PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Maturing your smart contracts beyond private key risk

blog.trailofbits.com | blog | #web3 | #smart-contracts | #access-control | #blockchain | #multisig | #key-management | #private-keys | #timelock | #private-key | #security-architecture
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Private key compromise drove 43.8% of 2024 crypto hack losses. This post offers a four-level access-control maturity model, from single EOA control to multisigs, timelocks, and radical immutability.
Published
Collected

Related coverage

blog · blog.trailofbits.com
State divergence enables unauthorized access
This coverage gives security teams current context for monitoring, validation, and remediation.
blog · blog.trailofbits.com
Safer cold storage on Ethereum
Exchanges can use Ethereum smart contract programmability to build cold storage that stays secure even when multisig keys are compromised, via role-separated signing, timelocks, and rate limiting.
blog · hackenproof.com
Aptos Move Smart Contract Security: How Object Refs Leak and Global Storage Breaks
Unchecked borrow_global_mut, leaked object refs, and Block-STM races break Aptos protocols. See the $25.5M Thala exploit and an Aptos/Supra audit checklist.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a CTF Security Challenge for the Blockchain Industry
HackenProof and Hack The Box turn blockchain security into a gamified CTF track with weekly challenges and a ten-quest series, giving top performers a path into the bug bounty ecosystem.
blog · hackenproof.com
HackenProof, in Partnership with Hack The Box—the Four Million Platform—Has Launched a Course for the Blockchain Industry
HackenProof has launched a blockchain-industry course with Hack The Box, the four-million-member ethical hacking platform, aimed at building practical blockchain security skills.
blog · hackenproof.com
How to hack everiToken?
An introduction to everiToken, a token-based public chain that replaces smart contracts with 'safe contracts' and BFT-DPOS consensus, plus node setup, API testing, and a node vulnerability.
Back