SMART CONTRACTS, DEFI & WEB3 SECURITY - Chapter 7, Exercise 1 Solution ========================================================== Why a Shared Library Contract Creates a Different Kind of Risk PROBLEM ------- Using this chapter's own real Parity library-freeze incident and Chapter 3's own immutability material, explain specifically why deploying a single shared library contract that many wallets depend on creates a fundamentally different kind of risk than each wallet having its own fully independent copy of the same code. SOLUTION -------- If each wallet had deployed its own fully independent copy of the same logic, a bug or exploit affecting one wallet's own copy would, at worst, only affect that one wallet. Every other wallet's own separate, independently deployed code would be completely unaffected, since there would be no shared dependency linking their fates together at all. Sharing one library contract across many wallets - the real design choice this chapter describes Parity making, specifically to save on deployment gas costs (Chapter 2) - changes this completely. Every dependent wallet doesn't hold its own logic at all; it holds a reference pointing at that one shared library's own address, and delegates its real functionality there whenever it's used. This means every single one of those wallets' own fate becomes tied to that one shared contract's own continued existence and correctness. This chapter's own real incident shows exactly what that concentration of risk actually looks like in practice: a single action - one user accidentally triggering selfdestruct on that one shared library - didn't just break one wallet. Because Chapter 3 establishes that a selfdestructed contract has genuinely no code left at its address at all, and because every dependent wallet's own logic pointed at that exact address, the single action simultaneously and permanently broke every wallet relying on it, all at once, with no way to fix any of them afterward. A fully independent-copy design would have turned this same mistake into a real but contained, single-wallet incident. The shared-library design instead turned one mistake, made by one person, into a single point of failure for every wallet that depended on it. ANSWER: A shared library concentrates risk that independent copies would have kept separate - a bug or accident affecting the one shared contract simultaneously affects every wallet depending on it, rather than being contained to a single wallet's own independent code. This chapter's real incident shows the practical consequence: one person's single action permanently froze every dependent wallet at once, rather than affecting just one. ---- WHY THIS WORKS AS AN ANSWER This identifies the structural cause (shared dependency vs. independent copies) behind the real, documented outcome, connecting the gas-saving design motivation (Chapter 2) to the real, catastrophic downside it created once a single point of failure was actually triggered.