Open iJrod opened 2 years ago
Hi all,
Thanks for this submission, we needed a bit of time to review to ensure the deliverables and timelines could map well into some of our plans for FLIP 934. We also needed to orient the milestones to be weighted heavier on deliverables that would help evaluate the efficacy of the proposed solution and adoption of it.
Here is our proposed amendments to the milestones, let us know what you think: | Milestone | Deliverables | Suggested Deadline | USD Suggested | |
---|---|---|---|---|---|
1 - Security review and threat modeling | Threat models and associated impact / likelihood of the existing Interaction Templates architecture | September 15th, 2022 | 10,000 | ||
2 - Key Risk Indicators for Flow | Define 3-5 KRI's based on a standardized methodology that are quantifiable, provide trending analysis, and provide a clear view of associated risks to Flow and Flow users | October 15th, 2022 | 5,000 | ||
3 - FVPL Metadata standards | Definition of Web2 and Web3 metadata elements which will be used for an inital set of KRIs (see milestone#3) and a normalisation approach for metadata. | October 30th, 2022 | 5,000 | ||
4 - Risk Indicator Service MVP | A service that is capable of calculating and storing the risk indicators in any format. Demonstrates and validates the need and effectiveness of the key indicators. | October 30th, 2022 | 15,000 | ||
5 - Risk Indicator Service Production | A production level build of the risk indicator service with threat modelling. | November 15th, 2022 | 20,000 | ||
6 - Adoption | At least 2 existing wallet providers must tentatively agree to the usage of this service. | December 15th, 2022 | 10,000 |
Total USD: $65,000
Thanks for getting back to us @srinjoyc - we have formally followed up via email after reviewing the updated milestones above.
We're happy to proceed, and looking forward to working with Flow alongside FLIP 934.
@iJrod - Great, consider the grant accepted, and feel free to get started! We will have some paperwork coming your way via email shortly this week!
Inconfido: Flow Verified Projects Ledger (FVPL)
Grant category
Please select one or more of:
Description
Problem statement
End users have the burden to validate and confirm that the smart contracts they interact with are legitimate and correctly associated with the project. This burden makes users susceptible to hacks and result in the irreversible loss of user funds.
Developers and wallets currently have no way of presenting verified metadata in a human readable way to end users, which would inform them when they are connecting to an unverified and potentially malicious smart contract.
Proposed solution
Impact
We will initially look into Flow’s FLIP on “Interaction Templates” and provide an analysis of pros and cons of using this method to provide human-readable user interaction and protect users against malicious activities. This will help Flow devs in shaping their roadmap for this proposal.
We will then formulate a view on how our security product, FVPL, that stores and uses Web2 and Web3 context for risk scoring could fit in with “Interaction Templates” and the proposed stakeholder roles. This will allow us and the Flow team to better understand how everything will work together to protect its builders and users.
Our ultimate vision is to provide users with clear and actionable data so they can make better decisions when interacting with smart contracts on Flow. FVPL, along with other existing mechanisms such as “Interaction Templates” will provide users with confidence in understanding when they are interacting with verified and secure smart contracts and when they might be executing risky transactions.
Link to “Interaction Templates” FLIP: FLIP #934
Additionally, Flow developers and builders will get enhanced security that they can embed into their projects and allow third-parties to deliver human-readable security for end-users. Builders on Flow will also leverage the security tools we will be providing in the future to encourage safe composability and secure development on Flow.
Summary:
Developers will receive:
Community / ecosystem will receive:
Overall:
Milestones and funding
- Engage recruiter
- Define pay schedule
- Perform interviews / onboarding
- Get job board posting
- Build 3-5 threat scenarios against architecture, including attack steps, and associated risk profile
- Review with interaction template team and provide recommendations
- Design analytics processes to capture trends
- Design mechanism to capture the metadata
- Design normalisation approach
- Create mock ups on UI
- Review with interaction template team and provide recommendations
Team