Maybe just to complement the above: DFINITY has initiated several further external audits covering other parts of the protocol (core protocol, consensus, threshold ECDSA, canister sandbox, Bitcoin integration), there is a commented repository of all external audits. Such an audit is also currently performed for the vetKeys feature, the report will be published when the audit is complete. DFINITY also runs a bug bounty program in order to incentivize security researchers to disclose potential vulnerabilities responsibly.
What is the ballpark for a security for a medium size project, lets say between 2000 to 10,000 lines of code of Rust, and JavaScript - TypeScript.
At the end of the day cost is a deciding factor.
I think every developer would gladly do a security audit if we could afford it, very few teams can.
Having read your ckBTC code, and even the TLA+ part I must say I am impressed, and glad for the level of thoroughness DFINITY did.
From a small developer firm with one to three people, operating on a very low budget, we can not do this, but can verify the code to the best of our ability and engage in a Beta period, which I think is the best compromise possible. Funds for security audits will always be welcome though!
I know Bob personally. For years. He is not dishonest, he is not edgy, he is not small minded. I know him to be extremely hardworking, team oriented, transparent, and gutsy and smart.
Someone like that….doesn’t just flip a switch one day and think “Oh I’d like to compromise my integrity for a measly 7 million when my talent over the next 20 years is going to take me a light year farther than that.”
That would not be helpful to them, or to the community. I suggest we we put some faith and energy into people who are working, giving transparency, and building the ecosystem. So he built lean and got hacked. He’s a good entrepreneur operating on a thin budget. Success would put a target on anyone’s back. Should it have happened? No. Should better security be in place? Of course. Could it happen to anyone? So far…that seems like no one who experiences any amount of reasonable success has been immune to it. I definitely favor sticking to the more solid ICP protocols. It’s one of the main selling points of ICP.
I also happen to know Bob personally. I have for years. He is not an inside job guy at all. In fact he’s the type of guy who is transparent, accountable, hard working, and operating on thin budget makes a lot of sense. Besides…I can personally attest, he doesn’t need the money haha. Not that he’s super rich or anything but he’s got a good life, good brain, and good people around him. all that plus his future is WAY more valuable than a 7 million rug…I trust him fully. In fact I trust him more now by how he is handling this. No hiding. Just full out work to find a solution. That’s the Bob I know
I makes sense to have distrust. It really does. So much of crypto, and the space is unvetted, unfilted, and filled with people we can’t see and don’t know. So I don’t blame anyone for feeling cynical.
Because I know Bob personally, and because if this happened to me, I would hope the people who knew me would say something. I trust Bob fully. I’ve known him for years. He’s got too much going for him to be a scammer. Human and fallible. Of course. But a liar and cheat.. not so. And I’m going to do what I can do help him and his team get back on his feet.
Waiting for the next what we have learned from the….
Could make a netflix series out of this especially if you include all the pre-odin ‘hacks’ wouldn’t be that interesting though as the central plot line is very predictable.
Other people’s trust in your reliability and ethical integrity are usually earned slowly over time but can be lost far more quickly. If you feel the need to vouch for Bob personally in four different posts on a stale thread about an earlier unfortunate exploit then I guess you are reading the room correctly.
I am confused.
March there was a large sum of BtC that appeared to go missing but wasn’t. Some update issue. Then in April there was a hack. August a large hack.
There was mention about security audits from highly skilled auditors being too expensive, but then the money for this audit appeared after the August hack?
How were they able to keep running on ICP without a security audit post-1st hack?
Are ICP tokens actually safe? It seems like a gamble now to invest in ecosystem projects other than the largest who have proven themselves. For non devs like me just discovering all this, it is not comforting. I will just say that.
ICP was not the issue, the security there is solid.
Read the thread carefully.
The issue was outside of ICP, in a JavaScript library that was not properly checked, and was used because Odin Fun hides ICP from the user to make it appear as if Bitcoin is doing all things. If it used native ICP calls, and ckBTC explicitly, this hack wouldn’t have happened.
And yes, security reviews continue to be quite expensive and few can afford them.
we understand this.
The problem is, to the end user PUBLIC, it makes absolutely no difference. To the public, it’s just another crypto thing that got hacked. and if the project is associated with ICP, that’s the way the public sees it.
“Tamper proof” is an ICP narrative. Which may be true at the protocol level. But if end users lose funds to application level hacks, it makes no difference to them. And completely undermines this narrative.
Here is the full explanation, read it carefully.
P.S. If you work by the book without tricks as Odin Fun did, no error or hack would happen because DFINITY has done a good job securing their main toolbox.