Responsible Disclosure in Cryptocurrencies
summary
A one‑page pre-commitment vulnerability‑sharing agreement standard is proposed for cryptocurrency ecosystems so multi‑project, consensus‑critical bugs get fixed faster and more uniformly. It records contact details, expected deviations (for shielded‑transaction risk cases), and who to tell, and it enabled coordinated fixes for the Sapling and Bitcoin inflation incidents across Horizon and Komodo. The proposal maps a disclosure surface, avoids mandatory bounties, and argues the usual 90‑day norm is too long compared to rapid consensus needs; see the one‑page standard on GitHub.
AI-written summary · about
chapters (6)
- 0:00Start
- 2:12Common standards for responsible disclosure
- 2:42Multiparty disclosures & standards
- 3:26Critical issues present big disclosure problems...
- 5:04Tale of two bugs: CVE-2018-17144 and CVE-2019-7167
- 14:04Summary
related talks
18mWhat You Need to Know and Do about Vulnerability Disclosure
58mPanel Discussion - The Risks of Requiring Premature Vulnerability Disclosures
01h 08mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
44mA Researcher Centric Approach to Coordinated Vulnerability Disclosure
44mPreparing for Zero-Day: Vulnerability Disclosure in Open Source Software
24mTowards a Vulnerability Reporting Specification
48mHow to report a vulnerability: Responsible Disclosure for Developers
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...