Chapter 4 — Web3, blockchain and cryptoasset security: guided lab and applied synthesis
Lesson map
Lesson 04 published. Map, example, EX039.
flowchart TD
N0["Learning outcomes"]
N1["4.1 The checklist"]
N2["Lab — Loyalty setup checklist"]
N3["4.2 Interpreting the gaps"]
N4["4.3 Deciding and planning"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX039"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["4.1 The checklist"]
N2["Lab — Loyalty setup checklist"]
N3["4.2 Interpreting the gaps"]
N4["4.3 Deciding and planning"]
N5["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX039"]
[Learning outcomes]
|
v
[4.1 The checklist]
|
v
[Lab — Loyalty setup checklist]
|
v
[4.2 Interpreting the gaps]
|
v
[4.3 Deciding and planning]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX039]
Learning outcomes
You will (1) score a setup against a short checklist; (2) interpret gaps; (3) decide and plan next steps.
4.1 The checklist
Mr Otieno gives Elena a short checklist for small token schemes, drawn from the course: privileged minting held by a multi-signature arrangement, administrator changes behind a timelock of at least 48 hours, customer names kept off the ledger, daily reconciliation of points against purchases, recent review of vendor access, a tested backup restore, a written incident contact list, and monitoring of role changes and pauses. The contractor records whether the vendor's test setup meets each item, with evidence. The guided lab scores the synthetic answers with a read-only standard-library script.
Lab — Loyalty setup checklist
"""Score a synthetic loyalty-token setup against a short safety checklist (read-only)."""
CHECKS = [
("Mint role held by a 2-of-3 multisig", True),
("Admin changes behind a timelock of at least 48 h", False),
("Customer names kept off the ledger", True),
("Daily reconciliation of points issued vs purchases", True),
("Vendor access reviewed in the last 90 days", False),
("Backup restore tested in the last 90 days", True),
("Written incident contact list", True),
("Monitoring of role changes and pauses", False),
]
def main():
passed = [c for c, ok in CHECKS if ok]
failed = [c for c, ok in CHECKS if not ok]
print(f"passed {len(passed)}/{len(CHECKS)} ({100 * len(passed) / len(CHECKS):.1f}%)")
for c in failed:
print(" gap:", c)
if __name__ == "__main__":
main()
Run with python3 lab_loyalty.py. Verified output:
passed 5/8 (62.5%)
gap: Admin changes behind a timelock of at least 48 h
gap: Vendor access reviewed in the last 90 days
gap: Monitoring of role changes and pauses
4.2 Interpreting the gaps
The lab shows 5 of 8 items passed, 62.5 percent, with three gaps: administrator changes have no 48-hour timelock, vendor access has not been reviewed in the last 90 days, and role changes and pauses are not monitored. Elena notes that all three gaps concern control over the system's rules, the area the course identified as highest risk. A percentage alone can mislead: one missing control over privileged changes matters more than several minor items. She discusses each gap with the vendor, who agrees to fix all three before launch.
4.3 Deciding and planning
Elena decides to proceed with a three-month pilot in one café, conditional on the three gaps being fixed and verified by the contractor, a monthly balance export, the exit plan in the contract and personal data off the ledger. She writes a one-page decision note for the owners, stating the benefits, the remaining risks and a review date. She adds a simple monthly check: compare points issued with purchases and review any privileged events. Mr Otieno praises her for a proportionate decision grounded in evidence rather than enthusiasm or fear.
Worked example
The checklist scores 5 of 8 (62.5 percent), with all three gaps in control over rules, and Elena approves a conditional one-café pilot.
Synthetic case. The checklist results, vendor and pilot are synthetic.
Errors and limits
Reading a checklist percentage without weighting gaps can hide the most serious missing control.
Exercises
- EX039 — Checklist score. What does the lab score? Rubric: 3 = 5 of 8, 62.5 percent;; 2 = 62.5%;; 1 = 8 of 8;; 0 = none.
- EX040 — Timelock gap. Which timelock gap is found? Rubric: 3 = admin changes lack a 48-hour timelock;; 2 = no timelock;; 1 = too long;; 0 = none.
- EX041 — Access review gap. What access gap is found? Rubric: 3 = vendor access not reviewed in 90 days;; 2 = access review;; 1 = too many users;; 0 = none.
- EX042 — Monitoring gap. What monitoring gap is found? Rubric: 3 = role changes and pauses unmonitored;; 2 = no monitoring;; 1 = too many alerts;; 0 = none.
- EX043 — Gap theme. What do the three gaps share? Rubric: 3 = control over the system's rules;; 2 = privileged control;; 1 = vague;; 0 = none.
- EX044 — Percentage caution. Why can the percentage mislead? Rubric: 3 = one missing privileged control outweighs minor items;; 2 = weighting;; 1 = it cannot;; 0 = none.
- EX045 — Pilot scope. What pilot does Elena approve? Rubric: 3 = three months in one café;; 2 = one café;; 1 = all cafés now;; 0 = none.
- EX046 — Pilot condition. Name one pilot condition. Rubric: 3 = gaps fixed and verified by the contractor;; 2 = exit plan in contract;; 1 = free coffee;; 0 = none.
- EX047 — Decision note. What does the decision note state? Rubric: 3 = benefits, remaining risks and a review date;; 2 = risks and review;; 1 = only benefits;; 0 = none.
- EX048 — Monthly check. What monthly check does Elena add? Rubric: 3 = compare points with purchases and review privileged events;; 2 = reconciliation;; 1 = vague;; 0 = none.
- EX049 — Coach praise. Why does Mr Otieno praise the decision? Rubric: 3 = proportionate and evidence-based;; 2 = evidence;; 1 = it was fast;; 0 = none.
- EX050 — Verification owner. Who verifies the vendor's fixes? Rubric: 3 = the café's IT contractor;; 2 = contractor;; 1 = the vendor itself;; 0 = none.
Synthesis
A short checklist, careful interpretation and a conditional decision let a manager adopt new technology responsibly.
Continue studying — chapter 04 of 04
← Chapter 03 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →