Opsec Reviews

A code audit answers “can this program be broken?” An opsec review answers a more uncomfortable question: “if something goes wrong, do we have the people, processes, and access controls to recover?” On Solana, that question is increasingly the one with the highest expected cost, most of the public losses in the last 18 months were operational, not cryptographic.

We start with structured interviews. Who has signing authority? On which keys? Where do those keys live? When was the last time the multisig signer set was reviewed? Are there off-boarded contributors whose keys are still in the topology? These are simple questions, but they’re rarely written down in one place, and the act of writing them down is itself half the value of the engagement.

We then observe at least one live operation, a deploy, an upgrade, a parameter change, end-to-end. Watching a signing ceremony is the only way to find out whether the actual practice matches the policy.

Finally we run a tabletop incident drill: a critical bug has just been disclosed, an exploit has just landed on mainnet, a signer’s laptop has just been compromised. We walk through who pages whom, who can pause what, what the communication channels are. The report that follows isn’t a list of code findings, it’s a prioritized list of process changes, with which ones are urgent and which can wait a quarter.