Crypto Bug Bounties: Samun Biya don Hacking din Blockchain

Siffar da kalmar "hacker" ke samarwa tana da wuyar gogewa: wani matashi sanye da riga mai hula baka, yana kallon allo a cikin daki mai duhu, yana satar kalmomin sirri na mutanen da suka amince da intanet fiye da kima. Wannan hoton ya dade tsawon shekaru a cikin al'adun tsaro na zahiri saboda hanya ce mai sauki ta mayar da wani abu mai sarkakiya ya zama kamar mugun mutum — kuma mugaye koyaushe suna da amfani. Abin da ba a cika ji ba shi ne cewa wasu daga cikin kwararrun hackers suna bangaren da ya dace, suna gano matsaloli kafin barayi su gano su (kuma ana biyan su ladan kokarinsu). Wannan aikin yana da suna, tarihin hukuma, da tsarin kwararru wanda ya samo asali shekaru da dama kafin kirkirar blockchain.

Shirin "bug bounty" na zamani na farko da aka tsara ya fara ne a ranar 10 ga Oktoba, 1995 ta kamfanin Netscape. Kamfanin yana aiki ne akan Navigator 2.0, wanda shi ne babban browser dinsa a lokacin, kuma ya yi kira ga jama'a: gano kuskuren tsaro, bayyana wannan raunin ga kamfanin cikin kwarewa, sannan a biya ka ladan kokarinka. Kodayake kasafin kudin ya yi kankanta idan aka kwatanta da na yau — dala 50,000 aka raba a duk tsawon shirin — ra'ayin kansa ya kasance sabo ne kwarai. Netscape, a zahiri, yana amincewa a bainar jama'a cewa manhajarsa tana da raunin da ba zai iya ganowa da kansa ba kuma mutanen waje na iya kasancewa a matsayi mafi kyau na gano su. Fiye da kudin, abin da wannan amincewar ta nuna shi ne mafi mahimmanci.

Wannan ya fara ne a hankali a cikin shekarun 2000 sannan ya kara sauri lokacin da manyan kamfanoni suka shiga ciki. A shekarar 2010 Google ya sanar da Shirin Ladan Rauni (Vulnerability Reward Program) wanda a yau kadai zai biya sama da dala 12,000,000 ga masu bincike da kuma sama da dala 50,000,000 gaba daya zuwa yau. Sai a shekarar 2013 Microsoft ya bi sahun tare da shiri na hukuma, sannan Apple — wanda ya dade yana kin amincewa da ra'ayin — a karshe ya bude nasa shirin ga jama'a a shekarar 2020.

A tsakiyar shekarun 2010, shirye-shiryen lada ga gano kura-kurai (bug bounties) sun zama ruwan dare ga kowane kamfanin fasaha da ke da gaske game da tsaron sa, tare da bullar ayyuka kamar HackerOne da Bugcrowd don sauƙaƙe shirye-shiryen a babban mataki ta hanyar haɗa kamfanoni da masu binciken tsaro masu zaman kansu waɗanda ke gudanar da neman raunuka a kowane lokaci.

Sai dai, ba dukkan manyan binciken tsaro ne suka faru a cikin tsarin lada na yau da kullum ba, kuma wasu daga cikin mafi tasiri sun nuna abin da zai iya faruwa idan ba a yi hakan ba. Can baya a shekarar 2014, ƙungiyoyi biyu — Neel Mehta na Google da kuma ƙungiyar kamfanin Codenomicon na ƙasar Finland — sun bayyana wani babban rauni a cikin OpenSSL ba tare da sanin juna ba, wanda shi ne laburaren ɓoye bayanan sirri (cryptographic library) da ke zama ginshikin babban sashi na dukkan bayanan intanet da aka ɓoye. Wannan sabon raunin da aka gano, wanda ake kira Heartbleed, ya ba mahari damar karanta ƙwaƙwalwar ajiya daga uwar garken (server) (wanda bai kamata su iya shiga ba), inda yake bayyana makullan sirri (private keys), bayanan shiga (credentials) da dubun-dubatar ayyuka ke amfani da su, da kuma bayanan masu amfani a sarari. Babu wani ladan gano kuskure da za a iya nema a lokacin. Kodayake an bayar da rahoton raunin cikin gaskiya da rikon amana, ya ɗauki lokaci mai tsawo a bayyane tsakanin ganowa da gyarawa fiye da yadda kowannenmu zai so tunani akai, kuma abin da ya biyo baya ya zama kokawa ta duniya baki ɗaya har tsawon watanni don komai tun daga gyare-gyaren manhaja, sabunta abubuwan ciki, har ma da tura bayanan gaba. Hasashen abin da ka iya faruwa — idan ma'aikatar leken asiri ta gwamnati ko ƙungiyar masu aikata laifuka suka gano shi tun da farko — ya kasance abin damuwa sosai wanda ya gaggauta aiwatar da tsare-tsaren bayyana raunuka (structured disclosure programs) a cikin masana'antar baki ɗaya.

Dalilin Da Ya Sa Crypto Ke Buƙatar "White Hats" Fiye Da Kowane Fanni

Don haka, matsalar tsaro a cikin blockchain ta bambanta ta fuskar tsari (kuma tana da sarƙaƙiya sosai) fiye da matsalar tsaron manhaja ta yau da kullun, wanda hakan ke da muhimmanci wajen bayyana dalilin da ya sa ladan gano kura-kurai (bug bounties) ya zama babban jigo a wannan fanni.

A cikin manhajoji na gargajiya, rauni (vulnerability) yana da tsanani amma yana da iyaka. Manhajar banki ta yanar gizo da aka yi wa kutse na iya fitar da bayanai ko haddasa zamba, amma ana iya shawo kan barnar a cikin tsarin da ke da dokoki, inshora, gano zamba, da kuma ikon soke hada-hadar kuɗi da aka yi ba bisa ƙa'ida ba. Akwai hanyar bin diddigin kuɗin. Maharin ba ya aiki a cikin sarari ba tare da wata alaƙa ba.

Yanayin asara a DeFi kuwa: nasarar kutse (ko akasin haka) tana faruwa ne ta hanyoyi daban-daban a kusan kowane fanni. Cikin daƙiƙu, ana iya kwashe dukkan kuɗaɗen da ke cikin wata yarjejeniya (protocol) idan mai kutse ya yi amfani da wani rauni na lokaci (timing flaw) a cikin kwantiragi mai basira (smart contract). Idan har ya yi nasara, maharin ya sami kuɗin crypto wanda ba wai kawai yana da wuyar bin diddigi ba ne, har ma kusan ba zai yiwu a dawo da shi ba tare da haɗin gwiwar mai shi ba. Babu wanda zai iya soke hada-hadar saboda babu wata hukuma ta tsakiya. A kowane lokaci, biliyoyin daloli suna nan a ajiye ba tare da canzawa ba a cikin waɗannan kwantiragi masu basira (smart contracts) waɗanda kowa zai iya karantawa kuma suke aiki da kansu. Lambar sirrin manhajarka (code) ita ce samfurinka, kuma samfurinka rumbun adana dukiya ne. Tsarin "wanda ya riga ya zo shi ne zai fara samu" ne ya shafi kusan kowane tsari, inda mafita ɗaya tilo ita ce bayanan da ba za a iya gogewa ba a cikin blockchain (on-chain).

Wannan shi ne ya sa takun-saka tsakanin mashi da garkuwa a fannin crypto yake da matuƙar gaggawa. Daga lokacin da ka ƙaddamar da kowace yarjejeniya (protocol) mai ƙima, tana fuskantar barazanar hari tun daga rana ta farko. Maharan ba marasa tsari ba ne.

Wasu suna da alaƙa da ƙasashe, wasu ƙungiyoyin masu laifi ne na zamani, wasu kuma kawai suna bin taswirar rashin ɗa'a ne da kuma zama a cikin Solidity; suna da kuɗi a hannu kuma suna sa ido sosai kamar shaho kan duk abin da aka tura (deployed). Jira har sai masu amfani sun daina amfani da tsarin saboda matsalolin tsaro ba dabarar kasuwanci ce mai dorewa ba. A'a, hanya ɗaya tilo ita ce gano waɗannan raunukan (vulnerabilities) kafin wasu su gano su — sannan a ɗauki mutanen da suke da isasshen gwaninta don gano su.

Binciken tsaro (Auditing) da gwajin kutse (penetration testing) — wato samun kamfanin tsaro ya duba lambobin sirri (code) kafin ka tura su — ya zama dole, amma sam bai isa ba. Yawancin binciken tsaro ana yin su ne a cikin ƙayyadadden lokaci kuma ƙungiyoyi masu ƙayyadadden girma ne ke yin su. Tsarin "smart contract" na iya samun miliyoyin hanyoyin mu'amala, kuma ƙungiyar bincike da ke ƙarƙashin matsin lamba na lokaci za ta duba waɗanda suka fi fitowa fili ne kawai. Waɗannan shirye-shiryen bug bounty suna faɗaɗa binciken zuwa wani babban mataki, kuma suna aiki tare da ƙwararrun masu bincike daga ko'ina cikin duniya masu fuskoki daban-daban, tunani daban-daban, da kuma lokaci mara iyaka. Haɗa duka biyun — cikakken binciken tsaro na cikin gida kafin kaddamarwa a mainnet, sannan kuma shirin bounty na dindindin — shi ne babban darasin da masu kula da tsaron yarjejeniyar sadarwa (protocol) ke bi a kwanakin nan.

Lissafin Shugaba (CEO) Tsakanin Dala Dubu Ko Miliyan Ɗaya

Dalilin tattalin arziki na shirye-shiryen bug bounty a bayyane yake har ba ya buƙatar bayani; sai dai a aikace yana buƙatar bayani saboda ana kashe kuɗin ne yanzu, yayin da tanadin kuɗin na hasashe ne kuma ya bazu na tsawon lokaci.

Yarjejeniyar sadarwa (protocol) da ke da ladar $10,000 kan gano babban rauni ta kashe $10K kan tsaronta. Wannan ita ce yarjejeniyar da ba za ta nuna wani rauni ba (mun dai ga yadda wani mugun ɗan kutse ya yi amfani da wannan), kuma yanzu tana iya rasa dukiyar da ta tara, miliyoyin daloli duk sun tafi cikin sauri tare da ƙarin matsaloli masu sarkakiya, har ma ta rasa ayyukanta gaba ɗaya. Ladar (bounty) ba asara ba ce — biyan inshora ne na rigakafi kafin abin da ake tsoron ya faru.

Babu yawan muhawara da zai ba da fahimtar da ake bukata don bayyana wannan lissafin kafin kaddamarwa — kowane babban darakta (CEO) da ya taba fuskantar babban harin kutse (exploit) yana fahimtar hakan a zahiri. Wadanda ba su taba fuskantar hakan ba suna kallon kashe kudi kan tsaro a matsayin daya daga cikin kudaden gudanarwa da ya kamata a rage domin kawai a cika ka'idojin bin doka.

Tarihin hare-haren kutse na DeFi ne ke samar da bayanan kudaden da ake asara. Misali, a shekarar 2022 kadai, gadar (bridge) dake cikin hanyar sadarwa ta Ronin ta yi asarar dala miliyan 625. Sannan wata gadar daban, Wormhole, an yi mata kutse a watan Janairu wanda ya lakume dala miliyan 320. Gadar Nomad — an yi asarar dala miliyan 190 yayin da kowane mai amfani zai iya kwashe kudaden dake cikin tsarin (protocol) da zarar an gano yadda aka fara harin — raunin da watakila dala 50,000 kacal za a biya a matsayin ladan gano kuskure (bounty) don gano shi da kuma gyara shi. Wadannan ba wasu abubuwa ne da ba safai suke faruwa ba. Wadannan su ne bayanan hukuma na abubuwan da ke faruwa a yanayi mai daraja sosai inda gano 'ramukan' tsaro (red teaming holes) ke da babban lada, kuma babu wani tsada wajen yin kutse.

Hadarin da ba a cika ambata ba shi ne wanda ke faruwa ta wata hanyar daban. Tsarin (protocol) da ya kaddamar da shirin ladan gano kuskure (bug bounty program) kafin ya shirya masa sosai, tamkar yana bayar da gayyata ce ta fili don a gano duk abin da tawagarsa ta cikin gida ta kasa gani — kuma idan ba a duba lambobin tsarin (codebase) yadda ya kamata ba, hakan na iya nufin kusan komai ma. Misali, shirin da aka ware wa dala 100,000 wanda aka fara a kan tsarin kwangila (contract system) mai dauke da manyan raunuka guda ashirin, na iya fuskantar bayyana sirrin wadannan raunuka a lokaci guda wanda zai kwashe daukacin kasafin kudin ladan cikin kwanaki kalilan; yayin da hakan zai sa tsarin ya daina aiki cikin tsaro." Yi tunanin wannan yanayin da ke ba mu damar cewa yawancin ayyukan DeFi na farko sun tsinci kansu a wannan matsayi: an sanar da shirin bayar da lada (bounty program) a bainar jama'a, sai kuma korafe-korafe suka fara kwarara wadanda ke nuna cewa binciken tsaro na cikin gida (internal audit) ya kasance na sama-sama ne kawai; sai dai kuma, kudaden gyara sun zarce abin da kungiyar ta ware don dukkan tsarin tsaron su. Darasin labarin ba wai shirye-shiryen gano kura-kurai (bug bounties) suna da hadari ba ne — a'a, suna bukatar mafi karancin ingancin lambobin sirri (code quality) ne. Protocols suna gano matsalolinsu mafi muni ta hanyar da ta fi muni ta hanyar kaddamar da shirin lada a matsayin madadin sahihin aikin tsaro na cikin gida maimakon ya zama kari a kansa.

Sakamakon wadannan darussa ya haifar da wannan tsari na zahiri: binciken cikin gida, bincike daya ko fiye daga waje ta hannun amintattun kamfanoni, sannan a kaddamar da aiki tare da shirin lada na dindindin. Wasu kuma suna amfani da karin matakin kaddamarwa a matakai — ta hanyar kayyade matsakaicin darajar da ke cikin hadari (value-at-risk) na wani lokaci yayin da shirin ladan ke gudana, sannan kawai su kara yawan kudaden musaya (liquidity) da zarar babu wata babbar matsala da ta taso. Wannan tsari ya fi tafiyar hawainiya kuma galibi ya fi tsada fiye da kaddamar da aiki kai tsaye. Amma zabi na biyun wani lokacin yakan zama bala'i.

Tsarin Muhalli: dandamali, shirye-shirye da kuma biyan kudade mafi tsoka

Kayayyakin more rayuwa na shirye-shiryen ladan gano kura-kurai na Crypto sun bunkasa sosai tun daga kwanakin farko na imel din bayyana bayanai ba bisa ka'ida ba da kuma ladan da ake bayarwa ba tare da tsari ba.

Immunefi shi ne dandamali mafi girma a wannan fanni kuma an kaddamar da shi a watan Disamba na shekarar 2020. Ya zuwa yanzu ya raba sama da dala miliyan 100 ga masu bincike kan rahotannin kura-kurai sama da 3,000, kuma yana ikirarin ya taimaka wajen dakile asarar sama da dala biliyan 25 a akalla protocols 500 ya zuwa farkon shekarar 2026. Dandalin yana hidima ga al'ummar masu binciken tsaro kusan 45,000 masu rajista, yana tallafawa tsarin bayyana bayanai da aka tsara, sannan yana shiga tsakani a tattaunawar da ke gudana tsakanin masu bincike da protocols game da rarraba matakin tsananin matsala da kuma darajar kudaden da za a biya. Immunefi tana karɓar kaso daga cikin kuɗaɗen ladan gano kura-kurai (bounty payouts), wanda hakan ya daidaita muradunsu da ɓangarorin biyu na kasuwar: suna samun ƙarin riba idan masu bincike suka gano kura-kurai (bugs) na gaske kuma yarjejeniyoyin (protocols) suka biya su.

Mafi girman biyan kuɗi guda ɗaya a tarihin dandalin ya kasance ladan dala miliyan 10 da aka biya a watan Fabrairu na 2022 ga ɗaya daga cikin masu bincikensa mai suna "satya0x" saboda gano wata matsalar tsaro ta "uninitialized proxy" a gadar Wormhole. Wannan matsalar tsaron, idan aka yi amfani da ita, za ta iya fallasa kadarorin da aka kulle waɗanda darajarsu ta kai kusan dala miliyan 736. Mai binciken ya bayyana matsalar cikin kiyaye ƙa'ida kuma an ba shi abin da a lokacin ya kasance mafi girman ladan gano kura-kurai (bug bounty) da aka taɓa sani. A watan Disamba na 2021, Polygon ta sayi bayanin wata babbar matsalar tsaro daga hannun mai bincike Leon Spacewalker a kan dala miliyan 2.2, wadda za ta iya ba da damar ƙirƙirar (minting) har kusan biliyan 9.3 na token ɗin MATIC — wanda ya yi daidai da darajar biliyoyin daloli a farashin kuɗin na wancan lokacin. Lissafin a bayyane yake ta kowane ɓangare: ladan ya kasance mai yawa idan aka duba adadinsa, amma kuma kaɗan ne idan aka kwatanta da abin da za a iya rasawa daga hare-haren da aka dakile.

Shirye-shiryen ƙarfafa gwiwa na musamman da ake gudanarwa a matakin yarjejeniyar (protocol level) yanzu sun kai adadin da zai yi wuya a yi tunaninsa shekaru kaɗan da suka gabata. Mafi girman biyan kuɗi shine dala miliyan 15.5 don manyan matsalolin tsaro (critical vulnerabilities) a cikin shirin v4 na Uniswap. LayerZero tana da ladan gano kura-kurai da ya kai dala miliyan 15. A shekarar 2026, mafi girman biyan kuɗi na Gidauniyar Ethereum ya ƙaru zuwa dala miliyan 1.

Ba wai kawai wadannan alkaluma ya kamata su yi daidai da darajar abin da wadannan protokols ke kokarin karewa ba, har ma suna bukatar su dace da matsayin kwarewar mai binciken da kuke son jawo hankalinsa — iyakar dala $1,000 ba za ta karfafa gwiwar wanda zai iya gano wani babban rauni mai matukar hadari a cikin protokol na biliyoyin daloli ba.

Code4rena da Sherlock sun dan bambanta kadan, kuna gudanar da gasar tantancewa (audit) ta gasa a cikin wani kayyadadden lokaci, inda masu bincike da dama ke duba codebase a lokaci guda kuma ana raba jimillar kyaututtuka dangane da tsananin hadari da ingancin abin da aka gano. Tare da al'ummar masu tantancewa (auditors) sama da 8,300 da aka yi wa rajista da kuma abubuwa sama da 24,000 na musamman da aka gano a duk tantancewar Code4rena. An gudanar da irin wadannan gasa sama da 175 ta hannun Sherlock. Tsarin gasa yana canza fasalin karfafa gwiwa; ana karfafa gwiwar masu bincike su nemo matsalolin da wasu ba za su lura da su ba, domin gano abubuwa a irin wadannan adadi mai yawa sau da yawa suna samun kankanin biya ko ma babu ko daya. Gaba daya, wannan kuma yana bayyana matsaloli a babban sikelin da ya wuce yadda tantancewa ta jere (sequential audits) ko shirye-shiryen bayar da kyautar gano kuskure (bounty programs) marasa iyaka za su iya yi. Shirye-shiryen Crypto na sauran masu rike da Bitcoin Cash kamar Coinbase da MakerDAO har yanzu ana gudanar da su a GitHub. A duk fadin kasuwar bug bounty mai aiki a Web3 yanzu, akwai sama da dala miliyan 162 a matsayin kyautar gano kuskure idan wani abu bai tafi yadda aka tsara ba, wanda ke nuna girman abin da ke cikin hadari da kuma nuna hanyar kwarewa da masu bincike da dama suka bi.

Nazarin Kwarewar Fasaha Da Kuma Dalilin Da Ya Sa Ba Kudi Ne Mai Sauki Ba

Hoton mai neman kyautar gano kuskure (bug bounty hunter) a matsayin wanda kawai zai ga wani rauni a wata rana da rana sannan ya karbi kudi mai adadi shida ba gaskiya ba ne idan aka kwatanta da hakikanin aikin. Masu gudanar da wannan aiki waɗanda ke samun abin dogaro da kai ta hanyar binciken tsaro a fannin crypto yawanci ƙwararru ne, waɗanda hanyarsu ta zama hakan tana buƙatar shekaru masu yawa na shiri na fasaha a fannonin da yawancin masu haɓaka manhaja (developers) ba sa cika shiga.

Gano manyan kurakurai masu haɗari a cikin lambar (code) smart contract da ake amfani da ita yana buƙatar ƙwarewa a kan Ethereum Virtual Machine — ba wai kawai sanin yadda ake rubuta Solidity ba, amma fahimtar abin da take komawa bayan an sarrafa ta (compiles), abin da EVM ke yi a zahiri yayin gudanar da bytecode, da kuma waɗanne siffofi na yaren ne compiler ɗin ke tabbatarwa ko ma aka sani yana yi, idan aka kwatanta da matsalolin da ka iya tasowa (edge cases) waɗanda za su iya zama barazanar tsaro idan aka haɗa su da zaɓin inganta gas (gas optimization) da masu haɓaka manhaja masu ƙarancin kuɗi ke yi a ƙarƙashin matsin lokaci. Yana buƙatar ba kawai fahimtar nau'ikan raunuka (vulnerability classes) da aka saba gani ba — reentrancy, integer overflow, flash loan manipulation, oracle price manipulation, access control failures, initialization vulnerabilities — har ma da ikon gano sabbin hanyoyin kai hari (attack vectors) waɗanda ba su yi daidai da kowane sanannen tsari ba. Abubuwan da aka gano mafi amfani su ne waɗanda babu wanda ma yake nema.

Kayan aikin da masu bincike ke amfani da su a wannan aiki sun haɓaka sosai kuma yanzu sun haɗa da kayan aikin da a mafi yawan lokuta ba za a iya bambanta su da waɗanda mugun mahari (malicious actor) zai yi amfani da su ba:

Slither, wani tsarin nazari na tsaye (static analysis framework) wanda Trail of Bits ya haɓaka, zai iya duba lambar Solidity ɗinka don gano sanannun nau'ikan raunuka guda 40 sannan ya ba ka sakamako dalla-dalla. Wannan shi ne matakin farko, ba shi ne na ƙarshe ba — yana da kurakuran karya (false positives) kuma yana rasa raunukan matakin logic (logic-layer vulnerabilities) gaba ɗaya.

Mythril yana amfani da gudanarwa ta alama (symbolic execution) don bincika yiwuwar yanayin kwangila (contract states) daban-daban kuma yana duba ko akwai wani yanayi da za a iya kaiwa gare shi wanda ya keta wasu ƙa'idodin tsaro da mai binciken ya ayyana. Sai dai, yana da tsada kuma yana ba da damar nazari na sama-sama ne kawai ga kwangiloli masu sarkakiya.

Shi fuzzer ne mai dogaro da siffofi (property-based fuzzer): idan aka ba shi jerin ka'idojin da ya kamata kwangila (contract) ta kiyaye a kowane lokaci, mai bincike zai mika su ga Echidna, wanda zai bi ta dubban jerin hada-hadar kudi na bazata domin kokarin karya su. Mun kware musamman wajen neman matsaloli na musamman (edge cases) a fannin lissafi da dabarun sarrafa yanayi (state-management logic).

Yawancin binciken tsaro mai zurfi yanzu ana yin sa ne ta amfani da Foundry, domin yana da saukin sauyawa daga 'Ina tunanin wannan zai yi aiki' → 'Zan iya tabbatar da cewa wannan yana aiki', musamman tunda yawancin masu bincike suna rubuta gwaje-gwajensu da hanyoyin kutse (exploits) a cikin Solidity kai tsaye da Foundry.

Tare da kayan aikin tantancewa na zahiri (formal verification) na Certora, masu bincike za su iya amfani da bayanan siffofin dabi'ar kwangila a matsayin kwangilolin lissafi, sannan su tantance su da ainihin bytecode din. Wannan ita ce hanya mafi kalubale kuma mafi wahalar aiwatarwa, ta fuskar fasaha da kokari.

Wani daga cikin kayan aikin Trail of Bits, Manticore, yana yin bincike mai gudana (dynamic analysis) kuma ana iya amfani da shi wajen samar da bayanai kai tsaye wadanda ke bin wasu hanyoyin lamba (code paths) a cikin kwangilar — abin da bincike a tsaye (static analysis) ba zai iya kaiwa gare shi ba.

Babu wani kayan aiki guda daya da ke gano raunuka masu hatsari (critical vulnerabilities) kai tsaye daga cikin wadannan kayan aikin. Suna takaita fadin wuraren da ake zargin akwai matsala ne kawai tare da nuna wadanda dan adam dole ne ya tantance su. Idan mai bincike ba zai iya karanta EVM assembly ba, ko yin tunani game da tsarin jerin hada-hada (transaction ordering) da fahimtar tattalin arzikin tsarin DeFi a matakin tsari, ba zai iya tsinana komai ba da sakamakon kowane daga cikin wadannan kayan aikin. Wadannan kayan aikin masu kara karfin kwarewa ne, ba masu maye gurbinta ba.

Wadannan matsaloli na aikace-aikace sun wuce batun fasaha kawai. Gasar tana da zafi. Yayin gasar binciken tsaro (audit contest) a Code4rena ko Sherlock, daruruwan masu samar da manhaja (developers) suna nazarin tushen lamba (codebase) guda daya a lokaci guda.

Yawanci mai bincike guda ɗaya ne ke samun lada kan gano wata babbar matsala (critical finding) — duk wani wanda ya gano matsala iri ɗaya ba ya samun komai ko kuma ya sami ɗan abin da ba a rasa ba. Mai binciken da ya kwashe mako guda yana fafatawa a gasa amma ya gano matsaloli masu matsakaicin haɗari (medium-severity) kawai, yana iya tashi da ƴan daruruwan daloli kawai. Akwai rashin tabbas sosai game da samun kudin shiga, kuma lokutan rashin samun komai gaskiya ne.

Sai dai kuma, tabbatar da sakamakon bincike na iya zama da wahala kamar yadda gano shi yake. Dole ne mutum ya nuna a aikace yadda za a iya amfani da matsalar (yawanci ta hanyar amfani da "proof-of-concept exploit"). Wasu kuma suna yin jayayya kan rarraba matakin haɗarin wani bincike na "critical" ko "medium", suna masu hujjar cewa wasu fannoni sun rage tsananin matsalar. Masu binciken da ba su rubuta ayyukansu dalla-dalla ba, da kuma masu binciken da ba su da tasirin da ke fitowa daga suna ko kwarewa, na iya samun kansu da ƙarancin biya kan muhimman abubuwan da suka gano.

Sannan a ƙarshe, yanayin shari'a da haraji ya zama wani babban ƙalubale na daban. Yawancin ladan bincike (bounties) ana biyan su ne ta hanyar kuɗaɗen intanet (crypto) — walau USDT, USDC, ETH ko kuma asalin token na wani tsari (protocol). Karɓar tura USDT a matsayin kuɗin shiga yana haifar da wajibcin biyan haraji, wanda ke buƙatar mai karɓa ya bibiyi darajar kuɗin a lokacin da ya karɓa kafin ya canza su don dalilai na rahoton haraji, sannan ya fuskanci harajin ribar jari (capital gains) kan duk wani canjin farashi idan an yi biyan ta hanyar wani nau'in kadarar dijital. Shirye-shiryen gano matsalolin manhaja (Bug bounties) suna zuwa da nasu nauyin — kafa sana'ar gano matsaloli, kamar kowace sana'a, yana buƙatar daidaita tsakanin lokacin da aka zuba da kuma sakamakon da aka samu — idan ka yi watsi da al'amuran gudanarwa, hakan na zama wata matsalar da ke ƙaruwa a hankali.

Amma babban ƙalubalen shi ne cewa wannan aikin yana da damar samun kuɗi mai yawa sosai amma kuma babu tabbas ko kaɗan na samun ko kwabo. Mai binciken da ya haɓaka ƙwarewa ta gaske tare da tabbataccen tarihi — wanda ya gano manyan raunuka a cikin tsarin protocol, wanda sunansa ke fitowa a rahotannin bincike (audit reports) ko bayanan bayan faruwar matsala (postmortems) — yana iya samun kuɗin da ya yi daidai da albashin manyan injiniyoyi a manyan kamfanoni. Ko dai yana bukatar wata halitta ta musamman da aka haife ka da ita, ko kuma shekaru na gyara kwarewa a wani fanni na musamman don kaiwa ga wannan matsayi. Kusan duk wanda ya yi kokarin dogaro da shi kadai a matsayin hanyar rayuwa, yakan gano da sauri cewa lokacin koyo ya fi yadda ake tsammani tsawo, masu fafatawa sun shirya fiye da yadda ake tsammani, kuma yayin da ake tsaka da horo, kudin shiga ba ya isa biyan bukatun yau da kullum.

Wannan ba lallai yana nufin fannin ba shi da kyau ba ne. Yana nuna cewa fanni ne na gaskiya. Irin kwarewar da ke ba mai binciken bug bounty damar yin nasara — zurfin mayar da hankali kan fasaha, tunani kan yadda tsarin yake aiki, kirkira a lokacin rashin tabbas, da kuma shirye-shiryen yin aiki na tsawon sa'o'i a kan abin da zai iya zama ba shi da wani riba — ita ce daidai kwarewar da kwararrun tsaro ke nema a kowane fanni. Mutumin da ya bunkasa wadannan kwarewar har zuwa matakin da ake bukata don binciken tsaron crypto yana da damar zaba. Daya daga cikin irin wadannan ayyukan ita ce hanyar bug bounty, kuma hakan na kara bunkasa ga kalilan din da suka bi ta.

Wannan babban labari ne ga duk wanda ke gudanar da ayyuka ta amfani da USDT — tun daga daidaita wanda za a biya wane lada, zuwa raba kudaden biya tsakanin masu hadin gwiwa da dama, ko kuma kawai fitar da ladan daga tsarin (protocol). Na'urar lissafin tura USDT ta Netts (Netts USDT Transfer Calculator) tana yin hakan ne: saka adiresoshin mai aikawa da mai karba, kuma za ta gaya maka daidai adadin Energy da Bandwidth da za a bukata don hada-hadar, abin da za a kona (burnt) idan aka kwatanta da na asali ko kuma idan an yi amfani da albarkatun da ake da su, tare da kwatanta farashin aikawa zuwa adireshin da ya riga ya mallaki USDT (13.84 TRX idan aka kwatanta da 2-3 TRX na hayar Energy), ko sabon adireshin (27.70 TRX idan aka kwatanta da 4-5 TRX na hayar albarkatu) — tanadin sama da kashi 80% ta kowace hanya!