SMART CONTRACTS, DEFI & WEB3 SECURITY - Chapter 5, Exercise 3 Solution ========================================================== What "On-Chain Logic Means Fully Decentralized" Overlooks PROBLEM ------- A colleague says: "As long as a contract's logic is deployed on-chain, the whole dApp is fully decentralized, with no single point of failure at all." Using this chapter's own centralization tension, explain what this claim overlooks. SOLUTION -------- This claim is only really evaluating one layer of this chapter's own four-layer stack diagram - the blockchain itself, where the deployed contract genuinely does run in the fully decentralized way Course 1 described. It ignores the other real layers most ordinary users actually depend on to reach that contract in practice. Specifically, this chapter identifies a real, honest tension: most users don't run their own full node. Their wallet's default connection typically routes through a comparatively small number of centralized RPC node providers (this chapter's own real examples, Infura and Alchemy) to actually read state and broadcast transactions. If one of those providers experiences an outage, or chooses to block certain addresses or requests, users relying on that specific provider can be meaningfully prevented from interacting with the dApp at all - even though the underlying contract and blockchain are, at that very moment, running completely normally and remain fully accessible to anyone connecting through a different path (their own full node, or a different provider). The dApp's frontend website itself is also often hosted on an ordinary, centralized web server (unless deliberately hosted via something like this chapter's own IPFS coverage), and even IPFS-hosted content still depends on enough real nodes choosing to keep serving it. So "the contract logic is on-chain" is a real, true, and important fact - but it doesn't automatically mean every practical path a real user takes to reach that contract is equally decentralized. A single point of failure can still exist at the wallet's default RPC provider, or the frontend's own hosting, even while the contract itself has none. ANSWER: The claim overlooks that a dApp is more than just its deployed contract - most users reach that contract through a specific, often centralized RPC provider and a frontend that may itself be centrally hosted, either of which can create a real single point of failure for ordinary users, even though the underlying contract and blockchain remain genuinely decentralized and unaffected the whole time. ---- WHY THIS WORKS AS AN ANSWER This distinguishes the contract layer (genuinely decentralized, as claimed) from the other real layers in the chapter's own stack diagram (RPC provider, frontend hosting) that the claim silently ignores, rather than simply asserting the claim is wrong without identifying exactly what's missing from it.