10.1 Multi-Layer Threat Model
| Threat layer | Examples | Primary control |
|---|---|---|
| Private keys | Theft, loss, insider | Multisig + HSM |
| Smart contract | Logic bugs, reentrancy, access control | Audit + formal verification |
| Oracle | Data manipulation, downtime | Multi-source + circuit breaker |
| Bridge / cross-chain | Bridge attacks | Minimise dependency or specialised audit |
| Custody | Custodian failure | Licensed custodian + insurance |
| Governance | Vote capture, malicious upgrade | Timelock + multisig |
10.2 Risk Score Algorithm (Educational)
Risk Score = Likelihood × Impact × Exposure
Example: 4 × 5 × 0.8 = 16
Example: 4 × 5 × 0.8 = 16
This is only a sample scoring method, not a global standard. Each organisation should define its own risk matrix.
10.3 Key Recommended Controls
- Multisig + HSM for sensitive keys
- Timelock for critical changes (minimum 48–72 hours)
- Pause mechanism with transparent governance
- Invariant testing and fuzzing in CI
- Independent audit (at least one, preferably two)
- 24/7 monitoring and alerting
- Disaster recovery and segregation of duties
- Bug bounty after go-live
10 / 15