2026-11-05 –, Lotus Stage 2
Most blockchain security failures do not originate from unknown bugs, but from risks that were already understood and accepted. This talk explores why security is shaped as much by product, organizational, and engineering decisions as by code, and provides a framework for reasoning about those decisions as systems evolve.
Blockchain security discussions usually focus on finding bugs, improving audits, or building better tools. Yet many major incidents stem from risks that were already known before deployment.
This talk argues that security is not only a property of code, but also of the decisions made throughout the development process. Drawing from nearly a decade of reviewing DeFi protocols, L1s, L2s, bridges, and infrastructure, it examines recurring patterns behind security failures: mispriced risk, unclear ownership, pressure to ship, and architectural decisions that create long-term security debt.
The goal is to help engineers better understand the trade-offs leaders face when making security decisions, and help leaders recognize how those decisions influence the security of their systems.
Josselin Feist is a blockchain security researcher with over a decade of experience in software security. He is the creator of Slither, the Solidity static analysis framework, and previously served as Engineering Director of the Blockchain team at Trail of Bits. He holds a PhD in program analysis for security. His work spans DeFi protocols, smart contracts, L1/L2 systems, and core blockchain infrastructure, with a focus on systemic risks, protocol design, and security strategy. He currently works on protocol security at Aave.