Chapter 33 — Web3, blockchain and cryptoasset security: safety and resilience

Chapter 33 — Web3, blockchain and cryptoasset security: safety and resilience

Lesson map

Lesson 33 published. Map, example, EX097.

flowchart TD
  N0["Learning outcomes"]
  N1["33.1 Emergency scenarios"]
  N2["33.2 Pause and recovery"]
  N3["33.3 Rehearsal"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX097"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["33.1 Emergency scenarios"]
  N2["33.2 Pause and recovery"]
  N3["33.3 Rehearsal"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX097"]

[Learning outcomes]
    |
    v
[33.1 Emergency scenarios]
    |
    v
[33.2 Pause and recovery]
    |
    v
[33.3 Rehearsal]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX097]

Learning outcomes

You will (1) plan for emergencies; (2) design pause and recovery procedures; (3) rehearse incident response.

33.1 Emergency scenarios

Jonas describes emergency scenarios: a suspected flaw in the transfer contract, a compromised gateway key, a validator operator acting outside agreements, and a mass outage at the cooperative's site. For each he writes what members would experience, which controls limit harm and what decisions are needed. Thinking through scenarios before they happen allows calm, prepared responses. The EthTrust specification notes that organisational and off-chain security posture, including incident response procedures and emergency shutdown capabilities, matters as much as code. Each is reviewed by the board.

33.2 Pause and recovery

The pause procedure requires two of five board keyholders, an announcement to members within an hour, and continued redemption so members can still use credits for bills. Recovery after a contract flaw follows a documented path: investigate on a test copy, prepare and review a fix, queue the upgrade with the 48-hour timelock, inform members, and unpause after verification. For a compromised gateway key, the minting role is moved to a new multi-signature wallet through governance. Each path names who acts and what evidence is recorded.

33.3 Rehearsal

Jonas runs a tabletop exercise with the board, the developer and one partner operator, using the compromised gateway key scenario. The exercise reveals that only two keyholders know how to sign on the multi-signature wallet, so a timely pause could fail if either is away. The board arranges training for all five and a quarterly signing drill on the test network. Rehearsals reveal practical gaps that documents hide, and they build the confidence needed to act under pressure. The drill results are recorded.

Worked example

Four emergency scenarios are documented; a tabletop exercise reveals only two keyholders can sign, leading to training and quarterly drills.

Synthetic case. Scenarios, exercises and people are synthetic; EEA EthTrust is a real source.

Errors and limits

Writing emergency procedures without rehearsing them leaves untested assumptions about who can act.

Exercises

• EX097 — Redemption during pause. Why does redemption continue during a pause? Rubric: 3 = members can still use credits for bills;; 2 = bills;; 1 = vague;; 0 = none.
• EX098 — Recovery step. Name one step in contract-flaw recovery. Rubric: 3 = queue upgrade with 48-hour timelock;; 2 = review fix;; 1 = delete contract;; 0 = none.
• EX099 — Rehearsal gap. What gap did the tabletop reveal? Rubric: 3 = only two keyholders knew how to sign;; 2 = signing skills;; 1 = vague;; 0 = none.

Synthesis

Prepared scenarios, clear pause and recovery paths, and rehearsals make the system resilient.

Continue studying — chapter 33 of 50

← Chapter 32 (draft) · Course chapter index · Chapter 34 (draft) →