New Ethereum talks, every Monday. The week's conference uploads by event, in your inbox.

Loading player…

Guardians of the Digital Realm | Atakan Yavuzarslan - GoPlus Security

Ethereum DenverWed, Oct 9, 2024, 12:00 AM

A secure user experience is one of our views on web3, as in many areas of our lives. However, one of the results that we cannot clearly understand during the development of web3 is that when it comes to security in web3, the first concept that comes to mind is "code audit (audit)", but security in web3 is not limited to code audit only. I would like to explain what is "user security" and how we want to make it accessible to users through SecwareX APPLICATIONS FOR ETHDenver 2024: #YearOfTheSpork ARE OPEN APPLY NOW https://ethdenver.com/apply

Transcript

[Music] hello everyone um atak come from go plus security I'm head of Partnerships at go plus so today I would like to talk to you about go plus and our user security network and user Security in general so let's start with go Plus in general briefly so go plus user security network is a leader in the user security area we have comprehensive security service for many companies in the web 3 and web 2 world so with the cutting age AI model we adapted in Tech system we serve more than 1,000 partners with the with 21 million plus daily API calls and this data calls taking up to ma majority of the user Security Services okay and here here you can see some statistics about our data adoption from different chains and from different kind of Partners and when we take a look at this Partners you can see we have variety of Partners from data websites to user security tools we are cooperating with Dex tools Dex screener eer scan coin market cap Echo terminal on the wallet SES we we're cooperating with safe P token pocket and and we are not only staying at the data side we are also working with Native deps like sushi swap kber swap and also we we have been mentioned couple of times by Unis swap uh folks about how to teach people finding taxes in token swaps and also we have other security toolings other security projects uh help to improve their security services we are working with webc blowfish and Blox Falcon and couple of other projects so today I would like to take you to users perilous journey in web tree and I would like to talk to you about user security life cycle in the beginning so as you can see um maybe in past you have encountered with some of these problems some of these R risks uh for example private key loss or asset risks it could be related to nfts tokens or address poisoning or maybe even Oracle problems or if you didn't encounter with this first two you might be you might had problem with interactions for example you might but you might be fished or you might have a problem with the swap contracts in the past or you might have some problem like stable coin Deek maybe you might remember Luna or you might have some M attack or address exposure to some of the hackers so they they they would like to like send you some scam tokens and get your funds and uh in the last part let's say we can have some problems in the project as well like you can have some exposure to exploit or vulnerability in the smart contract so these are the life cycle of the user if you complete this life cycle without any trouble you might you might get you might consider yourself lucky because many of the problems having these kind of issues and it's a very big blockage for people to adapt native web tree apps so we are here to solve it as a network and as a company and I would like to take you to web 2 because in web tree we don't have like long history and we we we just started to develop these projects and like security tooling so we might need some ex R&D and Kno how from web to world and let's take a look at the web to world and what we have done so far so in the web to world we have all of these problems that we have right now like these are fishing sites malwares social engineering Telecom FRS or private mle and we have actually solutions for that like for example we have anti- fishing tools or you like operational system security suits antivirus softwares or some Financial Risk Management tools but in web tree we have more sophisticated problems we have all of the existing problems plus we have some unique web tree problems like rock pole MAV attack airdrop attacks scam tokens dusting attacks private key thefts and in the solution part um this this works a little bit different than web2 world because in web 2 we have operational SEC security operational level security tools like uh Windows Defender or antiviruses but in web 2 web 3 we don't have that much tooling and in web 2 we have centralized uh entities to like cover up your mistakes for example let's say you send your like funds to different accounts like wrong account and they can just cover it back but in web 3 everything is based on uh custodial systems so this might be on your shoulder and your wallet provider and this is a big respons responsibility to carry actually because these sophisticated Solutions cyber Security Solutions require some knowledge and also experience and this is hard to put all of these like workload to wallets and users so to solve this issue that's why we we are working on web Tre user secur Network as go plus and our part ecosystem Partners so I've been talking about user security network so I would like to mention some of the key features that we like that we need to have as a network to provide a constant and better service for users and also developers so first of all we need to have real time 24/7 service to help people when they need when they need the when they need our help our hand because this might be anytime it might be in the night time it might be on the morning time so we cannot say them sorry we are Clos after 5 500 p.m. so this is this is this will be ridiculous and we need some Dynamic and instant response once they need some uh extra solution because we have automated systems but sometimes we have abnormal situations as well so we need some experts and data to help this people in need on time and we need comprehensive ecosystem because we are working on tokens like analysis address analysis or signatures but some other people need to work on mle analysis and also program analysis so we need comprehensive and Broad solutions to cover up all the potential risks that we might encounter and first and also we need data because everything must be data driven to prove that we are on the right way we need analysis service toolkits and also we need experts to build all of these systems and integrate all of these solutions to each other and lastly I these are right now like a bonus because we need sensorship resistance as a network and verifiable data but to build that we need to decentralize web Tre Security First and this is this is a hard job all the pro all the system that we have right now is based on closed Source algorithm and this is hard to make it open source because when you make it open source there's also problem of this scenario for example I can can make my algorithm open source but some hackers uh can just make the reverse engineering and some find then they can find some transactions or they can write some smart contracts to pass the algorithm that shouldn't be passing so for this job we're building the network and we might need some time to make it more robust and comprehensive so let's go through what we can provide as a network right so here you can see we have existing chains these are like e it could be ethereum optimism Solana Bitcoin and right now this is like a buzzword but I don't think we should miss that everyone is talking about rollups and we will be living in a a world of rollups it these rollups will be on Celestia on on ethereum so we will we will have more rollups and there are some projects working on rollup as a service so as go plus our platform is uniquely positioned to serve a wide range of end users including individuals and organ organization operating in different blockchains that I mentioned before and we can integrate into existing chains and we can embate our services in a rollup as a service level to ensure that the user security template is always in a state of Readiness within the con constantly updating web infrastructure so we will have the Integrations we will have the embedded systems and on the other side our network will work on the Pro work on providing The Cutting engage technology and the up to- dat data and at the end we can protect users in every chain in every moment this is our end goal and I would like to talk to you about the architecture of the network so I've been talking about the network network but you might ask me like what is what does it look like so first at the fundamental level we have two layers first one is security data layer and the second one is security competing layer so in the security competing layer part we have go plus security engine and we have competing notes go plus security engine is providing the security services in last three years and it will be working like that but we might need some extra computation computation power and this might this will come from the comp Computing nodes on the other side we will have security data layer on the security data layer part we will have verification nodes and verification engine so verification noes will be providing the data and the verification engine will be ver verify the data that that is coming from the noes and on the storage part we will have we will store all the data that we need to run this algorithms and also users choice and these two layers in the in the fundamental level they will meet at the protocol level on the protocol level we have segare layer segare helps you to build your own security products and serve it to serve it to clients on Ser serve it through rpcs searex and the playground so that people or like normal people like me you or like developers might interact with them on this level and to keep this network integrated we need a incentive to incentive for people and developers to use it right so first of all as a user if you like to use go Plus network you need to hold some of the tokens and we will have seare security Marketplace to meet users and the developers and the every transaction the searex level the seare from the searex marketplace we will distribute to profit to seare X protocol so to be part of the seare X protocol you might be segare developer using segare data and creating some segw protocols rules products to serve and help people or you might be part of the compute layer by providing your computational power through nodes or as a third option you might be data provider you might provide data about addresses tokens and you will be part of the data layer so for these three rules that I mentioned you need to take your token and also you will get your return from the SE Weare protocol and as a user you will get motivation and incentive to use this protocol and you will secure your wallet and you will not encounter with any problem hopefully so I mentioned seare X so I would like to touch on touch on that a little bit seare X is is a extension of segare and it it is a gamified steam like approach to user security so we will help people to use security products and secure their wallet and we will give them the incentive and points to make it sustainable and enjoyable because security is boring unfortunately so here you can see some of the tasks that we provide to users so that they will complete this task for example this task could be like revoking the approvals or checking their health status through our products through our ecosystem and they will get points in return and also I would like to like mention couple of tools and services that you might build with square x square sorry so we divided them to divided them to three parts first one is before the event part so this is the scenario that we like to have because we want to prevent all these hacks attacks before they happen right like intelligence service so for this part you can build some token risk analysis tools like n risk analysis tools signature decoding tools transaction simulation tools or transaction inside tools and you can help people getting scammed uh being scammed and also let's say we have the second layer right they say we help them but they still interact with the wrong address or wrong wrong contract or the wrong website so we might still help them in the second layer we call it event phase or some or during R event so in this in this phase you can build some anti-cam services or anti- fishing Services by on RPC or sequencer level or you can some you can use some front run services like flash BS to prevent this transaction to be interacted with the blockchain let's say we build all of these tools but still people end up with uh being hacked or like uh they just send token to wrong guy address so we can still help them after the event so we can still help them by uh Insurance asset wacking for example you can track the asset and you can have the information and once they once the information is on the once this tokens are on the central exchange or some regulated environment you can uh claim that it's yours this is not not a big deal so it's already on site but we need need to show people that you can do it as well and also you can have help them by checking their approvals or roke their approvals to maintain their wallets constantly and here's the brief overview of uh tools and the services that you might provide to users but I already um go through all of these I don't want to take your time so thank you for your time and thank you for listening to me and I hope you you guys will not be hacked please use our products and also our ecosystem Partners to secure yourself and also secure your wallet

Automatic transcript — names and jargon may be misspelled.