sub0 Asia 2024 - Karsten Nohl (SRLabs), Giovanny Gongora and Serhan Bahar (Parity)
summary
Substrate security work is split into four practical levers: fuzz testing and internal pipelines that catch many implementation crashes, commercial audits that produce a prioritized threat model, community programs (Substrate Builder / audit pools) that found about two critical bugs per chain across 63 chains, and bug bounties that attract researchers but must set realistic rewards. Diagnosis is strong; the hard part is healing — ambassadors plus security champions halve open bugs and cut orphan issues threefold, so invest in ownership and prioritized remediation.
AI-written summary · about
chapters (16)
- 0:00Blockchain security challenges
- 1:46Finding security bugs
- 8:23Shared audit initiatives
- 11:57Bug bounty limitations
- 14:46Fixing discovered bugs
- 17:34Security ambassadors
- 20:03Parity team roles
- 21:07Security Champions debate
- 27:52Outsourcing security approaches
- 33:53Security practices in blockchain
- 37:02Holistic security beyond code
- 40:10Security education hiring
- 43:37Ecosystem security awareness
- 46:06Supporting Substrate devs
- 49:22Call to action security healing
- 50:27Q&A effective security measures
related talks
57mSecurity Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines
15mSearching Outside the Streetlight
36mDeciphering Web3 Security: Implications and Innovations
21mOverview of the Last Year of Audits, Reviews, and Proofs
01h 33mWhite Hat Panel: DeFi Exploits
11mThe Pod: Security with Asymmetric Research
22mOn the Shoulders of Giants: Security in FOSS
23mThanks for all the bugs!