Chapter 35 — Design studio II | Engineering Web3, blockchain and cryptoasset security

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 35 — Design studio II

Lesson map

Lesson 35 published. Map, example, EX103.

flowchart TD
  N0["Learning outcomes"]
  N1["35.1 Studio review"]
  N2["35.2 Addressing open risks"]
  N3["35.3 Production readiness"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX103"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["35.1 Studio review"]
  N2["35.2 Addressing open risks"]
  N3["35.3 Production readiness"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX103"]

[Learning outcomes]
    |
    v
[35.1 Studio review]
    |
    v
[35.2 Addressing open risks]
    |
    v
[35.3 Production readiness]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX103]

Learning outcomes

You will (1) review the integrated design with peers; (2) address open risks; (3) plan production readiness.

35.1 Studio review

In the second design studio, Jonas presents the integrated system: architecture, implemented contracts, integration, metrics and emergency procedures. Peers and a visiting practitioner from a fictional audit firm review it against the requirements and threat analysis. They ask how the design handles a member losing their own wallet key, a risk listed in the threat analysis but not fully addressed. Studio reviews bring fresh eyes to a design that its author has stared at for months. He records every question raised for follow-up.

35.2 Addressing open risks

For member key loss, the team designs two paths. Members using cooperative-managed custody recover through identity verification at the office. Members using their own wallets can register a recovery address in advance; if they lose their key, the board can, after a 14-day timelock and identity verification, move their credits to the recovery address. Jonas weighs this against the risk that the recovery power could be misused, and adds requirements that every recovery is announced and logged. The board approves both paths after discussion.

35.3 Production readiness

The studio produces a readiness checklist: external review completed and findings resolved; role policy conformance at 100 percent; invariant and reconciliation tests passing; monitoring and alerts live; emergency drills done with all keyholders; member communications prepared; and rollback plans documented. Each item has an owner and evidence. Jonas notes that readiness is a decision by the board based on evidence, not a date on a calendar, and that the checklist makes that decision transparent. Evidence for each item is stored in the readiness folder for the board.

Worked example

Studio review identifies member key loss as unresolved; two recovery paths with a 14-day timelock are designed; a seven-item readiness checklist is agreed.

Synthetic case. Designs, reviewers and checklists are synthetic.

Errors and limits

Launching on a fixed date without evidence of readiness puts members' credits at risk.

Exercises

EX103 — Unaddressed risk. What risk did the studio find unaddressed? Rubric: 3 = member wallet key loss;; 2 = key loss;; 1 = vague;; 0 = none.
EX104 — Recovery timelock. How long is the recovery timelock? Rubric: 3 = 14 days;; 2 = two weeks;; 1 = 48 hours;; 0 = none.
EX105 — Readiness nature. What is readiness according to Jonas? Rubric: 3 = a board decision based on evidence;; 2 = evidence;; 1 = a date;; 0 = none.

Synthesis

Peer review closes open risks, and an evidence-based checklist supports the production decision.

Continue studying — chapter 35 of 50

← Chapter 34 (draft) · Course chapter index · Chapter 36 (draft) →