4 ms·

I'd like to add that there is a critical shortage of security auditors for smart contracts and blockchain protocols. Projects are willing to spend up to millio

I'd like to add that there is a critical shortage of security auditors for smart contracts and blockchain protocols. Projects are willing to spend up to millions to squash away vulnerabilities. For example Balancer opened a bug bounty for their v2 with $2M USD for 1 critical bug: https://docs-v2.balancer.finance/core-concepts-1/security/bug-bounties https://docs-v2.balancer.finance/core-concepts-1/security/bu...

R0b0t1 6y ago
Do they have any interest in hiring regular employees? Most of the people I know who go after bounties barely make $30,000/yr. If I see bounties I see people who aren't really willing to pay.
- mratsim 6y ago
  You should apply to auditing firms (Trail of Bits, Open Zeppelin, Quantstamp, ...). They are all booked 3 months in advance at the very least and would love to onboard new blood.
  - toomuchtodo 6y ago
    What’s the comp look like?
    - seibelj 6y ago
      High - solid blockchain devs can pull a lot of money. Let me underline _solid_, there are a lot of people who took a tutorial and try to sell themselves as experts.
  - dguido 6y ago
    Yes! Please do apply. We have a tight-knit team of experts, industry leading tools, and a work environment that promotes continued learning. You'll get paid well and quickly become a leading industry expert. Here's our job req for a blockchain security analyst: https://jobs.lever.co/trailofbits/4f459855-3299-462f-9e73-299a840d5baf https://jobs.lever.co/trailofbits/4f459855-3299-462f-9e73-29...
- Jhsto 6y ago
  Note the difference between "I could not find any bugs" and "I proved there are no bugs". I would assume only the latter are hired. Yet, program proving as in formal verification is a very academic specialisation. The reluctance to hire these people seems partly a) unawareness these methods exist and b) capability to evaluate whether someone knows enough. To my anecdotal experience founders of DeFi applications are not that tech savvy, so instead of trying to understand Solidity (untrivial) they instead place bug bounties or hire a special firm to give a stamp of approval for a product launch.
  - R0b0t1 6y ago
    My take on formal verification was that we are still not close to being able to usefully prove the validity of the types of nontrivial programs that make up DeFi contracts. It can help, sure, but companies serious about security need to invest in internal auditing (that may not seem to be generating obvious returns) instead of hoping for a bug bounty Hail Mary. If these firms are out there and are being hired I suppose that counts.

R0b0t1 6y ago

Do they have any interest in hiring regular employees? Most of the people I know who go after bounties barely make $30,000/yr. If I see bounties I see people who aren't really willing to pay.

mratsim 6y ago
You should apply to auditing firms (Trail of Bits, Open Zeppelin, Quantstamp, ...). They are all booked 3 months in advance at the very least and would love to onboard new blood.
- toomuchtodo 6y ago
  What’s the comp look like?
  - seibelj 6y ago
    High - solid blockchain devs can pull a lot of money. Let me underline _solid_, there are a lot of people who took a tutorial and try to sell themselves as experts.
- dguido 6y ago
  Yes! Please do apply. We have a tight-knit team of experts, industry leading tools, and a work environment that promotes continued learning. You'll get paid well and quickly become a leading industry expert. Here's our job req for a blockchain security analyst: https://jobs.lever.co/trailofbits/4f459855-3299-462f-9e73-299a840d5baf https://jobs.lever.co/trailofbits/4f459855-3299-462f-9e73-29...
Jhsto 6y ago
Note the difference between "I could not find any bugs" and "I proved there are no bugs". I would assume only the latter are hired. Yet, program proving as in formal verification is a very academic specialisation. The reluctance to hire these people seems partly a) unawareness these methods exist and b) capability to evaluate whether someone knows enough. To my anecdotal experience founders of DeFi applications are not that tech savvy, so instead of trying to understand Solidity (untrivial) they instead place bug bounties or hire a special firm to give a stamp of approval for a product launch.
- R0b0t1 6y ago
  My take on formal verification was that we are still not close to being able to usefully prove the validity of the types of nontrivial programs that make up DeFi contracts. It can help, sure, but companies serious about security need to invest in internal auditing (that may not seem to be generating obvious returns) instead of hoping for a bug bounty Hail Mary. If these firms are out there and are being hired I suppose that counts.