What Should the Scope of the Web3 Audit Look Like?
DeFi Security Summit 2022 · 28 Aug 2022 · 4:18
At DeFi Security Summit 2022, Denis Ivanov of Hacken argues that web3 auditing needs a shared definition of what an audit covers. Communities read an audit stamp as a promise that a project is fully secure, while auditors only take responsibility for the code in scope, and with no agreed minimum anyone can sell a quick review as an audit. He invites auditors to join the Enterprise Ethereum Alliance to settle a minimum scope and a name for the service.
Speakers
Topics
From DeFi Security Summit 2022, hosted by DeFi Security Summit.
Transcript
our next speaker is Dennis Ivanov he is hack and CEO and is going to talk about the scope of web 3 Audits and what does it look like [Music] yeah um hi everyone um uh yesterday here was very lovely panel of um Auditors and they agreed on the thing that what each of us provides shouldn't be named an audit and it's a very funny thing and I understand why
the discussion happened but it would be very nice to agree with the whole stakeholders up there because not only we need to agree between ourselves but um yep uh but with uh different uh stakeholders clients and the community as well and to name it or code review or risk assessment or something that's much more appealing to the service that we are providing um because each of them there have their own expectations
Community has the expectation after the audit stamp that the project is 100 secure and they are not looking and at scope of work at anything they just believe the auditor company the projects uh they want it to be as fast as cheap and without spending time on fixing bugs and Auditors at the same time they wanted to be uh just uh to take responsibility only for that piece of code that they uh audited and with knowing all of them all of that
why the service is has so so many different sides because languages matter and because there is no any standards what's minimum because each of uh each of the person developer out there can start their own auditing company tomorrow saying that this uh like two minutes of their time without any tools is an audit and no one can stop them doing that putting the stamps that this is then audit and that is an audit and we definitely integrate what's the minimum scope of work what's minimum
need to be checked marketers also are not helping with that because they are exaggerating uh the meaning of it and using an audit as a news for the community and it's also not helping in a good way with the security and at the end each hack for the community uh point of view it's the uh auditor fault and it's not like that if it's not a scope of work and all of that is uh one one point and one exact message I encourage Auditors to join ethereum
enterprise Enterprise Alliance to find out what's minimum scope of work and what and how we can name our service there is a link to discussion panel and there is a link to the this drama as if you're an Enterprise Alliance that's it so much Dennis [Applause] on his talk or or his activity no thanks