Security FAQs

1. How is Bitcoin custody secured?

Bitcoin custody is secured through Fireblocks, a comprehensive platform designed for the secure management of digital assets, catering to a wide range of needs within the digital asset ecosystem. Fireblocks integrates a defense-in-depth architecture, combining MPC-CMP and hardware security to eliminate single points of compromise, thereby creating a secure environment for storing, issuing, and transferring digital assets​. The infrastructure is designed to be reliable and resilient, capable of handling high transaction throughput and millions of wallets. Fireblocks' Direct Custody model ensures that users retain full control of their private keys, with multiple disaster recovery options to guarantee business continuity​. Finally, it integrates with leading compliance solutions for real-time transaction monitoring, ensuring compliance with AML, KYT, and Travel Rule regulations directly from the platform.

2. How about the issue around the oracle?

Yala Finance emphasizes oracle security, vital for its lending protocol reliant on real-time asset price data. This data comes from Oracle nodes, processed by the Oracle and OSM Modules under the Yala Foundation. Given smart contracts in Web3 depend heavily on oracles for external data, compromised oracle data poses significant security threats. Therefore, ensuring high-quality data and a secure oracle infrastructure is crucial to prevent exploits and maintain decentralized application integrity. Initially, the Yala Foundation, comprising Yala holders, coordinates rate setting, price stabilization, lending script maintenance, and market surveillance for emergencies.

3. Would you undergo any audit?

Yala will have its smart contracts rigorously inspected by high-reputation security auditors, focusing on medium and high-risk issues as per auditor recommendations. Automated testing tools will be utilized early in development to detect common vulnerabilities, and audits will be performed bi-annually to accommodate codebase updates and expansions.

4. Audits are rather static, so how would you prevent any future threats?

To preempt future security threats, a 24/7 Security Operations Center (SOC) will monitor network activity, use vulnerability scanners, and gather threat intelligence for early detection of potential security issues. SOC analysts will examine anomalies to identify incidents, guided by an incident response plan for threat containment, damage mitigation, disclosure coordination, and fix integration. This plan will be regularly tested with simulated attacks to enhance preparedness for complex threats.