Hacker News Reader

Comment by mratsim | Hacker News Reader

I'd like to add that there is a critical shortage of security auditors for smart contracts and blockchain protocols.

Projects are willing to spend up to millions to squash away vulnerabilities. For example Balancer opened a bug bounty for their v2 with $2M USD for 1 critical bug:

https://docs-v2.balancer.finance/core-concepts-1/security/bu...

View on HN

Do they have any interest in hiring regular employees? Most of the people I know who go after bounties barely make $30,000/yr. If I see bounties I see people who aren't really willing to pay.

You should apply to auditing firms (Trail of Bits, Open Zeppelin, Quantstamp, ...). They are all booked 3 months in advance at the very least and would love to onboard new blood.

Yes! Please do apply. We have a tight-knit team of experts, industry leading tools, and a work environment that promotes continued learning. You'll get paid well and quickly become a leading industry expert. Here's our job req for a blockchain security analyst: https://jobs.lever.co/trailofbits/4f459855-3299-462f-9e73-29...

What’s the comp look like?

High - solid blockchain devs can pull a lot of money. Let me underline _solid_, there are a lot of people who took a tutorial and try to sell themselves as experts.

Note the difference between "I could not find any bugs" and "I proved there are no bugs". I would assume only the latter are hired. Yet, program proving as in formal verification is a very academic specialisation. The reluctance to hire these people seems partly a) unawareness these methods exist and b) capability to evaluate whether someone knows enough. To my anecdotal experience founders of DeFi applications are not that tech savvy, so instead of trying to understand Solidity (untrivial) they instead place bug bounties or hire a special firm to give a stamp of approval for a product launch.

My take on formal verification was that we are still not close to being able to usefully prove the validity of the types of nontrivial programs that make up DeFi contracts. It can help, sure, but companies serious about security need to invest in internal auditing (that may not seem to be generating obvious returns) instead of hoping for a bug bounty Hail Mary.

If these firms are out there and are being hired I suppose that counts.

Reply on news.ycombinator.com