Chapter 2 — Web3, blockchain and cryptoasset security: service and stakeholder context
Lesson map
Lesson 02 published. Map, example, EX006.
flowchart TD
N0["Learning outcomes"]
N1["2.1 The donation service"]
N2["2.2 Stakeholders"]
N3["2.3 Regulatory context"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX006"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["2.1 The donation service"]
N2["2.2 Stakeholders"]
N3["2.3 Regulatory context"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX006"]
[Learning outcomes]
|
v
[2.1 The donation service]
|
v
[2.2 Stakeholders]
|
v
[2.3 Regulatory context]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX006]
Learning outcomes
You will (1) describe the donation service end to end; (2) identify stakeholders and their needs; (3) understand the regulatory context at a high level.
2.1 The donation service
Marcus maps the service: donors send cryptoassets to a published address; the treasury wallet, a 2-of-3 multi-signature arrangement held by the finance lead, the director and a trustee, receives them; the finance team records each donation with a receipt; once a month signers approve a transfer to a regulated exchange account; the exchange converts to local currency and pays the charity's bank account. He notes each step's owner and records. Seeing the end-to-end service shows where security matters beyond the ledger: publishing the correct address, recording donations, approving transfers and dealing with the exchange.
2.2 Stakeholders
Stakeholders include donors, who want their gifts to reach the charity; trustees, who are accountable for funds; the finance team; the exchange; auditors; and regulators. Marcus interviews the finance lead and a trustee. The trustee's main worry is a mistaken transfer that cannot be reversed; the finance lead worries about recording donations correctly for tax receipts. Each concern points to a control. Understanding stakeholders' needs helps Marcus prioritise and explain security work in terms that matter to the people who must approve and fund it.
2.3 Regulatory context
Marcus learns, at a high level, that rules for cryptoassets vary by country and change frequently, and that charities have duties around donor identity, record keeping and the prevention of misuse of funds. He does not attempt legal analysis himself. Instead he lists questions for the charity's legal adviser: what records must be kept, what checks apply to large donations and what reporting is required. NIST IR 8202 provides technical background but not legal guidance. Recognising the limits of one's expertise is part of professional practice.
Worked example
Marcus maps the service from published address to bank account and lists legal questions for the adviser rather than attempting legal analysis.
Synthetic case. The service, interviews and context are synthetic; NIST IR 8202 is a real source.
Errors and limits
Attempting legal conclusions without expertise risks wrong compliance decisions.
Exercises
- EX006 — Treasury signers. Who holds the treasury signing roles? Rubric: 3 = finance lead, director and a trustee;; 2 = three officers;; 1 = one person;; 0 = none.
- EX007 — Conversion route. How are donations converted? Rubric: 3 = through a regulated exchange account to the bank;; 2 = exchange;; 1 = cash;; 0 = none.
- EX008 — Trustee worry. What worries the trustee most? Rubric: 3 = an irreversible mistaken transfer;; 2 = irreversibility;; 1 = slow website;; 0 = none.
- EX009 — Finance worry. What worries the finance lead? Rubric: 3 = recording donations correctly for receipts;; 2 = recording;; 1 = fees;; 0 = none.
- EX010 — Legal approach. How does Marcus handle legal questions? Rubric: 3 = lists them for the legal adviser;; 2 = refers them;; 1 = decides himself;; 0 = none.
Synthesis
An end-to-end service view and stakeholder needs focus security work where it matters.
Continue studying — chapter 02 of 12
← Chapter 01 (draft) · Course chapter index · Chapter 03 (draft) →