DeFi Security Summit 2022
who it's for
smart contract auditors, protocol security engineers, DeFi protocol founders and operators, security researchers, blockchain governance engineers, bridge engineers, bug bounty program managers
topics
formal verification with Certora and K; fuzzing and static analysis tooling; Foundry test-driven development; TWAP oracle manipulation post-Merge; median TWAP and window sizing; cross-chain bridge security models; runtime threat detection and response; on-chain governance authorizer patterns; capture-recapture bug estimation; transaction debugging and contract indexing; audit contests and auditor workflows
| title | author | length |
|---|---|---|
| Welcome and Overview | Mooly Sagiv | 12m |
Overview lays out concrete goals: make the summit recurring, build a community of DeFi builders, auditors, bug bounty platforms and toolmakers, and push for… | ||
| MakerDAO Smart Contract Safety - When Billions are at Stake | Kurt Barry | 17m |
MakerDAO lays out a defense-in-depth stack: formal verification with K framework and ACT and newer Sartura workflows plus fuzzing, RPC simulation against… | ||
| Secure by Design | Jared Flatow | 19m |
Compound V3 launches and packages each market into a single contract to improve capital and gas efficiency, replacing V2’s hub-and-spoke. Design follows four… | ||
| The Butterfly Effect | Emilio Frangella | 21m |
Small coding oversights cascade into major losses: a single '>' vs '>=' bug in Compound’s liquidity‑mining accounting mints roughly $80M extra rewards, and an… | ||
| TWAP Oracles After the Merge | Mark Toda | 10m |
Proof: the Merge makes block producers predictable so a validator who knows they control two blocks in a row or can buy a preceding block via Flashbots can… | ||
| Discussion - Protocols, Session 1 | Kurt Barry, Jared Flatow, Emilio Frangella, BGD Labs Mark Toda, Zaki Manian | 26m |
Explains using create2 deterministic address to preauthorize a fix without publishing code, warns proof of stake only detects censorship of forks not… | ||
| Towards Verifiably Secure Governance | Nicolás Venturo | 17m |
A permissioned governance stack is built around an authorizer singleton that answers can-account-do-action by checking hashed action IDs (function selector +… | ||
| Searching Outside the Streetlight | Yuchen Lin | 15m |
TrustToken describes a hands‑on workflow: run audits, formal verification and bug bounties in parallel against one commit, inject bugs and hash them so… | ||
| Risk Management Approach to Security | storm0x | 22m |
Yearn runs B2 vaults with 153 vaults and ~325 strategies, launching up to six strategies per week at peaks and $6B TVL, so an operational risk scoring system… | ||
| Discussion - Protocols, Session 2 | Nicolás Venturo, Yuchen Lin, Emilio Frangella | 17m |
Teams describe inserting injected bugs into development to measure auditor and reviewer effectiveness, using a Fermi estimate to roughly count missed issues… | ||
| Billion Dollar Bugs | Neville Grech | 20m |
A scientific, repeatable pipeline combines a decompiler/indexer (contractlibrary.com), a fast transaction debugger and a declarative program analysis engine… | ||
| Not Quite Water Under the Bridge | Jan Gorzny | 18m |
Survey of cross-chain bridge failures shows concrete exploits and how they work: attackers use custodian vault admin takeover by replaying encoded calldata… | ||
| Clear as Mud | Gonçalo Sá | 10m |
Argues that compiler/EVM interactions produce real bugs and gives three concrete rules: don't obfuscate — auditors hit a huge caller graph when projects split… | ||
| Alpha for Auditors: The Vulnerabilities of Tomorrow | Anton Permenev | 22m |
Claims that auditors miss systemic risks: there are 35 ERC20 variants with different transfer semantics, integrations assume token behavior that changes (fees… | ||
| Static Analysis for Zero-Knowledge Programming Languages | Filipe Casal | 14m |
Static analyzers target Cairo and circum code, flagging concrete mistakes that compilers miss: Amarna (Cairo) already implements 14 detectors, a GitHub action… | ||
| Securely Scaling Decentralized Governance | Michael Lewellen | 23m |
Decentralized governance needs concrete controls: use long voting windows, time locks, delegated operational units, and emergency multisigs rather than vague… | ||
| Favorite DeFi Vulnerabilities | Mehdi Zerouali | 18m |
Shows concrete bugs: a single shifted bracket breaks retests because Brownie/Foundry unit tests fail; uninitialized proxy implementations let attackers… | ||
| Discussion - Auditors, Sessions 3 & 4 | Neville Grech, Jan Gorzny, Gonçalo Sá, Anton Permenev, Filipe Casal, Michael Lewellen, Mehdi Zerouali | 01h 02m |
Panelists describe security work as time‑boxed security assessments that read code, run static analysis (Slither, Mythril), run fuzzing and taint/symbolic… | ||
| Runtime Threat Detection and Automated Response | Jonathan Alexander | 06m |
A permissionless runtime monitoring network called forta runs decentralized scan nodes attached to EVM chains that collect blocks and feed them to independent… | ||
| Formal Verification with the Certora Prover | Michael George | 06m |
A formal verifier that translates contracts plus specs in CVL domain-specific language into logical formulas and uses multiple SMT solvers to produce either a… | ||
| Overview on Tools - Slither, Echidna, Manticore | Natalie Chin | 01m |
Trail of Bits describes three tools and how they run: Slither static analysis executes on Solidity source and prints findings immediately, Echidna… | ||
| Scribble in a Nutshell | Joran Honig | 05m |
Scribble is a specification language for Solidity that lets developers annotate contracts and functions with high-level properties written as comments and… | ||
| Formal Verification of Foundry Tests | Everett Hildenbrandt | 06m |
Foundry property tests get expanded into Foundry Decay generated K specs — a simple suite became ~23,000 lines and 55 proof obligations — compiled to core and… | ||
| The Big Red Button | Emiliano Bonassi | 19m |
Defines a “big red button” as a mix of on‑chain functions (Aave V3 per‑pool pause, Compound emergency admin, Yearn guardians and capped strategies), off‑chain… | ||
| Security Incentives | Mitchell Amador | 19m |
Describes a concrete model: launch large on‑chain bounties through a platform that paid roughly $4M to $50M+ in recent years, drives live disclosures, and… | ||
| How Do You Even Write Secure Code Anyways | Samczsun | 19m |
Shows why NASA’s Curiosity team spent about $3.2 billion and wrote 2.5 million lines of C to get reliability, then gives concrete rules that map to Solidity… | ||
| Discussion - White Hat Hacking, Session 7 | Emiliano Bonassi, Mitchell Amador, Curtis Spencer | 22m |
Argues that operational security—DNS, front ends, private keys—causes the biggest losses and requires continuous threat modeling from day one, monitoring of… | ||
| How to Understand a Smart Contract Hack | Daniel Von Fange | 10m |
Focuses on how to reverse-engineer a DeFi exploit by reading the execution trace to find the first weird state change, then mapping the attack contract, victim… | ||
| Price Manipulation Exploits | Christoph Michel | 20m |
Describes building a lending protocol on Uniswap V2, then exploiting it by using flash loans and two accounts to borrow all LP tokens, redeposit them as… | ||
| Smart Contract Governance | Tina Qian | 16m |
Explains how Beanstalk’s governance allowed a flash‑loan attacker to meet voting thresholds during a 24‑hour window and call emergency commit to drain the… | ||
| Discussion - Security, Session 8 | Daniel Von Fange, Tina Qian, Kurt Barry, Dan Robinson | 20m |
A governance flash loan once passed a proposal, so the system now uses a flash loan governance exploit countermeasure plus a 2‑day timelock and a… | ||
| TWAP Oracle Manipulation Risks | Mudit Gupta | 13m |
TWAP (time-weighted average price) oracles on AMMs like Uniswap V2/V3 are practically exploitable: price manipulation by buying/selling then reversing plus… | ||
| Probabilistic Liquidity Attacks in DeFi | Tarun Chitra | 18m |
Breaks down the XSUSHI/Cream pattern into concrete steps: flash loans fund two accounts, one does recursive borrowing of xSUSHI and the other withdraws… | ||
| From High-Level DeFi Properties to Concrete Security Bugs | Nurit Dor | 21m |
Certora verification language and unit-style properties map high-level DeFi rules to concrete checks and expose real bugs: a bitwise casting bug in Compound V3… | ||
| Discussion - Security 2, Session 9 | Mudit Gupta, Tarun Chitra, Nurit Dor, Mitchell Amador | 16m |
A live panel reports that a modeled Aave-style liquidation attack checks out as not practically viable after running MCMC-style simulations over on-chain… | ||
| The Unreasonable Effectiveness of Audit Contests | Jack Sanford | 24m |
Analyzes 154 audit contests run by Code Arena and finds audited code has zero in-scope hacks after months on mainnet, though 14 incidents are mostly… | ||
| Securing a Cross-Chain Bridge | Chris Whinfrey | 19m |
Claims that trustless bridges are far more secure backed by concrete numbers: about $2B stolen so far, single key compromises costing over $1B, Ronin losing… | ||
| Pre-Crime: The Future of Omnichain Security | Ryan Zarick | 13m |
LayerZero is an omnichain messaging layer that makes protocol upgrades optional via Library upgrades so apps opt into new code rather than having their… | ||
| Breaking Down Bridge Security Models | Layne Haber | 12m |
Ranks bridge designs by concrete attacks and defenses: natively verified wins economic security because an attacker must 51% the underlying chain, but is hard… | ||
| Breaking Bridges - An Incomplete Sampler of Bridges Hacks | Yoav Weiss | 21m |
Catalog of past bridge failures with concrete failure modes and attack steps: LiFi aggregator call data exploit lets a user-supplied target and calldata… | ||
| Discussion - Bridges, Session 11 | Chris Whinfrey, Ryan Zarick, Layne Haber, Yoav Weiss, Mudit Gupta | 17m |
pre-crime filter has run since May and flagged nothing while checking all messages; the Nomad exploit could have drained the whole pool in ~10 minutes but the… | ||
| V for Verification | Kostas Ferles | 07m |
A unified verification-as-a-service runs a language- and blockchain-agnostic pipeline that takes code plus optional V specification language assertions… | ||
| DeFirewall: Putting an End to “Blind Signing” | Jesse Tasman | 07m |
A live Chrome extension demo shows a wallet-approved transaction that looks identical in MetaMask but is actually a malicious payload injected on the front… | ||
| Tools For Supporting Manual Auditing At Scale | David Tarditi | 08m |
CertiK runs automated toolchains plus human review to scale auditing: 1,217 projects audited in six months with 4,938 medium-or-worse issues found. Pipeline… | ||
| What Should the Scope of the Web3 Audit Look Like? | Denis Ivanov | 04m |
Argues that “audit” is misleading and recommends renaming it to code review or risk assessment, documents specific conflicts: community expects 100% secure… | ||
| Privacy and Security | Sebastian Bürgel | 08m |
Demonstrates a practical method that reliably links validator pubkeys to IP addresses using a modified Lighthouse node, enabling ahead-of-time identification… | ||
| nothing matches | ||