Rei

In-person maximalist.

Making mass onchain delusion insurable @NexusMutual

[BraveNewDeFi @BraveDeFi]

Points 1-6 are a good starting point, but digging into some of those in more depth or looking at others is important when doing DD. Here are some other areas to dive into:
- Economic design. Outside of the code, is the economic design of the protocol sound? Can a death spiral occur during market stress; do low or zero fee features expose a protocol to economic attacks? The non smart-contract-based attack surfaces are important to review during the DD process.
- Protocol maturity, performance during market stress. How long has a protocol been live; what is the max TVL a protocol has held and for how long; how has a protocol performed during market stress or during periods of protocol-specific stress (e.g., mass redemptions, unwinding positions during market crashes, etc.)
- Team quality, track record. Is the team known? (If not, do the anons running a protocol have a track record of working in DeFi?) Have team members worked on protocols that have suffered loss events in the past? If yes, do certain team members have a history working at multiple protocols that have suffered loss events? Do they have experience working in the sector they're building in? This should be looked at in addition to the legal aspects (e.g., jurisdiction, if they've set up a bankruptcy-remote structure for offchain holdings, etc.)
- Loss history. Has a protocol been hacked before or suffered any type of loss event (e.g., exploit, opsec failure, fat-finger error, oracle misconfiguration, etc.). If yes, how did they respond/recover? Were they able to recover funds or make users partially or completely whole?
- Security practices beyond audits/bug bounties. Looking for audits, bug bounties, and comprehensive testing practices is an important part of evaluating a codebase, but does a team using monitoring services like Hypernative, Blockaid, Hexagate, etc.? If you find there are privileged actions within a protocol's design, how are those actions executed? Is there an upgradeable proxy in use? If so, is it owned by an EOA, multisig, MPC wallet? What's the exeuction threshold on the multisig that owns a proxy contract? Digging into OpSec best practices is just as important as looking for audits. This level of DD is harder to perform because OpSec info isn't public, but there should be information made available about the use of multisigs, MPCs, etc. @_SEAL_Org has great guidance on this in their frameworks, like the Multisig Security Framework: https://t.co/aYR3Yog4po
- Transparency, disclosure practices. Is the codebase public or private? Does a team offer transparency or do they just say they're transparent in their documentation? You can evaluate a protocol and its team based on their actions/track record on disclosures about security incidents (if they were impacted by another event or if a loss occurs, does the team publish a detailed post-mortem). If funds are deployed into underlying strategies, is it easy to verify where those funds are deployed or is there a third-party service like Accountable where you can verify onchain/offchain holdings?
- First-loss coverage. Does a protocol have a self-insurance module (e.g., Aave Umbrella) and has it ever been used? Does a protocol team purchase insurance and, if so, what type of coverage/what are the payout triggers? Is there any first-loss coverage available? Does the protocol implement senior/junior tranching? If yes, what is the premium being paid to junior tranche capital providers? Can you buy coverage/insurance for protocol, economic risks or depeg coverage? If yes, what is the rate coverage providers are charging?

These are just some of the checks we run when doing assessments at @NexusMutual. We've built our own tooling to run these checks in addition to reaching out to teams directly.

We also run regular assessments since risk is constantly changing, especially in lending markets and perps protocols.

And I cannot recommend the @_SEAL_Org Frameworks enough. Use these frameworks to assess how well a protocol team adheres to industry best practices: https://t.co/fNSX3xcJX5

[bitstarter @bitstarterAI]

We're hiring 💡

Our new CTO will take charge of one of the biggest jobs in Bittensor: building the best aspiring teams into tomorrow's top subnets.

From leading our Machine Learning track to screening subnet submissions and mentoring founders, this role has it all.

Link ⬇️

[Joakim 🌹🇳🇴🇪🇺 @joakial_]

I don’t think democracy can survive if public opinion is constantly manipulated by algorithms designed to maximize engagement rather than truth.

[bitstarter @bitstarterAI]

Machine Learning on Bittensor. Incubated by Bitstarter.

Announced live on @TWiStartups featuring @alex, @Lons, @macrozack, and @mccrinbc, our new track is:

☑️ Backed by @const_reborn
☑️ Built for the best ML start-ups
☑️ Subnet registration, development, and infra included 👀

[Nexus Mutual @NexusMutual]

Nexus Mutual's detailed incident report about the KelpDAO/LayerZero incident is now live ✍️

Our risk experts dig into:
- How the attack unfolded
- How the damage spread
- The systemic vulnerability it highlighted
- The industry response
- Is this covered?
- How we're addressing the opsec gap

See the full report here: https://t.co/jrQ6t4BpVU

[Hugh Karp 🐢 @HughKarp]

https://t.co/EA2g5qvzuT

[Dean Eigenmann @DeanEigenmann]

no babe, we aren't broke, our life savings are in a quantum superposition on aave

[Rei @Rei_Melb]

@ivangbi_ SEAL Frameworks cover a lot of this: https://t.co/ek8kUhekq0

[Proton VPN @ProtonVPN]

Things age verification achieves:

• Violating adults' privacy online
• Creating leak and hack-worthy databases with tons of personal sensitive information
• Censoring the internet as a whole

Things age verification does not achieve:

• Protecting children online

[OpenCover @OpenCover]

🔥 Recap on Covered Vaults → the first vault-native risk transfer primitive.

Built in collaboration with @NexusMutual and 15 exceptional partners, including @MorphoLabs, @kiln_finance, and @symbioticfi.

Here is everything you need to know 👇

[Clouted @CloutedMind]

KYC is so redundant in a world of enormous data leaks and AI

we need to abolish KYC and replace it with either cryptographic proofs or game theory

DeFi is ahead of the curve on this one

dont let the institutions say otherwise

[Nexus Mutual @NexusMutual]

Thank you @Vault__Summit for putting together this awesome panel!

While most only think about risk in DeFi after a big hack, it should be a core part of any investor's calculus

If you're wondering how experts approach onchain risk, definitely check out this replay 🤝

[Rei @Rei_Melb]

So much love for the @OpenCover team and the amazing work they've done on this

[Nexus Mutual @NexusMutual]

$50M in cover capacity per vault. No prepayment, no fixed terms, premiums streamed from yield

@OpenCover just launched Covered Vaults & we're proud to be the underwriting partner 🤝

Any vault operator or curator looking for embedded risk transfer, reach out to OpenCover today!

[Nexus Mutual @NexusMutual]

$50M in cover capacity per vault. No prepayment, no fixed terms, premiums streamed from yield

@OpenCover just launched Covered Vaults & we're proud to be the underwriting partner 🤝

Any vault operator or curator looking for embedded risk transfer, reach out to OpenCover today!

[Rei @Rei_Melb]

@stacy_muur Re: the latest one, key compromise is basically uninsurable without a physical presence.

More widely, some sophisticated actors have normalised it in their set-ups, degen gamblers less so.

Especially hard when yields are low, like now

Source: building @NexusMutual for 8 years

[Rei @Rei_Melb]

@hasufl The whole thing was done with a sense of irony and "judge for yourself" disclaimers. People had fun with their readings ofc

[Rei @Rei_Melb]

Say what you want about the Ethereum mandate, but it's fun to read in southern preacher voice

[Rei @Rei_Melb]

@laurashin @kaiynne @tayvano_ @LucaNetz @omeragoldberg Check out Nexus Mutual's report on the Resolv incident : 👇 https://t.co/wBM5XEbzct

[Nexus Mutual @NexusMutual]

We've published a preliminary incident report on what happened at Resolv Protocol on Sunday. We dig into what happened, how the damage spread through DeFi, and what Nexus Mutual covers.

Details are still developing and we'll update as the picture becomes clearer. Link in comments.

[Becky Tuch @BeckyLTuch]

AI writing has so many tells. Once you see it, it's fairly easy to identify (and exhausting to see everywhere).
If you don't know how to spot it, please read: https://t.co/FU3hIq9Opn