“Code is law” is one of the most common adages in crypto.

The idea that participants transacting in blockchain-based protocols are bound by the outcomes of self-executing contracts has sparked controversy in the crypto sphere at least since the day of Ethereum’s DAO hack. And now the debate is back.

In light of recent exploits in decentralized finance, two prominent lawyers are weighing in.

Gabriel Shapiro, Delphi Digital general counsel, is arguing that the proposition holds true, while Preston Byrne of Brown Rudnick law firm, disagrees.

The debate becomes especially relevant after a French court in the past week cleared all charges against exploiters of the Platypus Finance automated market maker. The court argued that the hackers were not guilty of receiving stolen goods as they interacted with openly available smart contracts according to how their code was written.

Code Exploit

Most hacks in DeFi are a result of the attacker finding a loophole or vulnerability in the code which they can exploit to secure funds.

But even as hackers are executing openly available code according to its set of parameters, the outcome they are achieving is not what the writers of that code intended it to be. So the question is, if the unintended outcome harms users, should an external arbiter interfere to change or reverse that outcome, or should the legal system abide by what was written in blockchain code.

“Code is law” says external arbiters should not interfere.

The concept was birthed by Larry Lessig, a renowned attorney, and defender of open-source software. In his seminal article from early 2000, Lessig proposed the idea that the regulator threatens the freedom offered by cyberspace. He offers the idea that the digital realm has a different regulator–code–capable of setting the terms upon which “life in cyberspace is experienced.”

Misleading Axiom

Byrne argues that Lessig’s claims are “annoying,” and a misleading axiom.

Code might not be enough to counter any eventuality, reinforcing the need for off-chain resolutive measures to take place.

For example, he points to the fact that on the internet, terms and conditions arise from private discretion, and not sovereign authority, but that regulators are tasked for enforcing these agreements. For example, just because platforms can ban users or content, Byrne writes, doesn’t mean it’s a law that they do, in the way a legal system would interpret it.

However, Byrne concedes that code is a source of law, and says smart contracts influence and transform legal systems. In fact, he writes, code has an emerging law-shaping effect that the regulator–must address.

Code Must be Law

Shapiro agrees to some extent, adding nuance.

Delphi Digital’s legal counsel wrote on Dec. 3, that “code must be law for DeFi to work.” Even if not actual law, when participants use protocols governed by self-executing code, they have come to the consensus they will accept the outcomes of that code.

“When using DeFi systems people should be able to consent that the outcome of the code is final & binding,” he wrote.

Shapiro points out that the problem, currently, is that systems are still insecure, so when things go wrong in a surprising way, all those enjoying the benefits of “code is law” are now no longer willing to accept its downsides.

He calls it a “cake and eat it” situation, wherein users call for the justice system to be used as a crutch, while also benefiting from censorship resistance and autonomous systems that blockchain smart contracts provide.

Whether participants have the right to external recourse when code is exploited or not, it’s remarkable that legal systems across jurisdictions are adjusting to crypto, Byrne said.

“It is absolutely marvelous to see the legal system starting to evolve to accommodate our version of reality rather than the other way around,” he concluded.