the loop will not terminate.
- The `constant` keyword for functions is currently not enforced by the compiler. Furthermore, it is not enforced by the EVM, so a contract function that "claims" to be constant might still cause changes to the state.
WTF?! Trivial loops won't terminate to due (unchecked) integer overflow, and the `constant` keyword does nothing? It's a complete gong show. I'm not touching anything to do with this language with a 100 foot pool. Is the hype bubble just that big?
[0] https://news.ycombinator.com/item?id=14807779
[1] https://solidity.readthedocs.io/en/develop/security-consider...
Edit: Oops, it looks like I'm mixing up my multi-million dollar screw-ups. First in July $30 million was stolen due to the "public is default" debacle, and then the fix for that problem introduced another bug (the developers forget to call the `initWallet` function), which lead to the $280 million being frozen in November[2]. Holy crap.
[2] https://news.ycombinator.com/item?id=15642856
- In `for (var i = 0; i < arrayName.length; i++) { ... }`, the type of `i` will be `uint8`, because this is the smallest type that is required to hold the value `0`. If the array has more than 255 elements, the loop will not terminate.
- The `constant` keyword for functions is currently not enforced by the compiler. Furthermore, it is not enforced by the EVM, so a contract function that "claims" to be constant might still cause changes to the state.
WTF?! Trivial loops won't terminate to due (unchecked) integer overflow, and the `constant` keyword does nothing? It's a complete gong show. I'm not touching anything to do with this language with a 100 foot pool. Is the hype bubble just that big?
[0] https://news.ycombinator.com/item?id=14807779
[1] https://solidity.readthedocs.io/en/develop/security-consider...
Edit: Oops, it looks like I'm mixing up my multi-million dollar screw-ups. First in July $30 million was stolen due to the "public is default" debacle, and then the fix for that problem introduced another bug (the developers forget to call the `initWallet` function), which lead to the $280 million being frozen in November[2]. Holy crap.
[2] https://news.ycombinator.com/item?id=15642856