Discussion - Protocols, Session 2
summary
Teams describe inserting injected bugs into development to measure auditor and reviewer effectiveness, using a Fermi estimate to roughly count missed issues while acknowledging bias toward single-line, easy fixes and difficulty counting duplicate or high-impact bugs that require full refactors. Governance actions use on-chain action IDs with a 5-day minimum delay and immutable scheduling. Practical tools include Slack/Telegram auditor channels, preliminary vs final reporting, and checklist scoring for test coverage and deployment readiness.
AI-written summary · about
chapters (11)
- 0:00Bug injection and auditing
- 1:25Security bug estimation models
- 2:50Validating injected bugs
- 4:15Vulnerability severity assessment
- 6:02Retaining injected bugs
- 7:23Bug injection bias and limits
- 9:07Governance and security analysis
- 10:52Transaction delays and safeguards
- 13:24Risk assessment guidelines
- 15:50Aviation security lessons
- 16:53Auditor rotation and bug bounties
related talks
27mSecurity: The Thing That Everyone...
01h 07mPanel Discussion: What is Lacking in Linux Security and What Are or Should We be Doing about This
01h 00mWorkshop
15m"You've Got Your Nice List of Bugs, Now What?" Vulnerability Discovery and Management
01h 33mWhite Hat Panel: DeFi Exploits
25mDiscussion
29mEvent-based Fuzzing, Patch-based Research, and Comment Police: Finding Bugs Through a Bug
48mGamify your Security