Why Smart Contract Audit is Not Enough
summary
Audits catch code flaws but miss HR, infra and supply chain risks and upgradeable contracts that change after review. Recommends CCSS for key handling, cites private key compromise and 0.05% fund recovery rate after hacks. Describes funding a dual defense post-audit bug bounty by putting 10% of revenue into a limited pool (minimum ~$100k), ran 15–20 times with hackers winning three times. Proposes a security prediction market and an Extractor on-chain monitoring that auto-blocks malicious interactions to prevent Friday evening drains.
AI-written summary · about
chapters (8)
- 0:00Introduction
- 1:10Smart contract audits shortcomings
- 4:44Security partner coverage
- 7:37Infrastructure and team risks
- 9:46Bug bounties necessity
- 12:17Post-audit bug bounty defense
- 13:42Security prediction markets
- 14:23Onchain monitoring tools
related talks
30mSmart-Contract Security 201: Auditing Lessons for Solana Founders
31mNeed of Web 3.0 Security
58mEnd-to-End Smart Contract Audit
12mSmart Contract Security
36mDeciphering Web3 Security: Implications and Innovations
24mThe Unreasonable Effectiveness of Audit Contests
18mFireside Chat with Dyma Budorin
51mA Deal with the Devil: Breaking Smart Contracts