# Proposal: New security Audit for Anchor Protocol **URL:** \ **Category:** General\ **Created:** [October 14, 2021, 9:38am UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331 "2021-10-14T09:38:47Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![Rhumidian](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rhumidian](https://forum.anchorprotocol.com/u/Rhumidian)\ **Post date:** [October 14, 2021, 9:38am UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/1 "2021-10-14T09:38:47Z")
**Background** As of current, the Anchor protocol has only received two audits early in this year from Cryptonics. Cryptonics have a poor reputation in the security audit space, most notably [auditing pNetwork who lost $12.7m USD of BTC](https://cointelegraph.com/news/latest-defi-hack-targeting-bsc-sees-12-7m-in-bitcoin-stolen-from-pnetwork) in September. As Anchor is nearing $4bn TVL, it is important to test the robustness of Anchors Rust contract, and additionally, provide assurance to the community that funds are safe in Anchors contracts from attack. Having up to date audits of the Anchor protocol will ensure the long term health of the platform, and build a stronger image that Anchor is a safe haven for long term UST savings. It is not acceptable that so few audits have been performed on the protocol. **Proposal** I propose that the Anchor protocol pays for 2 additional smart contract audits from reputable auditors such as CertiK or immunebytes to provide additional verification of the security of existing contracts. This will assure the community that the Anchor protocol is robust and protected against attacks and that the security of locked funds is upheld. Ideally, Anchor should also consider a continuous auditing schedule and agreement. ---
**Author:** ![fig](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/fig/32/259_2.png) [@fig](https://forum.anchorprotocol.com/u/fig)\ **Post date:** [October 14, 2021, 4:32pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/2 "2021-10-14T16:32:24Z")
I agree with the need for a second audit, by a third party. What is your criteria for choosing Certik or Immunebytes? What is the upper limit on costs? Recurring audits without significant code change can get expensive, quickly. ---
**Author:** ![Rhumidian](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rhumidian](https://forum.anchorprotocol.com/u/Rhumidian)\ **Post date:** [October 15, 2021, 1:17pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/3 "2021-10-15T13:17:10Z")
Criteria is an auditor who haven’t been REKT in the past, and have a long track record of audits on Rust. I agree with the expense, perhaps they don’t need to be reoccurring. However, I believe Anchor is in desperate need of another Audit. There is a lot of TVL. ---
**Author:** ![bitn8](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/bitn8/32/61_2.png) [@bitn8](https://forum.anchorprotocol.com/u/bitn8)\ **Post date:** [October 18, 2021, 3:48pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/4 "2021-10-18T15:48:07Z")
This is something that I’ve been worried about as well mainly the fact that security solutions haven’t scaled with total TLV and the entire ecosystem. It’d be great to hear your rationale behind selecting these organizations to do the work. Ideally I’d like it to be put together in the community via a DAO which is something I’m working on now. ---
**Author:** ![Lifted](https://avatars.discourse-cdn.com/v4/letter/l/c4cdca/32.png) [@Lifted](https://forum.anchorprotocol.com/u/Lifted)\ **Post date:** [October 19, 2021, 4:30pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/5 "2021-10-19T16:30:22Z")
Totally agree with this proposal. I’m a noob to all this so I’m curious about how cost gets covered. ---
**Author:** ![JeromePrintATrillion](https://avatars.discourse-cdn.com/v4/letter/j/958977/32.png) [@JeromePrintATrillion](https://forum.anchorprotocol.com/u/JeromePrintATrillion)\ **Post date:** [October 27, 2021, 4:35pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/6 "2021-10-27T16:35:51Z")
[Creame fiance](https://www.theblockcrypto.com/post/122241/ethereum-defi-protocol-cream-finance-hacked-for-115-million) just got hacked for over $130M. I think the community should definitely pay for another smart contract audit, if anything serious is found, it’s cents on the dollar for us! ---
**Author:** ![jc69](https://avatars.discourse-cdn.com/v4/letter/j/e68b1a/32.png) [@jc69](https://forum.anchorprotocol.com/u/jc69)\ **Post date:** [October 27, 2021, 5:04pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/7 "2021-10-27T17:04:49Z")
yep, seems like great use of community fund ---
**Author:** ![bitn8](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/bitn8/32/61_2.png) [@bitn8](https://forum.anchorprotocol.com/u/bitn8)\ **Post date:** [October 29, 2021, 1:14am UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/8 "2021-10-29T01:14:19Z")
Agree. We need to get past the one and done mindset or even calendar marked tasks mindset, and move towards auditing as a continual service that constantly monitors things like Immunefi that can scale continual auditing with TLV. This ensures an added layer of security as continual audits have a dynamic response to real-time protocol usage changes and attack vectors. It also creates a deeper knowledge of the codebase to better sense attacks signals. ---
**Author:** ![TraderBlake1](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TraderBlake1](https://forum.anchorprotocol.com/u/TraderBlake1)\ **Post date:** [November 15, 2021, 6:02pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/9 "2021-11-15T18:02:43Z")
As a user with a lot of value put into Anchor contracts I would really like an audit as the proposal suggest. ---
**Author:** ![BigBoyPants](https://avatars.discourse-cdn.com/v4/letter/b/91b2a8/32.png) [@BigBoyPants](https://forum.anchorprotocol.com/u/BigBoyPants)\ **Post date:** [November 15, 2021, 6:47pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/10 "2021-11-15T18:47:56Z")
Im with Traderblake and all the others on this one. An audit would really be great at this point ---
**Author:** ![Rhumidian](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rhumidian](https://forum.anchorprotocol.com/u/Rhumidian)\ **Post date:** [November 16, 2021, 10:26am UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/11 "2021-11-16T10:26:10Z")
Pinging this @ryanology045 . How do we move this proposal forward? ---
**Author:** ![PFC](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/pfc/32/266_2.png) [@PFC](https://forum.anchorprotocol.com/u/PFC)\ **Post date:** [November 16, 2021, 3:58pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/12 "2021-11-16T15:58:38Z")
Apologies… this one fell through the cracks. I was in contact with cryptonics, and they quoted ~120k for a re-audit on the codebase [GitHub - Anchor-Protocol/anchor-token-contracts: Smart contracts powering Anchor Protocol on Terra](https://github.com/Anchor-Protocol/anchor-token-contracts) branch `main` commit `cac5a72439190572a65f59cf7ea82997c72cec46` [GitHub - Anchor-Protocol/money-market-contracts](https://github.com/Anchor-Protocol/money-market-contracts) branch `main` commit `5d941654f97220a42d2ce4bf9cf6749dce53c99e` [GitHub - Anchor-Protocol/anchor-bAsset-contracts: Smart contracts powering Anchor Protocol on Terra](https://github.com/Anchor-Protocol/anchor-bAsset-contracts) branch `main` commit `486f1cd495325798f884e19880180a62566b5e48` [GitHub - Anchor-Protocol/anchor-bEth-contracts: Smart contracts for bEth on Anchor Protocol](https://github.com/Anchor-Protocol/anchor-bEth-contracts) branch `main` commit `b5ffd33c757e74e2aeb507c29fbbc1f3a26beba0` [https://github.com/Anchor-Protocol/anchor-vault-contracts](https://github.com/Anchor-Protocol/anchor-vault-contracts) branch `feat/bluna_anc_vault` commit `4850957223671737637f956562872d058775ab1e` if people are happy with this, we can put it up for a governance vote for ANC to pay for this service from their reserve pool. they expect the audit will take 6 weeks, and will probably start mid-feb. (every crypto audit firm is swamped) ---
**Author:** ![Rhumidian](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rhumidian](https://forum.anchorprotocol.com/u/Rhumidian)\ **Post date:** [November 16, 2021, 4:13pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/13 "2021-11-16T16:13:05Z")
The idea of this was to use a better auditor than Cryptonics. They have already audited Anchor, and have been rekt in the past (PNetwork). Are there other (better) auditors we can use? ---
**Author:** ![PFC](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/pfc/32/266_2.png) [@PFC](https://forum.anchorprotocol.com/u/PFC)\ **Post date:** [November 16, 2021, 4:15pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/14 "2021-11-16T16:15:11Z")
feel free to find one, and get an alternative. I do not work for cryptonics. I just asked them as they did the initial one. ---
**Author:** ![TraderBlake1](https://avatars.discourse-cdn.com/v4/letter/t/ee59a6/32.png) [@TraderBlake1](https://forum.anchorprotocol.com/u/TraderBlake1)\ **Post date:** [November 16, 2021, 7:25pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/16 "2021-11-16T19:25:45Z")
> [@Rhumidian](#): > > The idea of this was to use a better auditor than Cryptonics. They have already audited Anchor, and have been rekt in the past (PNetwork). Are there other (better) auditors we can use? I completely agree. When you like to get a 2nd opinion you do not go to the same doctor, and deff not a doctor with a bad rep. ---
**Author:** ![bitn8](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/bitn8/32/61_2.png) [@bitn8](https://forum.anchorprotocol.com/u/bitn8)\ **Post date:** [November 17, 2021, 2:53pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/17 "2021-11-17T14:53:07Z")
I just want to put some perspective here, Cryptonics (Oak Security) is one of the best when it comes cosmwasm. We need to understand that Rust and cosmwasm is vastly different from solidity. Also perfect track record auditors to my knowledge don’t exist for cosmwasm/rust. So do we really want the 1-2 solidity auditors with a perfect track record who lack specialized rust/cosmwasm code base knowledge needed ? Also, I would prefer a company that has even more intimate knowledge of our code base because they have done it before. That said, here would be the other recommendation for a cosmwasm auditor. I will see if they are even available and if so get a quote: [https://code423n4.com/](https://code423n4.com/) If I don’t hear back soon, I suggest we move forward with what @PFC put forward. ---
**Author:** ![PFC](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/pfc/32/266_2.png) [@PFC](https://forum.anchorprotocol.com/u/PFC)\ **Post date:** [November 17, 2021, 3:25pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/18 "2021-11-17T15:25:10Z")
we probably need to decide this in short order… as we are holding the slot with them (not sure for how long), and it is already on the critical path for our 1.1 release. ---
**Author:** ![Rhumidian](https://avatars.discourse-cdn.com/v4/letter/r/3d9bf3/32.png) [@Rhumidian](https://forum.anchorprotocol.com/u/Rhumidian)\ **Post date:** [November 17, 2021, 4:04pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/19 "2021-11-17T16:04:35Z")
Cryptonics is sketch af though. Their website is dodgy, it seems to be run by just 2 Spanish guys out of their homes. I don’t trust them, particularly with this much capital at risk. ToB have a slot in April 2022 but I suspect this is too late… ---
**Author:** ![PFC](https://sea2.discourse-cdn.com/flex016/user_avatar/forum.anchorprotocol.com/pfc/32/266_2.png) [@PFC](https://forum.anchorprotocol.com/u/PFC)\ **Post date:** [November 17, 2021, 4:43pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/20 "2021-11-17T16:43:59Z")
This isn’t the first audit, and won’t be the last. If ANC tokenholders decide ToB going forward, that’s great. I’m just not sure how governance feature allows ‘A vs B’ style voting ;-( ---
**Author:** ![MTMT](https://avatars.discourse-cdn.com/v4/letter/m/b5ac83/32.png) [@MTMT](https://forum.anchorprotocol.com/u/MTMT)\ **Post date:** [November 17, 2021, 7:56pm UTC](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331/21 "2021-11-17T19:56:34Z")
> [@bitn8](#): > > r back soon, I suggest we move forward this is good. let’s book. [Next page](https://forum.anchorprotocol.com/t/proposal-new-security-audit-for-anchor-protocol/1331.md?page=2)