Solution: serve Safe{Wallet}'s web interface from ICP with asset certification on to make it cryptographically verifiable. Configure so multi-party agreement needed to update assets (e.g via an "SNS" DAO). Safety achieved!
DFINITY might do this to kickstart the industry fix.
I usually try not to criticize other industry players, but I still do it once in a while. 😂
This update from Safe is not that great. It uses vague language to brush over the issues. I have more questions than answers after reading it.
1. What does "compromising a Safe x.com/safe/status/18…
this exists. But I caution oversimplifying complex problems.
1) Where do you get the hash from?
2) What about JS dependencies/ supply chain attacks? 3) What services does the FE call?
4) Isn't it more important to verify payload on the hardware wallet?
From Twitter
Disclaimer: The content above is only the author's opinion which does not represent any position of Followin, and is not intended as, and shall not be understood or construed as, investment advice from Followin.
Like
Add to Favorites
Comments
Share
Relevant content