Cryptocurrency market data platform CoinMarketCap has added a new metric to their site for measuring the fundamentals of cryptocurrency projects.

The new rating system dubbed the Fundamental Crypto Asset Score (FCAS) measures cryptocurrency projects “health” by considering user activity, developer behavior, and market maturity. Basically, the service provides insight into the growth and development of a project:

“We intake raw blockchain data across relevant projects and parse them internally. Once we clean, analyze, and recreate the raw data elements, we combine them with market data gathered from various sources to inform our models.”

User activity takes into consideration all customer behaviour for a specific cryptocurrency and comprises project utilization and network activity factors. The score is calculated by analyzing activity within a particular blockchain and labeling wallet addresses to determine the number of users, exchanges, contracts, and other types of participants.

Developer behavior indicates the level of activity and efficiency of a development community on a specific blockchain or project, and comprises such factors as code changes, code improvements, and community involvement. The benchmark tracks 30 variables to further explore the relations between traditional developer metrics and community activity.

The last criterion, market maturity, is sourced from risk and money supply factors. Generally, the metric represents the likelihood a crypto asset will provide consistent returns across various market scenarios by combining assessments of market risk and an analysis of the stability of the money supply of each tracked cryptocurrency.

The project is backed by such industry players as leading American cryptocurrency exchange Coinbase, incubator and venture capital firm Digital Currency Group, and Silicon Valley-based venture capital firm True Ventures, among others.

At press time, the scale of 1–1,000 health points shows that leading cryptocurrency Bitcoin (BTC) has a health of 885, behind Ethereum (ETH) with 909 health points. The third largest coin by market capitalization, Ripple (XRP) is sitting at the 751 points on the health scale at press time.

Stablecoin Tether, which recently hinted that it may no longer be solely-backed by the U.S. dollar, has a health of 437, giving it an “F” letter grade on the scale.

Source: https://cointelegraph.com/news/coinmarketcap-introduces-new-metrics-for-crypto-fundamentals

South Korea’s largest Bitcoin exchange, Bithumb, has announced layoffs of 50%, the latest casualty of “crypto winter.” B

A report in Korean media issued earlier today shows that the exchange will be cutting its staff from 310 to around 150. The exchange is currently ranked at no #2 in trading volume in the world by Coinmarketcap and has a 24/h volume of over $1.5 billion.

“VOLUNTARY RETIREMENT”
A company spokesperson claimed that most of the employees being let go had already wanted to leave.

Voluntary retirement is part of our support program for former employees and is intended to provide assistance and training for job placement.

Apart from that, [Bithumb’s] trading volume has decreased compared to the previous year, [so] we are trying to provide internal measures. We will continue to add necessary personnel for various new businesses.

Decreased trading volume and a corresponding lack of fee revenue are the cause of the layoffs, an all-too-familiar sight in the cryptocurrency industry of late.

Bithumb has been suspected more than once of faking its volume. If it had the volume it claims, its income would be more than sufficient, even throughout the crypto winter.

MAJOR LAYOFFS THROUGHOUT THE INDUSTRY
Bithumb joins other heavy hitters such as Dash, Steemit, ConsenSys, and Shapeshift in laying off large amounts of staff. Dash

Steemit cut 70% of staff in an extreme measure to keep the company afloat after the cryptocurrency price crash tanked the value of Steem tokens. The currency is the lifeblood of the social media platform, and the company admitted that it was over-dependent on its token valuation.

Eric Voorhees of the trailblazing ShapeShift exchange also stated that his company was overly-reliant on the price action of cryptocurrency, with a significant amount of company assets tied up in the market. He cited crypto winter as the main factor behind layoffs of around 30%, also adding that ShapeShift tried to expand too quickly and deviated too far from its original mission to provide crypto trading services.

Ethereum co-founder Joe Lubin was also forced to drop 60% of staff, announcing that ConsenSys would have to terminate staff and also begin dropping projects not turning a profit.

CRYPTO WINTER CONTINUES
With the largest companies in the industry taking massive hits, it seems that none are safe from what continues to be an ongoing problem. The volatility of cryptocurrency has been both a blessing and a curse for exchanges like Bithumb. It attracts traders seeking to capitalize on massive price swings while, at the same time, providing a foundation so shaky that many promising companies cannot build upon it.

For now, all they can do is attempt to weather the storm and hope that it passes quickly. For many, this means seeking funding and selling large parts of the company off to venture capitalists who may end up changing the original plans laid out by the hopeful founders.

Source: https://www.ccn.com/bitcoin-exchange-bithumb-announces-50-layoffs

The cryptocurrency market had a terrible period in 2018. Several cryptocurrencies lost as much as 90% of their price values during last year. The largest digital asset, Bitcoin was on a losing spree first six months consecutively, finally ending the streak in February earlier this year.

Analysts and speculators stated that it was the beginning of the end for the crypto bubble, and believed that the situation will keep deteriorating. However, this hasn’t prevented new players from entering the market which proves that the game is far from over.

Riot Blockchain, a US-based blockchain company has announced that it will be launching a new regulated crypto exchange in the country by the end of this year. The new entity will be called RiotX and will be regulated by the US Securities and Exchange Commission (SEC). RiotX will focus on three main services, viz, banking, trading and digital wallets.

The announcement was made via a filing with the SEC on Friday. The company has had regulations and compliance issues with the US regulatory agency in the past. Prior to its foray into the crypto space, the company was engaged in biotech business for about two decades, under the name Biotpix, which was changed to Riot Blockchain. The company shifted its focus to crypto mining in October 2017, following which the company was served a show cause notice by the SEC for the sudden shift in business model, which resulted in a certain hike in share prices.

During the past year, Riot Blockchain revamped its board of directors following the resignation of its chief executive. It also acquired a crypto futures brokerage firm called Logical Brokerage in March 2018.

In an official statement, Riot Blockchain said that the exchange will be managed by its subsidiary RiotX Holdings Inc., and will mostly focus on Bitcoin mining. RiotX will also launch an API based software, SynapseX, for banking services. The statement further read that API will also track the location and identity of users to prevent fraud and inappropriate use of the exchange. There are a few states in the US, where crypto exchanges are not yet legalized, and the exchange will have to take measures to avoid serving people located in these states, though it will restrict the number of users.

SynapseFi’s API will allow the company to locate where the user is while engaging with RiotX. If the user’s location seems to be a state where digital asset exchanges are not permitted, the platform will restrict that user’s access to the exchange, and vice versa. The crypto exchange will be operated in collaboration with exchange software provider Shift Markets, as it ended its contract with the Canadian exchange Coinsquare following the SEC investigation of 2018.

Riot Blockchain has claimed that it already has approval from five states, and the exchange will be operating throughout the United States, barring Hawaii and Wyoming, by the end of 2019.

The crypto space has been witnessing a certain resurrection since February, which has rejuvenated speculations for a bull market. Giant corporations like JPMorgan, IBM, Facebook, etc., have entered the digital asset game by launching their own cryptocurrencies and related services. Bitcoin has gained stability over the past few weeks and has been consistent in price at around $3,900 – $4,000.

However, the crypto exchanges throughout the US will witness a revamp, as the SEC is planning to establish a formidable regulatory framework for digital asset trading in the country. Especially, after arch-rival Russia announced its plans to reduce its dependence on the USD by introducing its own cryptocurrency, the regulatory agency will be taking extra efforts to avoid any kind of foreign manipulation or fraudulent practices on crypto exchanges.

Source: https://www.cryptonewsz.com/riot-blockchain-reveals-plans-to-launch-a-new-crypto-exchange-in-the-us/11762/

According to fnnews, a mainstream financial media outlet in South Korea, Kakao is integrating crypto for its 44 million local users.

Kakao is the biggest internet conglomerate in South Korea that operates KakaoTalk, KakaoPay, KakaoTaxi, KakaoStory, KakaoStock, and many other platforms that have overwhelming dominance in their respective markets.

On March 18, fnnews reported that following the integration of a crypto wallet by Samsung in the form of Samsung Blockchain Wallet, Kakao will integrate a crypto wallet into its messaging app to enable casual users to use digital assets on a daily basis.

“Following the integration of Blockchain Keystore on Samsung, the integration of a crypto wallet by Kakao, which is used by the majority of messaging app users in the nation, is expected to expand blockchain services and usage.”

WHY KAKAO IS INTEGRATING A CRYPTO WALLET
Local publications have reported that Kakao is estimated to have raised $90 million to develop its own blockchain network called Klatyn and the integration of a crypto wallet into KakaoTalk is one way to introduce their own blockchain network to the public.

Industry executives told fnnews that KakaoTalk “will be used as a crypto wallet,” allowing users to run various blockchain applications and send, receive, and store cryptocurrencies.

For now, Kakao is said to be considering an opt-in method to enable cryptocurrency and blockchain services. Simply put, users will have control over the presence of the crypto wallet on the messaging app.

For instance, on KakaoTalk, users can play various mobile games and run applications natively on the platform, only if the users opt-in to do so.

The cryptocurrency wallet of Kakao is expected to be rolled out in a similar way and the platform will let users choose if they wish to use a cryptocurrency wallet.

One industry executive said:

“Kakao needs a cryptocurrency wallet for users of Klaytn and the best way to roll out the service is to integrate a crypto wallet into KakaoTalk, which over 80 percent of the population of South Korea use to communicate.

Speaking to CCN, Heslin Kim, South Korea-based CEO of BlockchainROK, said:

Kakao is representative of South Korea, a country with over 55 million people. It embodies the fast paced, technology driven lifestyle that Koreans adopt so readily. It’s an app so deeply attached to what it means to be Korean.

The fact that one of the most widely adopted apps, with over 95% market share, is publicly promoting and spreading blockchain/crypto is tremendous for mainstream adoption. Connect the dots with the market share and total population. With Samsung’s S10 and now Kakao’s wallet we can continuously expect Korea to be at the forefront of the DLT disruption.

WHAT IT MEANS FOR SOUTH KOREA’S CRYPTO SECTOR
If Kakao moves forward with its current plans to integrate a crypto wallet into an application used by tens of millions of users in South Korea alone, the country’s most widely utilized device in Samsung Galaxy S10 and messaging app will have native support for crypto.

While a Kakao representative has not officially confirmed KakaoTalk’s integration of crypto, the representative said that it is putting in efforts for the development and expansion of blockchain technology.

The sentiment around the launch of the Samsung Blockchain Wallet and reports regarding Kakao’s integration of crypto has been positive and investors in the local market have demonstrated optimism towards the initiatives of influential conglomerates in the country to lead the growth of cryptocurrency and blockchain.

Earlier this month, local publications reported that Samsung Pay is set to integrate cryptocurrencies following the release of the Galaxy S10’s Samsung Blockchain Wallet, reducing the friction between casual users and cryptocurrencies.

“At this phase of development, if a cryptocurrency wallet is added to Samsung Pay, the application will be strengthened as a complete fintech platform. Currently, the Samsung Blockchain Wallet is said to be supporting Ethereum but more cryptocurrencies are expected to be integrated in the near-term,” the report read.

Source: https://www.ccn.com/koreas-biggest-messaging-app-kakao-to-integrate-crypto-wallet-for-44-million-users

Cryptopia, the New Zealand-based cryptocurrency exchange has been working on updating its system to start afresh, after two hacks crippled the exchange in January 2019. In order to be fully functional, the exchange carried out a system update, following which it was functional for a short while, reported Chepicap.

During this window, the exchange allowed users to carry out trading activities, before halting it again. In their latest tweet, the exchange also informed users about the scheduled update that was going to take place.

“Please note, that we will be putting the site will be into maintenance from 2pm (NZDT or 1am UTC) today for 2 hours, we will keep you updated on our progress.”

Cryptopia also announced that the team will be sending emails to all users impacted by the hack. The mail in question, appeared to be a clarification about the hack, and addressed allegations of it being an exit scam. The exchange further explained the steps taken by them during the hack, steps that prevented additional funds being compromised.

“On the 14th of January 2019 we noticed several suspicious transactions and placed our site into maintenance to prevent additional funds from being compromised as best we could.”

The exchange added,


Cryptopia, the New Zealand-based cryptocurrency exchange has been working on updating its system to start afresh, after two hacks crippled the exchange in January 2019. In order to be fully functional, the exchange carried out a system update, following which it was functional for a short while, reported Chepicap.

During this window, the exchange allowed users to carry out trading activities, before halting it again. In their latest tweet, the exchange also informed users about the scheduled update that was going to take place.

“Please note, that we will be putting the site will be into maintenance from 2pm (NZDT or 1am UTC) today for 2 hours, we will keep you updated on our progress.”

Cryptopia also announced that the team will be sending emails to all users impacted by the hack. The mail in question, appeared to be a clarification about the hack, and addressed allegations of it being an exit scam. The exchange further explained the steps taken by them during the hack, steps that prevented additional funds being compromised.

“On the 14th of January 2019 we noticed several suspicious transactions and placed our site into maintenance to prevent additional funds from being compromised as best we could.”

The exchange added,





“We notified local and international law enforcement agencies of the matter and our offices were locked down and the site was only accessible to a very small number of staff and law enforcement agencies.”

Since been given access to their site on 14 February, the exchange has taken significant steps in resuming service, including regular updates via their Twitter handle. The blog had also announced that victims of the hack will be refunded.

The exchange informed users that they were planning to go active by the end of this month, and concluded by saying,

“We will be emailing you again shortly with more details around the rebates and the projected dates for trading to be active again. Please be aware, we are hoping to achieve this by the end of the month.”

Source: https://ambcrypto.com/cryptopia-announces-intention-to-reopen-by-march-end-reveals-website-in-testing-phase/

On the heels of recent commentary from the published correspondence between Securities and Exchange Commission (SEC) chairman Jay Clayton and representative Ted Budd, SEC senior advisor Valerie Szczepanik explained at Austin’s SXSW conference that stablecoins may be violating current securities laws.

Stablecoins May Live in the Land of Securities
Over the last two years, stablecoins have become an extremely hot topic while becoming popular vehicles for hedging against the volatility tied to cryptocurrency markets. Tether (USDT) has been king of the stablecoins for a while, and recently made headlines for a revision to the company’s website. The change caused uproar within the cryptocurrency community because instead of confirming that each Tether is backed by one USD, the terms were substantially revised.

“Every tether is always 100 percent backed by our reserves, which include traditional currency and cash equivalents and, from time to time, may include other assets and receivables from loans made by Tether to third parties, which may include affiliated entities,” the website now reads.


Following Tether’s recent website update, on March 15, SEC senior advisor Valerie Szczepanik explained that due to the inherent nature of stablecoins, the tokens could “raise issues under securities laws.” Szczepanik explained that stablecoins are broken down into categories which include tethering the tokens to “some real asset, like real estate or gold and oil — Coins tied to a fiat currency held in reserve, and a third category that could become problematic under the law.” The SEC advisor added while on stage at SXSW: “I’ve seen stablecoins that purport to control price through some kind of pricing mechanism, whether it’s tied to the issuance, creation or redemption of another type of digital asset tied to it, or whether it is controlled through supply and demand in some way to keep the price within a certain band.”

Szczepanik continued:

It’s these kinds of projects where there is one central party controlling the price fluctuation over time that might be getting into the land of securities.

The recent statements from the SEC senior advisor and chairman Jay Clayton’s statements last week could mean that stablecoins fall into the security category. Stablecoins, no matter whether they are backed by reserves held in a bank, or use the over-collateralization method favored by the Maker network, are essentially promises. Skeptics take issue with claimed tether (USDT) reserves because they believe the company has failed to prove its backing. Tether’s recent website change provoked popular finance author Frances Coppola to write: “Tether’s U.S. dollar peg is no longer credible,” in a seething critique.

Coppola’s assessment continued:

Perhaps crypto enthusiasts should read up on the fate of Reserve Primary Fund in 2008. Or perhaps Venezuela — After all, an exchange rate peg only holds until the reserves run out.

A Crypto Flash Crash Scenario Could Put a Heavy Strain on Stablecoins
Other stablecoins are based on promises as well and some have the stamp of U.S. regulators in order to make the pledge more robust. Trusttoken (TUSD) has tried to tackle transparency by allowing TUSD owners a “real-time view” of the company’s reserves. According to the Trusttoken team, accounting firm Armanino has developed a platform that allows users to verify the TUSD dollar collateral. Dai has over-collateralization, so there’s some safety net there, but critics believe that if the price of ethereum (ETH) plummeted in a flash, the stablecoin would have issues unless the team sold the collateral quickly.

A flash drop in overall fiat value within the cryptoconomy really puts a strain on stablecoins and when bitcoin and a few other digital assets dropped significantly in value last October this was quite noticeable. The belief that stablecoins can hold their stability would truly be put to the test if there was a flash crash throughout the crypto markets.


Just like their fiat cousins, all stablecoins are only as good as their promises and a flash crash and severe lack of liquidity could ultimately wreak havoc on digital promissory notes. On October 15, when the cryptoconomy shuddered with another price crash, tether (USDT) dipped below the $1 mark. However, despite concerns over coins like tether, Szczepanik asserted at SXSW that “algorithmic stablecoins” raise the most issues because there is a lack of any real collateral.

“You’re talking about folks who are buying into that ecosystem, or are buying this coin, with the expectation that somebody else is going to be holding a profit, or guaranteeing a profit or holding the price at a certain level. Again, that could raise issues under securities laws.”


Stablecoins Face a Future That Falls Under Securities Laws
At the moment, stablecoins face some significant hurdles and two major issues. One is the promise to hold to constant stability and liquidity especially during a big market crash. The other issue is whether stablecoins, whose legal status is currently being questioned, will pass the scrutiny of regulators. Stablecoin startup Basis knows these dangers only too well as the company was forced to close operations in December due to fears its product would be deemed a security.

“Folks like to put labels on things, but we’ll always look behind the label to see exactly what’s happening,” Szczepanik said. “So you can call it a utility coin, call it a stablecoin, call it a consumptive coin or some other coin — We’re [SEC] going to look at the characteristics.”

Source: https://news.bitcoin.com/stablecoins-are-threatened-by-these-two-major-issues/

More than six months since Intercontinental Exchange (ICE) revealed its vision for Bakkt, the hotly anticipated bitcoin futures market is still awaiting regulatory approval.

ICE, the parent of the New York Stock Exchange, originally planned to launch Bakkt in mid-December. Then it got pushed back to late January. Then, on New Year’s Eve, the launch was indefinitely delayed, with ICE saying its previous Jan. 24 target “will be amended pursuant to the CFTC’s process and timeline.”

Now, with the first quarter of 2019 nearly over, the Commodity Futures Trading Commission has yet to release Bakkt’s proposed exemption for public comment. That means even if the proposal came out today, the launch can’t happen until mid-April at the earliest since the commissioners have to give the public 30 days to weigh in and then take another few days to read the comments before voting on whether to approve the plan.

And as of late February, the proposal, which would allow Bakkt to custody the bitcoin trading on the platform, was still being reviewed by the CFTC’s Division of Market Oversight, two officials said.

Why the hold-up? The government shutdown, which began on Dec. 22 and lasted a record five weeks, creating backlogs at the CFTC and other agencies, surely didn’t help matters. In getting caught up, the agency has prioritized other matters, mostly unrelated to crypto, including more than half a dozen enforcement actions announced since the shutdown ended.

But the ambitious nature of Bakkt’s business plan is likely also a factor in drawing out the process.

Physical settlement
To be clear: the issue is not necessarily with Bakkt’s envisioned one-day futures contract, which would be physically settled, meaning the buyer would receive the actual commodity – bitcoin – at maturity.

In late February Amir Zaidi, the director of the CFTC’s Division of Market Oversight, told CoinDesk that the analysis for evaluating cash-settled bitcoin futures contracts – such as what CME Group and the Cboe offer – is slightly different from the analysis for evaluating physically-settled bitcoin futures contracts.

The different analyses examine whether the futures contracts, once offered, are “readily susceptible to manipulation,” Zaidi said. This is a concern with cash-settled contracts, where at the end one party pays the other the difference between the spot and futures prices; if the spot price is determined from a manipulated price feed, one side is getting bilked.

With a physically settled contract like Bakkt’s, “you don’t have to worry about the cash market, so some of [the] concerns [are resolved],” said Zaidi, who would not discuss the proposal any further.

Yet while the manipulation concerns associated with cash-settled contracts may be addressed by physically settled futures, Bakkt’s intent to act as its own custody warehouse appears to have raised other issues.

‘Novel and complex’
A former CFTC staffer, who spoke on condition of anonymity because their current employer has business before the regulator, noted that generally, commodity futures exchanges use a service provider like a bank or trust to manage custody “under the full control of the clearinghouse.”

The contracts are settled at the bank or trust, but the underlying asset would be delivered “under the auspices of the clearinghouse, and under federal or state oversight of the bank or trust,” this lawyer said.

“It seems to me, without more information, that Bakkt is trying to gain approval as a third-party warehouse similar to a silo where it’s controlled by the requirements put in place by the clearinghouse and the exchange, by ICE’s regulated entities in this case,” they said.

Yet Bakkt’s proposal, based on what information has been publicly released to date, could result in the firm not falling under federal or state oversight.

The former CFTC staffer explained:

“Without knowing more, the hiccup could be that Bakkt’s approach is novel and complex and the [question] is do you treat the delivery point like a grain silo or do you treat the delivery point like the clearinghouse itself; and if you treat the delivery point as a grain silo does it have some sort of designation under state or federal law?”

Return to sender?
In December, a source familiar with the CFTC’s process told CoinDesk that Bakkt’s proposal to custody bitcoin on its clients’ behalf using its own warehouse had been passed from the agency’s staff to the commissioners.

However, it would appear this is no longer the case.

The former CFTC staffer said it is not unusual for proposals to be sent from the Commissioner level back down to staff, particularly “if [the Commissioners] are not comfortable with the direction or their questions are not answered.”

Late last month, Commissioner Brian Quintenz told a group of reporters at a derivatives conference in New York that he did not have the Bakkt proposal before him at the time, meaning he would not be able to vote on whether to release it for public comment.

When pressed about Bakkt, CFTC commissioners repeatedly referred CoinDesk to the regulator’s work with guidance on “actual delivery” – a long-standing issue for the agency – to indicate that the agency is still examining the crypto space, if not specifically the Bakkt proposal.

Speaking to CoinDesk in late February, CFTC Commissioner Dan Berkowitz explained that this guidance “is one of the priorities [for] the agency,” but that there are also a number of other issues to examine (of the non-crypto-related variety).

Like Berkowitz, Quintenz referred CoinDesk to the regulator’s examination of its actual delivery guidance.

‘Not standing still’
For its part, Bakkt appears to have been continuing to build out its product and systems. In January, CEO Kelly Loeffler announced that the company was acquiring select assets belonging to Rosenthal Collins Group, a futures commission merchant.

These assets included former employees of the group, and Bakkt finalized the deal the next month.

In her January announcement, Loeffler stated that the “acquisition underlines the fact we’re not standing still as we await regulatory approval by the CFTC for the launch of regulated trading in our crypto markets.”

Loeffler did not provide any revised estimates on when Bakkt would launch.

Bakkt declined to comment for this story. But at a derivatives conference in Boca Raton, Fla., last week, chief operating officer Adam White spoke in general terms about the exchange’s work with regulators, indicating his team recognized a need for patience.

“It’s not the world where you fill out an application, you throw it over the fence and you hope you get it back so you can launch your business,” he said, without mentioning the CFTC or the status of Bakkt’s proposal. “It’s partnering and working with the regulators to help them understand what is hard fork, what a deep chain reorg is, why one blockchain or public blockchain may be sufficient and capable while another one isn’t. It’s very much the approach that we’ve been taking.”

White concluded:

“And the regulators are going to move at the pace they are comfortable with, so that they are protecting the public.”

Source: https://www.coindesk.com/bakkts-bitcoin-futures-market-appears-stuck-in-regulatory-limbo

More than 1.2 million ethereum applications have used a little-known security tool to help them avoid the costly errors arising from self-executing lines of code known as smart contracts.

Launched by ethereum technology startup Amberdata back in October, the free tool is available for anyone in the general public to interpret the security of active applications on the ethereum blockchain. Smart contracts with bugs that have been exploited have led to huge losses, even to the tune of hundreds of millions.

The automated service scans for common vulnerabilities found in smart contract code and generates a letter grade rating (e.g. A, B, or C) for the security of a decentralized application (dapp).

The feature is one of the many tools encouraging best practice and increased transparency between dapp developers and end-users in the ethereum ecosystem.

What’s more, it’s a feature that has been around in the broader web space for quite some time. Privacy-minded browser DuckDuckGo recently launched a Chrome browser extension used to rate websites (not dapps) with a letter grade, giving users an easy insight into how well or poorly service administrators protect user privacy.

“Our vision is to raise the standard of trust online,” writes DuckDuckGo in a blog post from January 2017.

Similarly, the vision behind Amberdata’s security grading tool, as highlighted by Amberdata CEO Shawn Douglass in a press release, is to provide “greater access and enhanced visibility into smart contracts.”

He added:

“We hope that by providing these tools to the community, we can reduce outside dependencies and enable the community to develop faster and more safely.”

The ratings
But how exactly are these applications on ethereum rated on Amberdata?

Pointing to 13 types of vulnerabilities scanned for automatically by the program, Amberdata CTO Joanes Espanol likened each of these to “engine lights on [a car] dashboard.”

“It just means that I need to check what’s going on with the car. Any of these can result in security error,” explained Espanol to CoinDesk.

And the more security errors that are detected by Amberdata’s security scan, the lower the alphabet letter grade a dapp will receive. These ratings range from an A+ all the way to an F.

But they don’t strictly depend on the number of security errors. Each of the 13 vulnerabilities have varying degrees of severity, Espanol explains, that will impact a dapp’s final grade. Two common low severity vulnerabilities marked by Espanol include “delegate call to a user-supplied address” and “message call to external contract.”

The latter may pose a potential security risk if a dapp, rather than being self-contained in one smart contract, calls additional contracts possessing buggy code.

Similarly, a delegate call is another operation that is normally used to split smart contract code into multiple sub-contracts, so that any necessary upgrades to the software can be made piecemeal without terminating the whole application.

“That’s the good part of those delegate calls. But the bad part is that now as an owner of the contract, I could start doing bad things. So, I could start replacing contracts that change the behavior of the original [application,]” explained Espanol.

As such, on both counts, Espanol described the security audit as sending out “warnings,” rather than pointing out immediate code errors.

Indeed, one such dapp currently leveraging message call and formerly having deployed a smart contract upgrade using delegate call back in January is TrueUSD. Created by blockchain startup TrustToken, the USD-backed stablecoin on ethereum is currently ranked with a C letter grade.

While that doesn’t sound good, looking at the vulnerabilities flagged for TrueUSD, TrustToken security engineer William Morriss told CoinDesk in a former interview all identified concerns were actually not “critical.”

“The vulnerabilities that are being reported are not ways in which we can be attacked … We are aware of them and when people bring vulnerabilities to us we treat them very seriously,” said Morriss.

Elaborating on the matter of message calls specifically, Morriss added that for TrueUSD, all external contracts are owned and operated by the companies themselves as opposed to third parties with potentially lower security standards.

How to get an A+
Errors of “high” severity will hit the application’s security rating harder because they indicate a greater potential for code error and exploit.

One of the most common of these, “integer overflow,” indicates operations carried out within a smart contract could generate values exceeding code limitations, leading to wacky, unpredictable behavior that, in the worse case, could lead to loss of funds.

The flipside is “integer underflow,” another vulnerability of “high” severity, by which the exact reverse may happen and a value below the defined range similarly causes erroneous output.

There are also some features in Solidity that dapp developers should just avoid, according to Amberdata’s grading system, including “suicide()” and “tx.origin.” The latter is described by Espanol as “deprecated code” that may be removed from the Solidity language altogether at a future date, while the former poses risk of being hijacked by outside parties to freeze user funds – that they can never get back.

Since it doesn’t have any of these four vulnerabilities, the infamously popular ethereum dapp CryptoKitties currently has an A+ security rating on Amberdata. CryptoKitties software engineer Fabiano Soriani attributes this to “implementing as many tests as we can.”

Adding that “passive resources” such as written documentation and video tutorials on dapp development are not enough to build secure applications on ethereum, Soriani told CoinDesk:

“When someone runs an audit, they point out things for you. It’s a very good complementary resource [to passive resources] because developers coming from a more traditional background aren’t familiar with blockchain.”

‘It’s a new set of problems’
Indeed, when it comes to building dapps, the importance of airtight, impenetrable code cannot be understated. The core reasoning for this is two-fold.

First, unlike traditional applications, dapps are generally open-source computer programs and as Morriss explains, “a heightened level of caution” is required when running code that is “public.”

“If there’s any bug in a traditional application you might be able to get away with it for several years … but if you have a bug in your smart contract people are going to find it rather quickly and take advantage of it either to your destruction or to their benefit,” said Morriss.

Secondly, dapps on ethereum run exclusively on smart contracts. Specially coded in programming language Solidity and executed in the blockchain’s nerve center called the Ethereum Virtual Machine (EVM), a key strength of dapps is that they can’t be changed.

The downside to this is obvious. Programmers are not easily able to correct errors or bugs in the software once deployed on the blockchain.

Calling it a “grievous error” to skip a third-party security audit or scan for these reasons, Morriss told CoinDesk it was important for developers not to become victims of their own “hubris” and ensure that “tests are covering every branch of your code.”

“With ethereum, it’s a new set of problems that people aren’t aware of when coding in Solidity,” stressed Espanol to CoinDesk.

Source: https://www.coindesk.com/how-ethereum-applications-earn-a-security-ratings