Peter (not a federal agent)

I wrote this for people who are interested in Web3 security, as well as those who may be planning to take security-related certifications in the future. I also hope it can be useful for anyone thinking about Web3 security on a personal level. Since we are in a bear market, I thought it might be a good time to make a few posts that also make use of what I have learned through my main job. @arc mainnet is getting closer, and one thing that stood out to me was the security design around @hibachi_xyz . Rather than going deeply into the technical details, I wanted to share more about the way I think about the security approach itself. Looking at Hibachi’s safeguards, it feels like there is a clear awareness of: Prevention → Detection → Containment One thing I personally think can be risky in security is relying too much on the idea that: We should prevent every intrusion or malicious action from ever happening. Of course, prevention is extremely important. But no matter how many safeguards are added, vulnerabilities and compromises can still happen in both Web2 and Web3. So I think another important question is: What happens after an attack succeeds? A system can be stronger when there is still another layer between a successful attack and the actual loss of assets. For example, with Hibachi: One oracle is compromised ↓ That alone is not enough to change the price ↓ Trading and settlement are also validated separately ↓ State changes are constrained as well ↓ And even if an attacker somehow gets through those layers, vault withdrawals are not instant What I like about this approach is that breaking through one safeguard does not immediately mean reaching the assets. Personally, I think this kind of design is more reassuring than simply saying: "We added these security measures, so everything should be fine." A stronger way to think about it may be: "Even if this layer is compromised, there is another one after it. And even if that is compromised too, there is still time before assets can leave the system." Security is not only about trying to prevent 100% of attacks. ⭐I think it is also important to assume that something may eventually go wrong, and then design the system so that the damage can still be limited.⭐️ That feels especially important in Web3, where protocols often handle assets directly.