From Sick to Secure: How Remedy Is Curing Web3 | Ruben Muradyan - OneGuard LLC

please welcome him thank you hello at Denver I am representing hex hexons and I'm Chief Information Security there and I would like to introduce you to a few projects that we have started and the just a small history that we had we are doing cyber security for last 13 years we have started our products this year and one the product that we I will be representing presenting now have started just yesterday so what do we like and what uh principles we follow the first and the most important one for us is that we like Community really well we run our uh vapedia it's a Wikipedia devoted to the uh web3 security uh issues listing all the possible bugs the most most prominent hacks and stuff like this uh and our idea and our approach is that uh web3 security is often understood or uh have is being seen as something luxury and uh we would like to bring uh to the community the idea that it is not luxury so we have created a platform that is called remedy and uh what is there first of all uh no uh I mean all the listings or remedy are free for now next is that bu Bounty service fee is again zero we are not going to charge uh will be projects or will be security researchers for any found bug or uh payment we we will provide uh security triage for all the reported bugs to minimize the uh conflict of interest between security researchers and security project and projects that are being listed in B bounty we uh provide assisted migrations from different platforms different back Bounty platforms coming to our platform we are not doing exclusive contracts I mean if a project wants to be listed in remedy it could be listed everywhere else and we are providing free access to glider and before I will will show you the glider I would I would like to tell you what are the problems that we are try we were trying to uh solve and what are the foundations that we are trying to build that product on the first thing is that key smart contracts in blockchains are open source I mean uh feel free to take pictures guys uh what is good in and what is bad in having open sourced key contracts the the uh sources are available for to white heads and to black heads so white hats are doing security research for good and blackheads doing that the same security research for stealing assets uh next thing is that common mistakes and uh there are nearly 20 type of different bugs that could be uh implemented in smart contracts that we can find in smart smart contracts all those bugs uh are really common people understand how people know how to program uh securely for decades but no one cares about it it's like 10 commandments people know uh about 10 commandments for 6,000 years and no one cares up to now uh smart contract uh code is oftenly us used and if a bug is found in a smart contract then it it is being fixed it is not being fixed in all the derivatives of that smart contract and the reused code at that point we understood that during our uh security research or smart contract audits we are dealing with the same bugs all over and over and we have tried to find a way to build a lazy Auditors security tool something that will allow us to find bugs on mass on the whole blockchain so what do we decideed to do first of all at least for now there's no Automation in bu buck hunting we can say that uh there is some approaches uh with llms or any other AI Appliance but for now they provide more false positives uh than real findings if you are for following uh immuni or any other platforms you may see that there was a shitload of false reports starting like uh 2023 February because people were putting smart contract code into chat GPT and trying to report something that Chad GPT found to uh bug Bounty platforms and of course uh the increase was like 24x of reports and all those 24 X of reports was nothing to do with real Security fundings even when Ai and I understand that it will be the day when AI will cover security issues uh even when it will cover it it will still remain a human job it will stay remain a job that should be done or uh authorized by humans uh of course there would be a lot of false POS positives and at some point we will be going through those false positives to find something relevant or something efficient but at the at that time and in near future near perspective and when I say near I mean 3 to five years I do not see AI reading a normal proof of concept for reported security issue another thing is that uh there's a lot of approaches uh on how to do uh security search on mass but main thing is that people try to find a way to do that common F and common de is something that is the clearly visible path but path that will not work and at least for now CH GPT is doing something like this it is not going deeper into the uh understanding how solidity uh evm work and they do not provide efficient enough approach to uh that uh task what do we know and it is the most important thing that uh vulnerable code can be easily piz when we say that we have uh an approach to uh type of vulnerabilities like re-entrancy like C reuse we understand that we have that part that it could be piz and we have tried to build a solution that will allow researcher researchers to pize that staff what do we address first of all and uh the most important we are uh addressing cfgs and dfg's uh code flow d uh graphs and data flow graphs and another approach to this is that we were trying to find a way to describe of vulnerability in a formal language so here's the glider first of all we have comp compiled a database of all verified contracts as I have told before uh all the critical all the important contracts all the contracts uh uh created by big projects or big organizations are open- sourced and verified just to tell uh the audience that they are doing only good and uh their approach is pure the second part is that control flow graphs and data flow graphs are is something that we would like to build our patterns on next thing is that semantic analysis in line with CFG and DFG and solidity artifacts allows us to come closer to that formal description of uh solidity vulnerabilities and at that time we we have understood that we have to create a query framework that will allow users to query the database the created database of available uh compiled SM smart contracts and find what do they really need a side note about source code and bite code there is there are a lot of approaches uh trying to analyze bite code uh in uh blockchain the issue with with bite code is that even when we are disassembling that code and trying to get uh disassembled code we are losing the Logics that developers have put in it uh so analyzing bite code is something that we have tried we have thought a little bit on it and understood that it will be more efficient to go into the source code part and analyze Source Code by itself so this is the first screenshot and I would like to give a pose for you just to let you read commands cuz commands are self-explanatory by the way take pictures so running this quiry allows us to look only in functions that have no properties uh that have no modifiers having then going into instructions and looking for self-destruct solidity call what does it mean it means that we can find with this query all the contracts that have self-destruct fun function call without proper uh control the next one is more complicated so here we are going I mean do you see the code or no ah so come closer it's the only thing that I can say guys uh here we are looking for the we are going through two functions that are uh that have no property of uh that have external and public properties that have no properties with Mod modifiers and uh Constructor then again go into to instructions and uh limiting uh calling the function name self-destruct then limiting the output to 100 then going to again to the results and through all results we are pushing the uh Global asking if they have global data flow then going to previous instructions and looking in those those previous instructions conditional comparison ifs and after this we are uh getting the result of that I mean we are getting address of the smart contract and we are getting all the smart contract code that is defined and described but by this query so please scan this QR code CU under this QR code you will have like one hour video describing all the technology behind this stuff and how to use this stuff and what can you use and what uh benefits can you get out of this it is deeply technical it is really nerdy but this product is nerdy and the task is nerdy so let's move on who needs this first of all independent security researchers and I would like to open a little bit a little bit uh what do we want with this stuff you can search for a bazillion of contracts just with one qu query you can Define scenarios that uh will be uh Boutique for your researches you may focus on delivery of results of really narrow field of your security research and address this stuff through the bazillion of contracts uh we plan to collect queries provided by a community in our platform and pay royalties for the Box found with those queries so if you you have a query and then that query found a bug in a contract that was deployed after your query you will still get the royalty for this you will be able to provide really tailored M Boutique Services if you are specialized for example in gcy attacks you may go through the database of all contracts and focus only on the type of attacks that you are specialized in so you will be able to get the lowest hanging fruits and to get this in a back Bounty platform integrated to this staff moreover we would like to inform and we will announce it that the platform by itself will try to find the owners of vulnerable contracts and establish a communication between a security researcher and that the owner of vulnerable contct uh scaling guys being in this business for more than a decade we understand that so far this stuff is still human job it is not uh automated it is not optimized you are still looking in a uh source code and trying to find the bu with this you may scale your job guys you may div divide the job of auditing the contracts between people with narrow specializations and provide them the ability to go through to go deeper into the details and yep passive income something that every computer scientist dream of it is something that we have tried to provide with this solution Academia and we would like to focus on on the following thing that uh there are there is a lot of research done by companies and businesses but we have to understand that uh universities independent researchers have to have the ability to work with the perfect tools the cut engage tools just try to try to find uh something that is in the blockchain and the most important the unknown unknowns when we are getting a smart contract to audit we understand that we have known unknowns we know that there are bugs we would like to find those bugs but there are cases when we have no idea what can we find in a research so research is always dedicated to finding an unknown unknown and this is this is something that we are sure that uh glider will provide to Academia and one of the narrow narrow benefits of glider is gas optimization cuz uh when you are familiar with with CFG and DFG uh DFG approaches and you may quiry this through the glider you may understand for example how to Benchmark your smart contract against others approaches and how it will work deeper businesses web three projects will be will have the opportunity to in in to insert or to use glider in their cicd and cicd pipelines and sdlc approaches just imagine that you are writing a solidity code that is being checked against a known database of of that will be checked against a database of known vulnerabilities so you will easily find a vulnerable pieces of code Snippets of codee during the development real time threat intelligence uh we we are now developing a dashboard a sem type dashboard that will allow web3 projects see what happens with their blockchain in terms of written queries we can provide them service of uh periodically run qu query sets and understanding what uh what new artifacts have been discovered in their supplied in their deployed codes audit Camp companies as I have mentioned before they can uh scale their business they can find bugs on mass they can use this stuff to uh win their uh bounties on heatons and ctfs they can manage already developed queries just to provide that Boutique Services as they try to build their service on and create unique checks and uh estimate uh the amount of code or amount of uh I mean right now uh when you ask for audit you the audit company says okay guys what what is the amount of code that we would we will need to audit and people saying answering most probably in lines of code sl's or loc's in this case they can provide more precise understanding of what uh the contract is and how to uh measure the effort to audit that part Venture capitalists can use this product for technical due diligence we can use this product for quick check for security issues before funding may use this for prediction and Analysis of Market movements based on g code Gus and web3 Foundation chains may use this for one day protection research and development data extraction Forks Dex and Etc and actually understand that glider is a data mining tool not a security research tool so its use is Li limited guys only by your imagination so I know that there are a bazillion of questions I will be enjoying my cigar next at that place so we will have one hour of me uh doped by nicotine answering all your questions we will have happy hour please join our table and ask for this stuff and please scan this code to see all the resources thank thank you so [Applause] much