Avoiding $1.5B Bybit Attack via Super World Computer Framework | Qi Zhou - EthStorage & QuarkChain

all right try that again all right hello everyone thank you for joining us for this next talk we have avoiding the $1.5 billion bybit attack via the superworld computer framework we're going to be seeing how to build the future uh in a decentralized world please welcome to the stage Chi Joe oh I got the mic hello hello everybody it's my great pleasure here to share uh our some technologies to Avo the reason 1.5 billion attacks by of the by bits uh so my name is chi uh I've been working in this space for about seven years before that I was a softare engineer at Facebook Google and my primary interest is in in in infrastructure including layer toes and data availabilities and so I have a receiv couple grants from eum foundation and also like optimism um so um byit uh was everybody perhaps know that was attack U lose lost about 1.5 billions fun and we just discover the root cause is that if it's the front end of the safe multi Wy was malicious replaced by the attacker so that it will sign a manous transaction that replace the ownership of the multi wallet of the bits and then once the bits cosigners including their coo ban signed a transaction they did not check the actual intention of this transaction and just believe what the safe Fran running on their servers returns so this um malicious transaction then replaced ownership of the contract to the attackers and the attackers then drain all the 1.5 billion iser to their own account which marks the the largest financial attack in our human history so one natural question especially F flying around in trees is people are asking is ethereum still safe actually it's not ethereum actually ether is still safe but we are missing one key point is that the front end of most of the app applications are not protected by the web3 of the ethereum consensus they have to rely on centralized components including DNS centralized servers for example safe is a perfect case there's a couple of other examples like Unis Swap and um and Tado cache which all of them now using DNS and running on top of centralized servers which become the central point of failure that of centralized systems are facing for example all the data that we retrieve from the C centralized servers cannot is very hard to verify its Integrity in the case of the babby attack the FR was malicious replace and nobody is aware of that because it's running on the centralized server second all the replacement happened into the those centralized server is opaque so that all the history of those changes cannot be found unless we have to rely on thirdparty internet archive service to periodically check the historical uh web page of the safe and figure out when it was changed and how it was changed which is really un unreliable and lastly it cannot guarantee availability it can be easily censorship attack for example uh some centralized exchanges uh like France like Unis swap uh reported to refuse to serve some restricted areas because of the regulations and their servers can be easily down which compared to our web stre like E network is 100% up since Genesis that gives us a count intuition say hey we should have a safer World protected by web 3 but unfortunately we still have a lot of places that suffer from the central uh centralized component attack with single point failure besides the the server being uhan being replaced by uh the attackers that also a lot of attacks here are just name a f actually this is really not new actually in last previous cycle we see a lot of this attack including sensorship DNS IP hijacking server attack each of these attack can easily create millions of transaction uh millions of dollars of loss and for B attack being is perhaps the largest one so one cool naive idea to solve this problem is that why not we are able to move all our FR to the on the blockchain and protect it by smart contract so that now both the on on front end and also the corresponding application contract can be protected by the etherum network in this way we can have a lot of benefits we can guarantee all the front end files are in has Integrity which is the same as the what the onchain contract is and it cannot be changed unless the owner of the contract which most likely is the same as the application contract that would like to change and second is transparent in order to change a file we have to submit onchain transactions which will be recorded onto our public leder and it will be immutable and lastly it guarantee 100% Avail availability so nobody is able to perform sensorship attack and the server this website will be 100% up the same as the a network itself so This Ss to be a cool idea but why nobody is now deploying their smart their front end onto the eum network one key problem is that it's too expensive so for example putting one gigabytes of storage data on top of f Network right now can easily cost more than1 million US dollar suppose I want want to run a FR with 100 with a couple of for example 10 megabytes of data they can easily cost me a couple of thousands or even more um onto the E network and this is definitely imp too expensive for a lot of a lot of from applications so in this way we would like to see how if is able to solve this problem in the future and thanks to AER scal be no map AER aims to scale is capability to process the transaction greatly while called row approach the basic idea is called is using offchain computation with onchain verification with introduction of the da now it will just cause a few substance to process a single transaction and verify on chain using a row approach will that be the end game will that solve the problem of course not we still have a lot of missing pieces in order to achieve internet scale and fully decentralized web three why first of all even with L TOS all those lay tools using the standard fully replication storage model which means that all the validator of layer 2 NOS have to store a full copy of the layer 2 data which will be a gener of few terabytes otherwise nobody is able to verify the offchain transaction validity however compared to our web web two for example Twitter it can generate 10 more than 10 terabytes of data per day which means that suppose we want to run a secure twtter with sensorship attack without without sensorship attack it will be able to run for a few days and then we can will soon exhaust all the storage capacity of a layer 2 and second suppose we want to push a lot of transaction for example romance and also D5 transaction on the layer two we're still facing the performance limit because of the ethereum evm sequential execution model so on the right hand side is the output from eum go etherum which will also output the meas per second that the go etherum can process which is about 100 megas per second convert this number to our usual operations for example unit swap V2 swap operations it can only support up to 1,000 swap transactions and so in this way it's really hard to support globalwide internet scale applications using single layer two technologies there's also a couple of other issues here I highlight a few one is on boarding cost where the web stre users needs to create a wallet and memorize their private carefully unlike web web two we can easily create an account like Gmail account TW using a cell phone or other basic authentication method and then be able to send the first or send first email with just in a few seconds the users needs to also acquire the gas token in order to be able to perform the first transaction there a way try to address problem is to using air job to incentivize the user and pay their first transaction fee pay their transaction fees unfortunately because of the misalignment of the inches those air jobs can be easily attacked by seos which people create a lot of accounts and try to maximize their profit and then sell their token directly rather than running organic or transaction on top of network and this something we have to solve in order to in order to enable massive scale and lastly even we have led two technologies with some uh some for example ZK fra proof and also uh uh fra proof algorithms it still take significant high cost to validate these offchain transactions the validity proof is can verify offchain transaction immediately but require expensive Prov to prove offchain transactions and also once the eer has upgrades it take expensive and time to all the new circuit this cost called evm upgrade scary and fla proof is able to alleviate the proval cost but it thiss high onchain interaction uh transactions like for example optimism right now requires 75 onchain transactions in order to narrow down which instruction that offchain execution is incorrect and this result in Long uh with draw window and also High onchain transaction cost so to summarize order to achieve an internet scale fully decentralized Ro we still have a lot of things to be done first we need to address the centralized front end we need to bring the ref three chust also to our centralized front end and second we we need to have a greatly scale natively storage capacity built on top of ether and we also need to improve the evbm performance so that we are able to serve internet scale applications and we also want to bring almost the same Web Two user on boarding experience on top of web3 so the users just need to spend a few minutes to able to send their first web stre transactions and lastly we should reduce the validation cost so that we are able to quickly settle the L to transactions within a hopefully in a few days or even a couple hours so with all these problems in our head we introduced the super world computer projects it's building on top of ether lay 2 Technologies on top of OB stack with a lot of customization so that you can enable a lot of new fully decentralized applications top eum so this is the overview of the super computer project so in order to address the centralized FR we have dropped the EIP 404 webs access protocol which is a protocol that is able to access onchain resources and be able to verify the corresponding resources using called light cine verification so then now we can using ethereum as a decentralized HTTP server and be able to random those Dynamic contents thanks to the power of smart contracts second to address the storage limitation problem we are working on the is storage which is also supported by ethereum ecosystem gr program so now we are able to scale the storage using offchain storage and onchain storage proof verification which is another direction of l two and for Ev evm performance we are working on performance vvm with parallel execution and O and to reduce the onboarding cost we are working on account abstraction that is EIP 7702 together with SO gas token lastly we are working on aan frro algorithms with the support of optimism to adust the uh validation cost on lay one so here for the webs assess protocol what it looks like is just turns evm into Unstoppable HTTP server it's very similar to http but just translate a HTTP like link to a Smart contract call and ask smart contract how to represent the front ends with corresponding request so our our the the the standard is being finalized as ERC 4804 and we have the Gateway and EV browsers that are available created by our community members and we also maintain a copy of a vital blog and all all our FR ends are now also hosty using WC accs protocol that is also deployed on chain and we are building the EA storage which is a modular storage layer so that we are able to support pedabytes of storage capacity and we J changing the etherum consense layer so they can achieve minimum chust per motion list and modular and it will be able to run as lf3 so that we can support PAB uh capacity applications so that we can for example even Deploy on chain tws on top of ethereum network we are working on high performance EVN to optimize the iOS and EIP 7702 that's one of most exciting EIP for the following ethereum pure upgrades we have one of the early team to contribute to the EIP 7702 and here is demo to using ESC token to pay gas and so gas token is another uh idea that we propose to air drop nonr token to the user account you can imagine it's just like Web Two credits but it's able to pay a transaction fee rather then just transfer and sell the token directly in this way our Target is to be able to airdrop hundreds of millions of accounts including web 2 and web three users with minimum uh with minimum cost and for the other once for proof we are all working on the um EIP 444 bra to carry uh media stage to fastly settle down the fra proof and with the sport of op grants so with all these Solutions we are now working towards the super world computer be able to serve the fully onchain applications and here is the progress we have a public test net that's ready in this month feel free to check out our documents and go through the details of how to run a note we also contribute the sum of code to the op stack and this storage is also deployed on top of ethereum suppor test net and our super world computer layer too so that you can also run your applications from end for examp Save on top of that we also offer 20,000 uh Grands uh during the is Denver hackerone so that you can experiment all these fancy ideas and be able to um demonstrate your Innovations and receive uh the corresponding rewards and we are with all this we can enable a lot of powerful fully onchain applications including fully onchain AI even we can move the the H GitHub on top of E network and fully unchain WordPress or all these crazy ideas are now be possible on top of the full if lay one layer two Network there's a couple of new directions for example how we able to integrate all the protocols website access protocol into the browser so that you can automatically verify all the content from the uh from the onchain and also how we are able to decentralize access the ethereum so that we don't need to worry about sensorship attack like for example uh like infura May uh May perform so we are working with the etherum project called etherum protal Network that address all these problems uh in a fundamental way so many thanks for attending my today's talk and if you have any questions regarding uh for examp how do we solve the problem and what how the tech launch Works feel free to reach out to me and um again thanks again for for attending my talk bye-bye [Applause]