Future-Proofing Wallets for Web3 with Brandon Millman

graciously referenced in the coinbase wallet presentation um awesome so yeah thanks everyone for coming to see this talk and yeah big shout out to the event organizers as well um for orchestrating this huge event um my first eat Denver was actually back in 2018 and things were obviously extremely different back then um and it's crazy how big the industry has gotten uh East Denver 2018 was actually the birthplace of ERC 721 um so obviously A lot's changed uh it's really amazing to see all the progress that we've made together so far uh so yeah cheers to that but anyway transitioning to the actual talk so today I want to talk a little bit about the topic of future proofing wallets uh for web 3 and I think that we've learned a number of uh very valuable lessons while building Phantom throughout our experience serving over 3 million users in web 3 on the salon and ecosystem and with our upcoming multi-chain release uh we're taking a lot of these hard Lessons Learned and bringing them to the ethereum and polygon ecosystems and I think that we've created a wallet experience that is the safest and easiest to use on the market so before we start just a little bit about myself so my name is Brandon Millman I am the CEO and co-founder of phantom uh before starting Phantom I actually worked in the ethereum space from 2017 to 2021 at a company called Xerox which builds decentralized exchange technology on evm chains if anyone's ever used machet at XYZ or Xerox API which is uh integrated into coinbase wallet then I help those bring those products to life uh after four years of working in the ethereum space I realized something as adapt developer or protocol developer your growth and ux is basically completely bottlenecked by the wallet experience and things are just not really getting better every time you onboard a user or ask them to do like anything at all the wallet sits in that critical funnel and so I thought that the highest leverage place to spend my time and efforts in web 3 was by fixing the wallet layer and by fixing the wallet layer we can simultaneously speed up growth of the end usage across the entire ecosystem uh so in 2021 I started Phantom so here's how I would describe the wallet problem the wall problem is the advancement of blockchains has created a powerful set of tools for new a new wave of developers to build a Next Generation internet quote-unquote web 3. the wallet is a tool used to explore this new internet and the wallet's job is to ensure that the user can access web 3 in an intuitive easy and most importantly safe manner and yeah I just want to emphasize uh the the safe keyword in that statement and that's that's where I'm going to be focusing the majority of this of this talk so for those of you who don't know Phantom uh we're currently the number one wallet in the Solana ecosystem where essentially the metamask of the salon ecosystem and we're available on extension IOS and Android like I mentioned earlier we're actually bringing this experience that we've honed for the last year and a half from Solana to the polygon and ethereum ecosystems and we're currently testing this multi-chain version of the app with around 70 000 beta testers if you want to help test this just come find me after this talk and I can help you get set up all right so if anyone is a Dragon Ball Z fan then you may recognize this location so this is the hyperbolic Time Chamber the hyperbolic Time Chamber is a training Zone where you trade you go there to train under harsh conditions so that you can become like a Super Saiyan or whatever right so I like to describe our last year and a half on the Solana ecosystem like training in the hyperbolic Time Chamber uh the combination of Solana's low fees like the quick rise of the nft ecosystem there and a quick rise from zero to three million users just created this perfect storm of really harsh conditions for anyone building web 3 apps on Solana and the space really became a target for a really hot Target for scamming and fishing um and we were really that first line of defense for all those users and just to give you a quick sense of the scale that we dealt with over the last year so in the last year three million plus Phantom users made 317 million transactions in app so that's actually a little bit over 10 transactions per second which is equivalent to the entire throughput of the ethereum network like in total so we were doing that uh sort of like on a on an average basis through last year all just human activity through the app and so through that activity we've able been able to learn a few things so today I'm going to be talking about a couple of those things and talking about four lessons that we've learned while building a wallet at high scale so first is help users understand transaction signing which was talked a little bit about in the previous talk two expect nft spam especially in a low fee environment three expect fake websites and four invest in customer support and I just want to add that these lessons are basically applicable for anyone out there building web3 wallets um or sorry web3 applications not just wallets and not just Phantom so lesson one is help users understand what they're signing so everyone's probably familiar with this pop-up here so this is the standard experience of signing a transaction today pretty much all you can glean from this is that you're interacting with uniswap in some way and you're sending .073 eth somewhere but in reality this transaction can be doing a number of different things to your erc20s like transfers or approvals and honestly you would have no idea what this is by looking at it and a normal person has no hope of understanding what this is doing in Phantom we use a technique called transaction simulation to show you what exactly is going on with your transaction it's a little bit hard to see but in this case it's actually revealed that this same transaction that we were we were viewing previously uh will not just debit 0.073 each from your account it will also result in a credit of 113 die so turns out under the lens of this transaction simulation you can actually tell that this transaction approval is a trade and yeah again if you're a normal user if you're even a developer you would have no idea what this was about to do with the with uh you know the approval on the left so here's another example of interacting with a potentially malicious site again it's a little bit hard to see but the pop-up might look if you're look interacting with something malicious the pop-up might look something like this uh transaction simulation will actually reveal that this application is issuing Mass approvals for tokens and it's likely something that you don't want to be doing as a user so we've actually had this transaction simulation system running live in Solana for the second half of last year and the results have honestly been uh incredible so we've simulated over 85 million transactions just in the last basically the last six months and over 85 million transactions we were able to prevent over 18 000 unique instances of theft so to put that in perspective there's like 18 000 people registered for this event or whatever so imagine this entire uh conference getting wiped out by scams we were able to protect those people in the LA in the last six months in the first month of this year alone we've protected over 3 000 unique users from getting drained so yeah I just want to underscore these stats because it's super important we you only really hear about all of like the high profile cases of theft um but you don't really hear about sort of the thousands of cases that go unreported where people are essentially too embarrassed or anything to really talk about it and they just really leave the space so uh yeah I believe that web3 everyone talks about web3 having an onboarding problem my belief is that the biggest problem that faces the web 3 space is the retention problem and we have a huge retention problem around scams and it's basically our responsibility and my responsibility running a wallet to be fully committed to solving that problem okay so next up expect nft spam so as many of you know Solana is a ultra low fee environment we're moving towards that Direction with youth l2s and whatnot and so uh nft spam is going to be a huge problem in the next you know one to two years so this is what your nft profile portfolio would look like if scammers did not exist this is kind of the ideal state where you see all of your blue chips or whatever so in reality this is what your wallet really looks like so if you if you hold if anyone here holds any sort of like Blue Chip NFC like an azuki or board eight your wallet is the constant Target of spam if you look at your polygon wallet it's completely ridden with with Spam and um so if you click into one of these you'll usually see instructions for claiming some sort of Prize or airdrop and these links lead to like unsuspecting users getting getting robbed and so the nft spam problem is actually very similar to email spam your email inbox is sort of this permissionless way for anyone on the internet to send you a message and email clients evolved over time to implement spam filters um wallets that support nfts also need to implement spam filters in order to protect their users and this is just going to be a baseline thing going forward in Phantom we've implemented an nft spam filter that actually hides all of these malicious nfts into a separate section at the bottom and can be opened and inspected uh just like just like you would email and this greatly reduces the chances of a user falling victim to one of these scams if a scam escapes the filter users can actually report it report it to help our models get smarter over time also very similar to email as a side note we also have this like in-app burn feature where that helps users permanently remove spam from their wallet instead of just hide it and uh yeah over the back half of 2022 users have burned over 740 000 nfts so people love to clean up their wallets all right so next up is lesson three expect fake websites so this is one that we have a lot of experience with so as you may know um there are many websites out there whose sole purpose is to mimic an existing popular application so I think of like uh uniswap which is pictured here open C magic Eden Etc um these websites game is to trick the user into signing a transaction that will compromise their Assets in some way if you reach any kind of scale or popularity as adapt you you will be affected by this problem users usually end up on these sites through like things like social media or telegram or Discord or things like that scammers will actually also take out Google ads to point users to these sites so this is something that we've dealt with personally quite a bit if you Google Phantom uh usually there the ad slot is uh pointing to some fake site uh and some will go as far as to register fake mobile apps as well something that we also have a lot of experience with fake Android apps specifically um and yeah so uh because Phantom is a browser extension um it's interesting that we actually are able to leverage a lot of unique capabilities through Chrome apis that we can actually block users from accessing these malicious sites in the first place so if you have Phantom installed and you try it to access a known phishing site there's a chance Phantom will actually look like the website will actually look like this and Phantom will block the contents of this site and we actually maintain we actually provide this service for not only Solana ecosystem sites but for sites across the ecosystem as well as ethereum and polygon um and the way this is achieved is actually using an open source Community maintained block list on GitHub uh that the the ecosystem sort of rallies around to report malicious websites so as dap developers uh discover scams they're added here and they're automatically fanned out to all other Phantom users other wallets in this space have also centered around uh this list specifically and yeah over time this list has accumulated over 2 000 fake websites and on top of that so once once a fake website is reported to us we actually work with a third-party service to get these sites permanently taken down so there's a really big operational aspect to this as well it's not just stuff that goes on in the app it's a whole operation outside and so um yeah so with those third-party services we've actually been able to take down over 1 000 malicious sites and over 250 social media accounts which are aimed at driving users towards these sites so um foreign last but not least is Lesson Four which is please invest in your customer support experience so the vast majority of projects in this space utilize a public chat system like Discord or telegram to provide customer support to their users and this is actually an extremely dangerous and honestly borderline negligent practice um you're you're taking users who are like in this agitated distressed State um and maybe they you know they just fat fingered a trade or they lost access to their account and through some crucial moment and they're looking frantically for help and then there they go to Discord they're told to go to Discord they're met by someone who's who claims to be support you know again they're like super distressed they don't know what's going on really and they end up you know use being extremely vulnerable and and um you know at risk to fishing and so there's actually a much better way to do this this is a this is a completely solved problem in Web 2.0 and there's no there's actually no reason to be doing this this way um so this is what the entry point for customer support looks like for Phantom users um the experience is actually predominantly self-serve um and it includes a repository of like educational content and like instant answers and FAQ and this is actually Dynamic content that that gets better over time uh as as we learn more about the the popular scans that are out there and everything so um but if the user is unable to help themselves then they speak to uh directly to a human support agent um so yeah just some stats about uh how we treat customer support so we we really treat customer support as a professional operation uh with metrics tracking goaling Etc so for example in order to make sure we're properly like supporting users we track things like median resolution time and number of tickets resolved and again this is like all solved problem stuff that please do not send your users to Discord for support um and that's just like for the for the good of the entire industry um and yeah The Help Center that I showed before uh has actually been viewed over a million times over the last year so users are really able to help themselves when you provide like education to them so that's pretty much it for me um just to recap so four lessons that um I think are crucial for future proofing web three one help users understand transaction signing to expect nft spam three definitely expect expect fake websites and four please invest in customer Supports and yeah that's that's about it just a reminder again we're in beta right now testing support for ethereum polygon uh I'd like for I'd love for everyone to help us test all of the user safety features that I went over are available in this