Interested to hear about an experience of auditing a $20 million project? Learn how he meticulously examines codes and documentation pre-launch, ensuring a solid foundation. Discover how his expert audit contributed to a remarkable $2 million increase in Total Value Locked (TVL), shortly after completion.

Watch the full interview over here:
https://youtu.be/4JmqHnkSlFI

Become a Certified Smart Contract Auditor:
https://johnnytime.xyz/smart-contract-hacker

Pashov shares his perspective on the responsibility of safeguarding substantial sums, acknowledging both the influence and accountability that accompanies his expertise.

For more insight into the landscape of blockchain security, join us in this discussion. Gain a deeper understanding of the multifaceted role of an auditor in fortifying the industry.

And also you mentioned that some of the protocols that you audited, they had TVL of $20 million.

Was it like before you started auditing that, it was like an on-chain deployed protocol, or after you finished, then it was deployed and then the TVL came in?

Yeah, actually not before, because I don't audit protocols that are already live on mainnet.

Usually not because they cannot be upgraded.

Most of the time, they cannot be upgraded.

They cannot be, if I find security issues, they cannot be fixed.

And protocols realize this and they know they have to get an audit before launching on mainnet.

So yeah, this protocol, I think got this TVL after my audit, they got like $20 million of TVL after this 1 that I have just audited.

Like I audited it on, let's say I finished on Friday and on Saturday night, it already had almost $2 million locked into it.

And yeah, some protocols, I don't even realize that, they're big protocols.

I mean, I always read their docs and I read their code, but sometimes I don't go exactly on their, on their statistics or on their website.

I go on the docs on the GitHub on their website, but I sometimes don't go on their exact website where you can see like $10 million of TVL.

Our application is number 1 in whatever leaderboard or whatever.

So yeah, sometimes I don't even realize how big a protocol that I'm reviewing is.

And another 1 that I have reviewed, the mbuyer wallet, I have reviewed their version 2, but their version 1 have like more than 20 millions of total value locked.

And some of those money will be migrating to the new version of their wallet and all of their new users will be off their new wallet version, which I have reviewed personally.

So it's a big responsibility, but it's crazy, it's crazy securing so much money.

I believe it's very satisfying to know that you helped to secure a contract that now holds $20 million, that you are the 1 that if you miss something, this $200 million could be at risk.

This responsibility comes with authority, which is a good thing, because you are actually an authority in the space.

Your word matters, your thinking matters, and people respect you, which is a great thing.

But you have the responsibility because if a protocol gets hacked, you probably be the 1 to be judged about it.

And I'm sure I'm certain that this will happen someday to me as well, because I don't think there is a researcher who has done enough audits, who hasn't had a protocol getting hacked or at least a protocol getting, for example, reported a critical severity or a high severity issue reported on Immunify or whatever.

You cannot guarantee security with audits, but you can just do your best, do your best effort.

And yeah, it's a great thing to know that the protocols that I have been auditing have been doing very well so far.

There is no 100% guarantee in anything in security.

Obviously, it will help you be better in terms of security, but it's always better to get more approaches, either if it's like bug bounties, if getting audits from multiple companies or multiple auditors.

It's just we always say in also in traditional cybersecurity, we are we cannot prevent a hack 100 percent.

We can make the hacker life 10 times or 100 times more difficult.

So it will will choose a different target that is easier.

So you are trying to make his time not profitable.

And the more you secure the system, the harder for it, and the more expensive.

It's all terms of money, time and resources.

Maybe not always in smart contracts, but in traditional cybersecurity, any network, any machine, you know, the most secure machine is a machine that is shut down.

You know, there is no electricity going in the computer.

But any computer can be hacked, any cellular, mobile phone can be hacked.

And yeah, it's all about making the hacker life harder and making his attack more expensive and more resource consuming.


Speaker 0: And also you mentioned that some of the protocols that you audited, they had TVL of $20 million. Was it like before you started auditing that, it was like an on-chain deployed protocol, or after you finished, then it was deployed and then the TVL came in?

Speaker 1: Yeah, actually not before, because I don't audit protocols that are already live on mainnet. Usually not because they cannot be upgraded. Most of the time, they cannot be upgraded. They cannot be, if I find security issues, they cannot be fixed. And protocols realize this and they know they have to get an audit before launching on mainnet.

So yeah, this protocol, I think got this TVL after my audit, they got like $20 million of TVL after this 1 that I have just audited. Like I audited it on, let's say I finished on Friday and on Saturday night, it already had almost $2 million locked into it. It was a staking contract. Yeah. So, so it's, it's crazy.

And yeah, some protocols, I don't even realize that, they're big protocols. I mean, I always read their docs and I read their code, but sometimes I don't go exactly on their, on their statistics or on their website. I go on the docs on the GitHub on their website, but I sometimes don't go on their exact website where you can see like $10 million of TVL. So many users are using it. Our application is number 1 in whatever leaderboard or whatever.

So yeah, sometimes I don't even realize how big a protocol that I'm reviewing is. And another 1 that I have reviewed, the mbuyer wallet, I have reviewed their version 2, but their version 1 have like more than 20 millions of total value locked. And some of those money will be migrating to the new version of their wallet and all of their new users will be off their new wallet version, which I have reviewed personally. So it's a big responsibility, but it's crazy, it's crazy securing so much money. It's really, it's really...

Speaker 0: I believe it's very satisfying to know that you helped to secure a contract that now holds $20 million, that you are the 1 that if you miss something, this $200 million could be at risk.

Speaker 1: Of course, of course. This responsibility comes with authority, which is a good thing, because you are actually an authority in the space. Your word matters, your thinking matters, and people respect you, which is a great thing. But you have the responsibility because if a protocol gets hacked, you probably be the 1 to be judged about it. And it's a dangerous thing.

And I'm sure I'm certain that this will happen someday to me as well, because I don't think there is a researcher who has done enough audits, who hasn't had a protocol getting hacked or at least a protocol getting, for example, reported a critical severity or a high severity issue reported on Immunify or whatever. So it's just a matter of time. You cannot guarantee security with audits, but you can just do your best, do your best effort. And yeah, it's a great thing to know that the protocols that I have been auditing have been doing very well so far. It's a good thing.

Speaker 0: Definitely. There is no 100% guarantee in anything in security. Audit is not 100%. Obviously, it will help you be better in terms of security, but it's always better to get more approaches, either if it's like bug bounties, if getting audits from multiple companies or multiple auditors. It's just we always say in also in traditional cybersecurity, we are we cannot prevent a hack 100 percent.

We can make the hacker life 10 times or 100 times more difficult. So it will will choose a different target that is easier. So you are trying to make his time not profitable. And the more you secure the system, the harder for it, and the more expensive. It's all terms of money, time and resources.

Anything can be hacked. Maybe not always in smart contracts, but in traditional cybersecurity, any network, any machine, you know, the most secure machine is a machine that is shut down. You know, there is no electricity going in the computer. But any computer can be hacked, any cellular, mobile phone can be hacked. You have 0 days.

And yeah, it's all about making the hacker life harder and making his attack more expensive and more resource consuming. Assuming.

See all JohnnyTime transcripts on Youtube

He Audited a Project with $20,000,000 of Total Value Locked