sub0 Asia 2024 - Philip Stanislaus and Christian Vari (Oak Security)
summary
Oak Security summarizes seven years of Polkadot audits, publishing Snowbridge and Bifrost reports and claiming 30–50% of bugs are logical flaws. Processes use independent reviewers and a credit model instead of retainers. Core lessons: push security through the SDLC, audits are time‑boxed and can miss issues, and defenses require layered checks like monitoring, formal specs, and bounties — the Swiss Cheese model. Concrete findings include a partial‑state persistence bug on failed bridge transactions and a recommendation to replace static with dynamic weight calculation for runtime costs.
AI-written summary · about
chapters (12)
- 0:00Oak Security introduction
- 1:48Audit clients and engagements
- 2:31Audit process and expertise
- 4:40Five lessons from audits
- 5:00Security beyond logic
- 6:43Audits may miss flaws
- 8:10Audits vs contests vs bounties
- 10:34Retainer challenges
- 13:00Common logical flaws
- 13:45Beyond audit services
- 14:27Snowbridge threat modeling
- 15:54Q&A and closing
related talks
21mOverview of the Last Year of Audits, Reviews, and Proofs
36mDeciphering Web3 Security: Implications and Innovations
27mSecurity: The Thing That Everyone...
22mOn the Shoulders of Giants: Security in FOSS
31mNeed of Web 3.0 Security
52mCollaborating to Improve Open Source Security: How the Ecosystem Is Stepping Up
37mSecuring Open Source Through Threat Modeling
24mBeing secure by design: Engineer-led security