Smart contracts and the assurance gap

“What we’ve discovered is an underlying failure to understand how smart contracts need to be engineered and executed in the first place, such as the governance rules that solve for these types of potential risk issues.”

Yvette Connor

Grant Thornton Strategic Risk and Operations
Principal

This issue goes deeper than trying to find and isolate predictable vulnerabilities; in many ways, that’s an impossible task. However, blockchain gives us the power to address risk if governance is properly structured. “What we’ve discovered is an underlying failure to understand how smart contracts need to be engineered and executed in the first place, such as the governance rules that solve for these types of potential risk issues,” Connor said.

In fact, “the emphasis in the market has been on contract design for execution, and less focused on designing effective governance rules,” warned Grant Thornton Risk Advisory Services Principal and Banking Sector Lead Graham Tasman. “This is where we see a huge opportunity to better leverage the power of blockchain — to incorporate effective governance contracts into the design.”

“There is a perception of inherent risk, from recent events where smart contract execution has failed in practice. The problem is, once a deployed smart contract is active in the blockchain, you can’t simply reel it back in.”

Graham Tasman

Grant Thornton Risk Advisory Services
Principal and Banking Sector Lead

“Since the entire adoption of blockchain is ultimately built around reliability and trust, it is critically important to eliminate the perceived risk of the unknown,” Tasman said. “There is a perception of inherent risk, from recent events where smart contract execution has failed in practice. The problem is, once a deployed smart contract is active in the blockchain, you can’t simply reel it back in.” It can be difficult to update change control for the rules on a smart contract after you discover a problem. That’s why knowledgeable design and testing are essential up front.

“There’s not sufficient attention given to the pretesting that is required to determine every permutation on an algorithm or business rule that goes into smart contracts,” Tasman said. Traditional computer-based algorithms and code undergo extensive testing, auditing and change control in advance of deployment. Likewise, a smart contract requires sufficient auditing and testing, with appropriate governance and control before release. The more rigorous the testing and auditing regimen applied during design, the better assurance of hardened operability when deployed.

Connor explained, “It’s like an airliner on autopilot, where you don’t need a detailed understanding of the aerodynamics involved or the failure points of the control system to fly the plane. That autopilot assurance is finite, so it’s not an entirely reliable or safe option.”

Vulnerabilities that are exposed in a deployed smart contract can be a serious problem for the contract’s participants. That’s because the inherent blockchain rules leave limited recourse on events that have already occurred. So, securing contracts before they are deployed can be the best way to drive assurance, even if it requires more work in development.

Fixing a deployed smart contract is like fixing a plane in flight — it’s not ideal, but we’d better be ready to do it. To address blockchain changes after a system’s release, developers need change control rules defined in on-chain governance. “There should be a whole set of change controls around editing or modifying smart contract business rules,” Tasman said.

A governance contract that attaches to the smart contract can establish who’s allowed to modify the contract rules and when. This is typically someone in leadership at the contract creator. “But then, let’s go a step further and ask, ‘Why can’t a regulator be named as a participant in that governance contract?’” Tasman said. “There are all kinds of possibilities to enable governance contracts to be operated as failsafe controls, but so few are spending time on them relative to the rules for smart contract execution.”

“It’s up to us in the business of managing risk to bring attention to this, emphasizing the appropriate focus on control to ensure a trusted and reliable network for all,” Tasman said.

“From an audit perspective, it’s about change management. It’s about security administration. It’s about governance.”

Scott Peyton

Grant Thornton Internal Audit Cybersecurity
Practice Partner

“From an audit perspective, it’s about change management. It’s about security administration. It’s about governance,” said Grant Thornton Internal Audit Cybersecurity Practice Partner Scott Peyton.

“These are not new topics, and good hygiene for systems development still applies,” Peyton said. “The code and the system that we’re stepping into is much more complex, but a lot of the basic principles are still necessary.”

Blockchain technology casts these concerns in a new light, but it also gives us new means for control and assurance. “When you build controllability into the process design, you don’t have to put as much rigor into after-the-fact checking,” Tasman said. “If you design the business rules with a component that is about the control, then you’re going to make the whole transaction much more reliable and efficient — but we need more emphasis on that point.”