3 ms·

As someone paying a six figure invoice to have their project audited right now, it's really not that simple. Do audited projects get hacked? Yes, absolutely. I

As someone paying a six figure invoice to have their project audited right now, it's really not that simple. Do audited projects get hacked? Yes, absolutely. Is a clean audit report mean a project is bullet proof. Definitely not, especially if it's not from a top-tier firm. But an audit will definitely catch any of the common exploits that are easy to make, like this protocol doesn't check to make sure that the caller is not currently inside another transaction in the contract. All in all, an unaudited protocol has at least an order of magnitude higher risk than one audited by a reputable firm. Ignoring audits altogether would be like refusing to lock your doors, because you heard about a house that still get robbed when the front door was locked.

danielvf 5y ago
There's the Swiss cheese theory of accidents. Each layer may have holes in it, but by having enough layers and aggressively trying to shrink the number and size of holes in each layer, you can get much more secure. External audits by good teams are a good layer, but neither they, nor any other individual layer is a silver bullet. Good audits do provide a lot of value.
rfd4sgmk8u 5y ago
Can you explain how it is not more simple than running open source tooling and copy pasting the results? I am yet to see an 'audit report' that is more than just this. Its checkbox compliance. Are you paying six figures for this? I agree that unaudited is worse. But what are you actually paying for with these clowns?
- warkdarrior 5y ago
  There are plenty of audit companies that do a in-depth review of the code, a review of the protocol itself, etc., and come up with questions trying to understand the various execution flows. This goes beyond what current tools can do, it acts as a second pair of eyes to read through and understand all of the smart contracts.
- danielvf 5y ago
  We've also paid for an audit from a leading company recently. You paying for a team of smart people to spend a couple weeks trying to break your system. It's not going to find everything, but everything that is found is a way that can't be attacked anymore.

danielvf 5y ago

There's the Swiss cheese theory of accidents. Each layer may have holes in it, but by having enough layers and aggressively trying to shrink the number and size of holes in each layer, you can get much more secure. External audits by good teams are a good layer, but neither they, nor any other individual layer is a silver bullet. Good audits do provide a lot of value.

rfd4sgmk8u 5y ago

Can you explain how it is not more simple than running open source tooling and copy pasting the results? I am yet to see an 'audit report' that is more than just this. Its checkbox compliance. Are you paying six figures for this? I agree that unaudited is worse. But what are you actually paying for with these clowns?

warkdarrior 5y ago
There are plenty of audit companies that do a in-depth review of the code, a review of the protocol itself, etc., and come up with questions trying to understand the various execution flows. This goes beyond what current tools can do, it acts as a second pair of eyes to read through and understand all of the smart contracts.
danielvf 5y ago
We've also paid for an audit from a leading company recently. You paying for a team of smart people to spend a couple weeks trying to break your system. It's not going to find everything, but everything that is found is a way that can't be attacked anymore.