I have a confession.
I usually skip blockchain audit announcements.
They tend to look the same.
“Protocol audited.”
“Critical issues resolved.”
“Security is our top priority.”
Then I scroll away.
So I nearly did the same when I saw Dusk talking about its audits.
But the number made me stop.
Dusk says its technology stack went through 10 different audits, with more than 200 pages of reports, covering things including the Piecrust VM and its PLONK zero-knowledge proving system.
Ten audits is not a small number.
Still, I don't think “10 audits” should be treated as some magic security score.
Audits don't make software invincible.
They don't tell you what nobody has discovered yet.
And they definitely don't eliminate every risk once a system goes live.
But I do think there's something worth paying attention to here.
Dusk isn't just running a smart contract and hoping nobody finds a problem.
It's building a fairly complicated stack: virtual machine, cryptography, privacy systems, consensus and all the pieces connecting them.
That means the boring work matters.
A lot.
I actually like seeing the reports exist more than seeing a project say “we take security seriously.”
The first is evidence of work.
The second is just a sentence.
And after the bridge incident earlier this year, I've become even more skeptical of treating security claims as guarantees.
A project can have audited code and still have something go wrong somewhere else.
So I'm not putting Dusk in the “safe because audited” box.
I'm putting it in a different box:
“Okay, at least they're doing the unglamorous work.”
Whether that work holds up under real usage is another question.
And that's probably the more important one. #dusk @Dusk $DUSK
#dusk $DUSK @Dusk
I usually skip blockchain audit announcements.
They tend to look the same.
“Protocol audited.”
“Critical issues resolved.”
“Security is our top priority.”
Then I scroll away.
So I nearly did the same when I saw Dusk talking about its audits.
But the number made me stop.
Dusk says its technology stack went through 10 different audits, with more than 200 pages of reports, covering things including the Piecrust VM and its PLONK zero-knowledge proving system.
Ten audits is not a small number.
Still, I don't think “10 audits” should be treated as some magic security score.
Audits don't make software invincible.
They don't tell you what nobody has discovered yet.
And they definitely don't eliminate every risk once a system goes live.
But I do think there's something worth paying attention to here.
Dusk isn't just running a smart contract and hoping nobody finds a problem.
It's building a fairly complicated stack: virtual machine, cryptography, privacy systems, consensus and all the pieces connecting them.
That means the boring work matters.
A lot.
I actually like seeing the reports exist more than seeing a project say “we take security seriously.”
The first is evidence of work.
The second is just a sentence.
And after the bridge incident earlier this year, I've become even more skeptical of treating security claims as guarantees.
A project can have audited code and still have something go wrong somewhere else.
So I'm not putting Dusk in the “safe because audited” box.
I'm putting it in a different box:
“Okay, at least they're doing the unglamorous work.”
Whether that work holds up under real usage is another question.
And that's probably the more important one. #dusk @Dusk $DUSK
#dusk $DUSK @Dusk
