Resources

People often ask me "How did you learn how to hack?" The answer: by reading. This page is a collection of the blog posts and other articles that I have accumulated over the years of my journey. Enjoy!

Kamino spends over $3M per year on security, and have a maximum payout of $1.5M on Immunefi. From audits to monitoring, to tooling to frequent engagements with big companies. They have undergone 20 audits, and 3 formal verification's. This is great but the Operation Security has been under fire recently. This article describes how they do operation security at Kamino.

Changes, such as configurations, or protocol updates, require some permissions. This is better than having the protocol being completely immutable but does make operational security important. Every change to code or configuration goes through a proposal process. Depending on the type of proposal, the number of signers, and the timelock changes.

The highest risk of a hack is signer compromise. Every signer uses a dedicated machine exclusively for multisig signing; this makes compromising the machine nearly impossible. Second, the signing is performed through hardware devices only. Finally, they have a diverse set of platforms for the multisig to prevent attacks like the Bybit hack. Some use tablets while others use MacBooks or Linux.

Besides the signers, there is the proposal being compromised itself. This doesn't mean a bad proposal; this means that the proposal is tricking the user in some way. To prevent this from causing issues, each signer has multiple independent locations to check before signing. Independent on-chain inspectors, decoded transaction description, a UI human readable review, and even transaction simulation in a sandbox. The more diverse you look at things, the better.

Every proposal requires m of n signers to approve before coming executable. Most proposals enter a timelock before becoming executable. During this window, the proposal can be reviewed once again. The quorum and timelock is calibrated per multisig and operation being performed. The more severe the action, the larger the threshold. The higher the urgency demands, the lower the signatures, and timelock. A program upgrade has a 24 hour timelock with a 5/10 multisig. For operations like pausing, it's 2/7 with no timelock. They have a table full of what the multisig does, the signers, the threshold, and the timelock that is very well-thought-out.

Overall, a great article on good operational security. The key takeaways are A) diversity in usage and B) balancing security and speed for operations.