Lukas Schor I Unlocking Digital Asset Ownership | Pragma Lisbon 2023

foreign [Music] good afternoon everybody hope you had a great lunch and we are ready to kick off the second half of pragma we got two more talks to go and two more demos and uh this is the 50 Mark so let's uh Buckle in and just begin right away with our next upcoming interview so for our next talk and that's our third Talk of the day I want to bring on Lucas from safe a lot of you have used safe before uh if you are part of a Dao if you care about custody in your assets and managing a lot more securely uh what you're holding whether it's your nfts or your money or everything in between you have heard of safe but there's a lot more to save than just a multi-sig and there's a lot more history to how safe got to where it is and to talk about all of that we're going to bring on Lucas and cover a lot more of these themes so please join me in welcoming Lucas and giving a big runner from us back in my day this used to be called gnosis safe and a lot of people were coming into this space now know it just as safe so I'd love to kind of start off by having you talk about the history of how this came to be a product tell us about Nosa save what was what that was like the decision to sort of go spend more time on this and and this eventual brand to save how much time do we have because it's actually quite a long story in the next five minutes all right um yeah in five minutes I'd like to go back maybe to um the origin of safe being part of of gnosis because we did this this spin-off last year but the the origin of the project goes back way way before that um yeah it was originally a research project within consensus it was actually the first spoke from consensus the first project that then from within consensus got spawned off um and what noses wanted to do is build prediction markets so Market mechanisms that allow for crowdsourcing of knowledge in order to have better informed decision making um and yeah that was Cash the the goal of gnosis they did the Ico uh to to fund this project and when they did the Ico they suddenly had a lot of digital assets ether they had to to safeguard and there was not really a good solution out there to do so um they don't want to have like a lot of ether just sitting on a single private key uh being managed by multiple people you don't know like when the transaction is made who triggered this transaction and such um so notice had suggest this needs of building a tool that allows for coordination around assets which ended up being the gnosis multisig and it was really just like an internal tool no assisted to to safeguard this Ico assets but they ended up open sourcing the project and it happened that a lot of these icos back then in 2017 had a similar problem and they just started using gnosis multisig and as things go if you open source something and someone else starts using it suddenly you have people having feature requests you want people want to have like a hosted version of this product you uh yeah you have to maintain it build it out so nurses started building a team around this project uh to just and by this time everything is still internal is that yeah I mean it was already used externally but this was exactly this transition period where gnosis saw this is actually something that the market needs we need to put a team behind it we need to productize the noses multisig um and then the next step was this is very valuable for teams but it also has a lot of potential for individuals that want to have more secure way to to custody the assets so that was when noses safe was born which was the next version of gnosis multisig new contracts more cast efficient like many improvements there initially mainly with the purpose to bringing this to retail users to individuals but then still like the this this team use case of having multiple people store assets together was still quite important so safe was also adopted there um yeah and at the same time those did a lot of other things they started uh the kickstarter the dxed out they took over the uh the parity clients development then open ethereum they created new like Market mechanisms which then uh was initially researched and then developed into cow swap now and kind of loaded itself with so many different projects and then there was this opportunity to merge also with with X Type which is a a separate layer one which has die as its native coin and cheaper transaction fees and so there were just too many things on the plate for nurses and the decision was then made that like the future of nurses is going to be nosy's chain so formerly xtai and the other projects that were too big to be part of this notice chain Vision had to spin off had to develop their own identity go outside of gnosis because they um I wouldn't say they were standing in the way but they were definitely it's harder to balance multiple projects so safe had like a huge potential so they didn't just want to close it down but they they said it has its life on its own so beginning of last year then this decision was made from from those system to spin off the safe project and then there was the question like how do we call this thing because people actually call always been known to say people call nurses safe just knows this many times um so like I use gnosis to constantly my my assets but the idea is that when people say I built on gnosis they should mean I build on those this chain uh because that's what the the now knows is going to focus on um and we want to prevent a little bit this this confusion also around around this so we said notice it was nice for the time being but now we need to focus on Save and it is a very hard transition to make because I mean people call it us is also safe like it it requires a lot of Education that you associate with safe not this physical safe but this new digital safe that we create um and I think it's it's a process and we start seeing a little bit the benefits of having our own identity now and our own project um yeah also Council biodiversity that's been off uh last year so that also happened and yeah it's still like a bigger gnosis family in a sense but there's uh yeah the safe now is completely independent well that's awesome we're going to dig into uh what does that actually mean but uh now you are right because I've had to remind myself multiple times to not say no she's safe on stage accidentally because I've just been used to over the past few years but and uh it's it's not it's not quite easy you start off as a multi-sick kind of internal tool became public open source and then people started using it and that means you are kind of focused on priorities for people at that time and nine multiple years have passed is is there something that you feel like people still misunderstand about what what safe is I think definitely one thing that safe because it has so much traction within teams and Taos and everywhere where multiple people coordinate around assets it's often mistaken as a as a dow tooling or as a like like a company solution but I think also if you look at the stats there's about two and a half million saves out there more than half of that are controlled by individual users actually interestingly the everyone who did this onboarding with World coin today they actually use a safe because World app deploys a safe for every user um and I think that's something which will uh become more more clear over the next months as well as we Explore More the opportunities of a conduct section and smart accounts that this there's so much more than just multi-seek that's enabled through safe because also if you look at the just pure smart contract architecture there's like this multic component in there so there's there can be one or multiple private keys that controller save but then it allows to add additional functionality for plugins we call them modules guards and fallback handlers that extend the functionality of a safe and that can make it extremely useful not just in a team where you have multiple private keys but even if you just have one private key but you might have a module that gives the user like a spending limit that they can use like a certain amount of assets per day or like a cards that protects you from certain interactions with like uh deny listed among like a list of of contracts so there's like a lot of more functionality Beyond just the multisig part so I would say biggest misconceptions is that safe is more than just a team solution and safe is more than just a multi-stick part and uh that sort of kind of opens up the whole platform piece which I want to talk about in a second um 2.5 million deployments of the contract that's that's a big number and uh especially in the kind of context of our ecosystem and where we are like that's that's a lot and are there any other stats that uh you're proud of for uh for how safe is doing I mean there's there's a few stats that definitely Boggle my my own minds because um right now there's about 70 billion dollars worth of assets being secured through safe um in no big deal if you compare this is roughly five percent of the entire crypto market cap including Bitcoin which you cannot even store not ethereum just a crypto Market guy yeah that's that's it I mean take this with a pinch of salt because on safest assets are not part of the traditional market caps or not uh like circulating Supply and like there's a lot of these assets that are counted in there but so like there's ton ton of value being secure and even if you look Beyond just the regular erc20 native coins there's a lot of nfts secured for safe about like more than 10 of all crypto Parks or happy ladies are all the captain major collections if you look at the stats usually are on saves um also more than 10 of all usdc is currently unsafe and that's a big number and uh uh yeah oh the most obvious question I have with this is well that's that's a lot of money uh being trusted with the same code how uh how do you think about security especially as more assets get custody and kind of what's your thinking and policy and framework around security yeah I mean we were also lucky that all this value wasn't just secured overnight um and it took people a lot of time to really trust the the safe contract I think the first three years it was always below like 10 million maybe in total I mean this was also pre last bull market but then people always were still having in mind the the parity hack and like putting money on a smart contract wasn't as common as after after D5 summer um obviously we do all like precautions with uh and this starts already When developing a smart contract with uh like security considerations around how code is developed the documentation around it then obviously the the audits where every new version is multiple times audited also we did formula verification for the initial base contracts we now do it for every future update we do again um there's like a impact Bounty of one million for for critical pucks luckily no one got it so far and um yeah we also have a Honeypot safe so whenever we do a new version there's like a safe with tons of assets that has upgraded the first before we even uh like have others or try to to implement it in our solutions for example um there's many many things we do but I think the most uh critical part for security is still the Lindy effect of the smart contract because every day that passes where the contract is not hacked and there's so much value on it the more the better I sleep at night because the that it's just this this huge Honeypot and I would say if it hasn't been hacked so far the likelihood just decreases over time that it that is really this big issue but you can never exclude it but I I sleep better now all that's good to know that uh that's uh it's not too active of a concern for you in terms of not being constantly worried about it because all those things do help um I do want to talk about uh centralization risk of not everything being like because you kind of brought up the Honeypot piece here it is true the more amount of assets are there the more attractive it is for somebody to now have an incentive to try to figure out a way to break it or go around it but uh security aside um do you feel like things are still aligned with the self-custody and decentralization piece if everything feels like it's managed by the same code is that sort of against the value of centralization or decentralization um how do you kind of think about that it's a good question and also another very linear answer as well because I mean to some extent we are also entrusting like the protocol code like this some some aspect of centralization like ethereum like if there's some issue under protocol level we're also like in fact in a sense and uh so there's there's that where like a good good and kind of interpretation of centralization is also standard like if we get safe to be uh getting so much traction that we say might be even worth putting it like in on the protocol level because anyways there's so much value already or like this uh this becomes a de facto standard uh then that would have the benefit of if something breaks then it's a break against the protocol it's not a spark contract tag and this would be able to be handled differently not not sure if we ever get there um that's one aspect and the other one is also like decentralization could also mean fragmentation because I see a danger with a count abstraction where suddenly there's a lot of teams looking into the benefits of smart accounts and a lot of wallets seeing like how can we leverage that and provide better security and usability to users um the worst case scenario is if now every wallet is going to build their own smartercon um because one important property of web free accounts is that you that they're portable so you can create an account in metamask and then you can use the same account by Ledger or by trust or any other wallet that you want and this this is probably also the power of web free where you're not tied to one solution and there there's this risk I'm not sure if it's how it's going to play out but there's this risk that when we have too much fragmentation in smart accounts that then we lose this important property of knowing I can use the same account everywhere and the the tooling build around it works for for all accounts um so I would actually advocate for and that's what safe is essentially building um having a a smart account standard as a as a modular kind of framework where like all the wallets can build upon and can use the same secure core which is proven over time but is extensible and can allow wallets to build their own experiences with it can build their own kind of flavors of safe and then we balance this this kind of value of having like a standard having like a shared layer with with the flexibility of still everyone being able to build their own Solution on top of that uh yeah this is interesting because my next question would have been and you kind of see yourself more as a product or a protocol but it seems like you're leaning towards a protocol so probably could be both as I don't want to speak for you but how I mean what you just said how is it broken down into these different layers that you're referring to so safe as a mod like the safe core that's just uh asset custody piece and everything else is an extension around it or what's a better way of understanding how the protocol is structured I mean yeah definitely safe started as a product no question around this like we like the smart contracts but one thing that enables the user interface to leverage multi-signature and other features um but then we we saw over time where like our interface allowed to have certain interactions with the save smart account and use it to interact with steps and such um but it couldn't be optimized for everyone's needs and then we had other teams the first ones were actually Alex of understand the build uni login on safe and then we had a coin shift and parcel as like treasury Management Solutions being built on Save and there were all these different uh Solutions popping up that leveraged underlying smart contracts but built very optimized Solutions on top and that's where we realized like this is much more than just a product it can be kind of the yeah the underlying custody protocol for for all kinds of accounts out there and that's where we started shifting from like also pushing our own UI to becoming an ecosystem and figuring out ways how we can support other developers to to build on safe to build their own smart wallets to build trashy Management Solutions different kinds of experiences on top um and so we now launched earlier this year uh safe core which is really the the entirety of these developer tooling that that was built over the last years um so that's obviously the the contracts the protocol and uh then some some infrastructure like the indexer Signature Collection Service that's needed for that um and yeah also some sdks that allow you to take advantage of those so yeah since then it's clear that the future of safe is going to be this infrastructure layer being this modular smart account and just supporting others to to build on that yeah this is super cool because uh it just also ties in with something you just said which is around other wallets doing smart accounts or smart contract uh sort of based approaches to receiving addresses did you mean that originally from the context of without the standardization of safe core everybody will have their own implementation and that's when you get inconsistencies across different chains or do you think there are other issues even if everybody switches from EOS to a smart account like what's a good way of understanding that better and how does that tie into what a constraction is as most people know it as of recently yeah it's maybe a good point to but clarify also how we see a conduct section General um because it's a term that's run a lot in in the last months and it's a too technical term because it doesn't mean too much for regular people but the idea about a conduct section is that we have this big problem in the very ecosystem where most of the accounts out there are just controlled by a private key where like you have a seat phrase which controls all your assets on on your wallet and this is extremely limiting because it's a it's a very binary logic you have the private key you can do whatever you want on the account you don't have the private key you cannot access your funds or worst case someone else has the private key and they have access um and so it's it's very clear that smart accounts which is put that logic from from the protocol layer to the to the smart contract layer where you then have the programmability everything you can program in solidity you can have as the logic behind your your account this enables so much more flexibility for developers to create more secure accounts more flexible accounts that have different Access Control policies and and such um he gave me a couple examples of what kind of new features will be enabled with that kind of abstraction yeah I mean the traditional ones are like recovery recovery systems so what happens if you lose your private Keys even if you have multiple private Keys there's a multi-sig chances are that sometimes you might uh mad news forget what we have done or like uh you know um and then smarter console out to have these fallback mechanisms where you can uh go such as uh social recovery where you maybe have a group of friends that can give you back access to your account or custodial recovery where you have a trusted third party be it in insurance notary Bank whoever you trust that can give you access to to your account and I think this is going to be quite important for for Mass adoption as well because like most people are pretty scared of self-custody and there's a few people out there that probably can do the the opsec and can handle keys and everything that it's not a big problem but for 99 of people it's it's super scary just saying if you don't have your keys anymore all your money is gone um so recovery is a huge thing um others is sponsor transactions or in general abstracting gas away from the user because what you can do with smart accounts is that you have a relay mechanism that takes a transaction that doesn't pay any transaction fees and the relayer pays for these transaction fees and then you just have maybe some agreement with this relayer or some mechanisms how they actually have the incentive to do so and this can enable use cases like adapt sponsoring all the transactions that interact with a certain protocol for the user it enables use cases like um not not having to pay in the native currency of the blockchain but in like a stable according token that you have for example also very interesting what gelato is doing there where they have this they call it one balance where you have just one gas tank can be in usdc and instead you can pay with that gas tank your transaction fees on any any blockchain out there and this just yeah there's very nice to have gas abstraction use cases that can be done there um all other things such as new signature schemes so going to Quantum secure signature schemes hopefully at some point like this requires the smart accounts to have this this flexibility uh but yeah I think the that's enough to actually see the potential of like you basically get a whole way to interact with a transaction before it gets broadcasted um he is we've seen a kind of traction become really popular in the last six to eight months um most people know it as ERC 4337 does what safe do for a kind of extraction the same thing here are we talking about different standards what's kind of the difference between what you have done or do right now versus what people know what account distraction is that's actually quite funny because so many people come to me us at these Global hackathons asked me so now with 457 there's no need for safe anymore right it's actually quite the opposite because what 457 does is solve one aspect or one issue of a concept section so with smart accounts like there can be any kind of validation logic but still the transaction needs to be put on chain and uh especially if it's not native account abstraction where the blockchain can accept these smarter contrast actions you still need a relaying mechanism to do this and what 457 does is just have like a specification and a standard around a decentralized relayer mechanisms that enables smartercon transactions to be put on chain so like when there's like blog posts or tweet threads about 457 it always they always go into detail like what 457 enables with like recovery and sponsor transactions and all of that but the logic of that is still in the smart account like 457 solves the reason part of it right um but these things need to be put together every 457 account is a smart account so save is 457 compatible with the latest version as well meaning that these yeah ideally you use those two energetically um but and that's helpful I mean that's a it's a pretty big uh point that people need to consider because you're effectively enabling more smart accounts to function with all their their full functionality um another interesting thing you said which I want to dive into is you kind of mentioned that it started as a product and now it's more of a protocol you can already broken down what the protocol is on different layers of the the stack and how things interact with each other how do you think about sustainability for the growth of safe and future features or how you think about security as you kind of get bigger or accommodate for more feature requests what does that world look like and and what's kind of your lens on this so sustainably I think about like I want safe to be a project that's around in 50 years or under the years and how can we achieve that how can we have this this ecosystem that's built around the safe contracts be thriving and uh yeah incentivized um and also here I want to make a a strong point because if sustainability and these topics usually the topic of feast comes up and I think what's really critical about safe is we I think there's like there should not be any fees within the safe smart accounts itself so no custody fees or transaction fees even though a lot of people always say just do like a custody fee that's how all custodians work that's a huge potential there to fund the project into the future but I think this is the the wrong way to go I see the the safe smart account more as a library as something open source everyone can use it it shouldn't have any modernization as part of that um but still on top of this smart account there will be like a thriving ecosystem of different stakeholders of different participants um that can range from developers building modules which I mentioned before this modularity of the safe that additional features to save it can range from uh like entities providing infrastructure such as indexes or such um or yeah and especially for for modules I think it's going to be interesting where like most people trust the core of the safe contracts like this reflected in the effect and everything like you don't want to mess with that pretty much everyone just said but people don't really trust these plugins these modules um so how can we incentivize the the right parties to bring trust to these modules how can we provide a protocol that gives security guarantees that incentivizes people to look at these modules and give attestations that these are like a proper Park freak maybe even have some like insurance or some kind of bond behind it or some mechanisms that enable you to have peace of mind using these modules and I think this is going to be quite interesting way to keep this ecosystem sustainable by creating these incentives for the different parties involved there because it yeah it's it's Auditors it's maybe insurance providers it's module developers that need to be this is an interesting point because you're saying that you want to have a mechanism for the safe ecosystem for these plugins but without contradicting or rather taking away the choice of these plugins to monetize even if they chose to do a fee model for their own Services um is that kind of the goal where you kind of do it compatibly or is that the incent that you you I understand how it enables a more robust safe system but but safe plug-in ecosystem but how does that help with the sustainability of safe because it's easier to understand these plugins help make the plugin sustainable because they have a business model now I mean I don't have the perfect answer there but that's why I was I I imagine that that there should be a way for users to to opt into a this secure plug-in ecosystem um where they also have the security that if something goes wrong with one of these plugins that there's some automated mechanisms that maybe disables the module or or something like this um and there's then entities or maybe the user is willing to pay for that maybe there's like insurance providers that are willing to provide a have a package around this uh that they say if something happens actually someone else is covering for that and there's many kind of things we're thinking about I'm not sure we have the end solution right now but I think we need we need to bring trust to these modules because otherwise uh like every module has to start from scratch building up this yes trust themselves like the the the ability to trust the core doesn't benefit anybody because now they have to think about added risk so no that's a really good point and I agree what um in terms of kind of obviously your the spin out from also safe to safe is quite recent you're figuring out what it means to kind of grow the community and how you want to think about all these things what is kind of your hopes for this ecosystem growth on top of safe and kind of how how can people get involved in in the safe ecosystem yeah that's definitely the the call to all the depths and and models out there that come talk to us we want to find ways so we can provide value to you how we how safe smart accounts can be a solution and you don't have to reinvent the wheel and build your own smart account but maybe more for people that want to just contribute to the to the ecosystem um yeah I mean we have a forum which allows you to participating in discussions and governance where this ecosystem is going but also there's a grants program coming up and what's what's important there we don't just want to fund Builders building on top of safe that's one aspect one one of our free pillars but also we want to support people that help us with educating people about the capabilities of smarter currents and general concept section uh as well what are the three pillars you you mentioned they're uh P pillars for the grant specifically for the grants program the free ones are are built educate and research so building obviously for developers educate more for the marketers out there and research them there's a lot of like still unsolved issues around smarter cons like 457 partially solved the relaying part but there's like hundreds of other issues that we need to solve one particular one is maybe like how do smart accounts interact in a multi-trained landscape because each of these accounts is a deployed contract on a new chain um that creates issues with States being different between these accounts or the addresses potentially being being different which people are used to their metamask account stay same everywhere um so that's one thing which definitely we should do some research on um but yeah like I can like build educate research if you want to contribute in any of these ways look out for this this grants program awesome um my last question to you before we we end this what would you like to see people build on top of safe that you haven't seen yet one for sure is more more retail Solutions because we need to get rid of this stigma of safe just being a doubt tooling just being team solution and there's there's some solutions out there like Nest wallet like linen wallet even like World app that targeting more retail individual users like these things will have much more potential probably in the future because the awareness is not there yet too much so this there is a more uh growth happening and then maybe more specifically when we look at the safe being this modular smart account framework like one of the the type of modules you can build there are guards these are like hooks that each transaction goes throughs and and checks certain transactions certain requirements um so it can be like a allow deny list where you say my account can only interact with these types of contracts but it can also be something like Security checks like you can you can build a resource checks with that talk to things outside the chain outside as like off chain like yes like you can have an off chain like risk assessment solution that then puts on chain at the stations and says this transaction it's good good to go this is maybe like double check it or like have another kind of confirmation from the user to to put it through and this like obviously a scam like block this transaction uh like you can do very cool things around that um and then maybe finally around recovery I think people always when they hear recovery and maybe this is also like vitalik is a big fan of social recovery and just pushing this notion of how we we end up recovering our accounts but I think this is gonna be one of many solutions so think about new novel ways to to recover your account whether that's some like cool things they could do is like you have multi-6 or you have multiple Keys multiple devices to control your account but over time if there's no interaction with the account the threshold goes down so if you lose maybe a few of your keys and you cannot get the threshold anymore after a month we can get it again or like it kind of gives you this fall very interesting answer yeah like you can do so many cool things around recovery there um yeah awesome well Lucas thank you so much for this amazing chat and uh hopefully we get to see how we can make custody even simpler and better for everybody else in the space thank you [Applause]