YOP Security Refresher
Upon hearing of the recent community alert surrounding the Ronin Validator compromise (which resulted in a loss of 173,600 ETH and 25.5M USDC) the YOP and Pluto Digital family would like to wish the Sky Mavis team well. We hope that the funds can be recovered.
The YOP team wants to take some time to reshare information on what we are doing to protect and secure the YOP platform.
First and foremost, security is a primary focus for YOP and Pluto Digital. We’ve developed the YOP ecosystem to ensure you feel educated and safe when using it. To this end, we have multiple tools & practices in our arsenal to protect YOP and the YOP community.
Smart contract audits: We forged an official partnership with Hacken and BTBlock, and we will continue working with them as we further develop the YOP ecosystem. You can read more details on the partnership and audits here:
Hacken: Hacken Audit
BTBlock: BTBlock and Pluto Partnership
YOP Tokens: In addition to the audits, we want to ensure that all parts of the process before YOP tokens enter the smart contracts or the community are secure. To keep all YOP tokens yet to be put into circulation safe, these tokens are stored in wallets controlled with multi-authentication in Fireblocks. Using Fireblocks ensures that all YOP tokens are moved from a Fireblocks hosted YOP wallet and go through a multi-authentication process before being sent anywhere. Based on the confidence we have in our Fireblocks setup, we are in the process of creating a YOP/Pluto x Fireblocks case study and formalising a partnership with them.
YOP Protocol Governance: We use Gnosis Safe (gnosis-safe.io) as our multisig platform for YOP. Our Gnosis Safe configuration requires a minimum number of core members to approve a transaction with a hardware wallet before it can be sent (M of N). YOP has created multiple multi-sig wallets mapped directly to our YOP ecosystem roles to provide a flexible and extendable approach on areas such as a minimum number of approvals (M of N) and contract permissions. You can read more about our use of Gnosis Safe in our YOP Multi-Sig Wallets blog post here.
Permissionless Deployer: Our YOP contract deployer is completely permissionless. It is unable to govern any of our contracts even at deployment time. Our deployer(s) private key is managed by AWS Key Management Service (AWS KMS) in an isolated configuration that doesn’t allow the private key to be exported.
Our team meets regularly to review our security practices and tooling to ensure that we cover all of our bases. Meeting regularly provides opportunities for any team member to challenge fundamental security assumptions and to share their own insight. Unfortunately, as we have seen from the Ronin Validators compromise, security assumptions can be broken.
Not only have we focused on smart contract security, but we continually learn from other exploits and focus on securing our entire stack. We have a full-time dedicated security engineer who works with multiple security companies to harden our day-to-day operations. We conduct regular security training and internal security tests to increase awareness and educate our stakeholders to pertinent security risks.
Our core belief is that security requires constant vigilance and a set of well thought out procedures that every team member understands. As we work towards our public launch everyone on the YOP team is working tirelessly to ensure the launch goes smoothly.
We would love to hear from you if you have questions, suggestions or concerns — join the YOP Discord Server and speak to us directly. For security related matters don’t hesitate to contact email@example.com.