[FINAL] Celo Ecosystem Security Services Program: Enhancing Ecosystem Security Through Subsidized Services
Authors: cLabs Security Team
Status: FINAL
Funding Request: 768,500 Celo ( $580,000 at 90 day average of celo:usd on 12/05/2024 = .675 )
Summary
The Security Team at cLabs proposes an initiative to subsidize the cost of security services for Celo ecosystem partners. This pro bono initiative will involve collaboration with leading security vendors to provide on-chain monitoring, automated security testing, brand protection, security architecture reviews, anti-money laundering (AML) compliance, and software supply chain security. We aim to leverage industry-leading practices and provide tools that empower partners to adopt and improve their security postures, reducing the risk of exploits that could impact the broader ecosystem.
The proposed funding for this initiative is 768,500 CELO ( $580,000 at 90 day average of celo:usd on 12/05/2024 = .675 ) to be distributed over a 1-year period, from January 2025 to December 2025.
Motivation
Let’s face reality: Web3 lost over $3.7 billion to hacks in 2022 alone. Every security incident in our ecosystem directly impacts CELO token value and destroys user trust that took years to build. These impacts ripple through every project building on Celo.
Traditional security reviews exceed $150,000 per project; forcing most teams building on Celo to choose between proper security and core development. This isn’t just about individual projects, it’s about protecting Celo’s entire ecosystem.
The urgency of this proposal is driven by three critical factors:
- Attack sophistication is rapidly evolving with Technology. Bleeding-edge technology must be implemented with effective security testing.
- Regulatory pressure is mounting, with authorities scrutinizing blockchain security more than ever. Security incidents attract unwanted regulatory attention, while proactive security measures demonstrate ecosystem maturity.
- Security has become a key differentiator for ecosystem growth, as leading chains strengthen their security posture and projects choose platforms partly based on security support.
This initiative transforms security from a luxury into a standard feature of building on Celo and aims to:
- Make enterprise-grade security services accessible to Celo ecosystem projects
- Reduce the financial barrier to implementing robust security measures
- Protect user funds and maintain ecosystem trust
- Enable projects to focus resources on development while maintaining security
Specification
The program will operate on a first-come-first-served basis with additional rewards for projects that have already implemented security controls. Key components include:
Services Offered:
-
Smart Contract & Wallet Security: Focusing on automated vulnerability scanning, smart contract security analysis, and wallet integration security. This foundational service helps projects secure their core smart contract infrastructure and user interaction points. The service includes gas optimization analysis and upgradability pattern security reviews.
-
Brand Protection Services: Providing comprehensive brand security services to prevent spoofing attacks, phishing attempts, and reputation damage. This service helps maintain user trust and ecosystem integrity through continuous monitoring and protection of project digital assets.
-
Attack Surface Monitoring: Implementing continuous scanning and monitoring of cloud infrastructure vulnerabilities, exposed API endpoints, and configuration issues. This service ensures projects maintain a secure operational environment.
-
Secrets & Supply Chain Security: Monitoring for accidentally exposed API keys or service account credentials in public source code. Additionally, the service includes scanning for vulnerable dependencies in the software supply chain, ensuring secure development practices.
-
Secure Deployment Workflows: Analyzing and securing deployment processes, focusing on preventing malicious, insecure, or inadequate automated workflows. This service helps projects maintain security throughout their development pipeline.
-
Static Application Security Testing: Providing automated security scanning tools specifically designed for smart contract code, helping projects identify potential vulnerabilities early in the development cycle.
-
Competitive Bug Bounty Programs: Supporting projects in establishing and maintaining bug bounty programs to incentivize responsible vulnerability disclosure and ecosystem security improvements.
-
Security Program Reviews: Offering comprehensive security program assessments to ensure no critical assets remain at high risk, providing strategic guidance for security implementation.
Budget Allocation:
Expenditure Breakdown ( amounts in USD )
-
Smart Contract, Wallet, and WebApp Security Review 120,000
-
Brand Protection 50,000
-
Attack Surface Monitoring 45,000
-
Secrets Management 45,000
-
Supply Chain Security 45,000
-
Secure Deployment Workflows 45,000
-
Static/Dynamic Security Testing 40,000
-
Competitive Bug Bounty Program 150,000
-
Security Program Review 30,000
-
Program Administration 10,000
-
Total 580,000 USD
Phase 1: Program Setup (Q1 2025)
- Program infrastructure setup
- Security vendor onboarding
- Application process launch
- Community awareness campaign
Phase 2: Initial Partner Enrollment (Q1-Q2 2025)
- First batch of partner applications
- Initial security assessments
- Service implementation begins
- First monthly report publication
Phase 3: Full Program Operation (Q2-Q4 2025)
- Continuation of partner onboarding
- Service delivery and monitoring
- Monthly reporting and community updates
- Mid-program assessment and adjustments
Phase 4: Evaluation and Planning (Q4 2025)
- Program impact assessment
- Community feedback collection
- Sustainability planning
- Renewal proposal preparation
Partner Selection Process:
- Open application process through Celo Forum (TBD)
- Clear eligibility criteria published
- Monthly batch processing of applications
- Bonus structure for existing security implementations
Fund Management:
- 2/3 Multisig structure:
- cLabs Security Lead
- cLabs Project Manager
- Community elected signer
- Monthly budget reporting
- Quarterly audits
Key Performance Indicators:
- Number of Partners Onboarded: Successfully onboard at least 10 partners within the first three months.
- Reduction in Vulnerabilities: Reduction in the number of vulnerabilities identified by scanning tools by 30% by the end of the project.
- Competitive Bug Bounty Participation: At least 20 bug bounty submissions, with 5 critical vulnerabilities addressed.
- Partner Satisfaction: Gather feedback from partners; aim for an average satisfaction score of 7/10 or higher.
- Security Maturity: Increase in overall security maturity scores from a scale of 1 to 5 for at least 70% of the participating projects, with a target of moving projects from an average score of 2 to an average score of 4 by the end of the program.
Reporting Structures:
Monthly Updates:
- Partners onboarded
- Services utilized
- Security metrics
- Budget utilization
Quarterly Reports:
- Comprehensive impact analysis
- Success stories
- Security trends
- Program adjustments
Fund Distribution:
- Initial transfer: 384,250 Celo (Upon approval)
- Second transfer: 384,250 Celo (End of H1 2025, subject to milestone completion)
Multisig Address: 0x35ff861a0b6215CeC71EA282B0D32AfefA661795
Signers:
- cLabs Security Lead: Benjamin Speckien
- cLabs Project Manager: Nikolaos Frestis
- cLabs Security Engineer: Patrick Putman
6. Long-term Sustainability
Year 1 (2025):
- Full subsidy model
- Program establishment
- Community engagement
Future Sustainability (2026+):
- Graduated co-payment model based on project maturity
- Community fund renewal based on demonstrated success
- Integration with broader Celo security initiatives
7. Team Structure
The program will be managed by a cLabs team including:
- 1 Head of Security
- 2 Security Engineers
- 1 Project Manager
8. Conclusion
This security services subsidy program represents a critical investment in the Celo ecosystem’s future. By making essential security services accessible to all projects, we can create a more secure and sustainable environment for continued growth and innovation.
The time to implement comprehensive security measures is now, before they become necessary rather than preventative. We have the opportunity to set new standards for ecosystem-wide security practices and support the sustainable growth of the Celo ecosystem.
TL;DR
cLabs Security Team is proposing a one-year program (2025) to subsidize security services for Celo ecosystem projects, requesting 768,500 CELO ($580,000 USD) in funding.
Key aspects:
- Purpose: Make enterprise-grade security accessible to Celo projects by subsidizing services like smart contract security, brand protection, and attack monitoring
- Motivation: Combat rising crypto hacks ($3.7B lost in 2022), high security review costs ($150K+), and increasing regulatory pressure
- Budget: Major allocations include:
- Smart Contract & Wallet Security: 120,000 USD
- Brand Protection 50,000 USD
- Bug Bounty Program: 150,000 USD
- Various monitoring services: ~45,000 USD each
- Structure:
- First-come-first-served basis
- 2/3 Multisig governance
- Monthly updates and quarterly reports
- Success targets include onboarding 10+ partners in first 3 months
- Initially fully subsidized, moving to co-payment model in 2026+
The goal is to transform security from a luxury into a standard feature for projects building on Celo.
Thanks for posting the proposal. Is good to see you posting.
Last remark