Dan Guido

Let's assume it is covered yes, though it seems to me like if it's not covered then they are back to wearing the security auditor hat and putting their reputation at risk for not resolving it.

Security vendors don’t resolve bugs, we advise on risk. It’s the owners perogative to take risks. If a bug is found after they deploy, that’s on the owner, not on me. I would hope our advice helped address that near inevitably, too, so handling it was quick with little impact.

Your doctor can’t control your legs and make you run. It’s not their fault if you don’t listen to every academic study they know could help you. This fantasy that a security vendor is somehow responsible for a client getting hacked is completely wrong.

I've never implied that security auditors are responsible for bugs in the code they audit, but it seems clear to me that an auditor that continually fails to report and disclose vulnerabilities that later get exploited will have a hard time finding new clients.

Maybe, or maybe you only booked 15 minute checkups when you needed a 2hr physical, or you’ve got a rare disease only a special test could find, or new research came out with risk factors no one understood before, or you didn’t like my advice and ignored it, etc.

Contract auditors have more knowledge about the risks of a system than a doctor could ever have about their patients. If their reports omit overflows that get exploited, it's unlikely people will keep using them. Obscure and rare vulns would likely not affect their reputation.

I’m sorry, this simply does not reflect the reality of code reviews we’ve conducted. There are many we’ve done where the constraints, or the design patterns, or the willingness to listen to us leave the code in a state where we’re not sure whether even all simple bugs are fixed.

Wouldn't that precisely put you in a situation where you *do not* want to provide insurance for these contracts? An insurance company for smart contracts would need their own security team to analyze the risks involved with a contract and price the coverage accordingly, if at all