From f9871c54976ee97805a244498cb353c904ad8cd1 Mon Sep 17 00:00:00 2001 From: Quan Nguyen Date: Sun, 30 Nov 2025 06:21:44 +0700 Subject: [PATCH] Add the Rekt Test security assessment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add documentation for the Rekt Test, a 12-question framework created by Trail of Bits and blockchain security experts to help organizations evaluate their security posture. Includes: - All 12 questions with explanations - Links to related documentation (incident response, workflow, tools) - Guidance on how to use the test Closes #333 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-Authored-By: Claude --- SUMMARY.md | 1 + development-guidelines/README.md | 3 +- development-guidelines/rekt-test.md | 82 +++++++++++++++++++++++++++++ 3 files changed, 85 insertions(+), 1 deletion(-) create mode 100644 development-guidelines/rekt-test.md diff --git a/SUMMARY.md b/SUMMARY.md index 9327e61f..9958443e 100644 --- a/SUMMARY.md +++ b/SUMMARY.md @@ -10,6 +10,7 @@ - [Incident Response Recommendations](./development-guidelines/incident_response.md) - [Secure Development Workflow](./development-guidelines/workflow.md) - [Preparing for a Security Review](./development-guidelines/review_checklist.md) + - [The Rekt Test](./development-guidelines/rekt-test.md) - [Learn EVM](./learn_evm/README.md) - [EVM Opcode Reference](./learn_evm/evm_opcodes.md) - [Transaction Tracing](./learn_evm/tracing.md) diff --git a/development-guidelines/README.md b/development-guidelines/README.md index bd35a44f..d48a0360 100644 --- a/development-guidelines/README.md +++ b/development-guidelines/README.md @@ -1,8 +1,9 @@ List of Best Practices for Smart Contract Development -- [Code Maturity](./code_maturity.md): Criteria for developers and security engineers to use when evaluating a codebase’s maturity +- [Code Maturity](./code_maturity.md): Criteria for developers and security engineers to use when evaluating a codebase's maturity - [High-Level Best Practices](./guidelines.md): Essential high-level best practices for all smart contracts - [Token Integration Checklist](./token_integration.md): Important aspects to consider when interacting with various tokens - [Incident Response Recommendations](./incident_response.md): Guidelines on establishing an effective incident response plan - [Secure Development Workflow](./workflow.md): A recommended high-level process to adhere to while writing code - [Preparing for a Security Review](./review_checklist.md): A checklist of things to consider when preparing for a security review +- [The Rekt Test](./rekt-test.md): A 12-question security assessment framework to evaluate your security posture diff --git a/development-guidelines/rekt-test.md b/development-guidelines/rekt-test.md new file mode 100644 index 00000000..fc60e09d --- /dev/null +++ b/development-guidelines/rekt-test.md @@ -0,0 +1,82 @@ +# The Rekt Test + +The Rekt Test is a 12-question security assessment framework created by Trail of Bits and blockchain security experts to help organizations evaluate their security posture. Inspired by [Joel Spolsky's Joel Test](https://www.joelonsoftware.com/2000/08/09/the-joel-test-12-steps-to-better-code/), it provides a quick way to assess security maturity. + +The more questions your organization can answer "yes" to, the more you can trust the quality of your security operations. + +## The 12 Questions + +### Documentation and Planning + +- [ ] **1. Do you have all actors, roles, and privileges documented?** + + Document who can do what in your system. This includes admin roles, privileged operations, and the scope of each role's permissions. + +- [ ] **2. Do you keep documentation of all external services, contracts, and oracles you rely on?** + + Maintain an up-to-date list of all external dependencies, including third-party contracts, oracles, bridges, and off-chain services your system interacts with. + +- [ ] **3. Do you have a written and tested incident response plan?** + + Have a documented plan for responding to security incidents. Test it regularly through tabletop exercises. See our [Incident Response Recommendations](./incident_response.md). + +- [ ] **4. Do you document the best ways to attack your system?** + + Maintain a threat model that identifies potential attack vectors. Update it as your system evolves. + +### Personnel and Access Control + +- [ ] **5. Do you perform identity verification and background checks on all employees?** + + Verify the identity of team members, especially those with access to privileged systems or keys. + +- [ ] **6. Do you have a team member with security defined in their role?** + + Assign explicit security responsibilities to at least one team member. Security should not be an afterthought. + +- [ ] **7. Do you require hardware security keys for production systems?** + + Use hardware security keys (like YubiKeys) for accessing production systems and critical infrastructure. + +- [ ] **8. Does your key management system require multiple humans and physical steps?** + + Implement multi-signature schemes and physical security measures for critical operations. No single person should be able to compromise the system. + +### Technical Security + +- [ ] **9. Do you define key invariants for your system and test them on every commit?** + + Identify the properties that must always hold true in your system and verify them automatically. Use tools like [Echidna](../program-analysis/echidna/README.md) or [Medusa](../program-analysis/medusa/docs/src/README.md) to test invariants continuously. + +- [ ] **10. Do you use the best automated tools to discover security issues in your code?** + + Integrate security tools into your development workflow: + + - [Slither](../program-analysis/slither/docs/src/README.md) for static analysis + - [Echidna](../program-analysis/echidna/README.md) or [Medusa](../program-analysis/medusa/docs/src/README.md) for fuzzing + - See our [Secure Development Workflow](./workflow.md) for a complete checklist + +- [ ] **11. Do you undergo external audits and maintain a vulnerability disclosure or bug bounty program?** + + Get independent security reviews before major releases. Maintain a way for security researchers to responsibly report vulnerabilities. + +- [ ] **12. Have you considered and mitigated avenues for abusing users of your system?** + + Think beyond technical exploits. Consider how your system could be used to harm users through phishing, social engineering, or economic attacks. + +## How to Use This Test + +1. **Initial Assessment**: Go through each question honestly. A "yes" requires evidence, not just intention. + +2. **Identify Gaps**: Questions you cannot answer "yes" to represent areas for improvement. + +3. **Prioritize**: Not all questions are equally critical for every project. Prioritize based on your risk profile. + +4. **Revisit Regularly**: Security posture changes over time. Reassess periodically, especially after major changes. + +## Resources + +- [Can you pass the Rekt Test?](https://blog.trailofbits.com/2023/08/14/can-you-pass-the-rekt-test/) - Original Trail of Bits blog post +- [Incident Response Recommendations](./incident_response.md) - Guidelines for question 3 +- [Secure Development Workflow](./workflow.md) - Detailed workflow for questions 9-10 +- [Program Analysis Tools](../program-analysis/README.md) - Tools for questions 9-10