Every Defi protocol should have:
1. Circuit breakers for deposit and withdrawals, and possibly other internal operations as well
2. Timelocks for any change
3. Security councils that can shut down protocols immediately
We don't need insurance, we need to do start doing the ffcking basics correctly. It's too early for this space to drive without any training wheels.
I beg you, sacrifice a tiny bit of UX to gain a lot of peace of mind. The worst possible UX is losing your user's money.
1. Circuit breakers for deposit and withdrawals, and possibly other internal operations as well
2. Timelocks for any change
3. Security councils that can shut down protocols immediately
We don't need insurance, we need to do start doing the ffcking basics correctly. It's too early for this space to drive without any training wheels.
I beg you, sacrifice a tiny bit of UX to gain a lot of peace of mind. The worst possible UX is losing your user's money.
I am extremely frustrated with the state of security in this space.
Audits typically focus on the protocol, and whether the implementation matches the spec. However, that's not where the majority of attacks occur: they happen in the quorums, the key management system, the deployment process, the security hygiene of the team.
Protocol audits are necessary but don't go nearly far enough, and give both (inexperienced) teams and external users false confidence.
I don't know what the solution is in this case - teams obviously need to do better, and probably auditors should expand the footprint they are covering. How else are we supposed to trust that a team doesn't build a nice-looking house, but leaves the frontdoor and 5 windows wide open?
Audits typically focus on the protocol, and whether the implementation matches the spec. However, that's not where the majority of attacks occur: they happen in the quorums, the key management system, the deployment process, the security hygiene of the team.
Protocol audits are necessary but don't go nearly far enough, and give both (inexperienced) teams and external users false confidence.
I don't know what the solution is in this case - teams obviously need to do better, and probably auditors should expand the footprint they are covering. How else are we supposed to trust that a team doesn't build a nice-looking house, but leaves the frontdoor and 5 windows wide open?
• • •
Missing some Tweet in this thread? You can try to
force a refresh
