WHY DOES
#defi STILL GET HACKED AFTER AN AUDIT?
In the
#THENA ×
#CertiK Space, the team explained why reviewing smart contracts only covers part of the risk.
Phishing, compromised wallets and front-end security need attention too.
Old contracts aren't safe just because nobody has hacked them yet.
CertiK explained that
#AI helps attackers search through older contracts faster and more cheaply.
The code may stay the same while the tools used to find its weaknesses improve.
Using AI to write code? That code still needs checking.
CertiK discussed risks from unverified AI-generated code and malicious packages installed during development.
Moving faster can create expensive problems when security checks get skipped.
When should a protocol get another audit?
CertiK recommends looking at what changed:
▹ assets
▹ dependencies
▹ settings or features.
A hack at a similar protocol is another reason to review your own system. The calendar alone shouldn't decide.
An AI agent that can move money creates a new target.
CertiK discussed agents that choose routes, prepare transactions and even sign them.
The speaker described an attack using instructions hidden in Morse code. Security models are still catching up.
What should teams have beyond an
#Audit ?
CertiK highlighted multisigs, timelocks, transaction checks and live monitoring. They also stressed having an incident response plan ready.
When something goes wrong, the team should already know what to do.