Bitcoin Forum

Hello guys,

Was thinking to myself how do you consider the security factor before the investment? ???

I just started trading crypto and was debating between some coins, mostly considering the security factor of the project.

How are you checking if the code of the project is secure? don't you afraid of rug pulls? scams stolen crypto.

Do you use any tool that aids in this kind of investigation?

All of us are afraid of rug pulls and if someone like me doesn't have technical knowledge about coding, I'll rely on the information of other good and generous investors of the same coin.

One best tool and way is through the forum. Many members here do care for information and if somebody has seen some bad characters of that particular project, they're posting it here for the others to see.

Thank you for the reply.

I appreciate the importance of the forum, but I love to check things by myself.

I thought maybe is there any tool on the web that helps you to identify the safety of the project in a metric way.
For example, ETH is a safe investment 9/10, and "MyCoin" 2/10.

I appreciate your help.

I understand that type of tool that you want. But that's prone for being bias by the developer and it's favoring coin. What if the coin that you're trying to research is listed there and the owners of that project paid for that tool to give them that good rating for them to attract investors despite the actual project isn't really good? That's the cons that we can see with such tool and that's why if the forum won't be enough, you have to look for any other website that gives different views about these projects for you to weigh which is which.

I only know 3 ways through which you can get an image of the security of a protocol:

1) See if any audits have been performed at what are their scope.
2) Check the settlement and asset layer on which the project is built.
3) Verify who has the privileges to change the code and what is the process. Is multi-sig deployed? Is the protocol controlled by a DAO?

extra: do your own diligence on the communities run by the project and the development activity. Developers won't cram up to develop products on a platform with weak/broken security.

The security can be seen through the result from the audit to the code. This will determine which code that potentially contains the vulnerability.
Security is the most important thing. A project without good security can dead anytime once it gets hacked.
I personally taking the result from the audit as my best source to make sure if that was safe from the security problem just like vulnerability and rugpull function. This is the only way for you to make sure if that's safe.
No. I don't. It can be seen easily on the code

Thank you again for the comments guys

Actually, you gave me another point of view about my exploration method of low cap coins, maybe you are right and this is all paid ads.

But is still managed to find something on the web and wanted to share it with you this platform and to hear what you are thinking about seems very promising to me.

https://data.valid.network/home

When it comes to the security factor, in investing, of course, risk has become the main thing that is agreed upon. The tool for reviewing it is done manually, which means studying the project from all sides which is indeed the basis for analyzing a project. One of them is reviewing all social media, who the team is, and also checking white papers, and understanding the roadmap. Because in determining investment, it does not necessarily include money. Therefore, the main factor is that you must know and recognize the project you want to invest in accordance with the long-term target you are looking for.

It would contradict yourself if you are trying to find such a website. You have to trust that website methodology of research and by the point of checking on yourself, you aren't but instead you just trusting those third-party site.

Separating the wheat from the chaff in the never-ending scammy cryptocurrencies world is so mundane. Good luck trying to find a hidden gem while almost every new cryptocurrencies/tokens that barely popped out is mostly a scam.

It is good if you found that site though, but you better take it as a grain of salt. After all, if you trying to find low cap coins, I see that site doesn't list any of those.

Most of the projects have their GitHub repositories so maybe you can check out the code itself.

But for those who don't have experience, I guess the reviews of others will be enough. But then again, we must be very careful as there could still be rug pulls in the end.

So I guess it's the risk that we are going to take in the market that we live in. Maybe you are going to be lucky to invest on a solid and legit project.

I do consider security as the most important part before try to decide investing in the project. don't you even see those projects who got hacked by the hackers? they are dead right now even some may take the prevention act but it gives a very big impact to the project and this is also creating so many fear to the people to come in. Security factor is the most important thing and that's why some developers wasted big amounts of money to keep the platform safe caused by the security needs to be audited anytime. This is also making you can avoid the rug pull project. you can see that through the function that already published in the contract. There are some functions that linked to the rugpull. Im afrain with rugpull caused it can make me lose my money instantly but as long as i do audit and im safe with it. As long as you understand the function and you can find that easily.

I believe that many of us here have no experience or knowledge of coding, that's why it was very difficult to find out in terms of security in such incidents like rug pull I guess it's better to choose those projects that the team is not hiding in anonymity at least the investors will know who they are including their real identity just in case they intentionally done it they will reach the extended arms of the law for the better avoid investing those project that has an anonymous and fake team.

Test running how secured a crypto projects are is one of the reasons why we have audit platforms like certik, there are people who won't invest in a project that hasn't been audited before.

Also few projects always make bounty available for people who can hack their platforms just to know how strong or weak their project is

You will not have access to the code of the app or website, basically the MVP is being developed. The token's smart contract can be checked and is checked by many people, so community consensus happens. Nobody will try to scam using this, because the smart contract is available on the blockchain explorer websites and anybody can verify it.

Happens all the time. Been watching them since 2015 when ICOs were popular. Scene has not changed much.

Your wits. If you lack those, dont enter this sector, not even bitcoin. You need wits to trade bitcoin too. In altcoins almost every other altcoin is a scam/pump and dump. Enter at the low and exit at the high, dont even think about holding them. You can learn how to check copied whitepapers, copied team pictures form random linkedin profiles and so on. Even then there will be some scams or failures that you will never be able to catch. Even if you do catch, there is a lack of legal support to force them to repay their investors.

It might just make you lazy to check the background of each coin if there is such a tool.
What if they paid enough to look like they are a better project than any? You cannot just rely on what the page will tell like coinmarketcap or coingecko.
They are just tools for basic information but going deep in researching would be your part to avoid scams and lessen the risks.
If there's such thing as a tool then we won't be here trying to help each other about new coins coming out, details, experiences, etc....

Great newbie question. This is something that a lot of us struggle with because nobody is ACTUALLY checking code. Its all about having consensus that "somebody" must have done it.

When it comes to bitcoin, you don't have to worry about the security of chain or code. You have to consider only personal security and ensure that you know the necessary rules of keeping your private key and mnemonics safe and away from public infrastructure.

When it comes to ERC-20 tokens on Ethereum, you can go to the explorer like etherscan and check the contract code. You shud atleast ensure that the code is indeed accessible and open-source if it is a completely new project from an anon developer.

The method that I find the most useful is to find some niche community, friends on discord who have been part of good projects already. Most of these people are on lookout for projects and its easier to collectively weed out scams. That is the only possible way for non-technical people to get in early into a project that has not already blown up.

There are also places that check the code for you, not that you have trust them but they have built a whole reputation based on it. Which means that all the code that they check, gets rechecked by other people who do not get paid for it, and if there is any wrong or mistaken line of code there which these places didn't pick up on, they will lose reputation based on it and can't make money from it.

Like CertiK for example, do you think that you could pay them money to keep something hidden? Your code will be open to the public and anyone can check it and if they check and give you greenlight and say you are great when you have something wrong, another person will find it and that will mean CertiK will not be able to get jobs anymore, because they won't be trusted by the community anymore and their sign of approval will mean nothing to people if they were shady.

Of course. Which is why I only invest on audited DeFi platforms.

Sure, they are not going to be entirely secure just because something has been audited in the past, but it is definitely a much better chance that they don't rugpull as a result if there is an audit done by a reputable firm.

If you are just blindly throwing money out there, it is the Wild West at the end of the day so you should expect to get rugged sooner or later.

This looks like a promising website and gives a rating for each project about its security. But I don't know if this is the right platform for me since if you want to view other types of tokens, you have to get listed and pay for their membership fee.

They should allow it for free if it's just about viewing but what they offer is a whole package and it's not that cheap at all. Well, sort of disappointed to see that they required to upgrade just for viewing the tab for different tokens and other security measures. They should unlock it.

Well yes, it's hard to find this day a free tool, "if it's free you are the product".

But they aid you to explore for new coins, monitor the assets 24/7 seems that if I was a more experienced trader I would benefit a lot from it and lose less money.

Another topic they are talking about is the API which you can ask them to make a custom for you, this is interesting I will continue my research, and maybe I will try to speak with these guys about the price for the service.

would like t to hear more of your comments thank you, everyone. ;D

if you think and look for security factors, then I suggest choosing the top coins in the market. Though it can't give you the fullest security as it depends on how you manage your fund, as for that, you can still assure that you can get something from your trades. We don't need to be foolish and think for instant returns as most likely you just end up getting scammed.
Research (DYOR) is a perfect tool to do between us, nothing else. If you can do that, then you are eventually adding security to your funds.

First, you need to check altcoins contract address that is verified or not, after that you should check the contract is audited by any company like certik or any other company then you need to check more details their social community is strong or not and check out the project whitepaper and website. then you can avoid scam altcoins.

There are many experts in this forum and they do post whenever they find anything wrong in any project so we should be active on this forum to get updated all the time but in my opinion, most of the rug pull happens in the meme coins and we should always be careful while investing in any project always check the team. If the team is anonymous one should think twice before investing. I believe everyone is afraid of getting scammed but this is a market and we all learn from our or others' experiences.

Usually we use fundamental analysis, maybe also helped with some audit project websites such as certik to avoid fraud, try to avoid playing BSC tokens, investing in coins that have been verified from the audit or registered on binance.

Of course one of the most important factor if you want to invest into a project is the question if the project and the team behind it is really legit or if they are just scammers that want to take your money via a rugpull or another method. When you invest into projects that are in the top 200 market cap wise then you should be 99% safe from a rugpull or stuff like that in my opinion. If you are investing into new projects though then the risk of investing into a scam is way higher and you really need to do your research as thoroughly as possible in order to avoid being scammed. The big problem is that even if you did everything right and you are almost sure that the project is legit there is still a slight chance that they may do a rugpull because you can not check everything.

Blockchain technology is so strongly encrypted that it is not easy to get a hacking attack. However, we only need to store important data such as seed, mnemonic, private key, json file for wallet access, because of the leak in making someone steal our wallet access.

Private keys are a difficult thing to crack nowadays, but we can't close our eyes that the hack case from the project that made the project change the address contract is an indication that this is not impossible, especially now that more and more people are trying to make programs to crack private keys.

Unfortunately, there isn't any one-stop solution where you can find such a thing, even though there are a lot of websites that give ratings or scores to new projects, but my personal idea has always been to invest in any project only after it has been listed, once a project is listed on a reputable exchange you at least have the security that 100% of your money won't erode away, at maximum you will lose a certain %age of your money and never more than that. Moreover, if a reputable exchange has listed it there is a good chance that the project is safe as the exchange has done it's research. So that's the best way to get assurance about your security factor.   

Bitcoin? I know we are discussing altcoins but that is the most secure coin in the entire world if you ask me. Obviously sometimes there are some problems but the reality is that we are talking about the most secure coin out there with all that many miners working on protecting it. If you really want a secure one as altcoins, then ETH could be a decent one, it could still have some problems with these new improvements that they are focusing on, like 2.0 and all that is still unknown.

However, if you want real security, like the one where you are certain you won't lose but you won't win neither, then BUSD would be the case, that is real security, Binance is always around and looks like they will stay around and nobody could just confiscate their money since it is in crypto, which means that you could put CZ in jail and they will still be fine.

I understand what you mean, and DYOR is important.

But we are using tools that help us explore new coins, monitor our assets, etc.
so I was concerned and still am about the security factor of my assets, and how I can track or in other ways defend myself from risks.

I think you heard about the latest Solana hack where ETH was stolen.
So it is hard to agree that investing in known well fundamental coins would help aid me in avoiding scams stollen crypto etc.
So as I see it Valid Network helps me to track those vulnerabilities.

I think this is the scariest point of this topic.  :o
This happens not just to "shit coins" this happens even in the big projects that we all know.
That's why it is important to me to track those risks and get informed 24/7

You are right it is very important to check who stands behind those projects.

But it is important to understand that not always the team is planning a scam or trying to work on people, sometimes is just a mistake or vulnerability in the code, personally, I want to track it 24/7 and avoid these situations.

I know that but to be honest if you're looking for the security tool and you may not find it right now. Remember this when you find your token developed by A developer and the tool created by developer B that uses the different formula and how can you know that if the tool is working perfectly as you wish? That's why this must be done manually. I thought that you can use dropstab to identity the fundamental of your token but if this related with the security audit and you must do that manually with the smartcontract of your tokens.
I know his.
Did you mean wormhole? The developer didn't aware about this vulnerability as the attack find that by using the different formula in the code. Hacker has different implementation to fund the vulnerability

Yeah but you can't deny that you will get less profit
It may be a common vulnerability that already known by the developers such as rug pull function or minting function.

All investors consider security and are always vigilant if they want to invest in a new project, unless the project is a popular ERC-20, BSC or MATIC token. and what I usually do is whether the project has passed an audit from a third party or not, if not then better leave it.

For beginners I suggest it is better to invest with coins that already have a high market capacity and already have strong fundamentals such as BTC, ETH and BSC because investing with these coins will certainly be safer for us, but if you really want to try investing in projects then you are required to do research first with the project and usually what I do first is look at the whitepaper or roadmap to find out how far they will develop for their project in the future.

Yes, for beginners, I also recommend investing in coins that are already popular and have high credibility of course. It becomes safe for beginners while learning things in cryptocurrency. I'm sure sooner or later we will slowly understand what are the risk factors, especially security in a project.
Investing is not an easy thing for beginners, especially for those who do not know the basic knowledge to invest.

It is a good suggestion because at least his chance to profit from the coin will be better than a new project, especially if he invests in BTC, ETH, and BSC. If he still wants to invest in a new project, he must not use too big money because the big risk will follow him. Besides that, usually, the price of the new project is still very lower so he does not have to spend much money to buy the token. But no matter what, he must research more details because finding one or two potential projects is not easy and hopefully, he does not make a mistake by picking the wrong project.

this requires more in-depth knowledge in cryptocurrency, if you look at it this way, then there is a risk in all aspects of the project, but I look at the success of the project, the CRO was recently hacked for a fairly large amount, and the project fully reimbursed all losses to users, this indicates a clearly confident project on the market.

Usually the token audit get passed and several third party white-hat ethical hackers check it just for interest. So that would not be the part having malicious stuff in it. It is usually the bankruptcy and the problems of hostile takeover that become more important.

Then again the plain vaporware projects do exist too and they are good at fooling newbies. Point is the code may be legit and malware free but that does not indicate zero mal-intent from the owners.

OP may be working on security solutions, but that code being public, usually the chances are low there. Closed source codes are not trusted in this sector.