The inevitable response to this take is condemnation from the culture, NFT, gaming etc crowd. But finance focus is not the nail in the coffin for “web3” Finance is hard. It has more stringent requirements. When I worked in TradFi, we had to abandon most off-the-shelf software because it took bad trade offs on important considerations like latency and consistency. Great finance software can work for everything else. Great everything software will not work for finance. Solana going laser focused on solving the hardest problem (finance) doesn’t mean you can’t use it for culture, gaming, etc. The best way to win is not to be everything to everyone. Creatives will always find ways to use tools beyond their intended scope. When you have a hammer everything looks like a nail. But maybe we start by hitting the actual nails first.
With Alpenglow going live, we as application devs have a responsibility to keep a consistent Slowlana experience. That means we need to make programs slower. Some suggestions: - Avoid zero copy. Borsh everything - Shove everything on the heap - Where possible, use python or javascript to write programs - Re derive bump seeds for every PDA, every time - You're not logging enough. More msg!
PSA to those of you regularly using new products: Audits cost hundreds of thousands of dollars and take weeks to complete. Self-bootstrapped startups can't even afford them. There's actively a disincentive for your favorite protocols to stay on top of security, as it impedes their ability to iterate and find pmf. Do they pay $50k to audit a new feature that it turns out nobody uses? Make sure what you're using has been audited by someone you trust, and that what's running on mainnet is the code that was audited (verified builds, open source required). If you can't verify that's fine, but don't put all your eggs in that one basket. Solana Foundation has a program that provides audits for anyone with more than $10m TVL, which should definitely help.
Going to address this head on. We did not just audit the refactor diff from Drift to Velocity. We audited the *entire* codebase. This couldn't be further from a rush job. If we wanted to rush it, we could have just audited the diff, called the old code fine, and launched months ago. We wanted to err on the side of safety, which meant re-auditing the full codebase. This is expensive, and takes a long time. Drift is one of the largest Solana programs in existence with tens of thousands of lines of code. But it was the right thing to do, because safety is our priority. Yes, it's a lot of findings. But relative to the amount of code, it makes sense. Most findings were in pre-refactor code, and most of them would not result in LoF in any real situation. It was a herculean effort to (1) review this massive monolith, thanks auditors! (2) fix every issue no matter how small. That is why the launch has been pushed back so far.