Gate and GoPlus Security used the third edition of the "Gate Security Class" to argue that security is a moving target, not a certificate. Their central message was simple: passing an audit once does not mean a project will remain safe.
The discussion noted that many projects hacked this year had already been audited, and some had gone through multiple audits. That does not make audits useless. It shows that an audit answers a narrower set of questions than many users assume. A report only reflects one version of code reviewed by one team at one point in time. Contracts can be upgraded, permissions can change, oracles and cross-chain bridges can shift, and new attack methods appear constantly. From the moment a report is delivered, it starts aging.
Why audited projects still get hacked
GoPlus partner Adam said a one-time audit does not equal lasting security and described four structural weaknesses in traditional contract auditing.
- First, audits are snapshot checks. They are semi-manual reviews performed at a specific time, and the result depends on tool quality, the reviewer’s skill, and working conditions. Code, permissions, and parameters can all change later.
- Second, audits cannot predict future risks. New vulnerability classes and attack methods keep emerging.
- Third, projects rely heavily on external components such as oracles, cross-chain bridges, and third-party protocols. Changes in those dependencies often sit outside the scope of a standard audit.
- Fourth, older contracts that were audited years ago are being scanned again at scale by automated tools. Adam cited deep vulnerabilities found in long-running projects such as Balancer and Yearn.
He said permission abuse is often an operational problem rather than a pure code flaw. Common causes include overly broad owner privileges, leaked admin keys, poor multisig management, malicious proposals, and governance attacks. Even if a report flags permission risk, it does not answer who will keep watching later or whether future actions will be safe and reasonable.
Gate’s security team framed the issue differently but reached a similar conclusion: an audit can tell users what code can do, but not what a project team plans to do. In Gate’s view, many incidents begin with intent. A contract can be technically compliant, and owner permissions can look normal, yet a team can still choose a moment to use those permissions to change trading rules, activate a blacklist, or mint more tokens. Those actions may be fully valid at the code level and may not be labeled as vulnerabilities because they are part of the design.
That is why Gate said technical review alone is not enough. The exchange said it applies strict project screening and review during the listing process, signs a non-malicious conduct declaration with project teams, and monitors whether those commitments are honored. For already listed projects, Gate said it performs regular security audits and tracks contract status through on-chain event monitoring. Users can also check the current risk items of a contract at any time.
From one-off audits to lifecycle security
Gate’s security team said the crypto industry, especially DeFi, operates much like modular finance. Platforms are built from shared components: contracts, software libraries, wallets, price oracles, cross-chain bridges, connectivity providers, web interfaces, and systems used to push updates. That means security cannot be judged only by looking at a project’s own contracts. Every dependency in the chain matters. If an upstream component fails, losses can travel downstream. Looking back at major attacks, the weak point often appeared earlier than protocol logic itself, in suppliers, development tools, software delivery paths, or the process through which users approve transfers.
Adam said attackers have already industrialized vulnerability discovery with automated tools. What used to be expert manual research is turning into a pipeline. If the industry still relies on getting one audit report before launch, or only calls in a security firm after a problem appears, it is, in his words, like using bows and arrows against a machine gun. The only workable response is to use tools with similar efficiency on defense.
He said the industry needs to move from one-time audits or post-incident expert intervention to continuous security across the full lifecycle. Using GoPlus DeepScan’s "three-piece contract security toolkit" as an example, he described a closed loop made up of three stages:
- Before launch, token security self-checks can quickly identify honeypots, malicious mint functions, blacklists, abnormal trading taxes, and owner-permission backdoors within minutes.
- At launch, AI contract audits can analyze source code, permission management, and business logic, scan both syntax-level and logic-level vulnerabilities, and produce a structured report.
- After launch, continuous monitoring and regular health checks can track new vulnerability intelligence, attack events, and risks tied to external dependencies such as oracles, bridges, and third-party protocols, then issue routine alerts and periodic reassessments.
How vulnerability hunting has changed
Adam said attack methods have become more varied in the past two years for three reasons.
- Automated tools have sharply lowered the barrier to finding bugs. Work that once took top researchers weeks can now be run through an attack pipeline in minutes.
- The chain holds a large stock of older contracts that were audited years ago, creating a rich target pool for attackers.
- Attackers only need to find one exploitable flaw, while defenders have to cover all of them.
He said hackers may need only minutes to steal funds, but defenders may also need only minutes to identify the same flaw. The difference is whether the project used the right tools before the attacker did. He also argued that defenders hold three structural advantages: they can review systems repeatedly before and after launch, AI audits can be priced per use or by annual subscription and made routine, and security knowledge bases improve with every new attack event.
Self-custody and exchange custody are different security models
Adam split the security model for on-chain self-custody and exchange custody into two separate equations.
For self-custody on-chain, security equals private key security plus contract security. The user is the only party responsible. If a private key is lost or stolen, there is no customer service path to reverse it. Every interaction carries on-chain risk, including approval flaws, phishing signatures, and honeypot tokens. The advantage is that assets do not depend on the credit of any platform.
For exchange custody, security equals platform security plus account security. The platform manages private keys through mechanisms such as hot and cold wallet separation, multisig, and risk controls. In effect, the user outsources technical security to the exchange. But users still need to protect their own exchange accounts, including passwords, 2FA, phishing exposure, and API keys, and they still need to choose a platform with credible security infrastructure.
His conclusion was that on-chain use tests a person’s Web3 security awareness and operating habits, while exchange use tests both the exchange’s infrastructure and the user’s account security habits.
What Gate said it has changed on security
Gate’s security team said it regularly audits listed projects and continuously tracks contract status through on-chain event monitoring. That includes watching for upgrades, permission changes, and unusual large transactions. The team said a listing review, like an audit report, also has a shelf life.
On the platform side, Gate said its bug bounty program remains open. Security researchers can submit findings through sec@gate.com, the ticketing system, or the HackenProof platform. The team said exchanges that ask projects to accept scrutiny should also accept scrutiny themselves.
On asset placement, Gate said users should not chase a single "safest place" but separate funds by frequency of use. Funds needed for active trading can stay in a spot account, while assets that may not move for six months or a year can go into the Gate Vault.
Gate said the vault uses MPC with a 2-of-3 signing model. A private key is split into three parts held by the user device, Gate, and an independent third party. The full key is never reconstructed at any point, and neither Gate nor the third party can initiate a transaction alone. Every withdrawal also faces a 48-hour delay before settlement. Gate described that window as a security buffer during which the user can freeze the outgoing transfer. The team said that in many theft cases, users realize something is wrong only after the attacker has already moved first, and on-chain transfers cannot be reversed once sent. The 48-hour delay is meant to create time to detect and stop the transfer.
Gate also described its account security protection plan. The plan is built around a security score that converts settings scattered across different pages into a 0-to-100 score. Those settings include login verification, authenticator setup, two-factor verification, passkeys, trading limits, and withdrawal limits. Users can see what has been completed, what is missing, and receive reminders when the score changes.
If the score reaches 80 and the account status is normal, users can activate the protection plan. Once active, if assets are transferred out without authorization during the coverage period and the case meets the rules, the user can apply for compensation. Gate said the current maximum for a single incident is $200,000. It added that the amount will be increased, with tiered limits by VIP level reaching as high as $1 million. Claims must be submitted within 45 days after the incident through "My Protection" and require materials including a police report and records of the asset transfer.
What a complete audit report should include
Adam said a report that helps people act, rather than just archive paperwork, should contain at least four elements.
- A security score, used for quick screening rather than a final verdict. Project teams can use it as a quantitative anchor for internal reviews, exchanges can use it for initial listing filters, and users can use it as an entry point before reading the key findings.
- Key findings, meaning the high-risk issues and core conclusions used for decision-making. This is the executive summary that shows which issues are blocking and must be fixed before launch.
- Issue details, used to locate the problem. That section should identify the contract, function, and code line involved, along with vulnerability type, severity, attack path, and root cause. Adam said a good report should provide reproducible execution paths and trigger conditions, not just a list of issues.
- Remediation advice, used to close the loop. Recommendations should be specific at the code level, executable, and followed by rescanning and regression verification after the fix.
Gate’s security team added three points from its own contract audit practice.
First, the most commonly omitted sections are often the most important at the front of the report: audit objectives and limitations, and scope description. Gate said its reports are organized around eight dimensions: audit objectives and limitations, scope description, severity matrix, priority judgment, vulnerability details, risk paths, threat model, key function analysis, and remediation advice. The first two shape whether readers misunderstand the rest. If limitations are not clear, readers may assume everything was covered. If scope is not clear, readers cannot tell whether the review covered only the main contract or also liquidity pools, strategy contracts, oracles, and external dependencies. Gate said many promotions simply say a project has "passed an audit" without saying what was audited, which leaves almost no useful information.
Second, key findings should be read in combination. Gate gave an example of a common cluster: the owner can blacklist addresses and freeze assets, the trading pair can be reset so ordinary users cannot transfer, a minimum holding requirement can prevent users from fully selling, and a single owner can change multiple key rules at any time. Each item alone may look like normal design. Together, they show that control is highly concentrated in one person.
Third, readers should know how the report was produced because that defines its reliability boundary. Gate said its contract audit process has three steps. It starts with static analysis to check basic risks such as permission control, reentrancy, price manipulation, flash loans, and logic consistency. It then moves to business scenario modeling, extracting core interaction scenarios and testing business paths and boundary conditions to find issues that rule-based scanning misses. The final step is semantic verification, which checks key business paths one by one to confirm whether the risks identified earlier are real. Gate said this last step is mainly used to reduce false positives, because a report full of false alarms quickly causes users to lose patience and skip the review process altogether.
What ordinary users can do now
Adam listed six actions that users can take immediately.
- Check token security before trading, with attention to honeypots, malicious minting, blacklists, abnormal trading taxes, and excessive owner permissions.
- Regularly clean up contract approvals and revoke approvals for dApps no longer in use, especially unlimited approvals.
- Strengthen account security with strong passwords and 2FA, and apply least-privilege management to API keys without granting withdrawal rights to untrusted tools.
- Turn anti-phishing habits into muscle memory by checking domains before signing, avoiding links sent in private messages, and treating "airdrop," "customer service," and "high-yield staking" claims with default skepticism.
- Separate assets by purpose, keeping only small working balances in hot wallets and using hardware wallets for larger holdings.
- Pay attention to a project’s security attitude, not just the existence of an audit report. Continuous auditing and monitoring matter more than a report issued years ago.
Gate’s security team translated several of those points into platform-specific actions.
- Before trading a token, users can use Gate AI’s contract audit feature. After submitting a contract address, they can receive a report within minutes. Gate said the four items to focus on are owner permissions, blacklist and trading restrictions, mint permissions, and transfer tax. If any one of those is marked red, users should stop there.
- For account hardening, Gate said users should first push their security score above 80. The checklist includes fund password, authenticator, two-factor verification, anti-phishing code, passkey, daily withdrawal limit, and withdrawal method management. The team said the score’s main value is that it turns scattered settings into an ordered checklist. Reaching 80 also makes the account eligible for the protection plan.
- For phishing defense, Gate pointed to two existing tools. If a message claims to come from Gate, users can verify the domain or email address through official channels. Gate also said every email it sends includes the anti-phishing code set by the user, and any message without that code should be treated as fake.
- Before signing, users should check the approval amount carefully. Gate said a contract may be fine while the transaction request shown on the page is not. A normal dApp can request only the amount needed for the current transaction. If it asks for unlimited approval immediately, that alone is a reason to pause. If the signing window shows only unreadable strings, refusing the signature is safer than signing first and asking questions later.
The discussion closed with the same point it started from. Launching after an audit is only the beginning of security work. For project teams, that means post-launch monitoring matters more than the report itself. For exchanges, listing is the start of review, not the end. For ordinary users, the few minutes spent checking before signing are among the lowest-cost and most easily skipped defenses available.
Gate and GoPlus said security has never been a one-time certification. It improves only when every party adds another layer of review and restraint.