Chapter 4 — Web3, blockchain and cryptoasset security: core methods
Lesson map
Lesson 04 published. Map, example, EX016.
flowchart TD
N0["Learning outcomes"]
N1["4.1 Structured custody review"]
N2["4.2 Using recognised guidance"]
N3["4.3 Recording findings"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4
N4 --> EX["Worked example"]
EX --> Q["Exercise EX016"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 Structured custody review"]
N2["4.2 Using recognised guidance"]
N3["4.3 Recording findings"]
N4["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX016"]
[Learning outcomes]
|
v
[4.1 Structured custody review]
|
v
[4.2 Using recognised guidance]
|
v
[4.3 Recording findings]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX016]
Learning outcomes
You will (1) apply a structured review of custody arrangements; (2) use recognised guidance; (3) record findings consistently.
4.1 Structured custody review
Marcus reviews the treasury's custody arrangements with a structured checklist: who the signers are, how their keys are stored, what threshold is required, how signers verify what they approve, whether destinations are restricted, how lost keys are recovered and how signer changes are made. For each question he gathers evidence. A structured review ensures that important areas are not skipped because they seem routine. He finds that the signer list still includes a former finance officer who left four months ago, which is his first significant finding.
4.2 Using recognised guidance
Marcus uses recognised guidance as criteria. The OWASP Smart Contract Top 10 identifies access control as a leading weakness area, which applies to the multisig's signer management. The ConsenSys best practices discuss careful handling of privileged operations. NIST IR 8202 explains blockchain components and their trust assumptions. He maps each checklist question to guidance where it fits, so findings rest on recognised sources rather than his opinion. He notes that most guidance is written for developers, so he adapts it carefully to an operational setting.
4.3 Recording findings
Each finding is recorded with an identifier, description, evidence, risk rating, guidance reference and recommendation. Marcus records three: the former officer remains a signer; signers approve transfers on their everyday laptops; and there is no written procedure for recovering a lost signer key. He rates the first two high and the third medium. He discusses them with the director before writing the report, so there are no surprises. Consistent, discussed findings are more likely to be accepted and acted upon by busy managers and trustees.
Worked example
Marcus's custody review finds a departed officer still a signer, approvals on everyday laptops and no recovery procedure, rating two high.
Synthetic case. The review and findings are synthetic; OWASP SC Top 10, ConsenSys best practices and NIST IR 8202 are real sources.
Errors and limits
Skipping routine-seeming checklist areas can miss findings like a departed signer.
Exercises
- EX016 — Checklist area. Name one custody checklist area. Rubric: 3 = how signers verify what they approve;; 2 = key storage;; 1 = office layout;; 0 = none.
- EX017 — First finding. What was the first significant finding? Rubric: 3 = a former officer still on the signer list;; 2 = departed signer;; 1 = vague;; 0 = none.
- EX018 — Guidance adaptation. Why adapt guidance carefully? Rubric: 3 = most is written for developers;; 2 = developer focus;; 1 = it is perfect;; 0 = none.
- EX019 — High-rated findings. Which findings are rated high? Rubric: 3 = departed signer and approvals on everyday laptops;; 2 = two findings;; 1 = recovery;; 0 = none.
- EX020 — Pre-report step. What does Marcus do before writing the report? Rubric: 3 = discusses findings with the director;; 2 = discuss;; 1 = publish;; 0 = none.
Synthesis
Structured reviews grounded in guidance produce findings that managers act on.
Continue studying — chapter 04 of 12
← Chapter 03 (draft) · Course chapter index · Chapter 05 (draft) →