Reinsurance / Staking infrastructure risk / 2022

Turning Three Days of Validator Engineering into a 21-Question Risk Assessment

Lionscraft's predecessor practice delivered a specialist three-day programme for Munich Re on proof-of-stake infrastructure, slashing and operator security, producing a draft assessment built around the actual systems and practices of validator operators.

AdvisorySecure
21
questions in the draft operator assessment
3 days
specialist programme, July 2022
3
networks covered: Ethereum, Polkadot and Cosmos
7
control domains
On this page

The story in brief

01 — Situation

Munich Re was examining the technical risks that would need to be understood before insuring proof-of-stake validator losses. Standard cyber controls and a protocol's published slashing rules did not provide enough detail on how operator mistakes lead to financial penalties.

02 — Role

A43, Lionscraft's predecessor practice, designed and delivered a three-day technical programme bringing protocol rules, infrastructure engineering, operational controls and insurance assessment into one discussion.

03 — Work

Technical workshop materials, operator interviews and exercises, historical risk research, supporting controls and a 21-question draft validator-operator assessment organised across seven areas.

04 — Outcome

A documented programme delivered on 13–15 July 2022 with insurer and technical-practitioner participation, and an assessment artifact that could be developed for further operator due diligence.

Client
Munich Re
Industry
Reinsurance · Staking infrastructure risk
Period
2022
Engagement
Validator slashing-risk technical workshop
Duration
Three days, July 2022
Services
Advisory · Secure

The challenge

What would an insurer actually need to ask a validator operator?

In conventional technology insurance, assessors can ask about backups, security controls, incident response and business continuity. But proof-of-stake infrastructure can behave in ways that make the usual answers misleading.

An operator might improve uptime by introducing a backup signing system. If that backup is activated incorrectly while the original signer is still running, the system may produce duplicate signatures and trigger a slashing penalty. In that situation, what looks like a resilience improvement can increase the insured exposure.

Munich Re needed to understand such mechanisms in enough technical depth to ask operators meaningful questions. The assignment was to connect protocol-level failure and loss with the engineering and organisational practices that create or prevent it.

The story

01

A technical curriculum built around three networks

A43 prepared a programme spanning Ethereum, Polkadot and Cosmos, allowing participants to compare validator duties, penalty conditions, operating models and real-world failure cases.

The first day addressed consensus and staking mechanics, historical slashing events and the kinds of organisations operating validators. It also examined how established frameworks such as ISO 27001 and SOC 2 relate to staking infrastructure.

The goal was to give participants the right technical language and context before assessing specific operators.

02

Getting inside validator architecture

The second day moved into software, infrastructure and day-to-day operations. Topics included client software, signing keys, remote signing, key security, configuration management, testing, monitoring, recovery and the security implications of hosting and technology suppliers.

Practitioner discussions brought infrastructure and client-implementation perspectives into the workshop, including participants associated with Teku/ConsenSys and Dextrac.

The exercises examined risks that are easy to misclassify when looking only at a protocol's penalty schedule, such as an unsafe failover, a key accidentally active on multiple machines, or changes deployed without sufficient testing.

03

Turning technical understanding into assessment questions

The third day extended the discussion with additional practitioner participation, operator processes and assessment design.

A43's source package includes a draft 21-question operator assessment grouped under seven areas: operator characteristics, security governance, infrastructure, applications, slashing prevention, operating processes and key management.

The material was supported by technical decks, fact sheets, a historical slashing dataset, security-control references and interactive participant exercises.

The source records show practical engagement: one operations-focused exercise collected 34 questions about dependencies, keys, testing and incident handling; a final-day red-flag exercise recorded 14 responses from six participants. These are exercise results, not a verified total attendance figure.

04

A concrete research and training deliverable

The engagement produced more than an introductory presentation. It combined network-specific research, practitioner exchanges and a draft instrument for evaluating operational risk.

The available record does not establish that Munich Re adopted the draft questionnaire as a final underwriting standard or issued a policy as a direct result. The completed assignment was the technical programme and its assessment material.

What Lionscraft did

Results and impact

01

Three-day specialist programme delivered on 13–15 July 2022.

02

Coverage of Ethereum, Polkadot and Cosmos validator risks and controls.

03

A 21-question draft operator assessment across seven control domains.

04

Original technical decks, risk data, practitioner input and interactive exercises.

05

A documented early example of applying infrastructure-level staking knowledge to institutional insurance assessment.

Evidence and further reading

The public sources behind this story: announcements, partner reports and coverage. 3 sources.

Discuss a similar challenge

Need to understand the operating risks behind a digital-asset product?

Lionscraft develops specialist technical analysis, risk-assessment methods and practical workshops for institutions evaluating blockchain infrastructure and staking exposures.

Discuss your project