DeFi Security Summit 2024
who it's for
protocol security engineers, smart contract developers, auditors, security researchers, bug bounty hunters, incident responders, dao governance teams
topics
bridge implementation vulnerabilities; attacker tracing and OSINT; single-purpose protocol design; liquidation mechanism design; governance proposal security lifecycle; transaction frontrunning techniques; audit contest mechanics and incentives; zk-oracle integration; pull-oracle security considerations; Uniswap V4 hooks security; sequencer-level L2 protections; white-hat rescue operations and safe harbor
| title | author | length |
|---|---|---|
| Common Vulnerabilities in Bridges | Kirk Baird | 11m |
Most audited bridges fail on concrete implementation errors: a replay attack via 256→32 casting allowed reconstructing valid proofs and earned a roughly… | ||
| How to Find Attackers and Improve Your Security Posture | Heidi Wilder | 09m |
Shows the WiirX hack of about $240 million from a malicious contract upgrade, links the deployer to Tornado Cash Classic and matches deposits using Dune… | ||
| Risk isolation - Building Single Purpose Protocols | Merlin Egalite | 11m |
Claims that large DeFi losses (about $6.5 billion exploited) come from complex, upgradeable stacks and that safer systems arise from immutability and… | ||
| A deep dive into DeFi liquidations | Viktor Yurov | 11m |
Claims concrete fixes: gas-optimized multi-position liquidation batches many liquidations into one transaction to cut fees, partial early liquidations sell… | ||
| Security Lifecyle for DAO Proposals | Michael Lewellen | 11m |
Describes a four‑stage proposal lifecycle: creation, validation, approval and execution, and shows concrete fixes used on Compound and Arbitrum. CToken price… | ||
| 500 days of Security Summer | Sara Reynolds | 24m |
Title nods to a long effort but describes six months of intense security work on Uniswap v4, nine audits plus a ~$2.2M audit competition, and a switch to… | ||
| A cat-and-mouse game: how to frontrun a transaction in the future | Qi Su | 20m |
Claims that front-run bots repeatedly rescued funds in 2023 (Curve, BlockSec, KyberSwap returned about $5.7M) and that such rescues decline in 2024 as… | ||
| Battle of the Languages | Hari Mulackal, Wolfgang Grieskamp, Dave Grantham, Mehdi Zerouali | 41m |
Panel argues concrete tradeoffs: Move V2 ships a new compiler and aims for fully verifiable bytecode while teams run comparison testing against historical… | ||
| The Current State of Audit Contests | Jack Sanford | 21m |
Audit contests report concrete growth and changing economics: there are 625 audit contests historically with ~$36M paid to participants and 221 contests in… | ||
| The challenges of building, scaling and securing DeFi protocols | Sara Reynolds, Ernesto Boado, Erik Arfvidson, Merlin Egalite, Hari Mulackal | 39m |
Panel documents concrete practices and failures: Aave discovers an LLVM compiler bug during a zkSync deployment that breaks collateral math; Uniswap ships V4… | ||
| Professionals hack people, not systems | Pablo Sabbatella | 30m |
Claims that ~80% of crypto losses come from ops failures, not smart contracts, and shows concrete attacks: PDF zero-days and malware delivered via fake Slack… | ||
| The State of DeFi Security - 2024 | Peter Kacherginsky | 27m |
Year-over-year shifts show $450M from private key theft dominating losses while malicious insiders steal $95M across 17 incidents and price-oracle and… | ||
| Enhancing Protocol Security With ZK-Oracles | Victor Petrenko, Eugene Kolpakov | 24m |
Lido adds a pluggable ZK oracle that produces a zero‑knowledge proof of consensus‑layer data and anchors it to the execution layer via EIP‑4788 beacon block… | ||
| Security Considerations when using Pull Oracles | 0xmonsoon | 23m |
Pull oracles require the user to supply price payloads (examples: Pyth, Chainlink Data Streams, Redstone) and come in atomic execution, deferred execution and… | ||
| Enhancing Test Coverage: A Framework for Effective Protocol Security | Dmitry Zakharov | 19m |
An experimental framework groups concrete test work into three mindsets: hacker mindset, formal verification, and system architect. It claims 100% coverage… | ||
| The White Hat Safe Harbor: A deep dive in protecting white hat rescue ops | Kurt Opsahl, Alice Charm, Kurt Barry | 39m |
A legal framework that pre-authorizes emergency fund recoveries during an active exploit, backed by an on-chain registry (smart‑contract factory) that records… | ||
| What your auditor REALLY thinks but is afraid to tell you... | Mehdi Zerouali, Michael Lewellen | 44m |
Auditors report that projects still launch immediately after receiving a stamp of approval, despite time‑boxed reviews and finite budgets; one firm maintains… | ||
| Story time! A Year of SEAL War Games | Kelsie Nabben, Isaac Patka | 20m |
SEAL runs yearlong live drills that fork production chains (using Anvil/Tenderly), recreate block explorers and monitoring, and inject exploit and user bots so… | ||
| Introduction to SEAL | Samczsun | 11m |
A nonprofit called SEAL coordinates rapid-response war rooms, launches a bot within days, and assembles trusted nodes to avoid the chaos of the Curve Vyper… | ||
| The Bug Hunter’s Guide to High-Quality Reporting | Arbaz Hussain | 13m |
Five practical rules used by Immunefi triagers: concise titles that summarize attack vector — source — impact (example: unprotected delegatecall in proxy… | ||
| Security considerations when building Hooks in Uniswap V4 | Jota Carpanelli | 15m |
Uniswap v4 uses a single pool manager and transient storage so hooks can run across many pools in one transaction (enabling flash-loans across all pools)… | ||
| Enhancing L2 Security with Sequencer-Level Protection | Phillip Kemper | 07m |
Zircuit implemented sequencer-level protection that risk-assesses transactions via an AI-based oracle placed between Geth’s tx pool queues, marking suspicious… | ||
| Why DeFi Security Matters | Mooly Sagiv | 11m |
Conference founded four years ago to close concrete DeFi security gaps, running an annual marketing-free summit that now includes technical workshops, a career… | ||
| nothing matches | ||