درباره این اپیزود
When Sky's audits return serious issues, they don't just fix bugs and ship—they pull the brake and investigate what failed in their internal review process. Deniz Yilmaz, CTO of Sky Frontier Foundation, walks through the defensive layers behind USDS (third-largest stablecoin globally): six-month engineer onboarding requirements, spellcrafting governance with mandatory execution delays, and a protocol security team dedicated to codifying the implicit knowledge that keeps audit reports clean.
Topics discussed:
Treating audit findings as internal process failures requiring investigation, not just bug fixes
Six-month mandatory onboarding periods before engineers can modify spellcrafting code
Pre-audit internal review standards achieving consistent zero-finding results across multiple audit firms
Spellcrafting governance requiring bi-weekly token holder votes and execution delays for all protocol changes
LLM auditing integration delivering PR-level feedback before code reaches internal review
Mandatory OPSEC certification with domain hash verification testing for multisig signers
Protocol security workstreams codifying senior engineer practices into transferable frameworks
Auditor selection prioritizing codebase-specific experience over firm reputation
Subdao security enforcement maintaining core standards across autonomous entities with independent economics
Game theory-based development considering internal actor exploitation during code design
