Dan Guido

Smart contracts auditing companies like @trailofbits @ConsenSys Diligence or @OpenZeppelin should provide insurance services for smart contracts they are confident in. Companies and users could pay x% per year to cover potential fund losses held or managed by some contracts.

Wouldn't the insurer be the most at risk in case of a vulnerability, since they have to refund insured parties? It's not clear to me what the unethical aspect is in this scenario, though I must admit I am not familiar with the insurance world.

Since contracts are public, if there is a vulnerability in a contract they are the insurance counterparty for, isn't it in their interest to do everything to prevent that vulnerability from being exploited? Imo, seems like a more certain way of avoiding to reimburse losses.

Let's assume it is covered yes, though it seems to me like if it's not covered then they are back to wearing the security auditor hat and putting their reputation at risk for not resolving it.

Security vendors don’t resolve bugs, we advise on risk. It’s the owners perogative to take risks. If a bug is found after they deploy, that’s on the owner, not on me. I would hope our advice helped address that near inevitably, too, so handling it was quick with little impact.