Web3 Security: The Epic Battle Against Evil - TOKEN2049 Singapore 2023

uh hey everyone so I'm Richard Mollison final Quant stamp um so it's one of the largest web free security companies and um you know it's a pretty short talk so wanted to talk a little bit about um hacks so yeah a little bit about Quant stamp so um as of last year we're now a billion dollar company one of the largest security companies in the space uh backed by many of the leading uh you know ECS and um we basically do security for uh almost every type of company that's in the web free space whether it's exchanges D5 protocols games uh you know and even companies like visa and PayPal um so you know the reason why um we started Quant stamp was because um you know even before ethereum took off there were a lot of hacks in the cryptocurrency space and um you know uh actually some of the largest hacks happened in Asia you know and that included the mount gox hack which is still taking uh its time to resolve itself even after all these years as well as like the 400 million contract hack which happened uh you know in Japan uh many years back and um you know one of the first hacks that happened in a smart contract space uh was the DOW hack in 2016. it was the first project that I invested in it was sort of before um these big conferences and people had a lot of hopes for the project uh and you know a couple weeks after people invested um you know all the funds were uh you know lost because there was a bug in the code um and so after that incident um I decided that uh there needed to be companies that helped with security and made sure uh anybody that wanted to start a new company could do it in a really Safe Way uh and um when we started the company there were very few uh companies to do security audit for everyone was still starting up and so one of the first things we did was we said okay maybe we can like also invest in some of um that new upcoming projects and so if you're in the audience and you're building a cool new project and um you know maybe you're not ready for security yet but you're also like looking for an investment like you know come find myself or um uh you know our head of BD Dawn in the audience um you know after as well so the number of like hacks that's happened in crypto it's actually been going up as the industry has grown so last year in 2022 there was over three billion dollars stolen in cryptocurrency hacks and um the reasons for this is that like uh there's lots of teams building Innovative stuff and so it's really easy to make mistakes people have really tight deadlines so they maybe raise their series a and they made promises to their Community or to their investors that they're gonna deliver something by certain dates or by uh the time of a certain conference that they're gonna launch something and so sometimes it's rushed and sometimes it's more just like um missing you know a attack vector um you know even uh vitalik himself you know his Twitter was uh recently compromised and so sort of no one is fully uh you know above uh you know this um and every year also the the sophistication of the attackers has increased so when we you know first started quantum the smart contracts were really simple you know we were auditing tokens or like you know really simple games and so the types of attacks that you could do on it or also simpler they were easy to find um and the amount of money that was in them was also less you know in the beginning like for a cool project maybe if they had like 10 million dollars that would be a lot of money for that project nowadays there's like D5 protocols at launch and then you know when within a month they might have you know 50 million dollars or 100 million dollars in the protocol so that's sort of a really big change um a little bit more about Quant stamp so we've contributed to a lot of public goods uh you know in the blockchain space we audited the major upgrade to ethereum 2.0 we're currently working with ethereum foundation on L2 and CK scaling and so we're currently um you know we've been working on four different grants for the ethereum foundation um and to learn more about security we also have a monthly hacks Roundup so we try to like explain in really simple terms how what what's going on with all these hacks uh and you know we we basically pick five or seven of the hacks that happen in that month go through each one try to explain okay like what happened and how you could protect yourself um another cool thing about quantstamp is that we have one of the only licensed insurance companies in the world for web3 so it's called chain proof we started about a year and a half ago uh and um you know we're in partnership with the world's largest reinsurance company municary um so yeah so that's like a typical um security assessment um from font stamp um they're really you know important thing is for constant we really um want to make sure every single audit that we do is the highest quality because um so many people's like livelihoods and life savings depend on that and so we've developed a very collaborative approach with the teams that we work with um and you know we have some of the folks on the team with the largest number of years and audit experience in the world and so you know some of our team come from like many of the best companies in space over time you know in the beginning like when I first started quantstamp we used the only audit solidity smart contracts solidity has changed a lot over the years and now there's so many different Tech Stacks there's Russ there's kotlin there's you know golang for validators there's you know multico for internet computer there's Cairo for ZK uh and so besides part of the Journey of running the company it's it's been about constantly learning uh all the different programming uh paradigms that people are coming up with and like all the ways that they're using them uh and so it's kind of a continuous process and so you know we always like to work with new uh projects that are doing something interesting so if you're doing something interesting like you know find me after the talk um one thing that we've really focused on is that um over the years we've built a lot of great relationships with uh you know different VCS in the space and we've started to basically offer the portfolio companies of VCS um you know deals where they can you know get a security audit that can be reliable so um you know these are some of the launch partners that um uh are part of our batch one program uh you know if you're a VC that wants to work with a really reliable security auditor um you know we're currently still uh you know recruiting for batch two um yeah and you know there's um the current like ecosystem you know it's changed a lot after FTX and after Tara um from my experience um you know in Asia I would say um a lot of the projects that come to us for audits are actually still built on ethereum or on by the smart chain some recent ecosystems that have started to take off or like sui and Aptos but because of our vantage point we see you know a lot of the audits that come to us and so we kind of see like what's people building and what's kind of taking off what's not taking off so yeah and recently something that's been taking off a lot is l2's I'm sure you've seen at the conference uh it seems like almost everybody is building it out to um we're probably in the middle of L2 summer right now um l2s the biggest issue with l2s is that an L2 is a really really complicated bridge where you uh you know on the one side of the L2 you're storing you know like hundreds of millions or maybe billions of dollars in assets on L1 on you know and and transaction on the L2 and so it creates actually a lot of security issues um Bridge security is one of the hardest problems in the blockchain space and as many of you know like most projects have been hacked at this point um so we're pioneering a lot of r d in terms of bridge security and we've been you know giving a lot of talks about that um so if if you're thinking of using a bridge or uh or Lord forbid building your own Bridge um definitely like look at some of the best practices um you know that we've developed along with other experts in this space um you know one of the uh currents grants that we're working on is actually a security framework for rollup it's still rapidly developing space that I think uh you know needs a lot more work so yeah [Music] yeah and um for quantstamp we audited many of the first D5 projects as part of D5 summer starting with compound and curve and yearn and it it continues to this day so um I would say a lot of the sort of big bang Innovation and D5 has already been done now there's a lot more incremental Innovation um but you know for many of these l2s they all need perpetuals and spot exchanges and options exchanges and entree Market making uh and so just from having seen so many of these projects we've sort of got an idea of like what are the best practices for if you're building a new Perpetual protocol on you know arbitrimp for example um yeah and lastly um you know for nfts you know now I think it's kind of a very severe nft uh bear Market but there's a few cool companies like you know eluvium and parallel that are building some really awesome things you know in the AFT space um parallel just came out with an amazing game uh I highly recommend everyone like to check it out and play it because it will renew your sense of optimism uh for the for the nft and gaming space um but yeah you know we've been uh auditing some of the largest exchanges like openc and many of the largest games uh and with that I think I'm gonna just put up the QR code and I think I have time for one question so yeah uh so that's you know if you want to learn more about audits and if you want to learn more about working at quantstaff we're actually recruiting someone that speaks Mandarin so if you speak Mandarin and you want to work maybe on a technical analysis side come to find me afterwards um yeah any questions cool um then if not thank you appreciate it [Applause]