ISACA

TECH BRIEF

Smart Contracts

Smart Contracts: What are they? If this sounds somewhat familiar, it may be due to the
recent investment frenzy over Bitcoin, the cryptocurrency
Smart contracts are computer code—software that
with the largest market capitalization in the world. Smart
automatically executes transactions (e.g., exchange of
contracts are built on similar technology to that which
money, property, shares or anything of value) and/or
enables the use of Bitcoin: blockchain. Blockchain automates
enforces agreements based on the fulfillment of the
the 5,000-year-old concept of using ledgers to record the
terms of an agreement.
ownership and transfer of value, providing a secure, single
Smart contracts perform this function by leveraging a source of truth while adding the benefits of a decentralized
platform that uses public validation to ensure correct and infrastructure, anonymous transactions and elimination of
reliable performance according to agreed rules, utilizing a third-party attestation.
decentralized ledger technology. Constant public review
Blockchain should not be mistaken for a database, which
ensures that smart contracts resist manipulation and hacking,
can be altered by anyone with access; instead, blockchain
thus eliminating the need for third-party intermediaries (and
enables transactions that are immutable and irrevocable.
associated fees). Smart contracts create their own audit trail
Although transferring cryptocurrency is the primary use of
by storing all contract transactions in chronological order, if
blockchain today, the technology’s ability to automatically
later review is needed.
implement the terms of multiparty agreements opens the
door for widespread use of smart contracts.
While Bitcoin dominates the blockchain market today, it is
Smart contract rules are defined by if/then language: not alone. Ethereum®, which has its own currency (ether) is
If this (e.g., receipt of payment) happens, then that another such currency: one which holds greater possibilities
(e.g., shipment of a product) happens. for smart contracts as well as cryptocurrency. Ethereum
functions similarly to Bitcoin in relying on a public blockchain

“The cryptographic keys are a weak link. So far, attacks have not centered on the blockchain, but on the keys. The
individual who controls the keys can do anything within the contract, including making false claims for payment.”
RON HALE, PRINCIPAL RESEARCHER, COORACLARE INSTITUTE

1
 ISACA Tech Brief | Smart Contracts

and a consensus approach to validation, while boasting Several other platforms, such as EOS® and Tezos®, with
advanced functionality for coding and processing smart interesting new twists on smart contract execution,
contracts without the need of a trusted third party. Meaning, are under development as well.
in addition to the tamper-resistant transactional data Early proponents of smart contracts point to their
structures and ledger such as those that underpinning other ability to automate functions that can otherwise be slow
cryptocurrencies, Ethereum also provides a framework for and error-ridden, thus reducing cost and the time to
the execution of software. settlement. Critics note that the code can contain errors
The goal of a smart contract system is to implement and the self-executing instructions enable limited or
and operate a “Turing complete” instruction set as part of no legal accountability, unlike contracts executed in the
the currency itself; for example, one that operates as “real world”—in other words, they argue that smart contracts
part of the mining and ledgering process. This means that are neither “smart” nor “contracts.” Despite the naysayers,
it can execute arbitrary software logic in a similar way to interest and investment in the development of smart
a computer or a programming language can. Ethereum contracts are likely to accelerate over the next three
is not alone in seeking to implement this capability. to five years.

“This is an interesting time to start the conversation about smart contracts. We are migrating from the birth of
blockchain as a technology, moving through the process of funding and developing platforms that will support
applications that will make smart contracts readily available to the average user.”
AMY KEMP, OWNER, KEMP CPA PLLC

What is the potential impact for business?

Smart contracts are well suited for business activities that • Agriculture—IoT sensors reading the environment and
involve purchase or exchange of goods, services and rights, automatically initiating activities such as irrigation or deploy-
especially when frequent transactions occur among a ment of insecticide, based on programmed trigger values
network of parties and manual or duplicative tasks are
performed by counterparties for each transaction. This • Real estate—Automatically locking a house (through
application is a match for many financial services transactions an Internet-enabled lock) upon a tenant’s nonpayment of
(e.g., simplifying automatic dividend payments, stock splits rent and then unlocking it when payment is submitted
and cryptographic signatures on stock certificates; enforcing
• General business and personal management—Replacing
standard transactional rules for derivatives; streamlining
intermediaries that handle processing and payments for a
over-the-counter agreements). It also describes many supply
fee (e.g., eBay and Airbnb) with peer-to-peer transactions,
chain, manufacturing and retail transactions. However, the
automating compliance with records’ “destroy by” dates,
technology is still in its infancy, so most use cases of smart
and managing users’ multiple digital identities and preferred
contracts today consist of the transfer of cryptocurrency and
release of personal data
recording/changing ownership of land or other assets.
• Health care—Securing access to personal health records,
Nevertheless, additional possibilities for future use abound,
enabling doctors to provide insurers proof of completed
such as:
surgeries, supervising drugs and other supplies, and
enabling secure and timely sharing of patient information
for clinical trials and research

2
 ISACA Tech Brief | Smart Contracts

What are the risk, threats and controls?

Because smart contracts are still evolving, there is limited itself). The hacker took at least US $50 million from the
view into all their potential threats. Risk areas already DAO; the DAO’s investors could lose their entire $150
generating concern relate to the scalability of blockchain million investment.1
platforms, the trustworthiness of the data services that
• A coding error prevented a smart contract from properly
provide information to the blockchain, the privacy of the code
processing incoming amounts of ether cryptocurrency;
within the contracts, the changing and evolving technology
the error caused a US $14 million loss in QuadrigaCX’s
supporting smart contracts (will it all work together?), and the
holdings. In the few days that it took to discover the
potential for collusion among those building the blockchain.
error, all ether sent to the company’s exchange was
Questions also persist about:
trapped in the smart contract, unable to be used even
• Immutability—Smart contracts adhere strictly to their though it was technically in the company’s possession.2
code and are uncontrollable after deployment.
Smart contracts’ viability is based on the resiliency of the
• Irrevocability—Smart contracts cannot be revoked, software implementing the smart contracts and the secure
only replaced by new contracts. development/coding involved, so certain controls will be
needed to assure their viability. Use of software development
As with any service that depends entirely on software
life cycle (SDLC) practices and change controls in the
programming, the primary risk lies in the fallibility and
creation of the applications will help ensure that the files
security of the code. Two examples help to illustrate the
containing the smart contract attributes are not corrupted.
ramifications of such errors and breaches:
Controlling the cryptographic keys (the locking/unlocking
• A hacker exploited a vulnerability in the Ethereum block- mechanisms for transactions) will be critical. Testing and
chain used by a decentralized autonomous organization certifying smart contracts, as well as legal reviews of the
(DAO). The result was a fatal flaw in the smart contract terms—services already offered in the marketplace—will be
running on the platform (though not in the blockchain integral to the contracts’ widespread use.

Statistics

2,367 % $
400 $
116
MILLION
MILLION

Ethereum’s trading price has increased Expectations for spending on capital Smart contract venture capital-related
by 2,367 percent in 2017, an increase markets applications of blockchain: deals totaled US $116 million in Q1 of
attributed to support from corporations US $400 million and a 52-percent 2016, more than twice as much as the
wishing to use the technology for smart compound annual growth rate prior three quarters combined and 86%
contract applications.3 through 2019 4 of total blockchain venture funding.5

3
 ISACA Tech Brief | Smart Contracts

“The use of smart contracts will not eliminate legal reviews; if anything, it will elevate them to an indispensable
position. The equivalent of user acceptance testing will need to be completed for these contracts to ensure there
are no errors between what the attorneys want and the way that is represented in code.”
JACK FREUND, PH.D., SR. MANAGER, CYBER RISK, TIAA

Finally, there is the traditional “safety net”—insurance. What’s next?

However, before counting on insurance for indemnification, Any enterprise evaluating the use of smart contracts needs
a thorough review of existing policies should be conducted to do a bit of homework before proceeding. Here are some
to see if ample coverage exists to mitigate smart contract- things to consider:
related risks and losses. Insurance, notably errors and
• Be sure to have a good understanding of the processing
omissions coverage, will have to evolve to cover new risk
costs associated with smart contracts (which will be
brought on by smart contracts. It is doubtful that reliance
tied to the cost of the cryptocurrency).
can be placed on traditional policies for commercial property,
business income, liability or business crime. The vast majority • Even if your enterprise is not ready to tackle smart
of coding errors do not arise from intentional wrongdoing or a contracts today, start selecting and documenting contracts
catastrophic event, and they may not result in any injury to a that lend themselves most readily to automation
third party—the conditions that precipitate coverage by these (e.g., ledger-type transactions).
traditional insurance policies.
• Read the documentation for any system being considered
So far, governments have made minimal inroads into for use. Understand how it is designed, what governance
how regulation or taxation will apply to smart contracts. is built in and what currency is used.
However, once those rules are codified, the risk of
• Partner with firms working on similar projects that can be
noncompliance will exist, just as it does with other
addressed through smart contracts.
regulations or legislation.
• Wait until the technology is proven. Learn from the
experiences of others who are first adopters.

1 Siegel, D.; “Understanding the DAO Attack,” CoinDesk, 25 June 2016, https://www.coindesk.com/understanding-dao-hack-journalists/

2 Butcher, Jared R.; “My smart contract just ate $14 million—now what? Re-thinking indemnification for smart contract risks,” Lexology, 12 June 2017,
https://www.lexology.com/library/detail.aspx?g=c3e967ea-92a2-495b-a54a-0f46143f6833

3 Kharpal, A.; “Bitcoin may have more than doubled this year, but rival Ethereum is up 2,000 percent. Here’s why,” CNBC, 24 May 2017,
https://www.cnbc.com/2017/05/24/ethereum-price-bitcoin-rally.html

4 BI Intelligence, The Blockchain Report, May 2016, https://www.businessinsider.com/intelligence/research-store?IR=T&utm_source=businessinsider&utm_medium=content_marketing&utm_ter-

m=content_marketing_store_text_link_smart-contracts-pose-enforceability-issues-2016-11&utm_content=report_store_content_marketing_text_link&utm_campaign=content_marketing_store_
link&vertical=fintech#!/The-Blockchain-Report/p/66035425/

5 CFO Journal, “Getting Smart About Smart Contracts,” Wall Street Journal, June 23 2016, http://deloitte.wsj.com/cfo/2016/06/23/getting-smart-about-smart-contracts/

For more information, go to:

www.isaca.org/SmartContracts
Reservation of Rights
4
© 2017 ISACA. All rights reserved.