Security Engineering: Zcash Ecosystem Security and Learning From Safety-Critical Disciplines
summary
Year‑long grant work audits Zcash ecosystem wallets, deployments, ZIPs and hardware integrations and reports concrete results: 83 bugs found, of which 41 are medium-or-worse including 2 critical, 21 high and 19 funds‑at‑risk; most issues come from manual source inspection with occasional tests or a fuzzer and many projects patch within days. Recommendations include funded bug‑fix engineers, audit RFPs with grants, and operational practices borrowed from aviation — blameless investigations, checklists, timeouts — plus a prevent/detect/respond model.
AI-written summary · about
chapters (36)
- 0:00Start
- 4:49Bugs Discovered, by Type
- 6:43Conclusions So Far
- 10:33Learning from Failure
- 11:31"Human Error"
- 12:42Swiss Cheese Model
- 14:05Blameless Investigation
- 15:09Safety vs. Security
- 17:01Security Engineering
- 19:37Blameful Environment
- 20:45Authority Gradients.
- 22:11Get-there-itis
- 23:29Habituation / Normalization of Deviance
- 24:07Task Saturation
- 24:49Alarm Fatigue
- 25:10Condition-Based Maintenance
- 26:16Value Blamelessness and Fallibility
- 29:31Positive Transfer of Control
- 30:55Checklists: Beware of Rhyming
- 31:25Pointing and Calling
- 31:57Culture: Summary
- 33:52Prevent: Full Stack Security
- 35:32Detect
- 36:16Respond
- 37:26The Retrospective
- 38:13Retro: Root Cause Seduction
- 39:08Retro: The Final Report
- 39:47You Have Bugs
- 40:57Adversarial Mindset
- 42:30Security Audit: Process
- 43:05Internal vs. External Audits
- 44:17MITM thru memo-based contact list
- 45:51Autoshielding Deanonymization
- 46:47Paying for orders by paying yourself
- 48:00Hardware wallet state machine bug
- 50:23Tenets of Safety Engineering Security
related talks
46mInsights from Zephyr Security Audit and Vulnerability Experiences
46mInsights from Zephyr Security Audit and Vulnerability Experiences
40mThe Zephyr Project Security Overview, Progress, and Status
29mLessons Learned on Following Security Best Practices in Zephyr
21mOverview of the Last Year of Audits, Reviews, and Proofs
40mZephyr Project Security Status
36mDeciphering Web3 Security: Implications and Innovations
21mLessons from Zcash