最近EOS版的Fomo 3D狼人杀游戏骗局引发了大家对EOS智能合约的安全性的大讨论。
和以太坊智能合约的不可升级不同，EOS智能合约可升级，因而保存在智能合约中的数据称不上去中心化，因为智能合约的管理员可偷偷的升级智能合约来修改合约里的任何数据。最直接的示例是EOS代币，代币分发给用户后，用户的代币持有量仍旧可以被管理员修改，那这个持有量是不安全的。由于智能合约可升级，开发者往往也没有了开源的动力，因为反正可以升级，开源又有什么意义呢？你此时看到的源码下一刻就可能被修改掉了。所以说目前所有涉及到资金的EOS代币及智能合约大家都要小心。

干掉升级

那智能合约的中心化如何来解决呢？难道EOS的智能合约只是个玩偶？显然不是，解决的方法只有一个，就是“自宫”，开发人员自己禁用掉合约的升级功能，核心就是是更改智能合约账号的权限，就像EOS启动阶段eosio.system智能合约的权限变更一样（具体可看我的文章）将智能合约权限更改为权威多签权限(eosio, eosio.prods)或者未知私钥对应的公钥。所以说其实官方已经给出了示例的，只是开发人员没跟上。

权威多签权限eosio.prods

21个超级节点多签管理权限

未知私钥

比如EOS1111111111111111111111111111111114T1Anm这个公钥，它的公钥是0值加检验数据生成的，任何人都不知道它的私钥。这个公钥在超级节点竞选时临时用过，当时只有genisisblock生产区块，eosio.system智能合约处于临时冻结状态。

组建第三方权威认证机构(DAppStore)

智能合约将权限转交给第三方权威认证机构DAppStore，该机构由顶尖技术和生态大佬组成，采取投票方式是否同意某一智能合约升级。
比如该权限，智能合约拥有者账号拥有100张投票权，第三方权威机构有100张投票权（100个成员），所以必须得到智能合约拥有者同意且50%第三方权威认证机构票数认可(即150张票)才可以升级

代码开源

自宫之后，才能谈开源，目前eospark已经支持智能合约源码验证，开发者可以将源码发布到eospark验证。这样用户能看到合约的代码，且永远是这个代码。

升级功能什么时候用

既然智能合约都要去掉升级功能，那还要升级功能干嘛？其实可以这样用

• 只要服务不涉及到资金的智能合约可以使用
• 测试阶段使用。测试阶段收集反馈，发现有问题通过升级解决。运行一段时间后，固化智能合约。

转载自：blog.csdn.net/itleaks

root@iZj6cgy98yiuluw41gz0aoZ:~# cleos -u http://eu1.eosdac.io get actions bcskillsurou
#  seq  when                              contract::action => receiver      trx id...   args

发帖时可用。
数据来源： eosfans

本篇文章演示基于EOS Tracker获取和展示EOS MongoDb 数据。
所需的EOS Tracker为一修改版本,支持MongoDb，原版发帖时只支持MySql。

安装php 7.2

sudo add-apt-repository ppa:ondrej/php
sudo apt-get update
sudo apt-get install php7.2

安装PHP扩展

sudo apt-get install php7.2-mongodb
sudo apt-get install php7.2-cli
sudo apt-get install php7.2-xml
sudo apt-get install php7.2-mbstring php7.2-intl php7.2-redis -y
apt-get install composer

获取代码

git clone https://github.com/FeeSimple/eos-tracker.git

开始部署EOS Tracker API

进入eos-tracker/eos-tracker-api，更新安装EOS Tracker API子项目

composer update
composer install

修改MongDB for eos-tracker-api的配置文件

app/config/parameters.yml

# This file is auto-generated during the composer install parameters:
secret: 123 //一般默认为空
mongodb_server: 'mongodb://localhost:27017'
db_name: EOStest

开始运行

php bin/console server:run 0.0.0.0:8000

开始部署EOS Tracker前端项目

进入eos-tracker/eos-tracker-frontend
安装项目依赖

npm i
npm install -g @angular/cli@6.0.8

EOS Tracker是一个基于Angular4的前端，连接到EOS Tracker API。
用于与eos-tracker-api交互的eos-tracker-frontend的配置文件：

src/environments/environment.ts

    export const environment = {
        production: false,
        walletUrl: '//www.bcskill.com',
        appName: 'EOS Tracker',
        logoUrl: '/assets/logo.png',
        apiUrl: '//www.bcskill.com:8000', //修改为与上面API地址和端口一致
        blockchainUrl: '//rpc.bcskill.com:8888' //修改为已同步全部EOS区块的RPC服务器地址
    };

开始启动

ng serve --host 0.0.0.0 --port 4200

常见问题

• Cannot read property 'write' of undefined

  npm uninstall -g @angular/cli
  npm install -g @angular/cli@6.0.8

• add-apt-repository: command not found

  sudo apt-get install python-software-properties
  sudo apt-get update
  sudo apt install software-properties-common 
  sudo apt-get update

  参考：stackoverflow

• ubuntu npm 升级到新版
  （打开连接）

当卖内存字节数按当时内存价格所值的EOS数，如果小于0.0001，则交易出错

root@iZj6cbx3duprxf6dasczbpZ:~# cleos system sellram dapp.exec 1
1483958ms thread-0   main.cpp:438                  create_action        ] result: {"binargs":"000040aa2b50ab490100000000000000"} arg: {"code":"eosio","action":"sellram","args":{"account":"dapp.exec","bytes":1}} 
Error 3050003: eosio_assert_message assertion failure
Error Details:
assertion failure with message: token amount received from selling ram is too low
pending console output:

void system_contract::sellram( account_name account, int64_t bytes ) {
      require_auth( account );
      eosio_assert( bytes > 0, "cannot sell negative byte" );

      user_resources_table  userres( _self, account );
      auto res_itr = userres.find( account );
      eosio_assert( res_itr != userres.end(), "no resource row" );
      eosio_assert( res_itr->ram_bytes >= bytes, "insufficient quota" );

      asset tokens_out;
      auto itr = _rammarket.find(S(4,RAMCORE));
      _rammarket.modify( itr, 0, [&]( auto& es ) {
          /// the cast to int64_t of bytes is safe because we certify bytes is <= quota which is limited by prior purchases
          tokens_out = es.convert( asset(bytes,S(0,RAM)), CORE_SYMBOL);
      });

      eosio_assert( tokens_out.amount > 1, "token amount received from selling ram is too low" );

当按EOS买内存时，如果所支出的EOS扣除0.5%手续费后的余额，按当时内存价格所购买的字节数小于1，则出错"must reserve a positive amount"

void system_contract::buyram( account_name payer, account_name receiver, asset quant )
   {
      require_auth( payer );
      eosio_assert( quant.amount > 0, "must purchase a positive amount" );

      auto fee = quant;
      fee.amount = ( fee.amount + 199 ) / 200; /// .5% fee (round up)
      // fee.amount cannot be 0 since that is only possible if quant.amount is 0 which is not allowed by the assert above.
      // If quant.amount == 1, then fee.amount == 1,
      // otherwise if quant.amount > 1, then 0 < fee.amount < quant.amount.
      auto quant_after_fee = quant;
      quant_after_fee.amount -= fee.amount;
      // quant_after_fee.amount should be > 0 if quant.amount > 1.
      // If quant.amount == 1, then quant_after_fee.amount == 0 and the next inline transfer will fail causing the buyram action to fail.

      INLINE_ACTION_SENDER(eosio::token, transfer)( N(eosio.token), {payer,N(active)},
         { payer, N(eosio.ram), quant_after_fee, std::string("buy ram") } );

      if( fee.amount > 0 ) {
         INLINE_ACTION_SENDER(eosio::token, transfer)( N(eosio.token), {payer,N(active)},
                                                       { payer, N(eosio.ramfee), fee, std::string("ram fee") } );
      }

      int64_t bytes_out;

      const auto& market = _rammarket.get(S(4,RAMCORE), "ram market does not exist");
      _rammarket.modify( market, 0, [&]( auto& es ) {
          bytes_out = es.convert( quant_after_fee,  S(0,RAM) ).amount;
      });

      eosio_assert( bytes_out > 0, "must reserve a positive amount" );

当按字节数买内存时，内部会先按当时内存价格计算出所需的EOS价格，如果计算出的EOS扣除0.5%手续费后的余额，按当时内存价格所购买的字节数小于1，也会出错"must reserve a positive amount"

{
    "id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
    "trx": {
        "receipt": {
            "status": "executed",
            "cpu_usage_us": 688,
            "net_usage_words": 16,
            "trx": [
                1,
                {
                    "signatures": [
                        "SIG_K1_KUypLM5YSdRRZMTuTDUAu4fr4V3FhabKJdGdNcZTaTj5zbsB1xfta3FvL5XEGkaduako2yVaHhQxLc5hm8TjpmGarXDRoM"
                    ],
                    "compression": "none",
                    "packed_context_free_data": "",
                    "packed_trx": "d27c555bc5a54ba71421000000000100a6823403ea3055000000572d3ccdcd0130c618630c05a77900000000a8ed32322130c618630c05a77990b1cadec45aab49204e00000000000004454f53000000000000"
                }
            ]
        },
        "trx": {
            "expiration": "2018-07-23T06:59:30",
            "ref_block_num": 42437,
            "ref_block_prefix": 555001675,
            "max_net_usage_words": 0,
            "max_cpu_usage_ms": 0,
            "delay_sec": 0,
            "context_free_actions": [],
            "actions": [
                {
                    "account": "eosio.token",
                    "name": "transfer",
                    "authorization": [
                        {
                            "actor": "bcskill3333333",
                            "permission": "active"
                        }
                    ],
                    "data": {
                        "from": "bcskill3333333",
                        "to": "dappplaytest",
                        "quantity": "2.0000 EOS",
                        "memo": ""
                    },
                    "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
                }
            ],
            "transaction_extensions": [],
            "signatures": [
                "SIG_K1_KUypLM5YSdRRZMTuTDUAu4fr4V3FhabKJdGdNcZTaTj5zbsB1xfta3FvL5XEGkaduako2yVaHhQxLc5hm8TjpmGarXDRoM"
            ],
            "context_free_data": []
        }
    },
    "block_time": "2018-07-23T06:58:32.000",
    "block_num": 7317258,
    "last_irreversible_block": 8006080,
    "traces": [
        {
            "receipt": {
                "receiver": "eosio.token",
                "act_digest": "c6c9aa38acd0c3940de511b6ee69b1831f047f895b4aa94a6cde8ae80dfdd6a5",
                "global_sequence": 74737287,
                "recv_sequence": 2145761,
                "auth_sequence": [
                    [
                        "bcskill3333333",
                        6
                    ]
                ],
                "code_sequence": 1,
                "abi_sequence": 1
            },
            "act": {
                "account": "eosio.token",
                "name": "transfer",
                "authorization": [
                    {
                        "actor": "bcskill3333333",
                        "permission": "active"
                    }
                ],
                "data": {
                    "from": "bcskill3333333",
                    "to": "dappplaytest",
                    "quantity": "2.0000 EOS",
                    "memo": ""
                },
                "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
            },
            "elapsed": 42,
            "cpu_usage": 0,
            "console": "",
            "total_cpu_usage": 0,
            "trx_id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
            "inline_traces": [
                {
                    "receipt": {
                        "receiver": "bcskill3333333",
                        "act_digest": "c6c9aa38acd0c3940de511b6ee69b1831f047f895b4aa94a6cde8ae80dfdd6a5",
                        "global_sequence": 74737288,
                        "recv_sequence": 19,
                        "auth_sequence": [
                            [
                                "bcskill3333333",
                                7
                            ]
                        ],
                        "code_sequence": 1,
                        "abi_sequence": 1
                    },
                    "act": {
                        "account": "eosio.token",
                        "name": "transfer",
                        "authorization": [
                            {
                                "actor": "bcskill3333333",
                                "permission": "active"
                            }
                        ],
                        "data": {
                            "from": "bcskill3333333",
                            "to": "dappplaytest",
                            "quantity": "2.0000 EOS",
                            "memo": ""
                        },
                        "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
                    },
                    "elapsed": 3,
                    "cpu_usage": 0,
                    "console": "",
                    "total_cpu_usage": 0,
                    "trx_id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
                    "inline_traces": []
                },
                {
                    "receipt": {
                        "receiver": "dappplaytest",
                        "act_digest": "c6c9aa38acd0c3940de511b6ee69b1831f047f895b4aa94a6cde8ae80dfdd6a5",
                        "global_sequence": 74737289,
                        "recv_sequence": 1,
                        "auth_sequence": [
                            [
                                "bcskill3333333",
                                8
                            ]
                        ],
                        "code_sequence": 1,
                        "abi_sequence": 1
                    },
                    "act": {
                        "account": "eosio.token",
                        "name": "transfer",
                        "authorization": [
                            {
                                "actor": "bcskill3333333",
                                "permission": "active"
                            }
                        ],
                        "data": {
                            "from": "bcskill3333333",
                            "to": "dappplaytest",
                            "quantity": "2.0000 EOS",
                            "memo": ""
                        },
                        "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
                    },
                    "elapsed": 5,
                    "cpu_usage": 0,
                    "console": "",
                    "total_cpu_usage": 0,
                    "trx_id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
                    "inline_traces": []
                }
            ]
        },
        {
            "receipt": {
                "receiver": "bcskill3333333",
                "act_digest": "c6c9aa38acd0c3940de511b6ee69b1831f047f895b4aa94a6cde8ae80dfdd6a5",
                "global_sequence": 74737288,
                "recv_sequence": 19,
                "auth_sequence": [
                    [
                        "bcskill3333333",
                        7
                    ]
                ],
                "code_sequence": 1,
                "abi_sequence": 1
            },
            "act": {
                "account": "eosio.token",
                "name": "transfer",
                "authorization": [
                    {
                        "actor": "bcskill3333333",
                        "permission": "active"
                    }
                ],
                "data": {
                    "from": "bcskill3333333",
                    "to": "dappplaytest",
                    "quantity": "2.0000 EOS",
                    "memo": ""
                },
                "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
            },
            "elapsed": 3,
            "cpu_usage": 0,
            "console": "",
            "total_cpu_usage": 0,
            "trx_id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
            "inline_traces": []
        },
        {
            "receipt": {
                "receiver": "dappplaytest",
                "act_digest": "c6c9aa38acd0c3940de511b6ee69b1831f047f895b4aa94a6cde8ae80dfdd6a5",
                "global_sequence": 74737289,
                "recv_sequence": 1,
                "auth_sequence": [
                    [
                        "bcskill3333333",
                        8
                    ]
                ],
                "code_sequence": 1,
                "abi_sequence": 1
            },
            "act": {
                "account": "eosio.token",
                "name": "transfer",
                "authorization": [
                    {
                        "actor": "bcskill3333333",
                        "permission": "active"
                    }
                ],
                "data": {
                    "from": "bcskill3333333",
                    "to": "dappplaytest",
                    "quantity": "2.0000 EOS",
                    "memo": ""
                },
                "hex_data": "30c618630c05a77990b1cadec45aab49204e00000000000004454f530000000000"
            },
            "elapsed": 5,
            "cpu_usage": 0,
            "console": "",
            "total_cpu_usage": 0,
            "trx_id": "fe804e9a9ab2a9f8b674bb490ac2c89d4f70247f82bc506adc7285cb82e3c991",
            "inline_traces": []
        }
    ]
}

traces里面的你可以理解为是给参与这次交易的各个角色的发票清单 每一次EOS的转账都涉及到3个角色：转账方、接受方、执行转账操作的token发行方,如果是收款方查到的只是其中一个