Security audit is a MUST!

Having followed and being a maker+staker, I strongly suggest we do a security audit. The liquidity is $2.69 M now, neither users nor team could bear such loss.
Auditing is an ongoing process, we could start with the most important part, e.g. contract/collateral of money in/out, then we complete the rest step by step.

19 Likes

hey @jindouyunz. we’ve been talking to open zeppelin and peckshield.

open zeppelin is really good, but it looks like they only do audit for ethereum smart contacts. we actually like peckshield a lot! not only they can audit for our ethereum bridge smart contracts, but they can also do audit for the incognito chain.

do you have any other recommendations?

9 Likes

Hi, very happy to see you considering that. I’m not an expert in this field. I heard of Trail of Bits many times, they give an audit on Monero last year. Someone recommend Certik. In China, Slowmist is very famous, if you’re interested, I could introduce.
Great job! Keep Moving!

3 Likes

yes, any intros are much appreciated! we hope to finalize the audit firm soon.

we hope to find one that can audit not just ethereum smart contracts but also have experience auditing large code base of a full blockchain with more than 1M lines of code like incognito. it would be best if they have cryptographers on their team who can audit our privacy code. also, ideally, they should have experience with auditing other PoS networks, especially those implementing sharding.

my email is duy@incognito.org and my telegram is @duy_incognito if that’s more convenient for you to make the intro. thank you!

3 Likes

This seems like a good list of options to look into.

1 Like

I recommend NOT using Kudelski. They did a poor job auditing a large golang blockchain code base for the company for which I work.

2 Likes

Thanks for your kind suggestion.

Hey @duy, @andrey,

Is there any progress on this issue? As a rebel, I continuously promote the project in the crypto world in an honest way. The main concern of knowledgeable people is bridges. For example, one of the response to my comment was this: “the bank aspect of the project does present a bit of a risk, so it is important that the team takes the appropriate precautions. I do like the theory of being able to transform any standard crypto into a privacy coin, so I’ll make sure to keep checking in on this project from time to time and see how it develops.”

3 Likes

Hey @abduraman thanks for following up. Be sure that also care about the security of the network even more than anyone else.

To be honest I didn’t get the exact issue you point. But if you mean a security audit - it’s in an active phase. The whole summer we continuously do an internal security audit of the most important components of the chain and application layers.

2 Likes

Assurance of decentralization would probably greatly increase confidence that funds can’t be unilaterally confiscated so people would be able to leave large balances on the incognito blockchain. Hope that helps. I like this project a lot. :pray:

2 Likes

Hey @FFa the full decentralization is one more direction we work on. I think you will find this publication interesting Incognito's pragmatic approach to decentralization . It’s an explanation of the current state and direction where we go.

2 Likes

Hey @andrey, the expert cryptoers are afraid of hacking vaults like DeFi platforms. They mean the vaults (bridge wallets) by “bank”.

1 Like