Kriterium · Methodik-Version 1.2.0
Security
Was dieses Kriterium in jeder Kategorie misst, nach Methodik-Version 1.2.0.
Kriterium-ID: security · aus Release method-v1.2.0
Kriterien auf Englisch
Was es misst
In Exchanges and brokers
How well the platform protects the assets it holds for its customers. Evidence: the custody model (which share is held in cold storage, with whom, and whether customer assets are segregated from the company's own), published proof of reserves and whether it covers liabilities as well as assets, the documented incident history (hacks, losses, outages) with the platform's response, and protection mechanisms such as two-factor authentication, withdrawal address allowlists and insurance or compensation funds with their published terms.
In Hardware wallets
How well the device protects private keys against extraction, tampering and faulty firmware. Evidence: the key storage hardware (secure element or general-purpose chip), whether firmware and companion software are open source and reproducibly built, published independent audits, the documented incident and vulnerability history with the maker's response, and multisig support.
In Mobile wallets
How well the app protects keys and funds on a general-purpose phone. Evidence: use of the phone's hardware-backed key storage, whether the app is open source and reproducibly built, published independent audits, the documented incident and vulnerability history with the provider's response, and multisig support.
In On-ramps
How well the service protects customers' money and assets during a purchase or sale. Evidence: the custody model (whether purchased assets are delivered straight to the customer's own address or held by the service first, and for how long), published proof of reserves where the service holds balances, the documented incident history with the service's response, and protection mechanisms such as address checks and account protection.
Wie der Wert entsteht
Die Teilkriterien, die eine bewertende Person auf dem Weg zum Wert festhält. Sie werden nicht als eigene Werte veröffentlicht.
In Exchanges and brokers
Teilwerte werden als ganze Zahlen von 0 bis 100 notiert.
- Custody model
- How customer assets are held: cold and hot storage shares, the custodian, and segregation from the company's own assets.
- Proof of reserves
- Published attestations of reserves, how often, by whom, and whether liabilities are included.
- Incidents
- Known hacks, losses and outages, their size, and how quickly and openly the platform disclosed them and compensated customers.
- Protection mechanisms
- Account protection (two-factor authentication, address allowlists, withdrawal delays on change) and compensation funds or insurance with their published terms.
In Hardware wallets
Teilwerte werden als ganze Zahlen von 0 bis 100 notiert.
- Secure element
- Key storage in dedicated tamper-resistant hardware, and the published resistance to physical and side-channel attacks.
- Open source
- Firmware and companion software whose source code is public and whose builds can be reproduced from it.
- Audits
- Independent security audits, their scope, date and published findings.
- Track record
- Known incidents and vulnerabilities, their severity, and how quickly and openly the maker fixed and disclosed them.
- Multisig support
- Whether the device can take part in multisig setups with other devices.
In Mobile wallets
Teilwerte werden als ganze Zahlen von 0 bis 100 notiert.
- Secure element
- Use of the phone's secure enclave or hardware-backed keystore, and app-level protection (PIN, biometrics, encryption at rest).
- Open source
- App source code that is public and whose builds can be reproduced from it.
- Audits
- Independent security audits, their scope, date and published findings.
- Track record
- Known incidents and vulnerabilities, their severity, and how quickly and openly the provider fixed and disclosed them.
- Multisig support
- Whether the app can create or take part in multisig setups.
In On-ramps
Teilwerte werden als ganze Zahlen von 0 bis 100 notiert.
- Custody model
- Direct delivery to the customer's own address, or a custodial balance first, and how long assets stay with the service.
- Proof of reserves
- Published attestations where the service holds customer balances.
- Incidents
- Known losses, fraud cases and outages, and how quickly and openly the service disclosed them and compensated customers.
- Protection mechanisms
- Address checks before sending, account protection and refund terms.
Belege und Verlässlichkeit
Jeder Wert dieses Kriteriums nennt Belege mit ihren Quellen und trägt eine von vier Verlässlichkeitsstufen.
- hoch
- Primärquellen, zum Bewertungsdatum geprüft und durch einen Test von WhatTheChain oder eine zweite unabhängige Quelle bestätigt.
- mittel
- Primärquellen, die sich nicht unabhängig bestätigen ließen, oder einige älter als die letzte planmäßige Überprüfung.
- niedrig
- Nur Sekundärquellen oder widersprüchliche Quellen; die Begründung erklärt, welcher der Wert folgt.
- Schätzung
- Keine direkte Quelle: abgeleitet aus dokumentierten Eigenschaften und vergleichbaren Bauweisen, und die Begründung sagt, wie.