用Solidity写一个网上购物智能合约

学校期末web作业，要实现一个简单的网上购书平台，写到一半的时候发现支付这一块可以借助智能合约来完成。虽然接触过一点区块链的知识，但还没有动手写过智能合约，于是匆忙学习了一下Solidity和Smart Contract的基础，开始编写我的第一个智能合约，顺便记录一下学习历程。

先看下官网给的一个例子 https://solidity.readthedocs.io/en/develop/solidity-by-example.html#safe-remote-purchase

pragma solidity >=0.4.22 <0.6.0;contract Purchase {uint public value;address payable public seller;address payable public buyer;enum State { Created, Locked, Inactive }State public state;// Ensure that `msg.value` is an even number.// Division will truncate if it is an odd number.// Check via multiplication that it wasn't an odd number.constructor() public payable {seller = msg.sender;value = msg.value / 2;require((2 * value) == msg.value, "Value has to be even.");}modifier condition(bool _condition) {require(_condition);_;}modifier onlyBuyer() {require(msg.sender == buyer,"Only buyer can call this.");_;}modifier onlySeller() {require(msg.sender == seller,"Only seller can call this.");_;}modifier inState(State _state) {require(state == _state,"Invalid state.");_;}event Aborted();event PurchaseConfirmed();event ItemReceived();/// Abort the purchase and reclaim the ether./// Can only be called by the seller before/// the contract is locked.function abort()publiconlySellerinState(State.Created){emit Aborted();state = State.Inactive;seller.transfer(address(this).balance);}/// Confirm the purchase as buyer./// Transaction has to include `2 * value` ether./// The ether will be locked until confirmReceived/// is called.function confirmPurchase()publicinState(State.Created)condition(msg.value == (2 * value))payable{emit PurchaseConfirmed();buyer = msg.sender;state = State.Locked;}/// Confirm that you (the buyer) received the item./// This will release the locked ether.function confirmReceived()publiconlyBuyerinState(State.Locked){emit ItemReceived();// It is important to change the state first because// otherwise, the contracts called using `send` below// can call in again here.state = State.Inactive;// NOTE: This actually allows both the buyer and the seller to// block the refund - the withdraw pattern should be used.buyer.transfer(value);seller.transfer(address(this).balance);}
}

合约存在的问题

首先卖家创建合约并交两倍原价的押金，此时合约状态为Created，卖家可以执行abort取消贩卖退回押金。买家支付两倍原价进行购买，其中一倍作押金。确认收货后，各自退回押金，商品的钱交给卖家。

合约原理很简单，但存在一个很大的问题，一份合约只能用于一次交易，如果一个商品库存有100个，卖家就要去部署100次这样的合约，不仅麻烦还难于管理。

其次，合约试图用押金来约束买家和卖家的行为，但实际上，如果买家故意不确认收货，卖家会比买家更亏，也就是说没有做到平衡。比如商品价格为p，卖家支付2p的押金，发货后等于暂时失去了3p的资金；买家支付2p的押金，得到了价格为p的商品，他等于只失去了价值为p的资金。这时买家相比卖家是赚的，他有理由恶意拒绝确认。

主要解决思路

问题的解决参考了下面两篇文章(要翻墙)
https://medium.com/coinmonks/creating-smart-contracts-with-smart-contract-d54e21d26e00
https://medium.com/coinmonks/escrow-service-as-a-smart-contract-the-business-logic-5b678ebe1955

利用合约来部署合约。一类商品可以产生多个订单，卖家只需要部署每一类商品的合约；买家通过调用商品合约来创建订单合约，订单合约的地址记录在商品合约中。
增加发货和收货期限(通过记录时间戳实现)来约束买家和卖家；

（以下的代码参考原文章的代码，修改了很大一部分）

pragma solidity^0.4.22;// 商品合约
contract Product {bool public enable;         // 当前商品是否有效address public sellerAddr;  // 卖家的地址uint public price;          // 商品的单价uint public commitTime;     // 卖家承诺发货时间address[] public orders;    // 所有订单的地址address public lastOrder;   // 最新订单的地址modifier onlySeller() {require(sellerAddr == msg.sender,"卖家账号地址错误!");_;}constructor(bool _enable, uint _price, uint _commitTime)public{require(_price != 0 && _commitTime != 0,"参数信息不完整");sellerAddr = msg.sender;enable = _enable;price = _price;commitTime = _commitTime;}function setEnable(bool _enable)publiconlySeller{enable = _enable;}function setPrice(uint _price)publiconlySeller{price = _price;}function setCommitTime(uint _commitTime)publiconlySeller{commitTime = _commitTime;}function getOrderCount()publicviewreturns(uint _count){return orders.length;}// 买家创建订单，输入购买数量和两倍原价的msg.valueevent NewOrder(address _orderAddr);function newOrder(uint amount)publicpayable{require(enable == true,"产品当前无法下单");require(amount != 0,"购买数量不能为0");Order order = (new Order).value(msg.value)(msg.sender, sellerAddr, price * amount, commitTime);orders.push(order);lastOrder = order;emit NewOrder(order);}
}// 订单合约
contract Order {// 已支付，已接单，已发货，已签收，已收货，已失效enum Status {Paid, Taken, Shipped, Signed, Received, Inactive}address public buyerAddr;      // 买家的地址address public sellerAddr;     // 卖家的地址uint public price;             // 商品的总价uint public commitTime;        // 卖家承诺发货时间Status public status;          // 订单的状态uint public createTime;        // 订单的创建(支付)时间uint public signTime;          // 订单的签收时间string public trackingNumber;  // 订单的物流号uint8 public score;            // 订单的评分string public assession;       // 订单的评价modifier inStatus(Status _status) {require(status == _status,"订单的状态不可操作");_;}modifier onlyBuyer() {require(buyerAddr == msg.sender,"买家账号地址错误!");_;}modifier onlySeller() {require(sellerAddr == msg.sender,"卖家账号地址错误!");_;}function getBalance()publicviewreturns(uint _balance){return address(this).balance;}constructor(address _buyerAddr, address _sellerAddr, uint _price, uint _commitTime)publicpayable{require(msg.value == _price * 2,"买家需要额外支付与商品价格等价的金额作为押金");buyerAddr = _buyerAddr;sellerAddr = _sellerAddr;price = _price;commitTime = _commitTime;status = Status.Paid;createTime = now;}// 卖家接单之前用户可以取消购买function abort()publiconlyBuyerpayableinStatus(Status.Paid){status = Status.Inactive;buyerAddr.transfer(price * 2);}// 卖家选择接单或拒绝接单function take(bool _takeOrder)publiconlySellerpayableinStatus(Status.Paid){if (_takeOrder) {require(msg.value == price,"卖家需要支付与商品价格等价的金额作为押金");status = Status.Taken;}else {status = Status.Inactive;buyerAddr.transfer(price * 2);}}// 买家检查卖家是否没按时发货，如果是则退还买家钱，同时作为惩罚，卖家的押金被锁定在合约里了function checkLate()publiconlyBuyerinStatus(Status.Taken){require(now - createTime > commitTime,"尚未到卖家发货截止期限");status = Status.Inactive;buyerAddr.transfer(price * 2);}// 卖家输入运单号，确认发货function ship(string _trackingNumber)publiconlySellerpayableinStatus(Status.Taken){// todo: 检查运单号是否真实存在status = Status.Shipped;trackingNumber = _trackingNumber;sellerAddr.transfer(price); // 卖家发货后退回押金}// 确认签收function sign()publicinStatus(Status.Shipped){// todo: 通过运单号查询物流信息，判断是否签收并获取签收时间status = Status.Signed;// signTime = getSignTime();signTime = now; // 测试用}// 买家确认收货function receive()publiconlyBuyerpayableinStatus(Status.Signed){status = Status.Received;buyerAddr.transfer(price);sellerAddr.transfer(price);}// 过了10天买家没确认收货，则卖家可以自己确认function confirmBySeller()publiconlySellerpayableinStatus(Status.Signed){require(now - signTime > 10 days,"卖家超过10天才可以确认");status = Status.Received;buyerAddr.transfer(price);sellerAddr.transfer(price);}// 买家对订单进行评价function assess(uint8 _score, string _assession)publiconlyBuyerinStatus(Status.Received){require(_score >= 1 && _score <= 5,"评分只能是1~5之间的整数");score = _score;assession = _assession;status = Status.Inactive;}
}

合约整体流程

首先卖家部署商品合约，声明自己的账户地址、商品的价格、承诺的发货时间。
买家通过商品合约部署订单合约(注意订单合约的msg.sender是商品合约的地址)支付商品价格p+押金p，买家等待卖家接单，期间可以取消购买，退还2p。
卖家如果接单，需要交付价值为p的押金，同时要在自己承诺的发货时间内发货。如果拒绝接单，则合约将钱退还买家。
如果卖家没能在承诺时间发货，买家可以调用checkLate，退回押金，同时作为惩罚，卖家的押金将无法取回(可能有方法取回?)。
卖家确认发货时要填写运单(物流)号，为了验证这个订单号，需要物流公司接入以太坊并提供接口，这里就不模拟了，直接跳过验证。同样，签收的过程也偷懒省略了。
接着买家确认收货，为了防止恶意不确认或买家忘记确认，签收10天后卖家可以自己确认。
最后买家对订单进行评价。合约没有实现退货等功能。

代码在Remix上可以测试，在前端调用合约时用web3.js。

最后，我自己也是刚入门智能合约，这个代码的逻辑上和功能上肯定还存在许多漏洞，所以仅供参考。