 |
| By Jurica Dujmovic |
Time is essential to computer programs because it allows them to process information in an efficient manner. Moreover, smart contracts need to keep track of when certain operations should occur or end.
Without timekeeping, many computer programs would be unable to complete their tasks in an orderly fashion, resulting in errors and unpredictable results.
In computing, every entity must share the exact same value of time at any given moment.
This can be problematic for computers. Even though the time stamp on a file or in a log action is a static number, transmitting data itself takes time, and network conditions constantly change, introducing delays and fluctuations that do not get accounted for.
This offset causes networking devices not to be perfectly in sync with the actual time value.
To solve this problem, the Network Time Protocol was created.
In simplest terms, NTP is a protocol designed to synchronize the clocks of computers over a network. It does this through a hierarchy of timekeeping servers that are distributed across the globe with their routing paths optimized as much as possible.
In other words, NTP determines the shortest path between these servers, which reduces both latency and transfer time inconsistencies.
NTP works well for personal computers and centralized services. But the big question for crypto projects is if it will be effective for distributed systems.
Like other technology, Bitcoin (BTC, Tech/Adoption Grade “A-”) also uses time stamps, because it requires them for its proof-of-work consensus mechanism. However, the way it records this data is far too loose to be utilized as strictly as in centralized computing.
As a result, Bitcoin only uses time stamps as a secondary resource to keep PoW secure, and not as a tool to measure time on-chain.
Currently, whenever a node connects to another node, it receives a Coordinated Universal Time stamp and stores its offset from its own UTC. Here, network-adjusted time would be the sum of node time and the median offset of all connected nodes.
The issue with this method is that it makes block time stamps mere estimates, so these time stamps may be off by an hour or two.
Ethereum (ETH, Tech/Adoption Grade “B”) is not much different from Bitcoin.
With the Ethereum blockchain, the only party determining on-chain time stamps are miners. Consensus will not check any time stamps submitted by them.
The only factor blocking miners from submitting nonsensical values is the fact that the blocks should be in chronological order, so blocks with a time stamp from the future will not be accepted by the network.
For most blockchain applications, time stamps derived through Bitcoin and Ethereum are used for auditing purposes or to determine the order of events.
However, for applications where the exact timing of events is critical — like the execution of a smart contract — blockchain time stamps are insufficient.
This type of glaring omission is breeding ground for all sorts of hacks and exploits. As halborn.com states:
“Timestamp dependence vulnerability is when a smart contract utilizes the block.timestamp function when performing critical logic in a smart contract. This includes actions such as sending ETH or using the function as the source of entropy to generate necessary random numbers.
“This function is easily manipulated since the value of the actual timestamp is generated by the node that creates a block containing a transaction that executes the smart contract code.
“Block timestamps are flexible, and nodes will accept any timestamp within a certain window. This means that when a smart contract transfers ETH using block.timestamp, bad actors (miners) can exploit the vulnerability by manipulating the block timestamps themselves — setting up the conditions for their own success.”
There are already ways to prevent this type of behavior, but none offer bulletproof solutions.
The long-term solution to preventing these kinds of attacks before they occur is to create a reliable and decentralized way to track time on the blockchain.
One potential solution could be a third-party time server that is synchronized with global time and provides accurate time stamps to the blockchain. This would ensure that all transactions are properly finalized before being added to the blockchain, as well as provide an additional layer of security.
Until such a system is implemented, applications requiring precise timekeeping will need to explore alternative solutions.
The blockchain industry must continue to innovate and evolve to meet the demands of a constantly changing digital landscape. I personally look forward to seeing this type of evolution happen in real time.
Keep checking back here if you are, too.
Best,
Jurica
