In web3: security is not only of utmost importance, but also cannot be over-simplified to a checkbox for audit.
To help, @ajbeal, @nassyweazy, @cseifert, and I put together the following guide for thinking about smart contract security at every step 🧵
Riyaz Faizullabhoy
393 posts
building something new // prev co-founder @bastion, cto @a16z crypto, sec infra @facebook, founding engineer @anchorage, & sec @docker // work hard, be kind
Joined December 2012
- I could not be more excited to announce that I'm joining @a16z Crypto as CTO along with my close colleague and friend @nassyweazy (CISO)! Can't wait to get started with this amazing team.As web3 expands, even the most crypto-native projects will have a hard time keeping up with the latest security best practices. We’ll help with that. I’m thrilled to announce @riyazdf and @nassyweazy have joined @a16z Crypto as our new CTO and CISO! a16z.com/2021/10/11/nas…
- when thinking about security threats, it’s important to identify classes of attacks to address and defend against them in a systematic way. @mg_486662 and I survey web3 attack types here:
- Today, we welcome @bastion to the world. We believe companies building in web3 need more than just a wallet to deliver the best products for their users. So @nassyweazy and I have been hard at work with the Bastion team to build that holistic platform. 🧵 (1/7)
- we published the results of a security audit of @Docker for AWS/Azure! More on the secure infra they provide here: blog.docker.com/2017/06/docker…
- docker trust released with 17.10 edge today! Give it a spin: docs.docker.com/edge/engine/re…Replying to @nathanmccauley @riyazdf and @_ashfall_'docker trust view' allows you to see what teams, engineers, or systems signed the image x.com/sbucloud/statu…
- I echo what Nass says here. Thank you again to our friends and colleagues for your support yesterday - it means the world to us. I am so proud to say that we are finally live! We can't wait to show you what @bastion can do 💪We are blown away by yesterday's response to our announcement. Thank you again for all of your support and warm reception of @bastion. For a recap of all yesterday's announcement and our $25M fundraise👇
- Onchain security incident? Batphone the experts like @samczsun @mg_486662 (and more: gist.github.com/samczsun/366b8…) with t.me/seal_911_bot
- a reminder that security threats in web3 systems can span widely across infra, opsec, etc — strong security in web3 requires comprehensive threat modeling, defense mechanisms, and incident response beyond solely securing smart contracts1/ Update: Initially we thought the issue may have been with AWS, however after further diagnosis, we have identified that the hacker has managed to exploit Godaddy, essentially they have hijacked our domain and copied our codebase and in the process changed the swap parameters
- We’re laser focused at @bastion to enable the next generation of web3 interactions for businesses, that feel like web2. If you’re excited by our mission and ready to build secure and robust infrastructure, we are hiring
- Excited to have @CFriedman00 take on the COO role at @bastion! Her leadership has been instrumental to our success so far and I'm confident she will continue to excel in her expanded role as we empower more businesses to unlock web3 use cases.
- Secure your updates! Lily Guo and I are going to prove to you need TUF security! Come to our talk at #LinuxCon and #ContainerCon!
- Today at Bastion, we're proud to announce the acquisition of Money Transmitter Licenses in New Hampshire and Arkansas. We're committed to providing enterprise-grade web3 to our customers, and this marks a critical step on that mission, just one month after launch. /1
- Non-custodial != full control of keys. @nassyweazy and I break down the not so obvious trust assumptions, tradeoffs, and best practices for wallet security: a16zcrypto.com/wallet-securit…










