search

yearn / budget

yearn budget requests and audits
MIT License
36 stars 26 forks source link

Security Team Budget Request v3 #172

Open rareweasel opened 8 months ago

rareweasel commented 8 months ago

Scope

This budget request is for the security team comprised currently of two core contributors and one internship slot to continue contributing with security-related work in the yearn ecosystem. It will keep the main plan, and scope of the previous version.

The list of updates published in the previous (v2) budget request:

Presentation: link

This request will cover one quarter (3 months) and continue the team's work on security reviews for all contracts under development in the yearn teams as capability allows. Over the following period, these budget requests should develop and provide a detail of work attempted and achieved.

This request also will detail an overview of the team's goals and objectives for the period.

Note that this budget request includes no revenue share.

Plan

Note that there are no clawbacks based on the below performance targets. But performance should impact future budget requests.

Security Reviews

The security team will continue to work on the following:

External Security Reviews & Audits Coordination

The security team will guide and coordinate all the external security reviews and audits when requested by yteams.

The process for coordinating audits and external security reviews is the following:

  1. The yTeam that needs an audit/external security review will request coordination/help.
  2. The security team will coordinate the slot/s with the audit firms or external reviewers.
  3. Once and agreement with audit firm is reached, security team will create a group so yTeam and auditors can ask/answer questions. Coordination of payment and budget is managed by each yTeam.
  4. Once the audit/review finishes, the security team will review the report and coordinate with yTeam to help review issues to ensure they are fixed or acknowledge.

Note that this process might change based on the team's needs.

Ad hoc

The security team will also continue working with existing Yearn teams (or new ones) to provide ad-hoc support. Including but not limited to offering:

Risk Framework On-chain

As part of concerted plan of improving on yearn's current risk framework and overall security to support the upcoming launch of v3 and also integrating into it yETH and other yearn's core contracts, we developed and executed the plan to launch the risk framework protocol, which consists of a suite of contracts to manage yearn's risk framework.

In order to migrate the Risk Framework off-chain to on-chain, the security team has already deployed the initial smart contracts for a pilot phase on Polygon. In that direction, we also created this multi-sig (multichain) that will manage the configuration (scores).

We also have developed and published the subgraph to make it easier to query data from the contracts.

Both items have been tested successfully (set scores and tags) with some strategies/vaults from v2/v3 on Polygon.

Links:

The migration phase will follow after our initial pilot. We plan to back up all the current strategies and scores (342 strategies in 5 networks) from yDaemon. Verify and update each score as needed and publish in the on-chain version -only active strategies- gradually during pilot phase to test integrations.

Detailed Phases:

Last cycle we started the first phase of the onchain framework, feedback and changes are expected as we adjust the new Risk framework to be capable of supporting yearn's important core contracts. Continous development and improvement will happen during the upcoming cycles.

As a key integration, ySecurity plans to closely work with v3 strategist group to detailed an overall process for maintaning and showing in the UI and other tooling the appropiate risk information to yearn's contract users. This may entail combining external risk data (defi safety and llamarisk being in discussion) with our internal DD and risk process to have an aggregate and consistent risk profile to present to users.

Risk Framework - CLI

As part of our launch of the pilot phase onchain risk framework, we are providing additional tooling to interface with the core functionality of the protocol, the CLI is planned to be the primary interface to interact with yearn's risk framework.

This CLI will be in development but already supports the key functionality of providing the graph for the risk heatmap which is no longer active on the deprecated yearn.watch/risk page and is a key input for v2 allocations decisions (currently not showing the heatmap).

pyrisk CLI

CLI Heatmap

Planned functionality for this cycle:

We believe this tooling is key for both yearn's normal operations and more so during exceptional times like in war rooms, where we need quick information of specific vaults and strategies to integrate with our other scripting tooling. Our goal for the CLI is to be a tool used by all yTeams.

Internal Simulation Attacks

As part of the team that provided information to the SEAL team for the Simulation Attack on Yearn, we considered these simulations an imperative experience and tool for improving processes, understanding our weaknesses, and testing our response time.

That being said, our goal is to build the foundations in terms of tools, scripts, and bots to simulate attacks internally on a regular basis. Considering we don't have anything built yet, we plan to start building (or reusing) these tools in this BR period to create simulated attacks on v3, yETH, etc.

Goals

The security team plans to:

Period

It will cover 3 months:

People

Money

This budget request includes the following concepts:

Funds to be streamed over three months, starting 1st November 2023.

Total:

136,740.00 DAI

Any funds not spent at the end of the period will be transferred back to the yBudget team or considered for the next period.

Funds Details

The previous YFI amount was converted into DAI at 5500 DAI as an average price during the last 3 months.

YFI Conversion

YFI Conversion

Funds Details

Wallet address

0x4851C7C7163bdF04A22C9e12Ab77e184a5dB8F0E

Reporting

Monthly in this issue.

rareweasel commented 6 months ago

Security Team November Updates

NOTE: some of the links for internal gh repos are access restricted for security purposes.

rareweasel commented 5 months ago

Security Team December Updates

NOTE: some of the links for internal gh repos are access restricted for security purposes.

rareweasel commented 5 months ago

Security Team January Updates

NOTE: some of the links for internal gh repos are access restricted for security purposes.