Ownership of sites and smart contracts

Question

If I am an owner of a site, I can place restrictions on its usage even if the site software is licensed under an open source license such as GPL or AGPL, right? Which law allows me to place such restrictions? For example, I can disallow uploading porn to my site, right? I can forbid circumventing site payment system, such as by distributing site passwords to other users or by modifying (I think, it's called "hacking") the site scripts, right?

Do I have similar rights for an open source smart contract created and uploaded to public servers by me? Can I legally disallow certain usages of smart contract (such as retrieving data from it directly to download a paid file for free bypassing my user interface software)?

Note that I realize I have no rights to restrict usage of my source code of a smart contract, because it is open source. I ask about a particular instance of smart contract running (similarly to a particular site running on a particular domain not to its underlying open source software).

Smart contract is a computer program that runs on servers (you can assume they are third-party servers) with the purpose to controls possible actions (such as money transfers) and disallow certain kinds of actions (like uncompensated money transfers).

I suspect it is something related to "terms of service". Can I apply terms of service to a running instance of a smart contact? I think, the main question is whether I am considered a service provider for the services provided by a smart contract: I spin it once and then the smart contract runs without my intervention (it is even not possible for me to stop my smart contract running, but I can for example change the amount of the monetary fee for its usage) on third-party servers.

There is a thing (securing a public file) that I cannot restrict with logic of a smart contact. So I am seeking a legal ("if you violate, I can sue") way to disallow these actions.

Answer 1

You can set terms of service that prohibit anything you want on your front-end web site, so you could add clauses to the front-end terms of service prohibiting people from e.g. interacting with the contracts through any other front-end. It's not clear how enforceable this would be. Can Amazon's terms of service prohibit you from ever again shopping at Walmart?

Some people might never use (or claim to never have used) your front-end, but still interact with the on-chain contract. You could try and claim that you don't actually give permission to node operators to use and process your copyrighted contract bytecode except under a restrictive license that bans whatever you don't want. However, it might be tough to convince a judge to let you enforce your license terms; the system fundamentally couldn't operate if people could do that, and moreover you knew what would be done with your smart contract binary and you paid a miner to include it in the chain anyway.

Finally, to the extent that a smart contract is a contract, it can itself grant permission for people to do whatever it mechanically permits, and prohibit only what it mechanically prohibits. A court might be reluctant to enforce additional terms that aren't actually available to all parties to the smart contract, and that the smart contract itself doesn't reference.

Answer 2

Terms of service are contracts, where you grant a person a right in exchange for them doing something. If they have agreed but violate the terms, you may have legal recourse to sue them; or you can "undo" their action, e.g. you can delete porn that they uploaded. There are certain limitations on your recourse, for example you cannot fine a user $100 for posting a snarky comment, and this comes from contract law (no penalty clauses).

Regardless of the copyright status of any code you have running on your machine, you can set legal limits on how a program on your web page can be uses, for example you can stipulate "cannot be used for commercial purposes". The legal challenge would be for the provider to prove that they were actually harmed by the user's breach of contract: usually, the violator is just banned, which doesn't take a lawsuit. An indemnification clause is useful because it can require the user to take responsibility for legal damages that the user causes to you (for example, if they post defamatory content, they can be forced to cover your losses arising from the defamation lawsuit). You might have a hard time suing a person for making a snarky comment online, although the damage could be that it causes your snark-free forum reputation and attendant customer base to evaporate.

If your program transfers money from a user account to a specified target account and the TOS requires the user to have money in the account but the software doesn't check the account, then "writing a rubber e-check" would be a violation of the TOS and would cause damage, so you could sue. (For the sake of keeping this maximally related to the question you ask, I ignore the probability that online financial transactions are highly likely to be subject to other specific laws).

The comments suggests a complication, that there are two TOS's involved. There can be a front-end server that has a TOS, and that server can "silently" call on a separate server with its other TOS. If your TOS and use of the third party server is consistent with the third party TOS, there is no problem. If you are using the third party server illegally, you bear the liability and your customers do not (unless you are clear about the nature of the third party TOS and that you disclaim responsibility for lawsuits arising from the customer's illegal use of the service). It is unlikely that the situation will arise, since the customer has no agreement with the third party that they breached. It is insufficient to just say "we have a TOS", you have to have actual agreement between the parties.