A Security Disclosure Lands: How to Tell Severity From Noise
Vulnerability headlines rarely distinguish between a flaw in the protocol, in one implementation, in a wallet, or in a service. The four have…
Attestation, examination and audit are different engagements with different levels of assurance. The word used in the press release is often the weakest of the three.
An attestation reports agreed-upon procedures at a point in time. A full audit gives an opinion on financial statements. Most crypto "audits" are the former, and a point-in-time snapshot can be satisfied by borrowed assets.
A custodian publishes an assurance document. Whether it means much depends on details that press coverage almost never reaches.
An agreed-upon procedures engagement performs specific checks a client requested and reports the results, offering no opinion. An examination provides an opinion on a specific assertion. A financial statement audit gives an opinion on the whole picture and is the strongest — and least common in this sector.
Most reserve attestations are snapshots. Assets present on the measurement date satisfy the check, whether or not they were borrowed for it. Without either surprise timing or continuous monitoring, a snapshot is compatible with a shortfall on every other day of the year.
Demonstrating control of assets is the easy half. Demonstrating liabilities — what is owed to customers — is the hard half, because it depends on internal records the auditor must take from management. Techniques exist to let customers verify their own balance is included without revealing others’, and their absence is a meaningful omission rather than a technicality.
Who performed it, and are they independent? What exactly was in scope — assets only, or liabilities too? Was the date announced in advance? Is the full report public, or only a summary? And is it repeated on a schedule, or a one-off? A programme of surprise, liability-inclusive examinations is a substantively different claim from a single dated snapshot, though both are announced with the same word.
Vulnerability headlines rarely distinguish between a flaw in the protocol, in one implementation, in a wallet, or in a service. The four have…
Fee spikes are reported as congestion or as distress. They are an auction for a fixed quantity of block space, and the bidders are not always who the…
Miner results are the closest thing to a public window on Bitcoin's security budget. The headline figures are usually the least useful part.
The week’s Bitcoin news, one reasoned take, and the on-chain number that mattered. Free, weekly.
Signal, not noise. Unsubscribe any time.