1/21 Tempted by $USDD to bridge to @trondao? That supple and bouncy claimed 30% APY offering comes with a few strings attached. Let's dig in and make sure you don't regret it the morning after —>
2/21 Let's start with nodes: TronScan claims some 6000+ operate. This is impressive! Ethereum doesn't have this many. However, when you look at their documentation, they use a 27 node "Super Representative" system. What this indicates to us is that 27 nodes validate.
3/21 Of these 27 nodes validating through Delegated Proof of Stake, we found validators in South Africa, China and the US. This promotes network security. However, so long as "Super Representatives" are....
...indicated as the sole validators, the network is functionally permissioned. This presents significant technical risk.
4/21 Despite an impressive public repository, #TRON only documents one node implementation. While we value the philosophical quotes each release is accompanied by, we'd value more a greater diversity of node clients...
..Furthermore, we see some good discussion on each new release but we'd also like to see more contributors. More eyes improve security.
5/21 #TRON does not clearly document original node software function documentation. This would help researchers further understand how the node software functions and avoid crises like the one that occurred in 2019: thenextweb.com/hardfork/2019/…
6/21 However, it does provide comprehensive documentation and traceability for code with each new iteration of their node software. This promotes security via transparency. As for transparency on the chain itself, the block explorer is of relatively good utility.
7/21 We found their “Tron ETF” document particularly entertaining - see the image on the cover. It still lacks the polish of the unmatched @etherscan.io in navigating the chain due to limited quality of life improvements such as contract revoke tools. tronscan.org/#/
8/21 We’re also concerned by the disparity between TVL on @TRONSCAN_ORG versus what an independent and respected third party reports it to be - $6B. By contrast, TronScan indicates $12B. This disparity calls into question the use of the block explorer. defillama.com/chain/Tron?cur…
9/21 As for testing, it appears tron’s node has undergone some robust testing. By our count, over 200,000 lines of test code are documented. However, with only 53% code coverage, questions could be raised about how meaningful this testing is. app.codecov.io/gh/tronprotoco…
10/21 Without formal verification or clear instructions for users on how to replicate tests, we’d say that #TRON should certainly consider promoting transparency for third parties. Recreating tests promotes security.
11/21 Finally, this brings us to the security features Tron has implemented. Tron’s software is publicly unaudited, and has no bug bounty worth discussing....
... Despite having a TVL of over “$12B”, only $10,000 is offered to people seeking to disclose vulnerabilities. dnews.com/tron-trx-found…
12/21 This is frankly unacceptable given the fact that Tron node software remains provably unaudited and they’ve had previous close calls, such as the one identified in 6/ ...
.... This is something that can be quickly implemented and will bring immediate results. medium.com/immunefi/armor…
13/21 So, as you can see, Tron isn’t the decentralized L1 it claims to be. The assets built on top of it claiming to be the most decentralized are thus also not decentralized. The infrastructure to which they are deployed presents technical risk.
14/21 @trondao should be congratulated for not suffering documented downtime over its operation. Few chains have operated for such a long time without suffering some form of outage. There have been close calls, yes, but they were luckily averted thanks to @Hacker0x01
15/21 There are no documented cases of transaction censorship either. This is important for any #blockchain. However, given that roughly 99.7% of all TVL is stored in protocols that have some variation of “Justin Sun” (the founder of #TRON in their name, this is unsurprising
16/21 Looking forward, we’d like Tron to consider increasing the number of Super Representatives. This is a foundational issue that makes the technical risk of this chain significantly higher than it otherwise would be. More validators make a more resistant network.
17/21 Good documentation and robust development practices are let down by weak security infrastructure like absent public audits and irrelevant bug bounties. In our eyes, this chain is better than some but certainly not polished enough for us to endorse using it either.
18/21 Whatever exciting yield opportunities advertised to you should be tempered with the careful reminder that if you’re unsure of where the yield is coming from, it’s probably you...
... This is then compounded by the risk of the base layer on which these opportunities rely on. Does this fit your risk profile, anon?
19/21 Whatever exciting yield opportunities advertised to you should be tempered with the careful reminder that if you’re unsure of where the yield is coming from, it’s probably you... #TRON
20/21 (20/21) This is an extended snippet of our Tron chain report. For the full report, 14 other chains, scores on some 30,000 contracts as well as the protocol scores you know and love, please visit DeFiSafety.com/app and buy a subscription.
21/21 @trondao @justinsuntron @trondaoreserve @Poloniex @TronixTrx @WINkorg777 @WinkLink_Oracle @TRONSCAN_ORG @sunyuchentron @defi_sunio @TONi_ZH1 @PerelloLaurent @HEjustinsun @GrenadaWTO @TronColony @Marcus_ZhaoHong @Drewawise_ #DeFi #blockchain
• • •
Missing some Tweet in this thread? You can try to
force a refresh
