Ascending Security: The New Frontier of Application Security With EigenLayer | Sam Glenn - Drosera

[Music] hey guys uh so uh my name is Boba I'm the CTO at drosera uh today's talk is going to be about ascending security the New Frontier uh super bullish title right what does this even mean ascending security the New Frontier what are all those things um the talk is basically talk about how we can Ascend security and how do we handle security for the next Frontier in crypto right so uh rather than just talking about like kind of General uh uh security things I wanted to start with a thought experiment for you guys to think about uh when thinking about uh crypto and what we're doing with advancing all this technology um and the concept here is risk debt uh developers are familiar with the concept of tech debt right you add a feature you add more logic and you add some like huge epic right but you you need to be able to go back and you need to clean up the code you need to refine things right and I think the same thing goes for complexity when you add more complexity you add more risk and that risk debt gets built up over time and you need to be able to manage it because at the end of the day uh risk debt will eventually make you pay right whether it's through vulnerability or some dependency that you're using uh that has some other risk associated with it that is going to have a a a bad effect on on your protocol and your users so like I was saying uh crypto is quickly evolving and the pro to that is that evolving is essential for survival and it's essential for Innovation right survival is the thing that I think most protocols care the most about right if you can survive a couple Cycles you can continue to grow tvl grow users and this is fantastic but the con is a increasing complexity leads to increased risk so the parallel I like to talk about here is that back in the day uh websites and services had like maybe one or two or three dependencies that they used and now they have like 15 different Services right uh and I think the same thing is going to happen in crypto where uh rather than just using one Oracle or one Bridge we're going to have protocols that are using like 15 different other protocols and other tokens and there's risk associated with being connected to all those different protocols and then those protocols being connected to all these other different protocols right so what do we what do we do about it um and kind of what I'm proposing here is that we need to evolve our security infrastructure in locks step with industry right we need to continue to add more security infrastructure as we add more complex systems and as risk Grows Right this idea of risk debt and it's really important that we actually maintain alignment with the ethos of defi when we're making the security infrastructure that's like making centralized bug bounties decentralized auditing right just making sure that we're honing in on like this permissionless transparent decentralized nature of of crypto um and so there's a really big piece to this infrastructure that hasn't really been tackled quite yet like across from uh uh uh uh audits bug bounties and alerting infrastructure but I want to get to that um the first thing to think about here is this idea a of layered security if you're a protocol and you're using audits bug bounties and alerting platforms you're you're doing layered security you're adding many different layers to fill the holes in this bulletproof vest but the thing with security is that it's an iterative process you're never going to be able to like have a silver bullet one solution that just protects you from every last thing right so you need to be able to have multiple defenses defenses in depth so uh this is the missing piece I think that we really need incident response infrastructure um essentially you can think of this like uh nodes that are running 24/7 that are doing risk analysis on the ecosystem on protocols and they're essentially just emergency emergency systems in place to take some automatic action like if a bridge goes down or some lending protocol gets like some insane amount of bad debt we need systems in place to help protect the users and then protect other people's users that are maybe even using your protocol as a dependency um and then obviously we can't rely on devs waking up at 3:00 a.m. uh to sign to multisig I'm sure everybody loves to do that but I don't so we should try to put things in place to make sure that we don't have to do that anymore right um that would be fantastic uh so this is this is risk mitigation 101 right you have some type of backup plan put in place to be able to do something if you're not at your computer or your team is asleep or your team is maybe coming to East Denver and they're in an airplane right like that would be very important for you to have something in place so when you land you say oh my God thankfully our users are protected the system is paused or there's some type of mitigation that that was performed by our incident response infrastructure uh and so this is like the big question right like uh why are why am I talking about this now why hasn't there really been this much of a focus on this stuff and I think that a big reason is because of industrywide tech up updates upgrades right advancements in ZK advancements in reaking that's like Risk zero on the ZK side I layer reaking obviously on the reaking side and and obviously with something like reaking this allows us to build security infrastructure that is ethereum aligned right we're like leveraging ethereum to be able to like have some type of uh shared security and especially on the uh ZK side of things what's really important here is the fact that we can do general purpose verifiable compute whereas before uh it wasn't as possible we didn't have things like like Risk zero in place to be able to do some really advanced stuff so on the reaking side like how does it fit into all of this uh one thing I'd like to think about here is like if you think of Stak eth uh from a validator perspective that's like securing ethereum from the consensus layer from the execution layer but you can also think of restake eth as securing ethereum's applications at the application layer and that's something that is available to us with things like avss and just reaking in general um having slashing allows for us to build rules around these uh this node software uh and rules that weren't embedded into like your ethereum clients we can have like sidecars that are running and making sure that not only is are these ethereum validators caring about ethereum but they're actually caring about your application and if we have a lot of those then we can see applications in general uh becoming more secure and ethereum becoming more secure and then obviously on the ZK side what I was saying earlier about general purpose zero knowledge VMS like the thing here that's really important is that when it comes to security it's a always changing landscape like there's some new zero day that's occurring or or there's like some ecosystem wide event like a bridge going down um having general purpose zero knowledge VMS allows us to quickly innovate and add more security infrastructure to handle new threats as they come that's something that's like one1 in the web two space like we should be doing that in web 3 uh there's no doubt about it um and then as for usage like how have we seen ZK uh been used been used uh fraud proofs validity proofs those are things that you can use for uh incident response infrastructure security infrastructure uh and you can use it for like disputing um having a dispute window with fraud proofs if there's like consensus between a bunch of nodes that some incident has occurred or you can have validity proofs where a proof is sent saying hey this incident occurred mathematically uh take some action so this brings me to essentially my last slide talking about drer uh drer is an incident response protocol and it's an AVS so it's leveraging uh resticking igen layer um the whole point is to reduce risk debt the whole point is to handle the complexity that is constantly growing because it's just going to continue to go right we need to be able to have something like jera in place to be able to handle this risk debt so that we don't have to pay for it when exploits occur um the idea is to have nodes running 247 looking at your protocol and for them to be ethereum aligned as well so you have security that is aligned for your protocol's needs and ethereum's needs uh and then the coolest thing about drosera really is this kind of like catchphrase at the End security infra as smart contract code I think that's something that's super important in this space is making sure that we fully Leverage The evm rather than making like some nodejs backend thing that we're running in the cloud I think that if we can fully leverage smart contract code to make systems like drer then we're going to see kind of a an expansion of more complex systems that have reduced risk um and I think that uh if you think about this in terms of the igen layer space what's really cool about something like drosera is that it can it's like an ABS that can provide Prof protection for other avss and you can think of that as like igen Lair protecting itself if eum protecting itself it's added complexity but it's like targeted complexity to reduce risk all right that's the end of the talk guys bullish