Cosine: Blast’s explanation of multi-signature security issues is too funny, it’s better to admit the objective facts

In response to Blast’s explanation of multi-signature security issues, SlowMist founder Yu Xian commented on the Originally, many security personnel (including me) mentioned the risk of excessive Blast permissions, that is, just mention it so that players can have an idea. Just accept the objective facts, and you have to come up with such a funny security explanation." Cosine previously stated that Blast’s contract is indeed an upgradeable contract as Polygon Labs developer relations engineer Jarrod Watts said. The control rights belong to a 3/5 multi-signature (I don’t know who the five people are) and there is no time lock. If you want to run away, you must either sign more and upgrade a malicious logic contract, or enableTransition and set up a malicious mainnetBridge. Currently, except for the contracts issued on Ethereum, Blast is a fission gameplay of the centralized Web2 project, but it is endorsed by several well-known institutions. Users still trust projects endorsed by institutions. Earlier today, Blast posted on the X platform that security is multi-faceted, involving smart contracts, browsers and physical security dimensions. Immutable smart contracts are generally considered more secure, but may carry greater risks, especially in complex protocols. When it comes to upgradable smart contracts, the specific upgrade mechanism is very important. Upgradable smart contracts with timelocks may have vulnerabilities. In many cases, the only way to avoid a vulnerability being exploited is to perform on-chain operations before malicious actors do. In these cases, timelocks make smart contracts less secure. That's why every L2 has a direct upgrade path. Additionally, Blast highlighted the effectiveness of multi-signature security, which is also used by other L2 projects such as Arbitrum, Optimism and Polygon. Blast noted that each signing key in a multi-signature setup is independently secure, stored in cold wallets, managed by independent parties, and geographically dispersed, an approach designed to strengthen the protocol against various security threats. ability. Blast plans to update one of its multi-signature addresses within a week, switching it to another hardware wallet provider for enhanced security. The move is intended to prevent reliance on a single type of hardware wallet, thereby reducing the risk of compromise due to specific hardware vulnerabilities.