"Just because you're paranoid doesn't mean they aren't after you."

This is an incomplete, definitely non-exhaustive set of security guidelines for securing DeFi protocols. Every protocol is different and even if you follow every single rule in here to the letter, you may still get hacked. The job of this guide is to reduce the chance of getting hacked by North Korea.

This guide is meant to be used in combination with other guidance.

This guide is a work in progress and will be updated as I learn more.

(If you'd like to see more of what we do, check out our website.)

Securing your contracts

1. Formally verify your code. It's not that hard unless your devs suck.

2. Get audited by a good auditing firm that isn't CertiK.

3. Test rigorously. Aim for 99% code coverage, with fuzz, integration and invariant tests.

4. Use circuit breakers to slow down or pause any suspiciously large outflows.

Securing the process

Development process, bug bounties, war rooms, multisigs, et cetera.

1. Use VS Code dev containers to sandbox your development environment.

   • DevPod or any homebrew Docker solution is acceptable. Just ensure it has no way to escape the sandbox.

   • Another benefit of this is that tooling across all developers is the same, so no more "works on my machine"

   • Or use a separate machine entirely for your dev work and connect to it via SSH. Maybe even GitHub Codespaces (ew).

2. Fucking use Linux.

   • An immutable distribution of Linux is preferred. MacOS is acceptable.

   • They don't usually build malware for Linux.

   • It's just generally a better experience for development.

3. Force all your devs to stay up to date with all system updates.

4. Always set ownership in your contract initializers to a protocol DAO or multisig.

5. Never reuse a deployment key for a different purpose.

6. Never put deployment keys in environment variables.

7. Or you could use Truffle Dashboard.

   • Unmaintained

   • From my experience, has some compatibility issues with Foundry

8. Ensure all developer git commits are signed. I prefer SSH keys, but you can use GPG.

9. Open-source all code running in production.

10. Pay out your bug bounties.

    • It's not rational at all to refuse to pay or be stingy, it's just retarded. You're setting up incentives for grayhats or whitehats to become blackhats.

11. Always do the Kim Jong-Un test.

    

    Pop Punk

    @PopPunkOnChain

    

    This is how you identify a North Korean engineer.
    
    I asked him to say something negative about North Korea and Kim Jong Un and he immediately deleted the chat.

    

    9,003

    5:34 PM • Aug 26, 2024

12. Keep your development machine as minimal as possible. Browser, VSC, Docker, that's it.

    • If you must install apps, use Flatpak.

13. Make an incident response plan for what exactly to do in case of a hack.

14. Add your contact details to crytic/blockchain-security-contacts.

Securing the frontend

You can't treat building a financial app in the same way you build any other web app. NORTH KOREA IS YOUR ADVERSARY. Therefore.

1. Set up an IPFS instance of your dapp.

   • Recommend not to set it up using Fleek or any managed provider

2. Test every frontend update before it goes live using multiple wallets and browsers.

   • You want to induce malicious behavior if it's present before it gets shipped out.

   • Watch for network requests to any domains you don't recognize.

   • Watch for any behavior you don't recognize, such as asking for infinite approvals to suspicious contracts.

   • Don't test using dev wallets.

   • Make yourself look like a new user every test.

3. Nudge your users away from MetaMask.

   • MetaMask promotes harmful practices such as blind signing

   • Wallets such as Rabby or Rainbow which do transaction simulation are preferred

4. Don't block VPNs. Please.

   • This isn't technically a security concern, it's just very harmful to us anons

5. Make your web app immutable

   • This reduces the impact of a successful domain hijack only to new users or to those who have cleared cache

   • Ensure there is a way to update the frontend from inside

6. Onchain is better than offchain. Hold your domains in a multisig using 3DNS.

   • Gives additional protection against having to trust 1 dev with domain ownership

7. Follow Cloudflare's guide to preventing domain hijacking.