Oak Security

📑 Just dropped Part 2 of our Ethereum vs Solana security deep-dive! The latest writeup examines the security implications for the daily development decisions made on both platforms: 🔒 Security Model Comparison: - Language safety: Solidity vs Rust - Runtime security: EVM vs Sealevel - Account models and state management - Execution environment isolation and guarantees 💡Key Technical Insights: - EVM: Strong isolation, deterministic execution, higher gas costs - Sealevel: High throughput with different resource constraints - Rust memory safety > Solidity, but lacks blockchain-specific features 🛠️ Security tooling comparison: - ETH: Rich ecosystem of static/dynamic analyzers - SOL: Growing suite of tools, leveraging Rust's ecosystem - ETH leads in fuzzing & vulnerability scanners - Both need better adoption of security best practices Read the full analysis here: https://lnkd.in/eiaWRMFt #blockchain #smartcontracts #ethereum #solana #web3

🔐 Blockchain Security Deep Dive: Ethereum vs Solana 🔍 Our in-depth research compares Ethereum and Solana, two leading blockchain platforms, revealing fascinating insights into their security models. Key takeaways from the article: 1️⃣ Design Philosophy: Ethereum initially prioritized simplicity and decentralization, while Solana focused on optimizing latency and throughput from the start. 2️⃣ Scalability Trilemma: Both platforms make different trade-offs between decentralization, security, and scalability. 3️⃣ Consensus Mechanisms: Pros and Cons of Ethereum's Proof of Stake (PoS) vs Solana's hybrid Proof of Stake + Proof of History (PoS+PoH) approach. 4️⃣ Front-running and MEV: How architectural differences affect vulnerability to these issues. 5️⃣ Validator Dynamics: Comparing validator selection, malevolence discouragement, and punishment mechanisms. 6️⃣ Node Infrastructure: Risks associated with client centralization and potential censorship. This comprehensive analysis is a must-read for blockchain developers, security professionals, and anyone building on these platforms. It highlights how early design choices can have long-lasting impacts on security and scalability. 💡 Question for discussion: How do you think these security trade-offs will influence the future development and adoption of Ethereum and Solana? #BlockchainSecurity #Ethereum #Solana 📚 Read the full analysis: https://lnkd.in/eDzft8mu

The audits for the Consensus and Economic Protocols are completed! We are grateful to Oak Security for their thorough audits and are pleased to share the results. Get the overview in this short blog, or dive deep into the full report. Blog: https://lnkd.in/eNRMPptF Full report: https://lnkd.in/ecm4VE_q

Choosing a #blockchain for a protocol is not easy. Here is our guide written from a security perspective by Eduard Kotysh. https://lnkd.in/dJ7_DBzx

Join us #Web3Summit and don't miss Dr. Jan Philipp Fritsche's talk on our learning from 7 years in blockchain security!

The Deciphering Web3 Security panel of CONF3RENCE was a blast, full of interesting insights! Thanks to all the experts who shared the discussion with Stefan Beyer: Dyma Budorin, ACCA CCSSA, Ghassan Karame, Jason Jiang, Toni Lukic #blockchain #security

It was great sharing our security expertise with the attendants of CONF3RENCE #Dortmund this morning! We will be waiting for you at our booth to solve any questions around #security and #auditing. #blockchain #web3

In addition, Stefan Beyer will also take part in the panel discussion "Deciphering Web3 Security: Implications and Innovations"! See you all at CONF3RENCE!! https://lnkd.in/dXqf6v-7

Are you attending CONF3RENCE 2024 in #Dortmund this week? Join our directors Stefan Beyer and Philip Stanislaus this Wednesday for our workshop "Don’t Be Next: Learnings from 7 Years of Web3 Security Auditing" Check all the info below https://lnkd.in/dPavG97J

Our recent #audit of #Astroport's transmuter pool uncovered an interesting asset validation #security vulnerability related to CosmWasm smart contracts and #CosmosSDK chains. When validating received assets in a CosmWasm smart contract, it is not sufficient to just ensure that a denom exists 🔍. Attackers could provide existing but worthless or dummy assets that could pass such a validation but break the functionality in other ways. ⏹ The Threat: In this audit, attackers were found to be able to drain funds from the pool by providing worthless assets. ⏹ The Cause: The Swap feature takes an asset provided by the user in exchange for others in the pool. However, it accepts any existing native asset as valid, enabling the exchange of any asset for those in the pool. This was also possible using custom CW20 tokens. ⏹ The Solution: Assets should only be deemed valid if they belong to the current pool. 👉 Check the full report at https://lnkd.in/erG3Vibk Drop us a message if you have any questions about our audit process; let’s tackle your security needs together.