DEV Community: ByteAtATime

Private Keys, Public Keys, and Addresses

ByteAtATime — Sun, 18 Jun 2023 17:00:00 +0000

This post was originally published on my blog!

Welcome back! You’ve likely heard of private keys, public keys, and addresses, but what are they, and how do they work together? Today, we’re going to explore the relationship between these cryptographic values and discover how they interact with each other.

This article contains references to secp256k1, which is the elliptic curve used in both Bitcoin and Ethereum. I will be covering this in a later blog post.

Private Keys: Your Digital Secret

At the core of your Ethereum account is a private key, a 256-bit random number that serves as your digital secret. It is used to sign transactions and messages, proving that you are the owner of the account. If someone else has access to your private key, they can sign transactions on your behalf, effectively taking control of your account.

More specifically, a private key is a randomly generated number between the values 0x01 and0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFEBAAEDCE6AF48A03BBFD25E8CD0364140. This range is known as the secp256k1 curve order, which is the order of the elliptic curve used in Ethereum’s cryptography.

It is important that the private key is generated using a cryptographically secure random number generator. Do not generate it using a programming language's standard library!

Public Keys: Sharing Your Digital Identity

Derived from the private key, a public key is a cryptographic value that serves as your digital identity on the Ethereum network. Unlike the private key, the public key can be shared freely without compromising the security of your assets. It is used to verify digital signatures and encrypt messages intended for you.

Because of the nature of how cryptography works, your public key can be used to verify that you are the sender of a transaction or message. However, it cannot be used to derive your private key or forge a signature.

To get a public key from a private key, we use a process called elliptic curve cryptography. This process involves multiplying the private key by a special value called the generator point, resulting in a public key. The generator point is a constant value that is defined by the secp256k1 curve.

Addresses: Your User-Friendly Identifier

An Ethereum address is a 160-bit (40 character HEX) value that is derived from the public key. It is used to identify your account on the Ethereum network. Addresses are a shorter, more user-friendly representation of public keys, which are long and difficult to remember (not that you could memorize 40 characters, anyway).

To derive an address from a public key, we get the last 20 bytes (40 chars) of the KECCAK-256 hash of the public key.

Security Best Practices

To ensure the security of your Ethereum holdings, it is crucial to follow these best practices:

Protect Your Private Key : Keep your private key secure and never share it with anyone. Store it in a secure offline environment, such as a hardware wallet or a secure digital storage medium. Treat your private key as cash of equal value as your cryptocurrencies!
Use Hardware Wallets : Consider using a hardware wallet, a physical device specifically designed for storing private keys securely. Hardware wallets provide an extra layer of protection against online threats.
Backup Your Private Key : Make backups of your private key and store them in multiple secure locations. This ensures that you can recover your assets in case of hardware failure or loss.
Be Cautious Online : Beware of phishing attempts and malicious websites that may try to trick you into revealing your private key or personal information. Always verify the authenticity of the websites and applications you use to interact with Ethereum.

Conclusion

While private keys, public keys, and addresses are low-level concepts, they are crucial to understanding how Ethereum works. They are the foundation of your Ethereum account and are used to sign transactions and messages. By following security best practices, you can ensure that your assets are safe and secure.

What, exactly, is a "Token"? - Understanding the ERC20 Standard

ByteAtATime — Sun, 18 Jun 2023 17:00:00 +0000

This post was originally published on my blog!

Hello, and welcome back! Today, we’re going to dive into the intriguing world of tokens and shed light on what they how they are represented within the Ethereum ecosystem.

Tokens have become a fundamental building block in decentralized applications, enabling the creation and representation of various digital assets. In particular, we’ll focus on the ERC20 standard, which has revolutionized token development and interoperability on the Ethereum blockchain.

The Concept of Tokens

In the realm of blockchain and cryptocurrencies, a token represents a digital asset or utility that resides on a specific blockchain. Tokens can embody various forms, such as digital currencies, digital representations of physical assets, loyalty points, and more. They are often used to facilitate transactions, govern decentralized applications, or incentivize participants within a network.

However, when Ethereum first launched, it did not natively support the creation of tokens. Instead, developers had to create their own token contracts, which were often incompatible with other applications and services. This created a lot of friction within the Ethereum ecosystem, as developers had to create custom solutions for each token.

This article is about the ERC-20 standard, which covers normal fungible tokens (unlike the ERC-721 standard, which covers NFTs).

Introducing the ERC20 Standard

The ERC20 standard, or Ethereum Request for Comment 20, is a technical specification that defines a set of rules and interfaces for creating and managing tokens on the Ethereum blockchain. It solves the need of having a standardized way for developers to create tokens, especially those that are compatible and interoperable with other Ethereum applications and services.

How Does the ERC20 Standard Work?

To understand how the ERC20 standard works, let’s take a look at the ERC20 interface:

interface IERC20 {
    event Transfer(address indexed from, address indexed to, uint256 value);
    event Approval(address indexed owner, address indexed spender, uint256 value);

    function totalSupply() external view returns (uint256);
    function balanceOf(address account) external view returns (uint256);
    function transfer(address to, uint256 amount) external returns (bool);
    function allowance(address owner, address spender) external view returns (uint256);
    function approve(address spender, uint256 amount) external returns (bool);
    function transferFrom(address from, address to, uint256 amount) external returns (bool);
}

Let’s go over each of the events and functions one by one:

Events

`Transfer(address indexed from, address indexed to, uint256 value)`

The Transfer event is emitted whenever tokens are transferred from one address to another. It’s mostly self-explanatory:

from: The address from which the tokens are transferred.
to: The address to which the tokens are transferred.
value: The amount of tokens transferred.

`Approval(address indexed owner, address indexed spender, uint256 value)`

The Approval event is emitted whenever an address approves another address to spend tokens on its behalf. Again, it’s self-explanatory:

owner: The address that approves spender to spend tokens on its behalf.
spender: The address that is approved to spend tokens on behalf of the owner.
value: The amount of tokens spender can spend.

Readonly Functions

`totalSupply()`

The totalSupply() function returns the total number of tokens in existence. Depending on the token, this number may be fixed or variable. For example, if the token is mintable, then the total supply may increase over time.

`balanceOf(address account)`

The balanceOf(address account) function returns the number of tokens owned by a specific address. Duh.

`allowance(address owner, address spender)`

The allowance(address owner, address spender) function returns the number of tokens that spender is allowed to spend on behalf of owner. This can be changed through the approve and transferFrom functions.

State-Changing Functions

`transfer(address to, uint256 amount)`

The transfer(address to, uint256 amount) function transfers amount tokens from the caller’s address to to. It returns true if the transfer was successful, and false otherwise. It’s comparable to the send function in Solidity.

`approve(address spender, uint256 amount)`

The approve(address spender, uint256 amount) function approves spender to spend amount tokens on behalf of the caller. It returns true if the approval was successful, and false otherwise.

`transferFrom(address from, address to, uint256 amount)`

The transferFrom(address from, address to, uint256 amount) function transfers amount tokens from from to to on behalf of the caller. It returns true if the transfer was successful, and false otherwise. It also decreases the allowance of spender by amount.

Interoperability and Advantages of ERC20 Tokens

The ERC20 standard has revolutionized token development and interoperability within the Ethereum ecosystem. Here are some of the key advantages of ERC20 tokens:

Compatibility : ERC20 tokens are compatible with a wide range of Ethereum wallets, decentralized exchanges, and other smart contracts. This compatibility enables seamless integration and broader adoption of tokens within the Ethereum ecosystem.
Interchangeability : ERC20 tokens adhere to a standard interface, making them interchangeable. This means that tokens developed by different projects can be used interchangeably within the Ethereum network, fostering liquidity and usability.
Ecosystem Integration : The ERC20 standard has paved the way for the development of various Ethereum-based services and decentralized applications (dApps). It has become the foundation for token crowdfunding, decentralized finance (DeFi) protocols, and other innovative use cases.
Token Standards : The ERC20 standard has inspired the creation of other token standards, such as ERC721 (Non-Fungible Tokens) and ERC1155 (Multi-Token Standard). These standards cater to specific token use cases and expand the possibilities for tokenization on the Ethereum blockchain.

Conclusion

Tokens are the digital representation of assets and utilities within the Ethereum ecosystem, enabling a wide range of applications and use cases. The ERC20 standard has played a pivotal role in token development, providing a standardized set of rules and interfaces for creating and managing tokens on the Ethereum blockchain.

With its interoperability, compatibility, and ecosystem integration, the ERC20 standard has empowered the token economy and paved the way for countless decentralized innovations. So, the next time you encounter a token on the Ethereum blockchain, remember the underlying power and significance of the ERC20 standard that makes it all possible.

Ethereum Name Service (ENS) - What is it?

ByteAtATime — Sun, 11 Jun 2023 17:00:00 +0000

This post was originally published on my blog!

Welcome back! Today, we’re going to dive into the fascinating world of the Ethereum Name Service (ENS) and explore the process of domain registration within the Ethereum ecosystem. ENS brings a touch of familiarity to the blockchain world by allowing users to register human-readable domain names, making interactions with Ethereum addresses more intuitive. So, let’s unravel the intricacies of ENS and discover how it simplifies the Ethereum experience.

What is ENS?

The Ethereum Name Service is a decentralized domain name system built on top of the Ethereum blockchain. Similar to traditional DNS, ENS enables users to register human-readable domain names that can be associated with various Ethereum addresses, including wallet addresses, smart contracts, and decentralized websites. Instead of relying on long, complex hexadecimal addresses, ENS allows users to interact with the Ethereum network using memorable and user-friendly names.

How ENS Works

ENS operates by linking Ethereum addresses to unique domain names, creating a mapping between the two. Each ENS domain consists of multiple levels, such as myname.eth, where myname is the unique identifier chosen by the user. ENS domains are stored on the Ethereum blockchain, ensuring their immutability and decentralization.

ENS domains were previously bought using a bid-reveal process, but this has since been replaced by a simple first-come, first-served system. This means that users can now register ENS domains directly through a registrar, without the need for bidding.

ENS domains are stored in a smart contract, which can be queried to retrieve the address associated with a given domain. On the Ethereum Mainnet, the ENS smart contract is located at 0x00000000000C2E074eC69A0dFb2997BA6C7d2e1e at the time of writing.

Registering an ENS Domain

Registering an ENS domain is more or less the same as registering a domain name on the traditional DNS system. You can register an ENS domain through a registrar, which is a smart contract that allows users to register domains. The official and most common way to interact with a registrar is through the ENS website, located at app.ens.domains.

Managing ENS Domains

Once you own an ENS domain, you have various options for managing it. You can associate the domain with different Ethereum addresses, including your wallet, smart contracts, or decentralized websites. Additionally, you can configure subdomains, set up custom addresses for specific purposes, and even transfer ownership of the domain to another Ethereum address.

Benefits of ENS

The Ethereum Name Service offers several benefits to the Ethereum ecosystem:

User-Friendly Interaction : ENS simplifies the process of interacting with Ethereum addresses by replacing complex hexadecimal addresses with human-readable domain names.
Decentralization and Immutability : ENS domains are stored on the Ethereum blockchain, ensuring the decentralization and immutability of the domain name system.
Versatility : ENS domains can be associated with various Ethereum addresses, providing flexibility for wallet addresses, smart contracts, and decentralized websites.
Interoperability : ENS is compatible with other Ethereum-based services and decentralized applications, making it easier to integrate with the broader Ethereum ecosystem.

Conclusion

ENS is a widely used standard for registering human-readable domain names on the Ethereum blockchain. ENS domains are stored on the Ethereum blockchain, ensuring decentralization and immutability of the domain name system. ENS domains can be associated with various Ethereum addresses, including wallet addresses, smart contracts, and decentralized websites.

Overall, ENS reduces the barrier of entry to Ethereum by providing a level of abstraction over the complex hexadecimal addresses used by the Ethereum network. This makes it easier for users to interact with the Ethereum ecosystem and provides a more familiar experience for those coming from traditional DNS.

Ethereum Transaction Nonces - What are they?

ByteAtATime — Sun, 04 Jun 2023 17:00:00 +0000

This post was originally published on my blog!

If you’ve ever been on a blockchain explorer, you’ve probably seen a field named “nonce.” For example, this is how it looks on Etherscan.io.

This transaction has a nonce of 5.

What is this, exactly, and why is it used?

What is a Nonce?

In the context of Ethereum, a nonce is a unique, sequential number associated with each transaction initiated by an account. In English, this is a counter that increases with each transaction. This counter is associated with an account, meaning that each address has its own nonce.

Why are Nonces Used?

Nonces have two primary uses:

Executing transactions in the correct order
Preventing replay attacks

Maintaining Transaction Order

The first and most important function of nonces is to maintain the order of transactions. Ethereum is a decentralized system, meaning there are many thousands of computers. If you submit multiple transactions close together, it is inevitable that the second will propagate to some nodes before the first. Without a nonce, the second transaction would be executed before the first, which could cause unintended consequences such as a fork.

This is a problem that occurs in Bitcoin. Because Bitcoin does not use nonces, it is possible for transactions to be executed out of order. This means that, if you send multiple transactions, the one that is executed first isn’t necessarily the first one sent.

If an Ethereum node receives a transaction with a nonce that is higher than the next expected nonce, it will wait until the missing transaction is received before executing the transaction. This ensures that transactions are executed in the correct order, even if they are received out of order. However, if you accidentally send a transaction with a nonce that is too large, perhaps from a bug in your code, it may result in a transaction that is executed in the future, when you’ve already forgotten about it.

Preventing Replay Attacks

Another critical function of nonces is to prevent replay attacks. A replay attack occurs when an attacker intercepts a valid transaction and maliciously resubmits it, causing unintended consequences. By including a nonce in each transaction, Ethereum mitigates this risk.

Let’s say that Alice sends Bob 1 ETH. Without a nonce, Bob could propagate the exact same transaction to the network that was signed by Alice, and send multiple ETH to Bob. However, because the nonce is there, the network just ignores that the same transaction was submitted twice.

When a transaction is included in the Ethereum blockchain, the nonce associated with that transaction is recorded. Subsequent transactions from the same account must have nonces that are sequentially higher. If an attacker tries to replay a previous transaction, the nonce will not match the expected value, and the network will reject the replayed transaction as invalid. This ensures that each transaction can only be executed once, safeguarding the integrity of the Ethereum network.

Nonce Calculation and Transaction Submission

The calculation of nonces is, in theory, pretty simple. You just need to know the nonce for the latest transaction for an account and increment it. This is usually pretty simple because you can just query the blockchain for the latest nonce.

However, in applications that use hot wallets, this can be a bit more complicated. For example, if you have a centralized exchange that needs to allow users to withdraw money, then you need to have a server to control the hot wallet. Let’s say that your exchange becomes a hit, and many users start using it. This creates a scalability problem, where you have to use multiple computers to sign transactions at the same time.

This is where the problem lies. When multiple computers work together, it’s difficult to sync the nonce. Take the following example scenario:

<!-- HTML_TAG_START -->Latest transaction nonce: 5
Computer A creates a transaction with nonce 6
Computer B creates a transaction with nonce 6 <-- It doesn't know that computer A is creating a transaction with the same nonce!
Computer A signs and submits the transaction <-- This will succeed, because it's the first transaction with nonce 6
Computer B signs and submits the transaction <-- This will fail because the nonce is already used!<!-- HTML_TAG_END -->

This is a problem that is difficult to solve. Most exchanges take either one of two approaches:

Use a single computer to sign transactions - Cannot scale, but easy to implement
Use multiple hot wallets, one for each computer - Can scale, but more complicated to implement, and more expensive to maintain

Conclusion

While a transaction nonce might seem like an insignificant concept of Ethereum that’s usually abstracted, it’s actually a critical component of the network. Without nonces, Ethereum would be vulnerable to replay attacks, and transactions would be executed out of order. This would cause a lot of problems and would make Ethereum much less useful.

Not just that, nonces bring a whole new set of complications that are harder to solve than you might think. Mainly, using concurrency while signing transactions can quickly become a hot mess!