5 ms·

There are some brilliant people out there. I have no doubt solidity experts can spot vulns by inspection. My point is that auditing is necessary but not suffici

There are some brilliant people out there. I have no doubt solidity experts can spot vulns by inspection. My point is that auditing is necessary but not sufficient. Its a greater issue in security where audits and testing can lead one into a false sense of security, 'because it is audited'. The original post was saying all the hacked contracts were 'unaudited'. While this is true, I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling.

latchkey 5y ago
Agreed fully. Even with all the unit tests that I write, I still find logic bugs in my code. =) Software is hard!
danielvf 5y ago
"I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling." That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.
- rfd4sgmk8u 5y ago
  Would you be willing to share either reports or the name of the audit vendor that you trust?
  - danielvf 5y ago
    Sure. Best auditor is https://openzeppelin.com/security-audits/ https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf https://github.com/OriginProtocol/security/blob/master/audit...
    - rfd4sgmk8u 5y ago
      Thank you for sharing! I agree that OZ and ToB are the best in this space. They write the open source tooling, and I am sure they have some really good inhouse tools too. Their findings are very valuable, could potentially have saved million of user AUM/TVL. Sincerely, Best of luck with Origin!
      - danielvf 5y ago
        Good luck as well.

latchkey 5y ago

Agreed fully. Even with all the unit tests that I write, I still find logic bugs in my code. =) Software is hard!

danielvf 5y ago

"I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling." That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.

rfd4sgmk8u 5y ago
Would you be willing to share either reports or the name of the audit vendor that you trust?
- danielvf 5y ago
  Sure. Best auditor is https://openzeppelin.com/security-audits/ https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf https://github.com/OriginProtocol/security/blob/master/audit...
  - rfd4sgmk8u 5y ago
    Thank you for sharing! I agree that OZ and ToB are the best in this space. They write the open source tooling, and I am sure they have some really good inhouse tools too. Their findings are very valuable, could potentially have saved million of user AUM/TVL. Sincerely, Best of luck with Origin!
    - danielvf 5y ago
      Good luck as well.