I'd like to highlight up front that this doesn't contain any call to action. I'm not a lawyer, high octane developer or influencer, but I've been around for long enough to see history rhyme. With that said, I've been asked a few times now to flesh out what I think 'code is law' means (to the degree that it means anything at all).

As with my other writings, don't expect much by way of cohesive structure: it's a braindump that I want to look back on in years to come and see if my opinion has changed.

I'm a great lover of the EVM and other models (such as WebAssembly) that enable Turing-complete program execution in an adversarial, pay-to-play environment. My PhD thesis was on creating compilers that target stack-based languages exactly like the EVM, and I have huge affection for languages like Solidity that elegantly compile into it. The language semantics alone pulled me away from a career in banking - where I was programming around money - and into Ethereum, where I can program money directly.

As any Ethereum developer will tell you, though - the opportunities granted by Turing-completeness come with its own set of problems: testing being foremost amongst them. We've made great strides in fuzzing and formal verification techniques, but the whole paradigm is still very much in its infancy. People will write or reuse code that contains a flaw such as re-entrancy, or they'll write something that makes a simplifying assumption in order to save on execution costs that turns out to subsequently be vulnerable. They'll accidentally brick access to a core data structure, or mistakenly allow people to arbitrarily claim the balances of others.

As any software developer will tell you, programming is a wilful manifestation of intent: a conscious effort to formalise the process of getting something done: we write code to perform specific tasks according to a mental model. There's a spectrum for the scrutiny that that code receives depending on its purpose - you wouldn't spend much time searching for edge-cases in a program that handles your personal to-do list, for example - but code deployed on blockchains is excoriatingly important to get right: you're writing intent that natively handles other peoples money, with vanishingly few chances at winding back the clock if you got it wrong.

And yet - in light of a small pool of truly skilled EVM developers, an even smaller, very busy pool of auditors and the occasional bug that quite simply hasn't been seen before - exploitable on-chain code gets through the cracks, and is deployed to mainnet.

I'd like to talk about what happens when such code is misused. That's not to say that I'm uninterested in flaws at the protocol level (such as the two Bitcoin inflation bugs, CVE-2010–5139 and CVE-2018–17144), but these are a category apart - fundamental errors in the water, rather than issues with the fish that swim in it.

The story is always the same at this point. A confused tweet or Telegram message appears saying that something is afoot with some DeFi/NFT project - occasionally pointing at an Etherscan transaction - and an announcement is made on whatever platforms said projects utilise:

"Something has happened and we're investigating: we'll update you when we know more".

And in the replies: chaos.

The crypto-native community splits immediately into two camps. Those that rush to assist with root cause analysis, tracking of funds or general well-wishes, and similarly those that delight in the confusion and carnage - either mocking from the sidelines, lionising the exploiter, or messaging people who have publicly announced losses in an attempt to phish them to exploit them further.

A post-mortem is issued. An article appears on Rekt, then CoinDesk, then the myriad 'news' websites. A debate rages about whether or not the exploit was an inside job.

If the root of the exploit has already been previously identified (or is a mild variant thereof), strips are torn off of people involved for poor oversight. If it is novel, within 48 hours people who have never written a line of code in their life will confidently assert that it was incredibly obvious and that only the novice or malicious would have overlooked it.

Three days pass. No one talks about it anymore except for the affected.

Then the next protocol is exploited, and the wheel turns again.

Some of those that previously proclaimed that what had happened was "based" are hit for non-trivial amounts of their own net worth, and seek sympathy that they had previously denied. Some of those that were affected by the last exploit pour fuel on the new fire, out of a sense of revenge against those that weren't there for them when they were affected.

Send not to know for whom the bell tolls. It tolls for thee.

Crypto is one of the best examples currently going of a tabula rasa. By this, I mean that nearly everyone who comes to it - with an intent to actually engage with it - treats crypto as a blank slate, upon which their own philosophy, politics and worldview get projected.

Fundamentally, a protocol like Bitcoin is pretty boring: it enables pseudonymous, peer-to-peer transactions. That's not to say that the ability to make such transactions isn't a massive improvement upon the status quo that we were all brought up to accept as normal: it is! Rather, that's all that Bitcoin - when initially released - ever was or purported to be: a cypherpunk demonstration that commerce could subvert banks and clearing-houses.

The presumption that it was built to destroy governments, "act as the cure to all humanities ills" (I've seen this in the wild before), or even that Bitcoin could or should act as a store of value - these are all side-effects of the attitudes that people brought to the table and assigned to Bitcoin. The toxic maximalism that pervades its community on the whole is a result of the loudest voices in the room asserting that "this is what Bitcoin represents".

Ethereum is no different, but significantly more complex. We don't often hear the term 'global computer' anymore when discussing it, but that's all that it is: a credibly neutral platform for executing Turing-complete code, maintained in a decentralised manner using - currently - proof-of-work for consensus.

One of the most toxic projections I've seen appear in non-Bitcoin crypto is 'code is law', at least in the guise that anything that happens on-chain is - either implicitly or explicitly - fair game, because that's what was permitted in exploited code. I'm old enough to remember the same takes being applied to the early internet, when "if you put your credit card details onto a site, you deserve everything you get" was a drumbeat.

This take seems - to me - to derive from the belief that everything on-chain works in a void, and that we've abandoned a thousand years of legal precedent simply because crypto isn't fully embedded in society yet. I don't think this is true at all, but saying as much absolutely splits crypto aficionados in half.

I put a lot of the blame for this on the adoption and usage of the term 'smart contracts'. There's still a lot of muddy water when it comes to whether the notion of contract in a legal sense applies when engaging with on-chain code, and it sources infinitely many poor takes in the aftermath of every exploit that always go along the lines of "well, the exploiter didn't sign a piece of paper saying that they weren't going to use it in such-and-such a way".

Stop making this atrocious argument. I beg you. Contracts can be - and frequently are - created by conduct. You don't sign a contract every time you drive into a car park, or whenever you put money into a vending machine, but no one sane reading this is going "there's absolutely nothing wrong with breaking the glass of a vending machine and taking everything inside, I was allowed to do it". You aren't signing a contract when you put your details into a newsletter subscription page, but you're still rightfully annoyed and want intervention when that data is leaked.

Vitalik - as usual - is right here. We'd save ourselves a lot of pain if we'd used 'persistent scripts' instead. The damage is done at this point though, so this is just a howl into the void.

I see the above as the root conflict between the original cypherpunk vision of early Bitcoiners and "global parallel financial system that subverts intermediaries" view of the in-it-for-the-tech crowd. I don't think Ethereum was created with nearly the same focus on anonymity - we know who the creators are, for a start -, and use the aforementioned description of Ethereum as global computer when it comes to my thinking about it.

Coming at it from a purely cypherpunk perspective, the ability to efficiently wash digital assets cryptographically (if you're not a fool) leads quickly to the position "why would I ever pay tax on this?". It's an easy exercise to use that as the premise of a modus ponens that ends with "therefore all state oversight fails". I can appreciate the former point, I just don't agree with the conclusion.

You know what else works really well for enabling tax evasion if you're careful about where you keep it and move it around surreptitiously? Cash. And we - as a species - are very good about using it as such. And yet, we see the theft of cash as a civil wrong. Curious.

The lack of legal precedent establishing that on-chain code is not law in the free-for-all sense comes purely from the fact that it's hard to establish the identity of perpetrators, and that "justice" - if you believe that that's the appropriate word - can only ever be restorative in nature. In time, this dearth of precedent will eventually end: God gives her toughest battles to her soldiers with the weakest opsec.

I should point out here that I'm even split internally about what comprises an act that deserves legal intervention - I do have a streak of cypherpunk in me! Context matters a lot here, and I'll go to my grave defending the actions of, for example, anonymous white-hats who drain a protocol (assuming that no externalities happen such as LP collapse) with the intent of returning everything - modulo a bounty - once a critical vulnerability has been patched.

It's worth pointing out that I do believe in a version of code is law! Personally, I take it to mean that transactions are probabilistically final after a certain number of blocks, and that the execution of code cannot be censored by a miner or validator: that doesn't mean that said code execution doesn't comprise an offensive act. What I imagine most people will consider the genesis for this version is the exploit of The DAO and subsequent hard-fork of Ethereum back in 2016.

While there's a fairly convincing argument to be made that we now know who performed the exploit of The DAO - bad opsec stays losing - at the time we were all completely in the dark, and the choice was made to fork Ethereum to a state where all the Ether within The DAO could be claimed by burning DAO tokens via a separate contract. This decision was made after reaching social consensus - it was the first instance of on-chain code driving a protocol shift, and demonstrated that humans - Layer Zero - are the ones that truly govern the way that this all works.

Given that those that believed that the fork was a mistake went and stayed on Ethereum Classic - currently outside the top 20 cryptocurrencies by market capitalisation - I considered that proof enough that 'code is law' in the sense that exploiters use it had been thoroughly rebuffed. I'm interested to see if there'll ever be any legal action taken against the DAO exploiter, as that might put some new nails into this six year old coffin.

It's interesting to me that third-generation blockchains such as Kusama - Polkadot's canary network - are now baking in the ability to implement such social consensus rulings at the governance level. Back in October 2021 an exploit was detected on Karura, a DeFi hub platform built on Kusama, which was swiftly reversed via a contingency pallet and subsequent recovery of funds. In my view, the very existence of this capability serves as a rejection of the militant view of "code is law" and embrace of what I call Layer Zero supremacy, at least from the developers of such networks that are designed for global adoption.

It remains to be seen how much overlap there is between Layer Zero supremacy and state-mandated interventions: for example, I would vigorously defend the rights of a global governance body to refuse a court order to seize the funds of wallets identified as belonging to citizens of a sanctioned nation.

So, that's all I think I have to say on this. In my view, humans are in charge, humans get to make decisions about whether on-chain activity is legitimate or not, and the overriding coordination mechanisms we have at present to guide us are the principles of common law.

It's all Layer Zero.

It's also a story about how I became increasingly convinced of its need.

I'll preface this with something of a disclaimer: a lot of what I'm about to say may come off as hypocritical. I have relied on credentialism and connections to get by for most of my life, flying in the face of the meritocracy of crypto in its current form. The promise of crypto is for all, yet here I will be quite darkly protective of it, even though its purpose - pseudonymous, uncensorable transactions - is one that I have no true 'need' of.

I apply arbitrary purity tests upon the general understanding of the fundamental technologies of crypto, yet barely understand the mechanisms of the Internet through which I'll post this. Do I contradict myself? Very well then I contradict myself, (I am large, I contain multitudes.)

In short, you probably won't gain anything from reading this. You might well think I'm being a sanctimonious asshole if you do.

Nonetheless, I've been involved in the crypto space in some form or another for over a decade, and having finally made the Hajj to ETHDenver, I feel the need to write something down.

This is a scream into the void, upon which I hope to look back on and laugh in years to come.

I've been listening to Pet Shop Boys - Integral on loop while I write this.

"Turning and Turning in the Widening Gyre, The Falcon Cannot Hear The Falconer"

Mass adoption for crypto is finally here. Anyone who looked at - or stood in - the queue to get into the Denver Sports Castle between the 18-20th of February can attest to that. I had a conversation with a candidate for the presidency of the United States, and discussed advertisements that played during the Superbowl in a bar.

That's as mainstream - from an American perspective - as you can get.

And yet, despite all the tremendous work ongoing, and the euphoria of attending a massive get-together of friends and colleagues, the foundations all feel shaky and weak - like it would take just one concerted push from the incumbent powers to scatter it all to the wind. It's easy to catastrophise every mooted Executive Order, or every proposed-then-reversed company integration (i.e. Discord), but it shouldn't need saying that we've not actually seen any widescale global resistance to crypto yet. The fact that we just had ETHDenver - and people travelled from all over the globe to attend - proves it.

"Things Fall Apart; The Centre Cannot Hold/Mere Anarchy Is Loosed Upon The World"

A large part of my anxiety stems - where I'm standing - from the 'sexiness' of being in Web3 (a silly name) as the current topic du jour attracting mops and sociopaths. The people we considered part of the KPI for mass adoption include the girl who is squealing to her friends in a coffee shop that "they can't believe how many more Tinder matches they get now that they have 'crypto CEO' in their bio" (an actual line I overheard), or the guy who tried pitching RugbyDAO in a club, rather than those who understand why Ethereum exists in the first place, or what it's capable of doing.

Similarly, I met with several 'CT-famous' personalities over the course of two weeks: one of whom had - depressingly - turned their pseudonymous persona into their entire personality. It made them incredibly difficult to talk to, and they were more interested in leveraging their follower count into social status and the opportunity to play at Master of the Universe by bending illiquid markets to their will. Like attracts like, and what with CT currently being the face of crypto, I'm concerned about what we're signalling as being desirable.

If you read that last paragraph and think I'm talking about you: I'm not. I've already had a word with them. It's telling that I feel a need to assure a few dozen folks like that, in case they think I've said their quiet part out loud.

I recognise that during the Dotcom bubble, people didn't gather at conferences en masse to talk about the TCP/IP protocol, but the social signalling I witnessed at ETHDenver belies the fact that in the event of, say, a global ban with teeth: these people aren't sticking around.

And there are people that we need to stick around for.

"The Blood-Dimmed Tide Is Loosed, And Everywhere The Ceremony Of Innocence Is Drowned"

When I arrived in Colorado, I turned on the TV and wasn't short of things to feel bleak about. Trudeau had invoked the Emergencies Act in Canada to freeze the bank accounts of protestors and their donors, and newsdesks were dissecting statistics about rate hikes and inflation.

The response of crypto maximalists to the protests? To cry havoc and demand Canadian bank runs. The response of the media to the protests? To attempt to convince everyone that freezing the funds of someone that donated lunch money was covered under emergency legislation.

Yesterday, while I wrote part of this from the comfort of my office, Russia invaded Ukraine, after two weeks of will-they-won't-they. Russian forces are shelling cities, and Ukrainian civilians are evacuating en masse. Names of places I never think of while living in the UK are getting dredged up as part of a march towards Kyiv - Chernobyl was recently taken by force.

The response of crypto maximalists to the invasion? To declare that it was now a matter of national security for the United States to become 'the most pro-crypto nation in the world'. The response of the media to the invasion? The New York Times ran a line on their front page that cryptocurrencies could be used to evade capital controls.

"The Best Lack All Conviction, While The Worst Are Full Of Passionate Intensity."

It was with all of this happening that I spent a week and a half in venues that were heaving with humans, surrounded with free beer, CBD soda and pizzas being handed out by guys in full Teenage Mutant Ninja Turtle outfits, observing talks with names like "Into The Pussyverse" and walking around a Zen Zone with tranquil music, beanbags and tarot card readings, and wondering if every second person I spoke with was either high or just super excited to be out of the house for a major get-together for the first time in two years.

It was jarring. There were people hacking away on things, sure, but the overwhelming feeling was that of people speaking at each other.

Then I read this eGirl Capital article on solarpunk versus lunarpunk.

"Surely Some Revelation Is At Hand; Surely The Second Coming Is At Hand."

I won't rehash the contents of what is an excellent piece of writing, other than to say that there's a posited axis between "solarpunks" (unbridled optimism, crypto will shepherd us all into the sunlit uplands of DAOs, encapsulating all and sundry) and "lunarpunks" (privacy is a necessity for self-sufficiency, and we should be spending a lot more time building out software that enables this).

I don't know where I fall on this spectrum: I work - in public - for a DeFi DAO, but push code for tooling under pseudonyms. I don't use Tornado Cash due to the risk of potential contamination in the eyes of exchanges and the tax authorities, but the cypherpunk in me tells me that I have the right - if not the obligation - to only selectively reveal the parts of my financial history that are relevant to the interaction at hand.

The people I interact with daily online fall at various spots on this axis: ranging from people such as @joey__santoro (doxxed, founder/contributor to Fei), to @transmissions11 (name known but operates as pseudonymous, currently research engineer at Paradigm) and @dystopiabreaker (absolute unknown, cryptographer and nascent technophilosopher).

I suspect there's probably a four-quadrant graph you could throw together for this: solarpunk vs lunarpunk and unmasked vs anonymous, and further believe that most of us would sit squarely in the middle of it. The difference is important, though, as it comes down to what we envision crypto being used for, and to what end.

As an aside: what I find interesting about events such as ETHDenver is the name-anonymity that runs through a large chunk of the developer/DeFi group. I spent an entire week periodically bumping into @libevm, and would just refer to him by name as that: I don't know what his name is, and I don't care. That's pretty liberating, in a way - engaging with someone based on their ideas rather than the person themselves, even if you're standing right in front of them.

"The Darkness Drops Again; But Now I Know That Twenty Centuries Of Stony Sleep Were Vexed To Nightmare By A Rocking Cradle"

I'm digressing somewhat.

We have this vibrant ecosystem, filled - for better or for worse - with new blood, and while I can't speak for the NFT scene, I can for DeFi. Over the course of the last few years, we've built out a superb suite of tools and protocols that supplant the TradFi notions of yield-bearing accounts, derivatives, indices and options, backed by a wide range of various takes on stablecoin mechanisms. Absent the risk management procedures that exist in a typical financial institution, we're doing a very good job of replicating what exists, and improving where we can.

And yet: we use this infrastructure mostly to trade and flip shitcoins with ludicrous ponzinomics. Stables are still primarily dollar denominated, and beyond sites such as Bitrefill we are still beholden to centralised exchanges in order to interface with the fiat system to buy real-life assets, to pay our taxes and our bills: chokepoints that get our checking accounts frozen and our mortgage applications rejected. We donate to addresses created and maintained for emergency situations, with no certainty that the value we remit will actually be able to be easily exchanged for goods and services. We hand Bitcoin over to protestors, and then watch as they stumble around cluelessly trying to work how to leverage that into spending power. We put together DAOs for ludicrous things such as decentralised sperm banks, and then watch as they fall apart due to internecine squabbling over control of the treasury.

My point is that we're still woefully absent the parallel financial system that is required to properly entrench crypto into society, outside the bubble that we operate in. I can't pay for legal advice or buy my groceries with DAI or ETH - not once in Denver did I get offered the option to use an L2 to pay for a drink.

I see the emergence of such a system as inevitable: Colorado recently introduced legislation to pay state taxes in crypto, and I can hire digital labour - and choose to be paid for my own - in crypto, although coverage in this regard is pretty spotty. Perhaps it will be CDBCs that finally break the dam, perhaps it will be geopolitical pressures and lobbying. Perhaps institutions will be happier to start integrating their business processes on-chain when zero-knowledge proofs are more widely available in conjunction with data-siloed blockchain tech. Perhaps advertisers will arrive en masse (with all the concomitant attention) once we see the appearance of the first wallet-as-social-network that has a half-decent UX.

My point is: I believe that we're still early. Too early.

And this is the vulnerable point - evolved enough to make motions in Congress with lobbying, large enough to make the news on major price shifts, but isolated enough to strangle at a few key chokepoints and remove 95% of the eyeballs. Perhaps true lunarpunks would prefer this.

"And What Rough Beast, Its Hour Come Round At Last, Slouches Towards Bethlehem To Be Born?"

With all of this in mind, I figure that there are two ways I can contribute in a non-trivial way.

Firstly: I'll be going to law school at the end of this year. This is partially borne from the fact that my recent interactions with the legal system made it clear to me just how scant things are on the ground in terms of both crypto-specific law and the pool of legal professionals that are native to what we do and want to achieve (although perhaps this is simply generational).

My wider justification for throwing myself onto the wheel of credentialism once more is that once what we have built can no longer be swept aside, there needs to be a cohort of people who can comfortably walk in both worlds, willing to extend an open hand to the existing system to facilitate the merging of the two at the appropriate points.

Secondly: I'll be stepping away somewhat from my DeFi/DAO development work, in favour of putting together an intensive incubator program for emerging talent. Whether you believe you'd be more productive specialising within the crypto space as - among other things - a communicator, an accountant, a cryptographer or a developer, I believe that there's a set 'curriculum' of skills and knowledge that will help speed up the crossing of the Rubicon. To the best of my knowledge, something like that doesn't quite exist yet.

More pragmatically, in the event that the regulatory environment turns truly hostile (and we won't be able to rely on the beneficence of state actors for a good long while yet), I want to do my part in helping prepare for if the aforementioned open hand ever needs to turn into a fist, and development gets driven underground. In my mind, it'll be a lot easier to source the talent for continued work if they're already trained up while the environment is largely passive.

I arrived at ETHDenver excited and apprehensive. I left it confused, anxious, but optimistic.

We'll get there. We just need to continue sending more people uptrain.

For the day we take the engine.