White Hat Panel: DeFi Exploits
summary
Panel lays out concrete tactics and hard numbers: security researchers read code on GitHub and Remix, a study finds ~50 bugs that static tooling misses, and teams use forked mainnet testing to recreate integration failures. Practical defenses include bounty design for Optimism, the DamnVulnerableDeFi.xyz training site, and operational war rooms that coordinate fixes. Flashbots/TaiChi-style MEV tooling and quick upgrade or pause actions enable real rescues (teams recover multi‑million dollar losses in live incidents).
AI-written summary · about
chapters (14)
- 0:00Intros // "Have you been rekt"
- 4:50Difference between hacks and arbitrage
- 10:20How do you approach looking for smart contract vulnerabilities?
- 22:40What is the war-room like before or during exploits?
- 32:08Escaping the Dark Forest
- 36:00Designing a bounty program for Optimism
- 42:00DamnVulnerableDeFi.xyz // tagging auditing firms on twitter
- 48:50Training the next generation // Yearn Academy
- 51:15Designing around Flash Loans & Flash Minting
- 1:01:50Do you read the source code for every contract?
- 1:11:30Worst case scenario hack
- 1:20:50Audience Question: Should fork mainnet testing be used more?
- 1:23:20Audience Question: What is the future of smart contract security?
- 1:28:25Closing thoughts from the panel
related talks
18mFavorite DeFi Vulnerabilities
51mA Deal with the Devil: Breaking Smart Contracts
39mThe challenges of building, scaling and securing DeFi protocols
10mHow to Understand a Smart Contract Hack
36mDeciphering Web3 Security: Implications and Innovations
22mDiscussion - White Hat Hacking, Session 7
25mCommSec D2 - Smart Contract (In)Security
23mThanks for all the bugs!