Post

Dacian
Dacian@DevDacian·
The downsides of the contest model no-one tells you about is: * countless hours of back-and-forth arguing with strangers over the Internet trying defend the uniqueness and validity of your findings, while also attacking the uniqueness and validity of others' findings since unique findings are what pays the big $ * your payout and rankings are completely in the hands of whichever judge gets assigned and many decisions can go either way which can drastically improve or decrease your results * judging decisions can be highly partial to certain "big names" who dominate particular platforms. For example @trust__90 is a huge name on C4 while @IAm0x52 is a huge name on Sherlock; if this contest had been on C4 I'd wager Trust would have been successful in his appeals simply due to his name power there * anonymous judging doesn't solve this issue as auditors are typically de-anonymized during the crucial appeal phase so the name power is still extremely important when arguing with strangers over the Internet * at times there have been very clear agendas to discredit certain auditor's findings with the judges virtually cycling through reasons to invalidate particular auditors' findings * there have been cases where a high profile name has found a finding in one contest on a platform, then on another contest on that same platform another lower-profile auditor found the exact same finding with even more impact and the high-profile name missed it, and immediately a campaign began to invalidate the finding of the lower-profile auditor * when frustrated auditors have appealed the above behaviors and asked "what is the ultimate epistemological standard for truth? How can it be valid when high-profile auditor finds it in one contest but invalid when lower-profile auditor finds it in a different contest with even more impact?" the answer was SILENCE - if contest platforms and judges want to ignore you they can and there's nothing you can do about it unless you want to air the dirty laundry in public like Trust has chosen to do in this instance When you see contest rankings understand that it is not just pure skills of the researchers finding vulns that got them there - it is literally hundreds of hours of arguing and debating with strangers on the Internet. If you are the type of person who loves PvP, loves zero sum games, and loves arguing with strangers on the Internet, then you will absolutely LOVE audit contests! But if you find this whole process emotionally draining and not fun at all, then you will have a much more enjoyable life doing private audits. It is no wonder that the vast majority of auditors grind out enough audit contests to build a reputation then transition to doing private audits and rarely go back to doing contests.
TrustSec@TrustSecAudits

Over the past week, @sherlockdefi and the @Optimism team made what I believe is an erroneous re-scoping of the security contest rules. The direct consequence is invalidation of ~90% of the unique bugs submitted and re-shaping the payout. Long-term, this threatens to be a precedent for resolving rules against the supermajority of honest competitors. Here's the in-depth take gist.github.com/trust1995/fd11… Contest link audits.sherlock.xyz/contests/205 Bugs link github.com/sherlock-audit…

English
23
18
131
26.9K
Paylaş