Hello all,
So I recently came across an interesting new ICO for a protocol called Quantstamp (www.quantstamp.com). I have kind of a love hate relationship with ICOs. In a few cases, I have found really interesting projects which I am personally interested in, other than just buying and selling. Mostly though, I find the ICO space to be bloated and full of scams. Either the ICOs themselves are dubious, or more frequently, outside 3rd parties stealing funds are more concerning.
There are a couple of main reasons why I find Quantstamp to be an interesting protocol in the overly saturated ICO market. First, there is a real need for this service. Smart contracts are the future and having a robust mechanism to audit them is becoming increasingly important. As the number of smart contracts grows at a near exponential rate, the manpower to verify their security will not be sufficient to keep up with growth. This leaves potentially millions of dollars at risk due to poorly written code or very simple human error.
The second reason I am interested in Quantstamp is their implementation of another unique feature, proof of caring. So the team have decided that a better way to raise funds is not to simply find a handful of heavy Ethereum holders to give discounts to in presale. They have instead opted to give presale rights to people who show an actual interest in the project and will invest time and creative energy to help promote it. In many ways, a person's time is more valuable than their Ether, so I believe this to be as good a method as any, at engaging investors who are in it for the quality of the project rather than the flip potential.
Here is an awesome video which summaries QSP really well:
QSP Video
So I wanted to show I care as I do find this project interesting. As a minnow in this ocean of whales, a presale would be really helpful for my investment purposes, so all of this kind of syncs up nicely.
I've spent a couple of weeks in the telegram, read through the white paper, scanned the reddit, and watched their Youtube videos. Here are my thoughts:
- The idea itself is sound and well considered. It aims to solve a real problem with a practical solution. They are combining an automated service with the skill of the hacking community to audit and secure smart contracts. As the hacking community finds bugs, the security library is upgraded. I think of it as if I was a writer. The automated portion of the process is the spell checker making sure all my 't's are crossed and 'i's are dotted. This is the first critical step to make sure simple errors in the code do not result in security failures. This process does not necessarily check the quality of the code written, but ensures that the code was written properly from a language standpoint. The second step is the bounty program. To continue the analogy, this would be an editors job. The editor would continue to check on language, but they primarily are interested in quality of the story written. Does it make sense? Do the characters act naturally? Are there any plot holes? The bounty program would incentives 'hackers' to compete for healthy bounties and help secure the contracts. Hackers who may be inclined to hack a contract, would be risking a bounty payout in the event another talented hacker solved any flaws. So in this sense, even potentially malicious actors would be incentivised to improve security.
Nodes can contribute to the health of the ecosystem simply by running the QSP protocol. So even non technical people can security check smart contracts and help to ensure the blockchain is as safe as possible.
Scores a very low 10 on the Howie test - This means that QSP is unlikely to be classified as a security by the SEC
- Working prototype - They recently completed a semi automated audit of Request Network, another upcoming ICO. So Quantstamp is not asking you to invest in an idea. They have a partial product already working and according to the whitepaper, 4 audits will have been completed by the end of the year.
- Insurance - This is really interesting to me and quite important. The audits will be insured. So this is not just a document saying it is safe, the audits will be backed by insurance. The insurance process is set to begin June 2018 and an alpha version on mainnet in October 2018.
Partnership with University of Waterloo - They have several alumni from this university. A partnership with one of Canada's top universities can only serve to validate the protocol.
Public audits / certification - Developers will be encouraged to reveal the result of their audits to encourage public confidence, thus increasing the demand for QSP services as the public begins to demand proper security auditing. Providing an actual certificate of audit also further validates and simplifies the process for the public as developers can simply post that they have passed audit. The blockchain will host this audit ensuring the results can not be tampered with.
Price - The price of the audit should be cheaper as it will be automated on the blockchain. Bounties should be healthy as always, but at least a portion of the process can be made more efficient.
The team - The team is a really nice mix of individuals from the corporate sector and academia. As previously mentioned, there is a strong influence from University of Waterloo. I don't know enough to comment, but a quick search reveals it to be a top university in Canada. The founders have strong experience in programming, finance, and security. Check their linkedin profiles for more information.
So to wrap it up, Quantstamp is one of the few ICO projects to come out in the past few months that I have genuinely been interested in. I'm not going to speculate on price, I'll just say that offering the presale to people who care and motivating the community in this way, is a stroke of genius. Check their website for details on the token sale. The Medium page has more info on how the token sale is broken down.
- My main question about Quantstamp is on how they plan on encouraging developers to use the protocol. At the moment, bounty programs are in place to find bugs on many platforms. If this is not sufficient to secure the contracts, how does Quantstamp plan to get developers to use their services. Will there be an established network of security auditors in place to start? If not, why would a developer not just offer the bounty on their own rather than go through QSP?
Links:
www.quantstamp.com
https://www.youtube.com/channel/UCXP3YLX4JdI0gGb9UKSunMg
https://www.reddit.com/r/Quantstamp/
https://medium.com/quantstamp