publications
compound-protocol
Our great sponsors
publications | compound-protocol | |
---|---|---|
51 | 16 | |
1,313 | 1,823 | |
2.2% | 0.5% | |
8.7 | 0.0 | |
8 days ago | 5 months ago | |
Python | TypeScript | |
Creative Commons Attribution Share Alike 4.0 | BSD 3-clause "New" or "Revised" License |
Stars - the number of stars that a project has on GitHub. Growth - month over month growth in stars.
Activity is a relative number indicating how actively a project is being developed. Recent commits have higher weight than older ones.
For example, an activity of 9.0 indicates that a project is amongst the top 10% of the most actively developed projects that we are tracking.
publications
-
Skiff: Various Privacy Failures
Disagree, their reputation is tied to their audit quality.
But I'm pretty sure in this case the scope was bad. Like they coukd have had audits on "Do I use OpenSSL well?" and then misrepresent that all their privacy claims were audited.
Now it seems like Skiff conveniently didn't allow Trail of Bits to publish their reports, they are usually here: https://github.com/trailofbits/publications/tree/master/revi...
Disclaimer, I have used Trail of Bits service in the past (and 2 other auditors for an security campaign on a blockchain, cryptography + networking product).
- The Lisk v4.0 security audit 🔐
-
PyPI has completed its first security audit
Link to the report: https://github.com/trailofbits/publications/blob/master/revi...
They seem to not have analysed client-side of PIP itself, but I suppose there isn't anything you could say that isn't already obvious to everyone.
- SimpleX Chat security assessment by Trail of Bits [pdf]
-
Thoughts on Skiff? What do you like? What would you want to see improve?
Audits are mentioned on the Trail of Bits website https://github.com/trailofbits/publications and the Skiff one https://skiff.com/transparency. Skiff has been externally audited 4 times.
-
SimpleX Chat: private and secure messenger without any user IDs (not even random)
Here's the URL https://github.com/trailofbits/publications/blob/master/reviews/SimpleXChat.pdf It was in the article I have already linked.
-
Solidity digest fortnightly / 17-30 apr 2023
MYSO Finance Security Assesment by Trail of Bits
-
Audit Firms Ranking
Trail of Bits
-
Transparency at Skiff
Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - one of the best security auditing firms in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper We've also been in the news quite a bit: https://www.theverge.com/2022/5/17/23075804/skiff-mail-email-privacy, https://www.wsj.com/articles/encryption-bans-what-is-this-russia-hacking-online-privacy-security-data-signal-whatsapp-emails-protection-11675436242 (I wrote this with our team!), https://techcrunch.com/2023/01/30/russia-skiff-block/, and more, even though we're only a year old. We collect no personally identifying information - not even IP addresses used - no backup emails, phones, etc. - no advertising, and we end-to-end encrypt BOTH email subject + body and don't have any metadata (time sent/received an exception). What can we do to share more of this with more people? We're a younger company but it's so important this is made public.
-
Skiff Apps
Hi! I'm Skiff's CEO. We've had 3 security audits, including 2 from Trail of Bits - likely the best security auditing firm in the world https://github.com/trailofbits/publications. Skiff Mail is also open-source: https://github.com/skiff-org/skiff-mail as is our whitepaper https://skiff.com/whitepaper
compound-protocol
- List of smart contracts to strengthen your Auditing skills
-
Deployment of the Compound Contract Bravo
https://github.com/compound-finance/compound-protocol/tree/master/contracts/Governance .
-
How to set max votes on DAO delegation?
I'm making an NFT crowdfunding protocol as a summer project and am using Compound Governance contract along with ERC20Votes to do so.
- 333
-
What protocols are doing with our money ?
I highly recommend you do two things, first, try and get a feel for the behavior of smart contracts, there are tools that can help with this, like the ones at blockchain.ey.com - you can get a free personal use account and has a pretty convenient smart contract and token explorer tool for Solidity, you just drop in the code from the protocol’s GitHub (like recommended above) and bam. Here’s Compound’s timelock contract as an example: https://github.com/compound-finance/compound-protocol/blob/master/contracts/Timelock.sol
- Testing governance functions?
-
Tranquil Finance FAQ's!
The Tranquil protocol smart contracts are forked from the Compound protocol with minimal changes. It is a deeply battle-tested and audited protocol with formal verification of its contracts.We plan to get audits for the Tranquil protocol as soon as possible.
- Where can I see solidity code of a audited DAO smart contract? If possible where the code is explained to some degree.
-
Cryptocurrency Loan Platform Implodes in $130M Hack
Yep however I don't think I'd consider it to quite the same extreme. No doubt it was bad however proportionally to the size of the platform Cream's exploit was far more damaging. Like the rekt.news post mentions, it was more of a banking/spec error than an outright vulnerability. Your spec can't protect you if the loss is due to intended behaviour. There are ways to mitigate this however. The main way is by making your spec concise and clearly representable as a series of state transitions & operations or as a series of transformations.
The Compound Finance paper spec essentially just lists "this subsystem does these things" and then each function/operation is a list of preconditions, what actions are taken in what conditions, and the expected result. This isn't bad per se but it's not great either. Instead the paper spec really should be showing what transformation is being applied to the state, why we want that transformation applied, what properties must hold throughout the transformation, and then demonstrating that those properties hold.
Compare this (Compound):
https://github.com/compound-finance/compound-protocol/blob/m...
-
Forta is thrilled to announce that we’ve partnered with Compound Grants to bring you our first Agent Development contest!
Provide alert for 10% or more change in Utilization Rate within a 60 minute window in a given pool.
What are some alternatives?
slither - Static Analyzer for Solidity and Vyper
cosmos - Internet of Blockchains ⚛
manticore - Symbolic execution tool
verified-smart-contracts - Smart contracts which are formally verified
echidna - Ethereum smart contract fuzzer
security - Some of my security stuff and vulnerabilities. Nothing advanced. More to come.
verified-smart-contra
codeql - CodeQL: the libraries and queries that power security researchers around the world, as well as code scanning in GitHub Advanced Security
security - Materials related to security: docs, checklists, processes, etc...
art-gobblers - An experimental decentralized art factory by Justin Roiland and Paradigm.