NewsFlash Articles Data Fundraising BlockBeats Pro

Blast responds to security concerns: will update one of the multi-signature addresses within one week, and the contract settings are designed for security considerations.

Read this article in 4 Minutes

Choosing a project without time locks and upgradable smart contracts is a safer option as long as the project itself is not malicious.

Source: Blast

BlockBeats News, November 25th. Blast responded to the doubts about its security in the market, stating that there are often misunderstandings about security. Security exists within a range (there is nothing that is 100% secure), and there are subtle differences in many aspects, such as smart contract security, browser security, and physical security, each with separate attack vectors.

Having immutable smart contracts seems like a "safer" choice. However, especially in complex contracts, its security may not be as good as upgradable contracts.

Users can review immutable smart contracts an unlimited number of times, but can never be 100% certain that the smart contract is error-free. If there are errors in the immutable contract, it can cause significant trouble.

When it comes to upgradable smart contracts, the specific upgrade mechanism is crucial. It seems that using a time lock for token gate control upgrades would be "safer". However, this also opens the door for malicious actors to monopolize token supply.

The upgradable smart contract of the time lock may have vulnerabilities. Typically, the only way to avoid exploitation is to perform on-chain operations before malicious actors. In these cases, the time lock reduces the security of the smart contract.

This is why every Layer 2 has a direct upgrade path. Layer 2 solutions such as Arbitrum, Optimism, and Polygon use multi-signature because they can be very effective if used properly. So, how do you use multi-signature correctly?

The user wants to ensure that each signature key of the multi-signature is independently secure, which helps to make the multi-signature resistant to vulnerabilities. Each key should be stored in a cold wallet, managed by an independent party, and dispersed geographically.

For Blast, each signer possesses these attributes. They are technically proficient engineers with experience ranging from financial applications to high-risk applications such as smart contracts.

However, Blast can still further improve its security. In order to better respond to black swan events, Blast will update one of its multi-signature addresses within one week to switch to a different underlying hardware wallet provider, ensuring security even in the event of unprecedented hardware wallet damage.