Describe assets, actors and trust boundaries before listing attacks.
LET’S PICTURE IT
A building inspection starts by identifying valuables, entrances and people with keys.
SEE IT FOR YOURSELF
A valid counter call, step by stepStep 1 / 4
This example begins with count zero and a request to call increment(). No real contract is deployed.
This example begins with count zero and a request to call increment(). No real contract is deployed.Execution follows the code’s input and permission rules. A website button is not the access-control mechanism.The function reads zero, calculates zero plus one, and writes one to persistent storage.The accepted state contains count one. Later reads can inspect it. Events are emitted only if the code implements them.
Animated local teaching model. No wallet, RPC or live blockchain data. Some labels and hashes are abbreviated for readability.
List protected assets and properties
Include funds, upgrade authority, user permissions and availability. Write the outcomes that the system must prevent or preserve.
Describe actor capabilities
Distinguish ordinary users, privileged operators, external contracts and block producers. Avoid assuming an attacker is limited to the frontend’s intended workflow.
Map trust boundaries
Follow signed messages, oracle reports, callbacks and bridge messages across components. State which facts are authenticated and which remain assumptions.
Turn risks into local tests
For each plausible failure, construct a reproducible scenario and expected invariant. Record residual risk when a property depends on governance or an external service.
Work through the boundary
asset → protected property
actor → capabilities
entry point → trust boundary
scenario → expected outcome
assumption → residual risk
A simplified local review scenario. The example establishes a question to test, not a guarantee of production safety.
QUICK CHECK · NO PRESSURE
What should a threat model make explicit?
Those facts determine which failure scenarios matter.