3 ms·
"I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source to
by danielvf 5y ago
"I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling."
That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.
- rfd4sgmk8u 5y agoWould you be willing to share either reports or the name of the audit vendor that you trust?
- danielvf 5y agoSure. Best auditor is https://openzeppelin.com/security-audits/ https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com https://www.trailofbits.com. Here's the audit that just finished: https://github.com/OriginProtocol/security/blob/master/audits/OpenZeppelin%20-%20Origin%20Dollar%20-%20October%202021.pdf https://github.com/OriginProtocol/security/blob/master/audit...
- rfd4sgmk8u 5y agoThank you for sharing! I agree that OZ and ToB are the best in this space. They write the open source tooling, and I am sure they have some really good inhouse tools too. Their findings are very valuable, could potentially have saved million of user AUM/TVL. Sincerely, Best of luck with Origin!
- danielvf 5y agoGood luck as well.