Ethereum smart contracts are million dollar bug bounties? That sounds about right to me, and seems historically accurate.
Mind you, Ethereum apparently was too. :P
There is also the matter of verifying the platform itself.
In that case there is no redress as the platform is for all intents and purposes immutable when it's working correctly.
In other words, errors that occur due to malfunctions in the platform are reversible. Errors in applications built on top of it are not.
The Ethereum virtual machine has been formally verified.
"These properties make KEVM an ideal formal reference implementation against which other implementations can be evaluated. We proceed to argue for a semantics-first formal verification approach for EVM contracts, and demonstrate its practicality by using KEVM to verify practically important properties over the arithmetic operation of an example smart contract and the correct operation of a token transfer function in a second contract."
From the paper, it seems that the latter example could have found a bug that caused problems in a deployed Ethereum contract.
The primary difference is that banks are encouraged to cooperate to recover these. In the blockchain world, it's incredibly difficult to recover losses and people suggest "no-takesies-backsies" is an ethical method of doing business while wracked by fraud.
I think the bottom line is that contract law is an AI-hard problem-- meaning it takes a "real intelligence" to negotiate and enforce contracts. Simple logical rule sets implemented in code are too dumb.
The main difference is that it is infeasible to hold large amounts of cash, and so we usually allow a third party to hold on to our money. That third party will usually hand over your money if requested by the government (some overseas banks are notable exceptions!!). With bitcoin I can hold on to it myself and not have to worry about the actions of a third party. Secondly, even if you horde cash, it's hard to secure it. It's basically impossible to make it so that only you can access it. With Bitcoin, it is easy to secure a large amount of value and ensure that only you can access it. Bizarrely, a large number of people totally ignore this advantage...
This is the entire point of bitcoin. With the hype, fraud and what not, people often assume that bitcoin must have been developed as a scam. But I really do believe that the purpose was to allow people to have access to money and not have to rely on a third party who probably doesn't have your best interests at heart. It's not really surprising that criminals will be interested in this kind of system. They are the ones with the highest need. The government can't freeze your account.
The interesting question is: do we need that kind of security? Do we trust the banks and government to act appropriately with our money?
A bit harder to do that when someone deprives me of bitcoin by theft or fraud.
I am familiar with compensating transactions. Ledgers are a necessary mechanism, but they are not a sufficient mechanism to safeguard against theft, fraud and error. These systems work because of multiple overlapping defences and they still fail.
I find that I tense up at the strong strain of technoutopianism that runs through bitcoin and cryptocurrency circles.
You're asking the rest of us to bet everything on block. I don't trust anyone to not make a mistake and I don't believe in single lines of defence, no matter how computationally intractable they are on paper.
This is one of those cases where the theory and practice don't match. The are two cases: the destination account exists or doesn't. If it doesn't, your bank returns your money minus some handling fees. Your Bitcoin in the same situation is gone to an unused wallet which nobody can access.
If the account is valid: With Bitcoin it's on you to track down who owns your funds now and figure out how to recover it. In case of a bank though you raise an issue with them and start the process - either internal or across banks. It allows the person receiving the money to approve a quick reveal, or allows you to start legal action to recover your funds.
At some high, abstract level, these are similar. But in practice, banks make it pretty easy to recover your funds in case of simple mistakes.
We had examples of a number of entities, which tried to apply the best practices and were aware of the risks, completely failing at the task. Multiple exchanges, smart contract operators, and other companies failed to protect their coins. The real world shows us that this is not that easy given clever adversaries.
Is it easy to exploit smart contracts? Is it fundamentally impossible to make them secure? Maybe we lack the proper tools, maybe current architectures need to be improved.
When we come to blockchain world, we run into a dilemma:
1. Hard-forking means it's no longer truly "immutable"
2. Not Hard-forking means we're fucked.
The first point is important even if you're not an immutability nerd, and most people don't realize the significance of a truly ownerless ledger because most people haven't thought really deep into how the society and economy works.
In my opinion the difference between a truly ownerless ledger and another one that has made 0.1% tradeoff is as different as the difference between selling something for 1 cent and giving it away for free.
I think blockchains like Ethereum that want to become general purpose will have tendency to move towards being more centralized. Not saying that's bad, it's a tradeoff, but nobody knows what the end result would be. It could end up becoming like the Web, where the protocol itself is supposed to be decentralized but every user facing stuff is completely centralized.