Responsible Disclosure for Cryptocurrency Security

Stewart Baker discusses why the industry-norm responsible disclosure for software vulnerabilities fails for cryptocurrency software.

Why can’t the cryptocurrency industry solve the problem the way the software and hardware industries do, by patching and updating security as flaws are found? Two reasons: First, many customers don’t have an ongoing relationship with the hardware and software providers that protect their funds—nor do they have an incentive to update security on a regular basis. Turning to a new security provider or using updated software creates risks; leaving everything the way it was feels safer. So users won’t be rushing to pay for and install new security patches.

Second, cryptocurrency is famously and deliberately decentralized, anonymized, and low friction. That means that the company responsible for hardware or software security may have no way to identify who used its product, or to get the patch to those users. It also means that many wallets with security flaws will be publicly accessible, protected only by an elaborate password. Once word of the flaw leaks, the password can be reverse engineered by anyone, and the legitimate owners are likely to find themselves in a race to move their assets before the thieves do. Even in the software industry, hackers routinely reverse engineer Microsoft’s patches to find the security flaws they fix and then try to exploit them before the patches have been fully installed.

He doesn’t have any good ideas to fix this. I don’t either. Just add it to the pile of blockchain’s many problems.

Tags: blockchain, cryptocurrency, disclosure, patching, vulnerabilities

Posted on September 9, 2022 at 8:33 AM • 28 Comments

Comments

Eric Michaud • September 9, 2022 9:09 AM

We’ve been discussing this exact problem with Stewart who is an advisor to my company Unciphered. https://www.unciphered.com/about-the-team

There have been developments in our Vulnerability Research where we now are trying to figure out how to Responsibly Disclose these exact problems that could cause an event just like the Solana hack for others: https://financialpost.com/fp-finance/cryptocurrency/hackers-steal-millions-from-solana-wallets-in-latest-hit-to-crypto

If it leaks early you would see more wallet thefts.

Hopefully we as an industry can find a path forward. Happy to chat with anyone who wants to help move this ball closer to end zone and resolve this gap.

Anyone who wants to contact directly eric@ will work.

tim • September 9, 2022 9:12 AM

cryptocurrency is famously and deliberately decentralized, anonymized, and low friction

Is this a joke? Cryptocurrency is not decentralized, anonymized, or remotely “low” friction. Just attempt to buy -anything- with cryptocurrency will demonstrate this Stewart remains as out of touch as always and surprised he is quoted here.

Clive Robinson • September 9, 2022 9:15 AM

@ Bruce, ALL,

“Just add it to the pile of blockchain’s many problems.”

Sadly it’s not just “blockchain” that has this problem.

Consider “data at rest” that has been encrypted for instance,

I have files around from the 1980’s that are enxrypted with DES in a susceptable mode. I think most would agree that they are nolonger realy secure.

I have two choices,

1, Leave as is.
2, Decrypt and re-encrypt.

But two issues arise,

3, Copies of original file.
4, My systems being watched.

If I decide to go for option 2 I’m making a terrible choice.

Because I will have to reveal to a system,

A, The old key.
B, The file plaintext.

If the system or me are being “watched” in some way then there is a high probability the old key will become known.

But there is also the problem that an attacker does not have to be “in my system” to obtain either the old key or the new key. Because if the attacker can get close there will almost certainly be “side channels” that can be utilized.

Remember with the cost of direct crypto attacks halving every nine to ten months and indirect via OS etc to the user side I/O of the security end point being found more than once a day, you are effectively,

“Caught between the Devil and the deep blue sea”

Or if you prefer,

“The frying pan and the fire”

My choice is stick with option 1, because there is no certainty there is not a copy of the file spirited away on some server somewhere just waiting for a mistake to be made, or for it to get to the head of the que to be cracked. Of the two, waiting for it to get to the head of somebodies que is probably safer in the longer term.

Zaphod • September 9, 2022 10:25 AM

@Clive

Perhaps best to just destroy the drive.

Mr C • September 9, 2022 10:49 AM

In addition to the “how can we get everyone patched before the patch is reverse engineered and weaponized” problem, there’s also the problem that the cryptocurrency space is full of untrustworthy insiders.

Returning to the first problem, I think it’s likely insoluble. So long as the potential score is big enough, attackers will find a way to move faster than defenders. Or at least faster than some defenders, which is all they need. The only way out that I see would be for cryptocurrency prices to collapse so low that a pile of it isn’t enough to adequately motivate thieves.

a • September 9, 2022 11:16 AM

If you can make a blockchain secure, you can make a wallet secure. Keep it simple stupid.

JonKnowsNothing • September 9, 2022 11:24 AM

@ Zaphod, @Clive

re: Perhaps best to just destroy the drive.

That’s not a trivial activity. An instructive video of what’s required:

Search Terms

GCHQ
The Guardian News Paper
Destruction of File Servers
Grinders and Hammers
Snowden Documents

And then there are the drives you do not have physical possession of: back up facilities, data center catastrophic recovery systems, remote parallel deployed servers.

Perhaps tossing these devices under a steam roller until “ils sont bien goudroner”. I’m not sure that would still work, but the tar would surely gum up some of the works.

Clive Robinson • September 9, 2022 12:35 PM

@ a, ALL,

Re : Make it secure

“If you can make a blockchain secure”

You can not indefinately.

The security of the blockchain is based on the imponderable of “Duplicated Publicly”.

But the reality is that as the blockchain grows the “duplicated” requirment will eventually fail at which point it effectively ceases to be “public” under the security criteria as it has become under “unitary” “centralized” control.

The thing about the blockchain it’s requirment is to stop the “Double Spend” problem, and in the process if compleate and duplicated it destroys anonymity of transactions.

If not compleate then as coins drop off the bottom of the chain as it gets tail truncated you get all sorts of issues, not all of which I suspect have been worked out…

Clive Robinson • September 9, 2022 12:56 PM

@ JonKnowsNothing, Zaphor, ALL

Re : Steam rollered

Should that not be,

“Ils sont ecrases et goudronnes”

Something Terry Pratchett put in his will should be done to the hard drives of his computer setup.

SpaceLifeForm • September 9, 2022 11:00 PM

@ Clive, Ted, ALL

Just a web server problem, won’t fix until market conditions improve

Note the screen shots and what devices the users are posting from.

‘https://nitter.net/Bitfinexed/status/1568289652573962241#m

Ted • September 9, 2022 11:02 PM

I tried to catch a few minutes of a Senate hearing on digital assets. I don’t know how this space has a chance at security without regulations. Even then it’d be a pretty remarkable challenge.

Here’s a small excerpt copied from C-SPAN.

Sen. Kirsten Gillibrand:

“I APPRECIATE YOUR ANSWERS, BUT YOU’RE NOT ANSWERING THE FUNDAMENTAL QUESTION OF WHETHER YOU HAVE THE AUTHORITY TO DEAL WITH CYBER ATTACKS IN THIS SECTOR GIVEN THE DIFFERENCES BETWEEN YOUR CURRENT REGULATORY FRAMEWORK.

IT IS A SPECIFIC QUESTION. YOU HAVE THE ABILITY AND THE COMPETENCY TO MANAGE THE MARKETS AND PREVENT CYBER ATTACKS?

IF YOUR ANSWER IS THAT YOU DO NOT KNOW, IT IS FINE. I JUST WANT TO KNOW IF YOU HAVE THE TECHNICAL EXPERTISE TO GUARD THE CYBER MARKETS. I SIT ON THE INTELLIGENCE AND ARMS COMMITTEE. PREVENTING CYBER ATTACKS IS DIFFICULT FOR EVERY INDUSTRY.

I AM PUSHING DOWN ON DO YOU HAVE THE TECHNICAL CAPABILITY TO DO THIS IF WE GAVE YOU THE AUTHORITY?”

Commodities Futures Trading Commission (CFTC) Chair Rostin Behnam: The answer is no. We don’t have it.

https://www.c-span.org/video/?517737-1/senate-hearing-regulating-cryptocurrency-markets

SpaceLifeForm • September 10, 2022 12:24 AM

@ Ted, Clive, ALL

CFTC may not have the tech chops, but FINCEN and DOJ do.

The CryptoCurrency Money Laundering problem is big.

It all gets down to NYC and AML rules.

If people don’t follow the rules, then one can get in trouble, even by mistake. Though in this case, the NYC rule was not closely followed.

Note that when DOJ tells you to please consult with an attorney, you probably should. Instead of 5 years, he will probably get out in about 8 months of a 6-15 month sentence.

‘https://nitter.net/rizzn/status/1566555742110351363

‘https://www.justice.gov/usao-ndtx/pr/doctor-bitcoin-pleads-guilty-illegal-cash-crypto-scheme

Clive Robinson • September 10, 2022 3:47 AM

@ SpaceLifeForm, Ted, ALL,

Re : Is CoinBase doomed?

Just a web server problem, won’t fix until market conditions improve

Hmm let me think…

The little guys took a real bath not so long ago when the 60,000 BTC tumble happened. You may remember that somehow the “big fish” whales swam out but the little guys were left as whitebait and got done to a crisp.

Now there has been a 10% uptick the little guys left are heading out of the pond fast, trying to get ahead, which of course will bring the price down if not create a run or stampede.

The big fish don’t want that as it will not just muck up their “long con” it will muck up the side ventures that support the con.

But what of CoinBase? As some have observed they have liquidity issues but without the backup (all banks / exchanges by default have insufficient liquidity, which is why there are in normal banking Sovereign Reserve Banks they can call on to backstop them).

But also the “End of Quater” is oh 20days away, and CoinBase needs good figures to keep their investors happy. Also to stave off calls for regulators to start a “deep dive”.

So… does this make the third or forth fortuatous “software clitch” CoinBase has had?

Time to put on the frier I’m thinking it’s time for not just another whitebait cookup, but a kipper or two, but unfortunately not whale meat stakes…

SpaceLifeForm • September 10, 2022 5:37 PM

@ Ted, Clive, ALL

I actually watched the 2 hour 23 minute CFTC hearing completely.

There was not really anything surprising to me, except the comment about Estonia and Crypto Valley. IIRC, around the 1 hour 50 minute mark.

Overall, the consensus is that there needs to be market clarity, clear rules, and a well defined regulatory framework.

I totally agree with this. Otherwise the Money Laundering and Market Manipulation will continue.

I am still trying to figure out why there is an ATM I am familiar with that says it does Bitcoin.

In the meantime, Cash is King. In spite of the excessive ATM Transaction Fee.

Ted • September 10, 2022 9:42 PM

@SpaceLifeForm, Clive, All

Re: CFTC hearing

That’s awesome that you watched the hearing! There’s always interesting tidbits.

The remarks about Switzerland’s Crypto Valley and Estonia’s e-Infrastructure (around the 2 hour 3 minute mark?) came across as a little detail-lite to me.

Perhaps this was not completely surprising coming from the CEO of the Global Blockchain Business Council.

But it was bizarre to witness what felt like such one-sided testimony in the second panel. I’m grateful Bruce linked to Nick Weaver’s talk “Blockchains and Cryptocurrencies: Burn It With Fire.” 🤘

Did you remember hearing about an EO? I searched and found an EO that was issued in March 2022 – EO 14067: Ensuring Responsible Development of Digital Assets.

https://www.whitehouse.gov/briefing-room/presidential-actions/2022/03/09/executive-order-on-ensuring-responsible-development-of-digital-assets/

Some reports were supposed to come out in 180 days. Would that be around this time?

So many groups appear to be involved. Section 3 of the EO lists many coordinating parties. There are lots.

SpaceLifeForm • September 11, 2022 3:12 AM

@ Ted, Clive, ALL

Note that the CFTC Digital Asset hearing was on 2022-02-09.

I did not interpret the 4 members of the second panel as being one-sided, but that they all had their own unique perspectives. Yet all seemed to be calling for clarity IMO.

EO 14067 was exactly 4 weeks later. Things are moving along it appears.

The Legislative process is underway. In the Senate you have S.4760 and in the House H.R.7614 but it will take time. There are still some issues as to when a Digital Asset is a Commodity or when it is a Security, but in the main, I think it will be treated as a Commodity as much as possible.

Here are a couple of articles summarizing.

‘https://www.dlapiper.com/en/us/insights/publications/2022/08/how-the-digital-commodities-consumer-protection-act-of-2022/

‘https://www.jdsupra.com/legalnews/digital-commodities-consumer-protection-3869021/

Ted • September 11, 2022 7:15 PM

@SpaceLifeForm, Clive, All

Re: Cryptocurrencies and the CFTC and SEC

Great articles. I’m glad you brought up the issue of how cryptocurrencies may be regulated and under what regime.

You’ve made me curious now about how the SEC is looking at this area. I found these recent comments from the SEC’s Chair Gary Gensler:

Of the nearly 10,000 tokens in the crypto market,[2] I believe the vast majority are securities. Offers and sales of these thousands of crypto security tokens are covered under the securities laws.

Some tokens may not meet the definition of a security — what I’ll call crypto non-security tokens. These likely represent only a small number of tokens, even though they may represent a significant portion of the crypto market’s aggregate value.

[…]

Thus, I’ve asked the SEC staff to work directly with entrepreneurs to get their tokens registered and regulated, where appropriate, as securities.[11]

A handful of crypto security tokens have registered under the existing regime.

https://www.sec.gov/news/speech/gensler-sec-speaks-090822

I’m wondering if the few that have registered have issued public disclosures.

Clive Robinson • September 11, 2022 10:02 PM

@ Ted, SpaceLifeForm, All,

Re : Security or not world view.

Remember, the comment from the SEC’s Chair Gary Gensler of,

“Of the nearly 10,000 tokens in the crypto market, I believe the vast majority are securities.”

Is his opinion, under his interpretation, of not even US legislation, but his agencies regulation.

As such it is “legally unqualified” even in the US let alone anywhere else. At the end of the day, it’s what a judge decides based on legislation in any given jurisdiction that counts. With that legislation not of necessity being “national”.

The big problem that realy needs to be resolved is “where a transaction happens”.

There are two end entities to a transaction a seller and a buyer, but there maybe a multiplicity of intermediate third parties.

So even though it may be legal to sell in a jurisdiction, and legal to buy in another jurisdiction it may not be legal for a third party to exchange payment or exchange goods.

This can get ridiculous in some cases. For instance where a third party –to their own advantage– claim they can withhold or more importantly claw back payment where a perfectly legal payment in a single jurisdiction has occured. Because the third party claims legislation and regulation in an unrelated and ininvolved country in their benificial view applies (PayPal apparently does this all the time).

My view on those 10,000 or more tokens is “buyer beware”… Because you are not aquiring a “tangible physical object” you have control over. You are infact aquiring an “intangible information object” you have no control over.

So pragmatically not even worth the ink you might use to write/print it onto a piece of paper…

But that does not make the distinction between a table of information and a crypto-token they are both the same in that regard. Nore does the resources involved in producing them.

After a few more questions like that we discover the inevitable result that what makes the difference between a childs multiplication table and a security is “intent” when seen from a third party “Point of View”(PoV). As I’ve discussed on this blog before this is the same issue as deciding what is “Good or Bad” and is subject to the mores of Society.

PoV based legislation and regulation is almost always a very bad thing. Because even at the best of times it is subject to “Politics”, “Religion”, “Superstition” and other nonsense shifting beliefs that have plagued human history for over ten millennia.

The problem is most humans think their beliefs are “rational” when in fact they can be shown to be either irrational or have so many corner or edge cases that they can not be expressed in a logical bivalant system of deduction, so can not be codified let alone judged.

To see why consider the rule,

“Every rule has an exception”

This is at heart the same as the famous paradox quote from the 7th Century BC poet and prophet “Epimenides of Crete,

“All Cretans are liars”

Then consider one of those fundemental tenants of law,

“Every law has a defence”

The reason for it’s existance is based on the notions behind “The King Game” of “Might is Right” and thus “unquestionable authority” without constraint. That too often gets perverted to “For the Common good”, “Because we are the good guys”, or some other “Moral High ground” nonsense to stop people questioning the self entitled.

Umberto • September 12, 2022 1:16 AM

@Clive

1, Leave as is.
2, Decrypt and re-encrypt.

Or encrypt the DES-encrypted files with a more secure system and delete the originals.

If you are ‘being watched’ that would of course also risk leaking the new keys.

But that would also mean that can’t ever decrypt these files without leaking them, so they are either useless or insecure. Then, why keep them at all ?

Of course if the contents of these files are so important to you, then you should consider spending some money on a system and/or environment that is not so easily ‘watched’.

If the security of this data is important not only to you but in wider context, then doing so would actually be you duty.

JonKnowsNothing • September 12, 2022 2:48 AM

@Umberto, @Clive, All

re:encrypted files with a more secure system and delete the originals.

I think this recurses with no exit state, to Turtles All The Way Down.

Every turtle you make is another exposure. 1 turtle is easier to keep track of.

This does beg the question: Why in the first place?

I’m sure there are good reasons, but the NSA and 3Ls only hint at the deeper secrets of Cascading Turtle Domains.

Clive Robinson • September 12, 2022 5:58 AM

@ Umberto, JonKnowsNothing,

Re : Encrypted Files

“But that would also mean that can’t ever decrypt these files without leaking them, so they are either useless or insecure. Then, why keep them at all ?”

The thing about “files” is, in the general case, on nearly everyones computer they mostly “stay at rest” apparently unused, much like books on shelves in a dusty old library or archive.

Such buildings have doors locks and keys to keep people out for very many reasons, way more than you are considering. So no the files are far from useless. Encrypting the files is just moving the doors locks and keys to “little rooms” for each archive. Such segmentation can be very usefull.

So usefull you will have no trouble finding law offices that run “Sealed Archive Storage” in effect you can “time vault” a document for an annual fee. One use for such is to hold legal documents such as “Titles of Property” and similar. Also last wills and testiments, where you do not want the beneficiaries to know what is in the archive untill after your death (just in case they can not wait and decide to bump you off 😉

There is also the interesting face lift on the very old idea of a “Tontine”[1]. Where in this day and age the thing of value held is not money or tangible goods but information. One example might be the alledged Beale Ciphers[2], where although the ciphertexts are known the keys have apparently been lost to the mists of time.

Which brings us onto @JonKnowsNothing’s point of,

“I think this recurses with no exit state, to Turtles All The Way Down.”

This is a problem with all documents or similar that can be “copied” at minimal cost. As was observed by “The hippy generation” in later life “Information desires to be free”…

The advantage encryption gives is you can “lock the original befor a copy is made” and as long as it remains secure from crypto attacks all you have to do is keep the key under control in some manner.

The problem is as I’ve noted a couple of times on this blog is the encryption algorithms we use publically don’t last much more than between a quater (DES) and a third (RSA) of a century without being augmented or scrapped… Which means “early implementers” can pay a price.

As our host has observed attacks on security unlike most things in life do not get worse with age, mostly they just get better, especially as the resource cost has a habit of halving every eight to nine months.

The best you can do is somehow take the “intangible information object, and make it a “tangible physical object” that either can not be copied, or the fact it has been copied illicitly is evident upon simple inspection.

But as we know from the Olympics and samples for drug testing the Russian’s knew how to get around most apparently tamper proof systems.

[1] There is disagreement on where the idea for a “Tontine” originated but my ha’penny would be on Scotland. In essence it’s an agreement between a group of people over an object, such the last surviving member inherits it. One such idea would be a bottle of fine whisky, where the survivour drinks to the health of those that have gone before. Sometimes the object becomes an heirloom and along with the original document gets passed down the generations who in turn carry out an annual “observance” to all. It’s known that the French Government used the idea as the equivalent of a “bond and title” combined, such that a person would receive money as long as they lived. More generally the Finance and Insurance industries have taken over the idea for investments, pensions and similar.

https://legal-dictionary.thefreedictionary.com/tontine

[2] The alledged Beale ciphers are in all probability a money making hoax to sell pamphlets containing them. The “papers” contain three ciphertexts, the first of which states the location of a buried treasure. It is described in the second to be of gold, silver bullion and jewels, all improbabbly in “iron pots” in an underground stone vault, and estimated to be of considerable value (possibly $60million today). With the third listing the names of the treasure’s owners and their next of kin. It takes little imagination to guess correctly which of the three is the only one to have been decrypted. Especially as the pamphlets was actually very expensive for the time…

Ted • September 12, 2022 9:57 AM

@Clive, SpaceLifeForm, All

As such it is “legally unqualified” even in the US let alone anywhere else.

Gensler remarked in his Sept 8th speech “… I’d like to thank the Practising Law Institute for working with our agency on this program”.

Just curious if you’ve seen PLI’s resources on cryptocurrencies and digital assets? Any thoughts?

Also, it looks like the SEC has already been taking enforcement action in the crypto markets. I looked at the last three enforcement actions they list on the site below. From what I can tell, they appear to be for people and entities based in the US.

https://www.sec.gov/spotlight/cybersecurity-enforcement-actions

SpaceLifeForm • September 12, 2022 10:56 PM

@ Ted, Clive, ALL

You do not have to wait long these days. Not even 2 months. The Cryptocurrency Scamiverse is imploding.

‘https://www.sec.gov/news/press-release/2022-127

‘https://www.justice.gov/usao-sdny/pr/tippee-pleads-guilty-first-ever-cryptocurrency-insider-trading-case

‘https://yro.slashdot.org/story/22/09/12/223250/coinbase-execs-brother-pleads-guilty-in-crypto-insider-trading-case

Clive Robinson • September 13, 2022 2:53 AM

@ Ted, SpaceLifeForm, ALL,

Re : SEC and crypto-scam industry.

“Also, it looks like the SEC has already been taking enforcement action in the crypto markets.”

I am not indulging in “word play” when I say I suspect it will only be “Token Action” with just maybe one easy show trial for public consumption and politicians to make pointless noise over.

The SEC has a reputation now of being a governmental “rent seeking agency” not a law enforcment agency. So it’s in their interest to,

“Not kill their Golden Goose”

So they issue what are in effect paltry fines not convictions, which just encorages risk taking behaviour by certain “vampire squid” types who then learn how to avoid being convicted of anything thus just carry on seeing SEC fines as,

“Part of the price of doing business”

I guess the real question, I’ve also mentioned in,

https://www.schneier.com/blog/archives/2022/09/new-linux-cryptomining-malware.html/#comment-409927

Is,

“When do we see the normalization of the crypto-scam industry?”

Probably with the start of the likes of “revolving door” employment behaviour between the scammers and the SEC…

Then the bubble will realy get big, and we will have a future “Financial Crisis” to contend with… But don’t let the study of recent history get in the way of making money for the “Techno Bros and their hoes” and a taste for the fanbois to keep them crowing. You can see it starting with all the Web 3 nonsense flooding like effluent down a modern day TurnPike…

Ted • September 13, 2022 3:23 PM

@SpaceLifeForm, Clive, All

Re: First ever cryptocurrency insider trading case

Wow. That 62-page complaint by the SEC documented a lot of activity.

Plus from your Slashdot link:

Three Australian finance academics have posited that up to 25% of Coinbase listings in the past four years may have involved some insider trading.

A few days ago I was listening to a Darknet Diaries episode about insider trader. A group of hackers hacked into financial newswire firms to get advanced notice of press releases. And then they would trade on it. It’s amazing how much people can get away with before they start to draw attention.

Apparently the SEC has a tool called Artemis (Advanced Relational Trading Enforcements Metrics Investigation System) that can use mathematical algorithms and advanced analytics to analyze and rank trading activity. I wonder if they are or will be using it for cryptocurrencies.

https://darknetdiaries.com/episode/123/

Weather • September 14, 2022 12:48 AM

Ted • September 12, 2022 9:57 AM

@Clive, SpaceLifeForm, All
Contrary to what you think, Trump isn’t going to be a issue, not some conspiracy but he asked for it.

Clive Robinson • September 14, 2022 7:14 AM

@ Weather,

“Trump isn’t going to be a issue, not some conspiracy but he asked for it.”

My only concern about the Doh-gnarled is about half the US voting population… Not all people learn from lifes little mistakes, blow over or not.

How many million new voters will there be in four years? There may be enough “new angry votes” to tip the balance…

Srikumar K. S. • November 1, 2022 10:26 PM

Given that the default state of any piece of software is “buggy until proven correct, and the proof could be buggy too”, we need escape hatches from the consequences of such bugs. Earlier, when my team was reviewing smart contracts, we’d come up with a notion of “warranties” that are easy to verify and add a level of trust to the smart contracts – https://sriku.org/blog/2018/03/06/warranties-for-smart-contracts/ .

Note that we’re not talking about warranties for products, but warranties that the smart contract works as advertised, or you can take specific remedial actions. For example, if you’ve signed up on a p2p insurance contract (you shouldn’t, but that’s another story), a bug in the contract could end up voiding your insurance or premium. A “warranty method” can then help you remediate the situation and at least claim back your premium if you suspect some system condition such as “sufficient funds to meet your claim” is not met at some point.

If the warranty terms are not as simple as product warranties that say “any manufacturing or operational problem encountered within 1 year, we’ll replace the product free of charge” without getting into detailed specifications of kinds of problems. The existence of such a clause could also act as a forcing function on the contract devs to make sure the contract code is bug free to the extent possible.

Schneier on Security

Responsible Disclosure for Cryptocurrency Security

Comments

Leave a comment Cancel reply