# Сопутствующие статьи по теме Audit

Новостной центр HTX предлагает последние статьи и углубленный анализ по "Audit", охватывающие рыночные тренды, новости проектов, развитие технологий и политику регулирования в криптоиндустрии.

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

OpenClaw, a popular open-source, self-hosted AI agent platform, has experienced rapid growth due to its flexibility and extensibility. Its ecosystem relies heavily on third-party “Skills” from the Clawhub marketplace, which can perform high-risk operations like system automation and crypto wallet transactions. However, security firm CertiK has identified critical vulnerabilities in the platform’s security model. CertiK’s research reveals that OpenClaw’s current security—primarily dependent on pre-publishing scans like VirusTotal, static code analysis, and AI logic checks—is fundamentally flawed. These measures can be easily bypassed through simple code obfuscation, and malicious Skills can be published even before scanning is complete. In a proof-of-concept, CertiK developed a seemingly benign Skill that contained a hidden remote code execution vulnerability. It passed all checks without warnings and, once installed, allowed full system control via a remote command. The core issue is not a specific bug but a industry-wide misconception: over-reliance on scanning instead of runtime isolation. Unlike systems like iOS, which enforce strict sandboxing, OpenClaw’s sandbox is optional and often disabled for functionality, leaving systems exposed. CertiK recommends that OpenClaw enforce mandatory sandboxing and granular permission controls for Skills. Users are advised to deploy OpenClaw on isolated devices and avoid exposing sensitive data or assets until stronger isolation is implemented. The report stresses that security must evolve from detection-based approaches to default containment of risks at runtime.

marsbit03/17 14:39

Is Your "OpenClaw" Running Naked? CertiK Test: How Vulnerable OpenClaw Skill Bypasses Audits, Takes Over Computers Without Authorization

marsbit03/17 14:39

U.S. Tax Collection Reaches Wallet Exchanges from 6 Years Ago? Four-Layer Breakdown of the IRS's New Form

The U.S. IRS has introduced a new audit form requiring taxpayers to disclose all digital asset platforms, wallets, and services used, including exchanges like Coinbase, Binance, and defunct entities like FTX, as well as self-custody wallets such as MetaMask and Ledger. This form, part of a broader tax enforcement strategy, mandates detailed account information and transaction history, with penalties for false declarations under perjury laws. This move is not sudden but results from years of regulatory evolution, starting with the 2017 John Doe subpoena to Coinbase, which compelled the exchange to share user data. The 2021 Infrastructure Investment and Jobs Act further classified crypto exchanges as "brokers," requiring them to report user data via Form 1099-DA starting in 2025. The IRS employs a four-layer data approach: exchange reports, traditional financial records, blockchain analysis, and audit questionnaires. While centralized exchanges remain key data sources due to KYC requirements, the focus may shift to on-chain protocols like Hyperliquid, where transactions are transparent but identity linkage is weaker. The IRS typically audits up to three years prior, extendable to six for significant underreporting. High-risk groups include those who reported minimal crypto activity despite acknowledging it, discrepancies in 1099-DA forms, and high-frequency traders during the 2017-2021 bull market. Tax professionals advise consulting experts before responding to audits. Globally, tax authorities like the UK's HMRC and Australia's ATO are also tightening crypto tax reporting, signaling a broader regulatory trend.

Odaily星球日报03/16 02:52

U.S. Tax Collection Reaches Wallet Exchanges from 6 Years Ago? Four-Layer Breakdown of the IRS's New Form

Odaily星球日报03/16 02:52

活动图片