Security Issues: Core Topics in the Crypto Assets Industry for the Next Decade

Security issues are likely to become one of the most discussed topics in the Crypto Assets industry over the next decade. This issue has contradictions in both decentralized and centralized directions. Let's delve into this issue from the following perspectives:

1. Asset Sovereignty
2. Smart Contract Security
3. Anti-censorship capability
4. Wallet Security

Asset Sovereignty

Decentralized systems clearly outperform centralized systems in terms of asset autonomy. Users can have complete control over their assets, which became the mainstream narrative during the DeFi boom in 2020 and was also the cause of the large-scale withdrawal movement at that time.

However, with the frequent attacks on smart contracts and incidents of unauthorized coin theft, we find that the increase in asset autonomy does not necessarily equate to an enhancement in security. Many ordinary users lack the ability to identify risks, and managing assets securely on the blockchain requires a significant amount of learning time and experience accumulation, which undoubtedly raises the threshold for self-managing assets.

Therefore, new users entering the market often tend to entrust their assets to trading platforms or institutions, hoping to leave professional matters to professionals. Although this approach sacrifices the autonomy of the assets, it exchanges for the custody services provided by centralized institutions.

Currently, trading platforms and blockchain essentially attract different user groups, both of which carry corresponding risks, though the manifestation of these risks differs. On-chain self-management of assets offers strong autonomy, allowing users to have 100% control over their assets, but this requires sufficient experience and risk management skills. While entrusting management to trading platforms is simpler, it may face centralization risks. There is no perfect solution; the key is to understand where the risks lie and to remain vigilant at all times.

Smart Contract Security

"Risks always lurk in the unknown"

Apart from asset management, from the perspective of decentralized finance (DeFi) projects, non-upgradable and permissionless smart contracts are considered decentralized and immutable. But does this mean absolute security? The answer is no. Due to the inherent risks of smart contract code that cannot be fully predicted and simulated, if a critical smart contract has a fatal flaw and centralized intervention is not possible, it could lead to irreparable losses. In the early days of DeFi, there have already been multiple similar cases.

So, how will the security of smart contracts develop in the future? In accordance with the original intention of decentralization, simple smart contracts will first undergo testing by time and the market to achieve "solidification," meaning they will become completely decentralized and immutable. Then, the complexity of the contracts will gradually increase. In this process, some complex projects will inevitably need to set up emergency mechanisms at critical points to prevent losses caused by major events. (Of course, various permission constraints are usually employed during this process to control power and prevent the risks brought by excessive centralization.)

Therefore, the security of smart contracts must be tested and verified over time. The current doubts regarding the security of DeFi are actually doubts about the future of the entire industry. The security issues faced by smart contracts are challenges that all future blockchain projects will encounter, whether in GameFi or SocialFi. DeFi is just a pioneer, paving the way for those who come after.

Resistance to censorship

Censorship resistance is an aspect that many people easily overlook, as most believe they are just conducting simple transactions, seemingly far from censorship resistance. However, in reality, once you experience censorship, you will deeply realize the importance of censorship resistance. It directly makes you feel that without decentralization, your assets do not truly belong to you. This topic can be elaborated on a lot, but fundamentally, those who understand will realize that censorship resistance might be the most important aspect of the vision of decentralization.

At this point, censorship resistance and asset sovereignty complement each other, and decentralized management is indeed superior to centralized management.

Wallet Security

When it comes to storing assets on the blockchain, we often encounter cold wallets, hot wallets, and hardware wallets.

Cold wallet: Simply put, it means that the private key does not come into contact with the internet during its creation and management process. Users can create cold wallets themselves, such as using an old iPhone, and there are many tutorials and materials available online. From a personal management perspective, this method has a very high security factor, and the only thing to be careful about is not to lose the paper where the mnemonic phrase is recorded.

Hardware Wallet: It is not equivalent to a cold wallet. Hardware wallets involve many hardware technologies, and in general, the generation of private keys is also offline, but the controversy lies in the fact that the manufacturers providing the hardware are also centralized institutions, which theoretically may pose centralization risks. On the other hand, hardware wallets usually have an additional verification step before executing transactions, akin to security measures such as U-shield or security cards.

Hot Wallet: This is the type of wallet we use the most in our daily activities. It is more convenient and flexible to use, but frequent on-chain interactions will increase the number of authorizations and signatures for the wallet. Especially if some upgradeable contracts are authorized, although there may be no issues currently, the upgraded contracts may bring new risks, laying hidden dangers for the future.

The use of wallets is usually configured according to individual circumstances. The security of the wallet is essentially the security of the private key and permissions.