Monad Co-Founder Releases 10-Point Security Checklist for Protocols

ME News reports that on April 3 (UTC+8), Keone Hon, co-founder of Monad, published a protocol security self-audit checklist on X, focusing on core issues such as administrative permissions, fund security, and multi-signature design. The checklist includes ten key points: 1. Identify which admin functions could lead to fund loss; 2. Ensure all relevant operations are protected by time locks; 3. Implement real-time monitoring mechanisms; 4. Trigger immediate alerts when admin functions are invoked; 5. Review all privileged accounts and adopt multi-signature (k-of-n) structures wherever possible; 6. Clearly define signature threshold parameters; 7. Multi-signature signers should use dedicated cold devices solely for signing operations and follow best practices (e.g., independently verifying transaction hashes); 8. Apply rate limits on withdrawals and avoid having the same multi-signature control both withdrawals and other critical functions; 9. Ensure employee devices are equipped with malware detection and management capabilities; 10. Predefine extreme scenarios where multi-signature signers are compromised; analyze potential attack vectors from an attacker’s perspective and optimize system design to increase the cost and complexity of attacks. Previously, Drift Protocol adjusted its multi-signature setup to “2/5” (one old signer + four new signers) one week before suffering a $285 million hack, without implementing a time lock. The attacker subsequently gained admin privileges, forged CVT tokens, manipulated oracles, disabled security mechanisms, and transferred high-value assets from the vault. (Source: PANews)