Artículos Relacionados con Security Audit

El Centro de Noticias de HTX ofrece los artículos más recientes y un análisis profundo sobre "Security Audit", cubriendo tendencias del mercado, actualizaciones de proyectos, desarrollos tecnológicos y políticas regulatorias en la industria de cripto.

Kraken Points Out Gap in Cryptocurrency Wallet Audits

A vulnerability in Coldcard hardware wallets, revealed in August 2026, exposed a critical gap in the independent auditing of such devices. According to Kraken's security director, Nick Percoco, while audits might verify the presence of a certified True Random Number Generator (TRNG) in the hardware, they fail to confirm the working firmware actually uses it. The flaw, introduced in a March 2021 firmware update for some models, caused the devices to use a weaker, predictable Pseudorandom Number Generator (PRNG) instead of the intended hardware TRNG when generating seed phrases. This drastically reduced entropy, making certain wallets vulnerable to brute-force attacks. Coinkite, Coldcard's manufacturer, halted shipments and destroyed affected inventory. The incident led to coordinated attacks, with estimated losses exceeding $90 million across multiple waves of fund drainage from potentially vulnerable addresses. Users of affected firmware (Mk2, Mk3 versions 4.0.1-4.1.9; Mk4, Mk5, Q before specific updates) were advised to create a new seed phrase and migrate funds with caution. Percoco highlighted the lack of industry standards for auditing the complete "path" from the entropy source to the final executed code in working firmware, contrasting it with stricter validation in payment systems and government cryptography. The incident underscores systemic security verification shortcomings in the hardware wallet sector.

cryptonews.ruAyer 09:33

Kraken Points Out Gap in Cryptocurrency Wallet Audits

cryptonews.ruAyer 09:33

What Should You Do First with Claude Fable 5? Give Your Code Repository a Comprehensive Checkup

Title: "What You Should Do First with Claude Fable 5: A Comprehensive Audit of Your Codebase" This article introduces a powerful use case for the newly released Claude Fable 5 AI model (June 2026), which is positioned for long-cycle software engineering tasks. It presents a detailed "Audit and Project Improvement" prompt template that transforms the AI from a mere code-writing assistant into a systematic "engineering audit and project improvement collaborator." The core recommendation is to apply this prompt to important code repositories. The prompt guides the AI, acting as a world-class principal engineer, through a rigorous four-stage audit process: 1. **Discovery & Mapping:** Systematically explore the repository to understand its structure, tech stack, purpose, and existing conventions before forming conclusions. 2. **Evidence-Based Audit:** Critically examine specific dimensions—architecture, code quality, security, testing, performance, dependencies, devops, and documentation—citing concrete file paths and line numbers for each finding, and rating their severity. 3. **Improvement Strategy:** Synthesize audit findings into 3-5 key thematic issues, propose target states with underlying principles, and define measurable completion criteria. 4. **Detailed Task Plan:** Break down the strategy into actionable tasks with titles, affected areas, acceptance criteria, effort estimates (S/M/L/XL), risk assessment, and dependencies. Tasks are organized into prioritized milestones (Security Net, Critical Fixes, High-Leverage Improvements, Quality Polish) and quick wins are highlighted. The final output is a consolidated report including an Executive Summary with a health grade, the Repo Map, Audit Report, Improvement Strategy, Task Plan, and Open Questions for human decision-makers. The prompt emphasizes evidence over speculation, respects project maturity, and focuses analysis on the core 20% of the codebase.

marsbit06/10 03:58

What Should You Do First with Claude Fable 5? Give Your Code Repository a Comprehensive Checkup

marsbit06/10 03:58

Building Trustless AI Agents: ERC-8004 Security Audit Guide

ERC-8004, the Trustless Agents standard deployed on Ethereum, introduces a verifiable and trust-minimized framework for AI Agent identity and reputation management through three core registries: Identity, Reputation, and Validation. The **Identity Registry** (ERC-721 based) mints a unique AgentID (an NFT) for each agent, with a `tokenURI` pointing to an off-chain registration file. This file contains the agent's basic info, service endpoints, and capabilities. A critical security feature is domain verification, requiring agents to host a signed file at a specific path on their domain to prove ownership and prevent spoofing. Key audit points include access controls for URI updates, use of immutable storage, proper cryptographic signature validation (EIP-712), and prevention of signature replay attacks. The **Reputation Registry** provides a standard interface for submitting and aggregating feedback. It uses a "Payment-Proof Linking" mechanism, where feedback submissions must include a proof of a payment (e.g., an x402 transaction hash), making Sybil attacks economically costly. Audit focuses include enforcing payment proof validity, constraining score ranges, and ensuring robust, manipulation-resistant off-chain aggregation algorithms. The **Validation Registry** allows agents to submit their work for independent verification, crucial for high-stakes tasks. It supports two models: 1. **Cryptoeconomic Validation:** Agents stake funds, which can be slashed via a fraud-proof system if malfeasance is proven. Audits must check proof submission windows, decentralized adjudication logic, and sufficient stake levels. 2. **Cryptographic Validation:** This uses Trusted Execution Environments (TEEs) or Zero-Knowledge Machine Learning (zkML). For TEEs, audits must verify proof timeliness and content. For zkML, audits must ensure the use of audited verifier libraries and prevent model-swapping attacks. Overall, a comprehensive security audit of an ERC-8004 implementation must scrutinize all three registries, their interactions, and standard smart contract vulnerabilities to uphold its promise of a decentralized, trustless agent ecosystem.

marsbit03/05 09:10

Building Trustless AI Agents: ERC-8004 Security Audit Guide

marsbit03/05 09:10

活动图片