The good news about this is that it differentiates me from all of my peers so that I’m no longer a commodity in the workforce.

The bad news is that it makes communicating very difficult and, at times, counterproductive.

As I am want to do, I explored what is causing my communication errors and discovered, yet more, unique insights.

1. I can get obsessed with a detail too far removed from the target subject. Getting back to the target subject often requires that the person I’m working with interrupt me while I’m speaking just to push my focus back to the target subject. If the listener doesn’t know to do that, they just get frustrated waiting for me to make my point, then the collaboration breaks down.
2. If I am working with a complex or multidisciplinary problem, I often explore one side of the problem tree to an atomic degree, and then I don’t get to the other side of the problem tree until late in the night, if not the next day. This often results in stress and sleepless nights while I catch up on the work, which snowballs into more work in process as the week progresses.
3. I often assume people know as much as I do about the problem space and the various fields of study related to the components of the problem. This one is the most perennial of the bunch. It seems like every time this habit causes a breakdown in communication, I train myself to check for their knowledge level, and then just forget to keep doing it within a week.
4. From looking at points 1–3, it seems like my best option is to do a three-point check before I begin communication. Am I focused on target? Have I gone down the rabbit hole on something? Is the listener as informed as I am on this subject?

I’ll check back in to see if I have reduced the frequency and severity of communication breakdowns in a few weeks and post my observations.

*The next morning* I had a dream about connecting the dots for the people I’m communicating with. The short version is that words simply do not fill the function of connecting dots for people when the appropriate dots are like the stars in the sky. The solution is “Proof of Work”, “Show, don’t tell”. So the next article I’ll publish will describe the proof that I’m going to submit. It might be titled “The Network of Wills” or “A Kingdom in Your Pocket”.

These last several weeks have likely been the hardest of our lives, I know they were for me. It was almost like the events in the book of Revelation had come to pass. I won’t list all of the similarities, but I would like to give thanks to the man upstairs for sparing the people that I know and love. My only regret is that I didn’t take more time before the day of judgment to build bridges of love with more people and rebuild the bridges that I had burned over the years.
It’s not very often that we get the opportunity to save our own lives. And when that opportunity presents itself to an entire planet, well, that’s a very rare event, indeed. Whether you are reading this in the midst of a personal crisis or a global one, I want you to make the choice that aligns with love and not fear.
What follows are my thoughts on how we can use technology to build those bridges and how we can become more resilient, individually, and in community with one another.

At the time of this writing, I am in Memphis, a city known throughout the world for the message delivered by Rev. Martin Luther King, Jr. in his well known “I Have a Dream” speech that inspired people all across the world to take a step toward treating other people lovingly, despite their differences, no matter how superficial.
I am a builder and a builder needs to have a clear vision of what needs to be built. I didn’t have that before. I could conceive of so many things to build, so I began building before picking the right thing to build and I built too many things. I didn’t know any better.
I discovered that when I had built too many things when it took too much energy out of me and the woman I love, Annette. I could justify my actions to myself by saying I was trying, but I actually wasn’t. I was neglecting her and occupying my time with building. It felt like I was making progress towards building something beautiful for her, but I wasn’t because I didn’t understand what was beautiful in her eyes. So I came to her and laid my cares on her and she treated me lovingly. I didn’t expect it. Deep down inside I knew that she loved me, but I couldn’t sense how. Her love eventually won out over my bullheadedness and I fell into a peaceful and deep sleep.
As I slept, she taught me that I had been missing the most important part of the building process. She showed me that the love she was giving me was much more than just a good feeling about having me with her, it was in fact, a superpower to see what right looks like. She explained to me that Love is the energy that a builder needs to pick the right dreams and keep the wrong dreams from obscuring the builder’s vision. Once the right dream is chosen with love, the connection is made. The love will flow from her source into the dream giving it power. Then the builder can begin work of building the dream that she loves, even if the builder doesn’t have all of the right tools yet. The Love connects the builder to the dream and the builder collects the tools and materials to build something truly beautiful for her and both the builder and the lover become more powerful and capable, because they are bonded together in love with each other and the dream.
I now dream of bridges, connecting builders to love, and connecting builders to each other so they can build what is right and good. In my dream, there is a community of builders called MakerDAO that have built a lot of tools with love already and I can request those tools so that I can build bridges with those around me. Then the ones around me can build bridges with those around them.
One of those tools is Dai, it can help people acquire tools and materials built by people who aren’t connected with the dream yet. With that Dai, they can acquire other things that they need.
There are other tools built with love, but Dai can keep creating little bridges each time builders pass it along to new builders. That gets the love flowing through the community of builders. Those bridges can connect all of the builders to the power to dream, build, and take care of their own power partner and make a better future for them, together.

I don’t yet know how I’m going to get Dai flowing through Memphis, so I ask for anyone interested in building with love to reach out to me to help me try. It is my hope that we can rebuild the bridges that have broken over the years. That builders and the ones that love them, together, will wake up refreshed from their sleep and build what is best and good and sustain each other so we can all engage in building more and better things for the ones closest to us, and build hope for everyone in the world in these trying times.

About 500 years ago, we discovered how to manipulate optics. This established the path to understanding Newtonian physics, relativity, quantum mechanics, non-Euclidean geometry, biology, and chemistry. Magnifying the invisible revealed all the marvelous wonders of our present world.

11 years ago, designs were released that would allow us to utilize the same techniques that we applied to the material world, to the immaterial world. Now we can measure, record, and study the movements and nature of the intentional world.

First, we realized that air was matter that filled all empty spaces. Next, we discovered that light could travel through the empty spaces where air cannot fill. And now, we are learning that energy moves through the places where light cannot travel.

This same energy causes people to enjoy making, buying, giving, communicating, and doing. It is an energy that has always been just beyond our reasoning. We could not interpret it and hold it in a congruent mental framework, but we have been able to vaguely describe it all throughout history. It has been described as tao, karma, intention, spirit, The Muse, intuition, etc. But none of these descriptions have allowed us to graph its path through time and space.

Blockchain graphs this particular energy. Blockchain’s core feature is that it tracks transactions, value given, and value received, of any asset, on a permanent record.

Transactions occur when the wills of two agents align for a moment and each give something of less value for something of greater value. This holds true even in the case of charity, where one party gives without concern for any other gain than that of the counterparty. In classic accounting, this gain is categorized as “good will” and quantified as an asset.

A real-world example of “bad will” is the PlusToken Ponzi scheme in China. In this example, many people were defrauded of their bitcoin and then the Ponzi scheme scammers disappeared. The bitcoins that traveled through the Ponzi wallet now carry the taint of destructive intention. Since bitcoins do not exist outside of wallets and can only be tracked through the wallet addresses in which they have resided, there are now concentric circles of tainted wallets around the source of the misdeed that are no longer considered trustworthy. Exchanges will not do business with certain addresses based on how much of their history was spent in possession through ill-gotten gain.

In the PlusToken event, we see businesses qualify “bad will” and quantify it as a liability. This makes complete sense if, as accounting is a private double entry bookkeeping technology, blockchain is a public triple entry bookkeeping technology. The private method would result in counting the asset and the public method would result in counting the liability.

As more and more assets are tokenized, the transfer of good will and bad will throughout our trade networks will become readily apparent. Taken to its reasonable conclusion, every time anyone trades anything through digital media, some entrepreneurial agency will analyze that trade in order to maximize their own capital.

Currently, most of that data is being captured in private data centers. Only a very small portion is captured on blockchain. Because the information is reserved for only a few permissioned elites, it has been leveraged to affect significant change in the world for the benefit of the few. An example of this from recent history is the Cambridge Analytica hack. Bad Actors mined Facebook data to target people who could be easily influenced, then sent them messages to vote for a particular political candidate.

This is concrete evidence that having visibility on the will of a population allows agents to gain some level of control over the will of that population. This is not a phenomenon that can be eliminated because it has always been and will continue for as long as agents have wills. We also don’t want it to be reserved for those who would use it for their gain and our detriment. This power must be redistributed to all people so they can opt in to and out of trades with equal bargaining power.

On October 31st, 2008, Satoshi Nakamoto gave us a new telescope to allow us to see “the will” at macroscopic and microscopic levels. What kind of advancements lie in store for the next 500 years?

Special thanks to Christine Fahey and Ken Gendrich of Blockchain901 for editing and sanity checking this article!

If you have received value from this article, please consider donating to my research through one of the channels below:

The New Telescope was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

DeFi, Decentralized Finance, is Blockchain’s killer application. Cryptocurrency, Smart Contracts, and Decentralized Autonomous Organizations are empowering people all over the world to work and profit from ventures in cyberspace, but DeFi is the emergent application of blockchain technology that empowers humans to actually use blockchain to survive.

The things that really matter to humans are the things they can’t survive without: food, drink, shelter, etc. Collectively these things are called essentials. In the developed world we use money as a tool to acquire essentials. Money is one of the very few tools that stops working in different geographies or when it’s over produced.

It’s clear that there is a bug in the Traditional Finance algorithm that the fiat money developers can’t or won’t patch. With DeFi, the user can choose which tools to use to acquire essentials. Cryptocurrency, stable tokens, fiat money, exchanges, bearer notes, and company shares are all tools available to a DeFi user for the purpose of acquiring essentials.

Ching! sponsored two events at the University of Memphis to introduce Memphians to practical DeFi. One was a Pop Up market where users got to experience using DeFi in real life. The other was an introduction to the technology and the teams that are creating it.

The User Experience

At the Pop Up market, we had two different vendors. One was an ABC licensed bartender who was selling Crypto Punch and the other was a purveyor of consumer electronics. Both were able to use Ching! to setup a point of sale with payment processing, inventory management, and sales reporting in just a few minutes. By the end of the event, one vendor had begun selling xDai back into the Pop Up market to customers who valued xDai more than fiat money.

In this video we see two people who have never used crypto before transacting with less friction than if they were using cash and credit. With Burner Wallet, the customer doesn’t have to enter pin numbers or sign receipts. With Ching!, the merchant doesn’t have to worry about card readers or a cash drawer. What’s even cooler is that, since Ching! is a permissionless point of sale system, she doesn’t have to wait for approval from some back office to start running her store AND she doesn’t have to worry about fighting chargebacks at some future date.

In this video we see a peer to peer blockchain transaction happen over cellular infrastructure through the mobile chrome browser. The two big things to notice here are that the transaction is fast and that it runs on software that everyone already has on their phone.

In this video you can see me using my computer to send xDai to a consumer. From my computer, I can use my MetaMask credentials to convert ETH and DAI into xDai from within the same Burner Wallet that everyone else had running on their phone. It doesn’t take any esoteric knowledge to perform the conversion and anyone can do it without permission. The Ching! cashier was able to forward all payments to a MetaMask enabled Burner Wallet and at the end of the event she converted all of her xDai to into USD through Burner and Coinbase and exit DeFi through PayPal.

The Technology

DeFi is a new term to most people because Decentralized Finance is at the bleeding edge of the state of the art. Because of the advancements made in the Ethereum community, cryptocurrency has a slew of new features that enable its use in daily activities.

With Side Chains we get Network Stability, Scalability, and Cost Controls. DApps, Distributed Applications, can leverage purpose built copies of the Ethereum Network to handle transactions for a specific use case. If CryptoKitties clogs up the main network with transactions, a DApp’s side chain is unaffected.

With Stable Tokens we get Price Stability. Prices can be set in a common unit of account and transactions can be completed without capital gains or losses.

Through tools like Burner Wallet and Fortmatic we get Web 2.0 Compatibility. We can use our phones and browsers to interact with DeFi, never having to acquire Web3 specific hardware and software.

Best of all, the resources needed to develop tools in DeFi are all Open Source. Teams all over the world are competing with traditional financial institutions to deliver the best possible user experience to people who use money. Furthermore, they can’t be stopped by the rich, the powerful, or even the ingenious. DeFi is destiny.

Last month, the IMF asked Twitter how people will be paying for lunch in five years. Only 17% of respondents believed traditional finance to be the tool of choice. What is truly significant about this metric is that the people who responded to that poll were a broad cross section of the general public weighted more toward the people who are invested in following the IMF on Twitter (business leaders, policy makers, investors, traders, and bankers).

I was one of the 27% who responded that Mobile Phone would be the tool of choice. Not because I expect people will begin using their Cellular Data Plan as a line of credit, we already do that now. But because people will be leaving wallets and keys at home, where they are safe. Mobile phones will unlock your xDai for lunch and they will unlock your front door when you get home (see BookLocal for an example of physical access control on the blockchain).

Mobile Crypto will be a fact of life in 5 years. In Memphis, most people use Cash App. You can already “buy and sell” Bitcoin on Cash App, you just can’t spend it (they hold it on your behalf until they decide not to). When every restaurant has a free point of sale system that accepts crypto, they will accept fast stable tokens like xDai. Then, Cash App will include that token in their app. And they won’t hold it on your behalf because custodial services will be an unprofitable expense.

The teams that helped us bring DeFi to Memphis are working towards making DeFi globally available. The following is not an exhaustive list of DeFi developers, just the ones without whom we could not have hosted the Pop Up market.

MakerDAO is the Decentralized Organization responsible for maintaining stability of the xDai token. Additionally, they provide funding to other teams to develop DeFi solutions and to host educational events about DeFi. Click here for a short video about MakerDAO.

POA network is a framework for creating Ethereum side chains. One of which is the xDai network which allows us to spend DAI faster than any other stable token. You can learn more about them by clicking here.

Burner Wallet is an ephemeral browser wallet created by Austin Thomas Griffith. You got to see it in action in the Pop Up market videos. If you want to try it out, it’s available at xdai.io.

Ching! is a free point of sale solution for merchants who wish to accept DAI and xDai. It is currently a Proof of Concept and moving towards market viability. If you believe in what we are doing you can contribute code at https://github.com/ChingStore/ching or, if you don’t code, you can reach me directly at aaron@ching.store to discuss other ways to contribute.

Uniswap created the decentralized exchange that we use to convert between ETH and DAI, a key mechanism for getting stability in DeFi. You can convert into a bunch of other tokens at https://uniswap.exchange/swap.

Honorable mention goes to Coinbase for providing our bartender with a way to exit DeFi and return to the world of fiat. I think you may have earned yourselves a new brand ambassador.

Ching! Brings DeFi to Memphis was originally published in Ching! on Medium, where people are continuing the conversation by highlighting and responding to this story.

This guide is intended to walk new users through the flow of listing and selling items for xDai at Cypherpunk Speakeasies. If you find it to be incomplete, there are multiple ways to help me fill in the gaps:

1. Reply directly to this Medium article and I’ll update it accordingly.
2. Open an issue on the Ching! GitHub repo.(https://github.com/ChingStore/ching)
3. Send me an email at aaron@ching.store.

This guide will assume that you and your guests have xDai loaded onto Burner Wallets. If you don’t have xDai to load onto your guests’ devices, Burner Wallet has an exchange built in. The organizer can exchange their ETH into the the corresponding amount of DAI, then to the corresponding amount of xDai. It is essential to use xDai at this time because Ching! and Burner Wallet are actively being developed to support each other. Plus, the confirmation times are crazy fast!

Anyone can get a Burner Wallet by visiting https://xdai.io/.

In this guide, the minimum essential information will be in bold.

Step 1. Start by visiting https://ching.store/ from any mobile device or computer. You can simply type “ching.store” into your nav bar.

Here you can scan down the page and learn a little bit about what Ching! is. At the bottom of the page you can familiarize yourself with the founders.

The important part here is that bright blue-green “Become a vendor” button. Select “Become a vendor”.

Step 2. You will land on the DApp’s landing page.

You can skip right here by going to app.ching.store or master.ching.store. But this is a step by step guide and it doesn’t skip!

It presents two options, “Become a vendor” and “Log In”. Since we are starting anew, select “Become a vendor”.

Step 3. You will land on the account creation screen.

Here we have several options to get you authenticated. “Sign up with Google” works well for me. “Sign up with Github” and “Sign up with Facebook” might not work for some users. “Continue with e-mail” is a safe fallback if all else fails.

Select “Sign up with Google” and you’ll choose a gmail account to associate with this DApp.

Step 4. You will land on your store’s initial configuration page. If you make a mistake here, it’s okay because you can edit this stuff from inside the DApp as well.

We will assume that your event is only using Burner Wallets and xDai so copy your public Ethereum address from you Burner Wallet and paste it in the “Ethereum address” field.

You can find your Burner Wallet public address by clicking on “Receive” in the Burner Wallet. You public address is that string of random numbers and letters starting with “0x” directly below the QR code.

***Weird Edge Case!: If you are operating a Ching! terminal for a third party and they give you a seed phrase to use on your Burner Wallet, it won’t work if Burner Wallet detects injected web3 like Metamask. This means that you can go through the advanced settings to configure the seed phrase, but Burner Wallet won’t care because your injected web3 is more important (because it is much safer than the way Burner Wallet handles private keys). I had this happen to me at a MakerDAO DAppy Hour and all my sales went to my own account instead of theirs. I configured Burner Wallet from Chrome where I had Metamask enabled. If I had configured Burner Wallet from Brave where I don’t have Metamask installed, it wouldn’t have happened***

Information: If you click on “What is it?” you will be taken to this screen that recommends some wallets you can use.

The Coinbase wallet is good for accepting ETH as payment, but it does not support DAI or xDai yet.

The Status and Trust wallets can handle both ETH and DAI, but not xDai yet.

Again, for this guide, use the Burner Wallet from xdai.io.

Step 5. Once you have given your store a name and pasted in your Burner Wallet address, press the “Continue” button.

Step 6. Now we find ourselves in inventory screen. The DApp defaults to edit mode when you first get here.

From here you can edit your store name and add an item. We’ll add our first item. Just select “Add first item”.

Step 7. There will be four fields to fill out to add a new item. The name of the item you are selling, the price in USD, the amount in inventory, and a photo of the item.

In this example, I have opted to sell chapstick at $2.50 and I declare that I have 22 in stock. I used a stock image for the chapstick since I’m making this walkthrough on a laptop. If you are using a mobile device, it’s easier to take a picture with your device’s camera.

If you are selling a variety of drinks, it doesn’t hurt to be specific and specify the exact item you are selling. So if you are selling a variety of soft drinks, create an item called “Mr. Pibb” and another called “Sundrop” and so on.

When you are done filling in the four fields, press “Add a First Item” or “Add an Item”, it doesn’t matter as long as it’s the button at the bottom.

Step 8. I’ll assume we are selling two items, so instead of pressing “Done” or “Start Selling” we will press “Add another”.

Step 9. This time I’ll sell my old cash register since I don’t need it now that I have Ching!. The process is the same as before, I’ve input the values unique to this item like it’s name, price, number in stock, and it’s picture. Finally, I’ll select “Add an Item”.

Step 10. If you need to you can add more items. The “Add another” button will always be the last option displayed while you are in edit mode. If you don’t see it, scroll down or swipe up depending on if you are on a computer or mobile device.

To exit edit mode, press the red “Start Selling” prompt above your store name. The edit badge will disappear from your inventory items and “Start Selling” will turn into a subdued “Edit inventory” prompt.

In this example I’m ready to sell everything a budding chapstick vendor would ever need. In your case, you probably have drinks and snacks. It’s really all the same, Ching! doesn’t discriminate.

Step 11. My chapstick and cash register store is up and running. I have a customer who wishes to purchase a single chapstick. One of us will select the desired item and the number 1 will show up to the top right displaying how many of that item is being ordered.

If we press the item button too many times, a number greater than 1 will appear. No worries, just click on the number to knock it down a notch.

We see that a little tab has appeared at the bottom. It has some handy information for the merchant and customer alike. It shows the total number of items being ordered and the total cost. When the customer has finished selecting items to buy, click on that tab on the bottom of the screen.

Step 12. The shopping cart slides up all slick-like. Now we have a few options before checkout. We can press the “x” next to the item to remove it from the shopping cart or we can select and edit the quantity from here. If a customer wanted to buy all 22 chapsticks in my inventory, we could just edit the number here instead of clicking on it’s inventory button 21 more times.

But from here, the customer is in control. The next three steps will be completed from their Burner Wallet.

Ask the customer to pay with their Burner Wallet.

Step 13. The customer should have Burner Wallet on their mobile device with some xDai already in it. In order to complete the transaction, the customer will need at least a thousandth of a penny extra in order to pay for gas. This will almost always be the case except at the end of a Cypherpunk Speakeasy where the organizers gave everyone $10 in xDai and priced drinks at $10, $5, $2.50, or $1 a piece.

As long as they have slightly more xDai than the cost of their order, the customer should press the QR reader button on the bottom right of their Burner Wallet.

Step 14. When the customer clicks the QR reader button, they should grant permission for the DApp to use their camera if they haven’t already done so. Then they should just focus the camera on the QR code displayed in the Ching! shopping cart.

Step 15. In their Burner Wallet, they will see the “Send to Address” interface. Three important pieces of information have been populated for them. The receiving address you set up with your ching.store account is populated in the “To Address” field. The “Send Amount” is the same as their order total. And the “Message” kind of acts like a receipt for both merchant and customer.

There is no need to edit any of this information. If everything looks right, the customer should just press the orange “Send” button.

Step 16. At roughly the same time, the customer’s Burner Wallet will display a “Receipt” and your ching.store will display a checkmark with the word “Confirmed!”. Be sure to give the customer what they ordered and then press the “Sell more items” button.

In the workflow you will have at a Cypherpunk Speakeasy it will be handy to wait to hit the “Sell more items” button until after you have fulfilled the customer’s order, but it’s not absolutely critical.

Step 17. Ching has a “Sales” tab that keeps track of all of your transactions. If it takes some time to fulfill orders and you choose to take orders from more customers, you can use the “Sales” tab to view recent sales.

This feature is still in development, so the “Download report” button doesn’t do anything cool yet. You also can’t clear your “Sales” tab yet. Like everything else in the crypto-universe, we are still learning how the public will use our tools. If you have any ideas for how to make this feature more valuable, please send them to us! (Grants are also welcome.)

Step 18. Finally, in the “Profile” tab you can change your Ethereum Address whenever you like. If you click on the little green pencil icon, it will turn red and you will be in edit mode. I find it handy to use my Metamask address as a receiving address and you might, as well.

For the safest possible experience, you’ll want to use a more permanent address than your Burner Wallet’s default address. Just make sure it’s an address you can point to side chains with. I use Metamask in this case because I can switch over to the xDai side chain at will. You can also configure your Burner Wallet with your more permanent addresses private keys and use Burner Wallet to exchange from xDai to DAI to ETH. These are strategies outside of the scope of this walkthrough.

Once you’re done with the event, you can hit that “Log out” button and go back to your Burner Wallet to settle out for the night.

At the end of the event, all of your revenues have been forwarded to the address you provided. You can trade your xDai for cash with someone at the event or you can use Burner Wallet’s “Wyre” fiat off-ramp. Personally, I send all my burner wallet assets to my metamask account and then open Burner Wallet from my web3 enabled browser where it automatically detects metamask. That gives me the benefits of both DApps. Just don’t change any Burner Wallet settings if you have any assets left in it! Burner Wallet and Ching! are both underfunded open source projects so don’t take any risks with them yet. Just have fun running Cypherpunk Speakeasies and come up with new ideas for real world solutions, make friends and be awesome to each other!

Ching! User Guide was originally published in Ching! on Medium, where people are continuing the conversation by highlighting and responding to this story.

Ching! is a mobile storefront that anyone can use to setup a quick and feature rich Point of Sale. It is an open source application that helps to demonstrate the functionality of Layer 2 Ethereum payments. Check it out at ching.store.

It is currently being used in conjunction with Austin Griffith’s Burner Wallet at Cypherpunk Speakeasies and other educational events. You can see how easy it is to set up and start transacting with this tool in this video.

Currently Ching! can handle

• Inventory management
• Mobile and desktop deployments
• Order batching
• Forwarding payments to cold storage
• Payments from Burner Wallet
• Payments from Status Wallet
• Payments from Coinbase Wallet
• Payments from Trust Wallet

Features that are being added right now are

• Signup with Facebook, Google, and Github
• Even faster order confirmation
• Export sales report

We at Ching! are currently developing the roadmap for greater functionality. Since it is an open source project feel free to fork it, test it out, and provide feedback through our Issues Page.

Ching! is in Open Beta was originally published in Ching! on Medium, where people are continuing the conversation by highlighting and responding to this story.

Today is the first day of Spring where I live and to kick off the planting season I’m publishing a Farmer’s Almanac for DApp develop for this growing season and help you prepare for the next.

I will open each season’s forecast with a quote from the Tao Te Ching because the seasons themselves are a product of the Tao; Tao can be said to be the principle underlying the natural order of the universe. As a buidler (DApp builder), I find that the Tao Te Ching helps me to reason from first principles.

Cryptospring

The sage’s Way is to act and not to contend. -Tao Te Ching ch. 81

A quick glance back at the price chart of Ethereum makes it appear as though cryptospring officially began on December 15th, 2018. In February, Consensys released #cryptospring An Atmospheric Report in which Joseph Lubin writes that he believes that we have already turned the corner into spring. He points to some seeds sprouting that were planted in cryptowinter as leading indicators:

1. Gnosis is ceding full control of the DutchX exchange platform to the 100% community-owned dxDAO which, according to Marin Köppelmann, “has the potential to become the largest financial entity on the planet.”
2. Digital publishers now have an open source option because Civil will soon be natively integrated into Newspack, WordPress’s new publishing platform.
3. Crowdfunding is evolving with Gitcoin experimenting with CLR (Capital-constrained Liberal Radicalism) to help contributors get an exponentially larger match.
4. The launch of Ethereum 2.0 on testnet in addition to live deployments of Layer 2 scaling solutions.

The brightest flower to blossom, from my direct experience, is the xDai sidechain launched by POA Network. It has already demonstrated better than credit card user experience on DApps like Burner Wallet and Ching!.

Any good gardener knows that the most important element in a garden is the soil. Rich with nutrients and biological activity, soil that is moist and acidic to break down those nutrients and make them easily slurpable. In the Ethereum space we’ve kept the same number of active developers as before cryptowinter, a biological presence that has been building co-operative relationships through conferences, hackathons, and open-source repositories. Busy as we have been, we have been depleting the ecosystem of precious capital. External inputs have thinned out considerably during cryptowinter; it has fallen on established projects to inject capital into the community. This has kept the Ethereum ecosystem healthy whereas my tools and libraries for Satoshi chain development have all but decayed. Mobius on the Stellar Network is an unfortunate example of library rot in the shadow otherwise exciting recent headlines.

The good news for DApp developers on all chains is that much of the R&D being conducted in the Ethereum ecosystem can be repurposed on other chains at substantially lower cost. The Bitcoin.com repo is an excellent case study for how to apply Ethereum development patterns to Satoshi chains.

At this time, Ethereum’s soil is the most healthy, water and fertilizer will be able to serve their intended purpose and be highly slurpable. Building on Satoshi chains will challenge DApp gardeners to carefully select viable clones and carefully monitor environmental conditions. The flip side to that coin is that DApp specimens adapted to poor soil can bear much more exotic fruit and don’t have as much competition from weeds as the bellwether varieties.

This season will last for almost a year because the global economy is still surprisingly strong and stable. For most of 2019, there will be very little competition for investor funding and startups will absorb all currently available talent to work on an unprecedented variety of DApps.

Now is the season to build, invest, and experiment. Resources directed towards beating the competition are misguided and wasted. Looking at you here BSV.

Cryptosummer

To understand the limitation of things, desire them. -Tao Te Ching ch. 1

Just like this cryptowinter was the longest on record, this cryptosummer will be the longest one yet. There are several reasons for this, but the most important of which has been the negative media coverage of cryptocurrency that has been fairly constant since about October, 2013 (obligatory advisory statement: “some” of that article may have been fake news). Many of the people who would’ve been early adopters during this cryptosummer were burned when they entered the ecosystem in the last half of 2017 during a rather uncharacteristic season of positive media attention. Those users will return, but they are human and creatures of habit, so we shouldn’t expect them back until cryptoautumn.

Some other contributing factors to the long summer are the long overdue general recession, the maturity and diversity of DApp development during this time, and interloping by unpopular state-sponsored institutions.

Whether or not the general recession strikes during this cryptosummer it will not hasten the arrival of cryptoautumn. A general economic downturn is already anticipated and will continue to be expected until it actually happens. Safe havens for capital are still generally trusted with the exception of student loan debt and municipal bonds. General goodwill towards cryptocurrency won’t return until significantly long periods of sustained growth and consolidation have passed. My gut feeling is this summer will last three times as long as the most recent cryptowinter which would make it longer than the entire last uptrend of 152 weeks. Take note, that it will likely be four years from today before crypto technicals go parabolic.

The maturity and diversity of DApp development will provide a hedge against that parabolic exuberance because investors will be comparing DApps on their own merits instead of the merits of their underlying chain. Several chains will have killer DApps that get up to 10 million active users, none will hit 100 million daily active users (DAUs). Many of these will abstract away token economics from the user interface. Many will provide microfinance services and provide them at a higher quality than any other application has ever been able to achieve, but world class user experience won’t be enough to break the habits of billions of traditional finance customers. Many projects will be lead by Fortune 500 companies that only expose cryptoeconomics to superuser amateurs and the valuation of these projects will be reflected in their stocks and not their native tokens.

Interloping by state-sponsored institutions will depress crypto prices and cause investment to slow to a corporate pace. Regulators will do what regulators do and find new things to regulate, requiring permits for sandbox testing of open-source software, putting KYC/AML requirements for even the smallest inconsequential transactions, and putting onerous burdens on traditional industries to discourage them from experimenting with cryptocommerce. Coincidentally, STOs will be in vogue and will end up in people’s employer sponsored retirement accounts. In democratic countries, large banks and trading houses will leverage blockchain to decrease transaction times and costs while sponsoring legislation to keep competitors from doing the same. At least a dozen authoritarian regimes will remonetize their currency to private chains and experiment with ways to falsify transactions while, at the same time, forcing their citizens to use the state’s official crypto under threats as sever as summary organ harvesting. Looking squarely at you China. Russia will cut off access to all TCP/IP ports used by blockchains and they will allow all of their DApp developers to emigrate to the west. Intelligence and law enforcement agencies worldwide will fabricate narratives and charges against some of the most gifted innovators in the DApp ecosystem. Calvin Ayre will be the most infamous of these victims, making him a household name and earning Cuba international prestige. At least one major terrorist attack will be completely funded by a single privacy coin, masking state sponsorship and sparking a “war on privacy coins”.

And this is STILL cryptosummer.

The underlying value of the technology will cause week after consecutive week to tick up on the market charts. Any week in which a state-sponsored activity does not occur will be an up week in the broad crypto market. Investment and development will continue unabated in a fairly linear fashion over the weeks as the use case is proven over and over again in different industries.

An interesting thing will happen during the cryptosummer. 99% of projects that launch in cryptosummer will basically just be copycats trying to improve on some aspect of a project that launched before cryptosummer. These projects will attempt to improve upon a narrow scope of the source project, apply the source project to a new industry, or combine the source project with another emerging technology. They will secure funding an order of magnitude larger than what their source project required and spend most of it on advertising. This is because the talent required to compete with the source project will still be at the source project or generally unemployable. The talent gap will be filled by talented project managers from web2, underskilled development shops, and marketing geniuses from 5th Avenue. A portion of the remaining 1% will work on a groundbreaking technology to combine trustless and trusted systems with social media resulting a “black swan event”.

The black swan event will mark the end of cryptosummer and the beginning of cryptoautumn. I’ll explain what the black swan event is likely to be in the cryptowinter section, but we won’t be aware that it has happened in either cryptowinter or cryptoautumn. We’ll know cryptoautumn has arrived when crypto markets go parabolic again.

Cryptosummer will be marked primarily by the refinement of DApps and user experience to the point where they are superior to Facebook, Medium, Visa, PayPal, YouTube, YouPorn, Uber, and Air B&B. The job of DApp developers, blockchain researchers, and investors is to tend the garden they planted in spring so they can provide the customer with a higher quality product come harvest time.

Google and Amazon are making more money than ever and they are officially comfortable with crypto transactions.

Any newcomer into the space would be well served to be a cryptonative. Only cryptonatives will understand the pain points from wanting DApps to do all the things and not being able to do every single thing. Only a cryptonative will be able push a project past the edge of the impossible, especially at a time when so many resources are being devoted to excellence in user experience. During this time there will be a lot of competition for investor capital and talent is going to have to be provided either by blockchain focused coding bootcamps or by poaching the best talent from the best firms. Expect to pay up to a million dollars a year for top talent by the end of cryptosummer.

Cryptoautumn

People fail at the threshold of success. Be as cautious at the end as at the beginning. -Tao Te Ching ch. 64

By cryptoautumn we have seen multi million DAUs on several DApps. People who have never touched crypto are getting their packages delivered in record time because an army of amateurs are betting on their immediate satisfaction through prediction markets. People are betting a portion of their retirement on DApp 2.0.0-beta34 getting more market share than DApp 1.24.6. Every bank and payday advance place has a way to process crypto to fiat transfers. Miners and validators are making profits in every neighborhood in the world, often in completely sustainable ways off the grid, instantly swapping between chains to take advantage of arbitrage opportunities. Mainstream media is singing the praises of an all crypto future.

Sounds pretty alright, huh? We’re looking at somewhere around March 2023 and the weather is going to be pretty nice worldwide for the next couple months. Either the global economic downturn has already passed and we’re okay; or we are in the middle of it, but our businesses and investments are crypto based so we’re good, or money is going to flee the traditional markets into crypto in which case we’re going to the moon in lambos.

Not in this almanac. This almanac doesn’t have a happy ending.

In cryptoautumn there will be countless crypto startups that get funded, listed, traded, and relied upon for income. They are all worthless. At any other time, they could be just fine, but in this particular season they aren’t worth the time or attention anyone has put into them and those resources would’ve been better spent on AI, drone tech, AR, logistics, or medicine. Basically anything that has a military application.

10–15% of the world’s population is holding crypto, of that, approximately half are exposed to it’s cryptoeconomics. The other half has been enjoying the benefits of the technology, but reticent to get involved in something with so much regulation and associated with terrorism. But the news is so positive and all of the people who got burned last time are back in! People just like themselves have made fortunes in the last four years and all they had to do was expose some of their savings to the coin markets!

This exposure to crypto came through DApps, not the blockchain itself. In our efforts to bring crypto to the masses, we as DApp developers have brought DApps to the masses. Once a user is onboarded, it’s permissionless. Once they have their private keys, they can make any decision they like and no government on Earth can interfere with that because the code is law. That is the value proposition. Without realizing it, we have made people, who are accustomed to relying on government for their needs, more powerful than the mechanisms of control government can use to effect or reverse those decisions. No one can stop the half who are exposed to cryptoeconomics from upskilling the other half. We can’t stop each of them from talking to one or two other people. And we certainly can’t stop all of these new superusers who outnumber the population of China, from speculating and buying up the underlying crypto and driving up prices in a parabolic moonshot.

Now is the season to harvest what we have sown in the last two seasons. Set your stop-loss at 5% slippage and ride that wave up. You sowed your seeds wisely for four years, it’s time to take your profit. If the global economy hasn’t entered a recession, it will now. A nation of superusers, larger than any nation on Earth, has taken control of the blockchain and each individual superuser is acting in their individual best interest, attempting to maximize profits. Unimaginable sums of money are flowing from securities to crypto. It becomes clear that STOs were never securities because they are not affected by the 85% flashcrash on Wall Street. Cryptoautumn has brought with it the greatest redistribution of wealth in the history of mankind. No one can predict with certainty what happens after this point. In computer science, we refer to that as a Singularity.

The story of the Singularity is the story of the individual becoming asymmetricaly empowered against the State. -Gabriel Cardona, Plan B: A conversation with Gabriel Cardona on the trajectory of Bitcoin

Before this roller coaster peaks, half of the world population will either be invested in crypto or trying to get in. The other half are skeptics by nature and would say no to a free sandwich just on the principle of the thing.

It took us twenty thousand years to move from the invention of accounting to get to letters of credit. It took about four hundred years to move from letters of credit to double entry accounting. It took us six hundred years to go from double entry accounting to distributed ledger. And it has taken us less than fifteen years to go from distributed ledger to Singularity.

Now that we’re done reaping, we are not done playing the gardener. It’s time to “sell some, eat some, save some”. Singularities may be unpredictable, but seasons aren’t. As sure as autumn follows summer, winter follows autumn. And this is CRYPTO NUCLEAR WINTER! (Please attribute the phrase “Crypto Nuclear Winter” to me, that would be the most metal thing that could possibly go into a wikipedia article)

The beginning of winter on the Prairies is inherently unpredictable. Sometimes it starts in December, sometimes in mid-October. When you reach the end of October to early November, the weather can turn very quickly. You can go from 10 degree days of sun to -10 degree days of blizzard in only a day or two. So, the long hours can’t stop; there is still much to be done. -Jake, southsaskfarmer.com

Seven months could pass, ten months could pass, we don’t know beforehand. Just don’t get caught holding a bag without liquidity when it happens. You as an individual should be completely out of the market. Your DApp can keep chuggin along doing it’s thing, in agriculture we call that over-wintering, it’s cool. But your harvest needs to be converted to things that will serve you well in the coming season.

• Sell some: Definitely don’t stay exposed to crypto. Stable coins might be a good route, as long as they are pegged to something other than some nation-state’s currency like USD. You just set off a chain of events that’s going to cause that asset class to hyper-inflate. Not paper gold, gold stocks, gold certificates, or gold futures, all that stuff is all garbage now. Think cigarettes, Juul pods, Everclear, and cannabis (wax). Gold and silver bullion is fine if you don’t mind taking a bath on “service fees”.
• Eat some: You just crashed the world economy so fresh food may be a bit of a luxury for a while. Load up on shelf stable food stores, I’d do 12 month’s worth to be on the safe side. Just make sure it’s preserved, portable, and enjoyable. Military rations (MREs) aren’t bad, I used to live on them.
• Save some: Convert a portion of your portfolio to assets that aren’t all wibbly wobbly in relation to demand; housing, electricity, food, clean water, drugs, and waste disposal tend to have pretty constant demand even in the worst of times. The most important part of this step is to have something with which you can trade for crypto when cryptospring rolls around. (Feel free to revisit the “some” fake news article linked earlier or this one that Andy Greenberg phoned in a couple years later.)
• Taxes: I’m writing this from the USA, we add tax up at the end. It’s a pain at the grocery store already, having to guess how much your total is going to be since every State-County-City combination has their own total and they don’t tell you what it is until you’re already rung up. But even after you’ve already demonstrated how hard you can own the IRS, all of your city’s employees need to get paid and about half of them have guns. I’d recommend watching out for something titled “Guidance” or “Notice” on how to handle taxes on their website. It’s not likely to be delivered by mail.

Seriously, everything that happens after the Singularity is wildly unpredictable, make sure you plan in advance for you survival needs first so you can make it through cryptowinter. Then make sure you have a war chest you can access to fund your buidling through cryptowinter on into cryptospring.

Cryptowinter

Give evil nothing to oppose and it will disappear by itself. -Tao Te Ching ch. 60

This ain’t your papaw’s cryptowinter. The assumptions everyone has made about microfinance and high finance have turned out to be disastrously false. The people that leveraged their future on trips to the moon are completely bankrupt and for a great many of them, this is the second time. Financially, you’re better off than the elites. That makes you a target. You are public enemy #1 in every country on the planet and hurting people are demanding that their governments hold you to account.

People are dying all over the world because the governments they relied on for basic survival needs are insolvent. Entire industries have been disrupted to the point of cessation. Even a nuclear war broke out between India and Pakistan so the leaders of both sides could scapegoat the other and retain their grasp on legitimacy. Religious leaders leverage the human tragedy to increase their own power and coincidentally radicalize hordes of military aged males for the cause of defeating technological idolatry. Politicians worldwide mobilize for offense because war is the health of the State and nation-states just aren’t very healthy right now. Governments need their people to need them, and people think they need their governments. World war helps the people to reorganize toward a common goal and accept centrally planned economies just so they can get the necessities they need to survive.

Wars, even world wars, are generally localized affairs. You’ll be safe from harm if you avoid conscription or residing in urban areas at the junction of supply lines. If you can avoid being identified as one of the engineers of the Crypto Nuclear Winter and reside in a rural agricultural center, you should be able to last until cryptospring.

There’s just one catch, that black swan event I alluded to back during cryptosummer. There is a new distributed computing technology called “The Web of Trust”. It allows a user to rate the trustworthiness of anyone they are connected with through social media. It runs on distributed ledger technology and keeps an immutable record of the impressions of acquaintances. It aggregates the ratings of the people that connect you and returns the trustworthiness score for any person on Earth in relation to you. It wasn’t fully functional before it gained a critical mass of adoption, but it has that now. If it had gained mass adoption at the beginning of cryptosummer, it could attest to the good hearted, philanthropic nature of the DApp developers. It could even attest to the self-serving, untrustworthiness of the politicians who are sending victims of one catastrophe into the meat grinder of another catastrophe. But that’s not how history has played out. There was no need for The Web of Trust when traditional institutions were serving the greater good and crypto was making everyone rich through the power of belief. Now though, now times are hard, people are desperate, and there’s no one you can really trust.

In a perfect world, you could continue going about your business and the system would rank you as trustworthy. It could defend you in the court of public opinion against politically motivated prosecution. But it has a vulnerability: a Sybil Attack subverts reputation systems by forging or counterfeiting identities and voting as that identity. At no other time in the last 70 years would voting members of The Web of Trust allow signs of a Sybil Attack to go unpunished. But now? Desperate times, desperate measures.

Either The Web of Trust enables us to return to a state of general peace and actually improves society beyond what we experienced in the early 21st century, or hand control over to state-actors in exchange for increased security and we all get early 21st century China’s social credit system. Either way, our social credit on the blockchain becomes the most valuable currency we can own.

By the end of cryptowinter we have collective control over currency, debt, and credit worthiness through a blockchain powered DApp. It turns out that cryptocurrency (at least in this form) is the only form of currency which is trustworthy. And you are one of it’s intrepid designers, which ingratiates you to literally no one.

Even if cryptowinter doesn’t turn out this severe, the individual will have unprecedented power to affect entire institutions and those institutions are comprised of people not dissimilar to us. It is exceedingly important that we plan ahead and give evil nothing to oppose, especially the evil within our DApps.

Next Cryptospring

Do not interfere and people become rich by themselves. -Tao Te Ching ch. 57

Crypto had a rocky beta test, now it’s ready to go into production!

In the next cryptospring, the general population will be more skeptical of crypto than this cryptospring because more people will inevitably be harmed by it. We will be starting out from a larger base of active users and many of them will be evangelists for the tech because it has served them well in practical ways for five years.

The next cryptospring will be the longest in history because we didn’t fulfill our promises and crypto didn’t empower everyone equally and politicians have vilified it more than ever.

By then, we will have a value layer and a reputation layer on the internet. We will have The Interchain with many popular DApps that are sustainable and censorship resistant. And in that season we will plant the seeds for a new search engine and repository for information, truth, finance, goods, services, and all the things. Our history and memories will be saved and accessed there. Our cognition will be augmented by billions of other humans making decisions in their own best interest. Market cycles will lengthen and volatility will decrease as market efficiency becomes something we can manipulate individually as easily arithmetic on a pocket calculator.

Just remember to manage customer expectations responsibly this time. I’ll check in next cryptospring to see if I beat The Farmer’s Almanac’s accuracy rate of 80%.

Get Best Software Deals Directly In Your Inbox

The Crypto-Farmers Almanac was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

If you haven’t had the opportunity to attend a Dappy Hour, they are usually held after official Ethereum Community events like hackathons and developer conferences. The purpose is to allow community members to use Maker’s stabletoken DAI, and its derivatives, in real world trade and spark ideation and collaboration on ways to use stabletokens and Collateralized Dept Positions (CDPs) in practical ways. At ETHDenver, the eventbrite invitation read, “Experience a world where cash is banned and fiat is no more. All that’s left are our mobile phones and devices, and the rise of cryptocurrencies like BuffiDai and xDai. Find yourself in a known location where others like you use a new form of payment. Welcome to the Cypherpunk Speakeasy Dappy Hour!”

Wait, what’s “Cypherpunk Speakeasy?” In this case the term refers to a meetup where crypto enthusiasts gather to test out new ways to buy drinks with cryptocurrency. The Burner Wallet that everyone was using to trade ETHDenver’s native token, BuffiDai, was first put through its paces in a series of Cypherpunk Speakeasies starting in December. The feedback from those events allowed the Burner Wallet team to refine their technology to the point where they were able to facilitate the trade of almost $40,000 in food sales during the hackathon.

“There were 11 food trucks that sold a total of 4405 meals over the course of the weekend. Here is an example of a meal being purchased. Notice the transaction cost of $0.000046 USD? That means for all of the transactions for all of the meals the cost of running the wallet on xDai was $0.20!!!That’s pretty good for a total of $38,432.56 being paid in DAI to the trucks.” -Austin Thomas Griffith

Burner Wallet is a tool designed to get xDai (fast DAI) into the hands of customers. It abstracts away the overhead of the Ethereum Virtual Machine (EVM) so that people can hold and spend a fast version of DAI in their mobile browser of choice.

By contrast, Ching! is a tool designed to make it easy for vendors to sell items in exchange for DAI and xDai. Like Burner Wallet, Ching! hides that EVM overhead until the vendor decides to opt into it. It also has features that assist in order fulfillment, inventory management, and sales reporting.

This Dappy Hour was Ching!’s first Cypherpunk Speakeasy and in the course of two hours it took in 63 BuffiDai and fulfilled 26 drink orders.

Burner Wallet used paper menus with QR codes for individual items. Ching! presented an interactive menu where the cashier could increment and decrement order quantities.

The Burner Wallet menus had an item called beer, but customers would tend to ask for a specific type of beer. When that happened, the cashier was able to enter edit mode and add a new item on the fly!

After the cashier enters edit mode and clicks on “add another”, they can quickly create a new item. Below, the cashier adds an item called “Water”. It is selling for $2 USD and the cashier declared that 999 are in inventory. The cashier can upload a photo, or take one with their mobile device.

With the Ching! shopping cart, we were able to handle batch orders. In one cenario, one person was able to order drinks for himself and five friends and pay the bill at one time.

The shopping cart would notify the cashier when payment was received. Because we were accepting BuffiDai and xDai, we could confirm the transaction in just five seconds!

The Burner Wallet team added the handling for the Ching! QR code interface and the resulting interaction between Burner Wallet and Ching! was seamless.

At Dappy Hour, Ching! learned that our app can improve the customer experience for people who are using Burner Wallet. We hope that Cypherpunk Speakeasies continue to gain popularity and new people get exposed to this new way to spend their crypto. We will continue to support development of the Ching! store app and we strongly encourage speakeasy organizers to use Ching! as their Point of Sale solution. It’s very easy to onboard, just go to ching.store and click “Become a vendor”!

We invite users to file issues in the github repo if the app doesn’t perform as expected. This is an open source project and we are accepting contributors. Help us buidl the future!

Ching! Goes to Dappy Hour was originally published in Ching! on Medium, where people are continuing the conversation by highlighting and responding to this story.

Specifically, I’m targeting the list of known attacks published by the Consensys and the Ethereum Foundation.

• Race Conditions (Reentrancy and Cross-function Race Conditions)
• Transaction-Ordering Dependence (TOD) / Front Running
• Timestamp Dependence
• Integer Overflow and Underflow (including Storage Manipulation)
• Denial of Service with Unexpected Revert
• Denial of Service with Block Gas Limit
• Forcibly Sending Ether to a Contract

(A full description of these attacks can be found at https://consensys.github.io/smart-contract-best-practices/known_attacks/ and the definitive lecture by Bernhard Mueller can be found at https://youtu.be/iqf6epACgds)

Now the first thing I am going to do is test your contract, ideally, with the test scripts you have already written. If I don’t have access to those I’ll compile your contracts in either Truffle or Remix in order to make sure the contract compiles and exposes the functions that have been detailed in the contract specification.

Once I know I’m working with a functioning contract, there are a few steps I need to take in order to make sure my auditing application will recognize every dependency that your contract imports. I need to go grab the code of any dependency that is already deployed and then link it locally. If the framework your code is working in has any issues with pathing, I’ll copy your dependencies into the same folder as your contract and redirect the import statements to this copy. And then I’ll need to do the same for every dependency that I copied, because they will often times also have dependencies that I need to expose locally.

At this time, I’ll spin up Docker and run a local instance of my auditing application and give it the command to run a whole bunch of simulated interactions with your contract using symbolic execution. What this does is explore every possible interaction an actor can perform with your contract using an abstraction of any given input. So instead of testing every possible value that can be passed to every function, which would take longer than the heat death of the universe, it passes a symbol that stands for every possible input. This frees up time for the software to test all possible recursion in your contract’s flow control. The standard depth of recursion that I test for is 8 levels of recursion, but if we will be conducting a formal audit, I’ll run much deeper in an attempt to falsify any mathematical proofs required by a formal audit.

Once the audit application has finished exploring all the possibilities it will return a report that I will then convert to an appropriate file format; usually markdown, but some projects require JSON reports in order to be parsed by 3rd party applications. This report will contain both trivial and non-trivial vulnerabilities. The trivial ones are technically vulnerabilities, but are generally not exploitable. For example, if your contract is built atop OpenZeppelin smart contracts they could theoretically have malicious business logic, but if we check and see that OpenZeppelin is an accepted standard and does not have any delegate calls that will alter the behavior of the source contracts, we know that we are safe.

Non-trivial vulnerabilities are usually exposed by your business logic. A common one I see is Integer Overflow arising from a for loop that works with arrays. In this case, the business logic may be sound in that controls are in place that no combinations of array lengths or iterations through the for loop will result in an array length exceeding 2**256. But I would advise the client to request or perform a formal audit on that particular function in order to mathematically prove that there is no intersection between control logic boundaries and statistical vulnerability frontiers… or at least that the probability of their intersecting within a given timeframe is within the client’s risk tolerance.

Finally, I’ll write up my “Formal Auditing Recommendation” in which I identify those functions that expose non-trivial vulnerabilities and suggest that they either be formally audited or rewritten in order to preclude those vulnerabilities. Only the client and their development team can determine which option is most appropriate. As a general rule, though, you want your contract to require as few proofs as possible so it’s usually wise to go for the rewrite first and follow that with a second audit.

Auditing and testing are the pillars of good contract security. If you are handling money in your contracts you should definitely seek out those services from experts. And, if you are looking for some experts in blockchain solutions, you’re always welcome to reach out to my team at web3devs!

What to Expect when your Smart Contract is Audited: The Auditor’s Story was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.

While my team was converting a web3 enabled React component into a wordpress plugin, one of my teammates, let's call him Brian to protect the innocent, started freaking out because Etherscan.io was showing a whole bunch of transactions taking place on his Rinkeby account. It turned out he was looking at the transaction history for 0x627306090abab3a6e1400e9345bc60c78a8bef57. If that address looks familiar, that’s because it’s Accounts(0) when you run Truffle Develop.

It never occured to any of us before that the same private keys would create the same addresses on every network. In practice we would import the private key for the address we are working with to MetaMask and assign it a name like TruffleDev0 or MewRinkeby0. Then, when we switched provider from localhost to Rinkeby Test Network, we would switch addresses as well. This is the first time one of us forgot to switch accounts in MetaMask to reflect the change in web3 provider.

Get Best Software Deals Directly In Your Inbox

Here are the notes Brian wrote describing how he discovered the vulnerability:

Exploit we found
1. ran truffle dev
2. MetaMask imported using truffle dev seed phrase or private keys
3. THEN connected to networks other than local using the same MetaMask account
What that did:
Created the same wallets (with the same private keys) on each network I connected to
How we found it:
MetaMask didn’t show other people’s transactions
When we went to Etherscan, noticed a bunch of transactions we didn’t initiate
Exploit:
Everyone that runs truffle dev knows those private keys
So, when I connected to live net, every other Ethereum developer had access to real funds

Having realised that the Truffle private keys worked on Rinkeby, we switched providers over to Main Ethereum Network and hit the “View account on Etherscan” button. It turns out that since the deployment of Truffle 4.0, Accounts(0) has been very active on the main net. At the time of this writing there have been 378 transactions representing about ten thousand dollars in value passing through a completely open address.

We reviewed the history for all ten Truffle TestRPC addresses and discovered that they are currently being exploited by a few GETH scripts that redirect all ETH that lands at those addresses. After continued discovery we uncovered the following vulnerabilities within several popular web3 applications:

• By storing transaction nonce locally, MetaMask can return a transaction history that is not complete for a given address. Furthermore, it could create collisions while deploying contracts due to the nonce being estimated.
• Coinbase allowed the purchase of ETH by that account. In our test, we purchased 0.001 ETH from Accounts(0) and the transaction executed without any error handling. 3 blocks later, another actor had sent a portion of that ETH to another address. That target address has collected over $500 in ETH from Accounts(0) and Accounts(1) in the last 33 days.

• Etherscan does not have these addresses flagged in any way, nor have any comments been left by concerned citizens in the Disqus comment sections for these accounts.
• A Poloniex contract deposited 0.9 ETH at one point, which suggests that their interface does not prohibit their users from withdrawing to these accounts.
• Various accounts associated with legitimate ICOs have sent money to these accounts during their pre-sales and token sales.

My company, Web3Devs, is currently in the process of raising this issue with the teams identified above so that they can flag these accounts for their customers’ protection. But in the meantime we would like to offer some tips to help other developers stay safe when working with these accounts.

• Name your accounts in MetaMask so that you can easily see which network each account should be active on.
• Do not use testRPC addresses on a Test EVM as their are thousands of other transactions at those addresses which will make testing needlessly buggy.
• Do not store your savings or accept real payments at addresses that are stored in your development environment.
• Keep the funds necessary for production deployment to an absolute minimum in your development environment.

Truffle 4.0 has done us all a huge favor by keeping the Accounts and seed phrases the same from one instance of Truffle TestRPC to the next. But this convenience has come with a cost. Let’s all be sure to keep our teams adhering to best practices and keep addresses seperate between networks.

Also, we found this contract during discovery, read the comments if you need a good laugh.

Truffle TestRPC Accounts Can Cost Unwarry Developers Real World Ether was originally published in Coinmonks on Medium, where people are continuing the conversation by highlighting and responding to this story.