Risky Business – Taylor Monahan

so if you follow us on Twitter which you totally should you know that I literally just groped this talk last night and you also know that like I just edited this talk like five minutes ago so this is gonna be a mess and it's gonna be amazing so let's go okay risky business but we have a lot of like Gen Z Millennials in the couch so if you don't know risky business is this whole coming-of-age story right and it's baby biggest Tom Cruise his parents go to town shake goes down it's an adorable story right and it's mostly adorable because Tom Cruise is like literally 21 years old and I don't know he gets away with stuff like he gets in trouble but he gets away with stuff and the reason he can get away with this stuff is mostly because he's sort of like this underdog like and he just can't catch a break and you just feel for him the entire time and I kind of think of Krypto as like this story because we get away with a lot of stuff when we probably shouldn't like we refuse to learn from our past mistakes really we don't we refuse to learn how to make our smart contracts secure and yet like okay you know it's adorable but I think that if we want to grow up if we want to have a coming-of-age story rather than like a I don't know fall flat on our face story we should probably not rely on being adorable to get away with all the risky business we engage in you know this is this is just I'm sure everyone knows this quote but really if we don't learn from history if we don't remember history we are gonna repeat it and we're already starting to see this like we're looking at smart contracts and they're the same type of hacks that have happened again and again and again and I'll get to what happened this morning but we'll just leave it up for now and so some of the most important things when we think about risk and we think about just generally broadly what we need in order to sort of mitigate or reduce that risk we need more self-awareness we need more villa vigilance we need appreciation for the technology that we're using and the power and the impact it has on actual real people around the world like we're trying to create this technology we're trying to create these products for people and if we don't appreciate that that that technology can go really really well or really badly we are gonna be in trouble and I really think that in this space we do need a higher level of fear and paranoia and skepticism about what we're doing today because if we don't again you know it's only gonna be adorable for so long yeah this is an adorable okay it isn't and this is basically where crypto is and as we see the market pick back up we're gonna look more and more like this basically like a complete and utter douchebag and we don't want to be this so backing up what is risk risk is basically like bad thing is happening right it's the unexpected it's when you're you're expecting one thing happen you're expecting to make money you're expecting to save the world you're expecting to make this amazing product and then something happens and it all goes wrong and you lose money yeah you lose your users money everything gets hacked your product doesn't save the world one of the most interesting things that I've been researching lately is sort of the evolution of the internet and we see this all the time they were so idealistic and they were so optimistic and yet they ended up really creating some pretty bad things at the end of the day that they never intended to and we need to be aware of those so that we can mitigate even that risk right we don't want to go down this path where you know we think that we're connecting everyone we think we're creating this new decentralized world and in fact we're like you know just creating a really great system to invade everyone's privacy and exploit literally the entire globe so when we think about risk there's a ton of different types of risk you know some of it is very specific to financial markets and some of it's really specific to crypto and that's one of the most interesting things about deep I is it's really combining these two these two inherently risky things throwing them together mashing them up and then kind of like expecting everything to be okay and the reality is is like we're gonna have to work really really hard if we want it to be okay so some of the risks that you know just often on my head we have like reliance risks I call it like reliance risk compounding risk right it's like everything is stacked on top of each other we love to think about the defy Legos but if the foundation is not solid it's more like Jenga and we're gonna fall on our face you have like security risk smart contract risk you have counterparty risk which defy does eliminate some of but then you have liquidity risk still obviously regulatory risk you know these upgradeable smart contracts if you guys don't follow Chris black on Twitter you need to write now because he's been doing amazing research into like how are these smart contract upgradeable upgradeable smart contracts secured right like is it just a private key is it just a private key like on a post-it on someone's like friggin desktop right like what is protecting the inherent smart contract code because most if not all of these smart contracts are upgradable yeah okay so yeah this presentation is a freaking wonder okay so this morning like literally like four hours ago there was a bad thing that happened and there's sort of like this argument that's happening in telegram on whether or not this bad thing was a hack and I'm like I don't really care what you call it because at the end of the day something unexpected happened and obviously details are still coming out but as of right now this one we know somebody took a unknown amount of money from fulcrum I think the numbers gonna be about 350 K that's what it is right now um and it looks like things sort of like so there's UID X involved there's compound of all there's fulcrum involved then they did a W BTC short on something else and then or they borrow the WPT BTC on compound and then they sold it on unit swap to push that down and again because everything's relying on one another everything is compounded they were able to sort of combine all of these things and make a whole bunch of money and obviously when someone makes a whole bunch of money there's usually someone on the other side who loses money and again so standing from all that he said I think you forwarded this message and so I don't know if I want to put him on the spot but at the very end it says then this doesn't sound like a hack at all it's wasn't a vulnerability in this smart contract it was a complex arbitrage market manipulation scheme I don't care what it is okay like this is absurd that we're like oh well at least I'm smart contract didn't get hacked at least we didn't write like bad code that was like insecure in the more traditional way we just wrote bad code that did something unexpected in a different way right like it just doesn't make sense so this is what I'm talking about when we talk about like being diligent right and being paranoid um don't hide behind like legalese don't hide everything like words like oh we didn't get hacked we just allowed our market to be completely manipulated that's it's it's again it's not adorable of this fellas in the shot and I just had a freaking quote this cuz if you guys don't know Phil he has done such immense research on this his DEFCON 4 talk was literally like it was all it was this in a nutshell and he points out that security is not only whether the code does what is design but also what properties the design should provide to users the each community has gotten good at the former while throwing the ladder into the because now there are deep i profits to be made just because your code word does not mean that your system is secure I think this is real talk I think that this is the stuff that needs to be top of mind for us all right and then we what makes this kind of thing especially painful and again you know Detailers are still coming out we'll probably learn we'll learn exactly what happened but I want to say like two months ago maybe three months ago uh Sam son who is a security researcher and smart contract hacker extraordinaire uh basically went through a whole bunch of the the market smart contracts and specifically did this long post on DX and bz x which is fulcrum and he basically went and looked at situations we're relying on like you know swap for price data or anyone for price data if you can manipulate the price data you can make the smart contract do things that you wouldn't normally expect or you know you shouldn't allow them to do yeah and so he made some recommendations to them and they implemented some fixes but the first like you know when he initially found this exploit it would have resulted in the loss of all liquid funds and here's a sequence from this article and again this article is published monthly oh don't use an on chain too centralized Oracle without some sort of validation period and a conversation okay and also consider the implications of dependencies on third-party projects this is something I create a JavaScript project we this is like one of our biggest fears right dependencies because you have NPM we've seen so many bad things happen with the supply chain attacks and all that stuff but it does also apply to smart contracts right just because you're not like including something in your package JSON doesn't mean that you're not relying on it and this is a perfect example of a situation where both EDX and ECX were relying on unit swap and relying on khyber to provide information as expected and obviously that information was not as expected then a smart contract itself didn't act as expected which usually means that people lose money and we don't want that to happen and this is my favorite line of this article he says when you're introducing a dependency into your on or when you're introducing a dependency on a third party project consider not only whether the project has been audited but also whether the project specification and threat model align with your own so just because we think or we assume or we know or whatever word you want to use that Yunis WAP is secure just because you know swap can't be hacked right doesn't mean that it can't be manipulated or something can't happen without that dependency that could manipulate your own system right again this compounding risk this reliance risk etc okay and then like I don't know two weeks ago there's this super awesome smart contract called curb they put it on the main net without any sort of audit and then guess what happened can anyone guess no no one really rigs what do you have in so something bad happened and then everyone had to run around like chickens with their heads cut off trying to get the funds out before people lost the money and thank goodness they were able to frickin do so but it's absurd I know that we want to create amazing things okay I know that this environment is exciting I get it okay but putting a smart contract on the main net then letting it grow like a million dollars and expecting it not to be just annihilated that is it's clueless is not adorable it's absurd and right now the markets growing right we're seeing the hype and I said about six months ago that lending will never be hype and I can say with 100% certainty that I was wrong we are especially in this market where lending and these defy protocols are hyped and they're gonna get hyped in the same way that I SEOs were hyped and you're gonna see people throw money in them and I get that it's exciting but at the end of the day you have a responsibility to you yourself your team your employees the people who use your product that people that rely on your product and the entire community and the ecosystem as a whole if you do something that's irresponsible that's clueless and bad things happen it has effects on a wide range of people and you should be paranoid about that that should scare you because that fear is the only thing that's going to drive you to actually make responsible decisions so that maybe in the future less bad things happen okay and so I'm gonna go quickly through these because we just added all those lights but this is one of my favorite examples of like this compounding right um I'm just a regular person I hear about this deep I think I get super excited you see these blending rates I can make 8% 10% IgAN 2x20 is 100x long that's amazing so I grab my UFC and I get my E and that process in itself just that process carries all these risks right there's risk with crypto there's risks with the financial market there's also risks that like you get fished right like you you fall for Twitter giveaways down and then I decide you know what I'm gonna get some you SEC because the East market is just like a little bit too rich for my blood so I'm gonna go back to be stable but I still want exposure I still want to kind of participate in these markets and again uh there's all these risks with just this individual process and specifically with you SEC they have a blacklist right this is a centralized sample coin so if you like I don't know do something they don't like they could just like take your tokens gonna be it cool right and then in order to swap your cell phone you swap and I don't know maybe that gets hot I think I supposed to be yeah sorry okay so just pretend that's us DC to see us DC be a compound so now I'm going to put this in compound to make some money right and in return I get CEOs DC but doing that process we have like you know the centralized points of failures you can like at some point just like lose your keys or file you can get it hacked whatever again you're introducing more smart contracts where things can go wrong either they're manipulated or outright hacked and then token sets is super freaking cool and it is promising me the world so I'm gonna take my CEOs CC and I'm gonna put it in the ether assay PV index on token sets and again just Roz's carries this own risk writes about contracts we can be hacked you have front-running on the rebalancing of the orders you really don't have much control over your holdings whatsoever let's not even think about the tax implications of all of this and of course like you know you could still have the risks where you think you're gonna make money and you don't make money because the market does something different and so if we zoom out that's risky like that's risky business that's what we're doing that's defy right like that combination just enter like a token set position that's a lot and that's a very wide variety of risks and this is why I defy scares me right it's it's the overlap of all the smart contract risks all the technical risks all the crypto risks with regular financial risk market risk counterparty risk liquidity risk etc yeah we should be scared all right and obviously I just an example at the U SEC because it's super fun because that's a centralized able coin that has a blacklist like literally a non-tree blacklist but I think that we all know that the elephant in the room is maker and I and I'm just gonna leave it at that because we all know it all right so if anyone ever tells you that there's no risking defy or that defy is low risk just run okay that is a level of cockiness and arrogance that will result in bad things happening right if someone says that that it's just an indication that they're not paying attention that their clue is that they have no awareness and that in itself is the biggest red flag about anything you can go look at the audits you know look at the formal verification it doesn't matter okay that arrogance means that they're not going to be aware they're not gonna be on top of it and really just run run run run okay so I've been hearing that a lot of people think that I hate do you buy um but I want to be clear like I don't hate defy I'm super excited about defy I think that's the potential for for what this is is amazing okay we have Bitcoin then we have ether and now we have g5 and the reality is is like one of the goals of crypto currencies is to give people access to to money that doesn't have a central entity controlling it but it also is you know the whole concept of banking unbanked it doesn't just mean that people can like have access to their money it means that they can make that money work better for them and not for defy comes into play and that's why it's so exciting so as much as I talk about the risks and how silly this entire thing has become really really really really exciting and I want dphi to succeed I think we all do but in order for something to be successful we have to be aware that bad things can happen that there are risks so that we can mitigate those risks we can reduce the risks and we can actually make it successful right if we just kind of like walk down this path where we're optimistic or idealistic we refuse to uh you know heed anyone's warnings right if we dismiss any feedback as just like another troll on Twitter we're never going to be able to address the issues at our core and we need those outside people coming in and in poking holes at our theories and poking holes at our contracts poking holes out what we're trying to do because that's how it becomes more robust and so again I don't hate these bye it scares me it really does but the reason I'm on stage getting and dedicating an entire talk to it is because I think that it is valuable if we got it right and I want us to be able to get it right so how do we get it right so first step is we have to be aware of the risk and then we have to reduce the risk and reducing those just means like generally speaking have less sort of a talk surface right have less things that can possibly go wrong so you know in my earlier example where we're relying on all these different things with fulcrum relying on you to swap you know if you can restructure the systems to not be as reliant on other systems or if you can change something that's reducing the risk entirely and then number three is mitigating the risk so if something does go wrong which it will how do we make it so it doesn't go really really wrong right like how do we make it so it's like you know a couple hundred thousand rather than a couple hundred million and so with those types of things we want to look at like just like really kind of like broad hard-coded safe limits like reasonable things that you know this should never happen but if it does like let's just not have that happen things like that and again like most of my experiences in sort of JavaScript land web land but we see sort of um we see sort of the same patter all the time we focus so much on reducing the risk we focus so much on on the optimism and idealism and and the amazing products that we're building and we see a lot of times that products just don't think too much about like mitigating or what to do if things do go wrong right so like when things go wrong how do you address it really quickly how do you detect it really quickly and how do you limit the amount of loss to your users so this is really awesome project called defy score they have been doing a ton of research is Jordan here join us here Jordan's right there he's amazing okay I'm so happy that someone is doing this he and his team are basically going through and they're trying to identify all the different risk factors that are sort of a specific to our defy protocols and yeah it's it's really really cool but I think the most important thing about this tool is that it's going to continue to iterate and it's going to continue to evolve and we need more eyes on it so that when you look at sort of these put scores there accurate and they address all the risk and then the other really important thing is what do you do once you have these numbers like what's the end goal right because right now it's sitting on defy score you know I go and I look at it because I think it's cool but at the end of the day what's the point of the product like this and it's important to remember that we're building products for people okay five minutes okay we're building products for people and we need to make those people aware of the risks so that they can make an actually informed decision about the risk that they're taking on and this is going to be more and more important as as this bull market takes off again it's yeah it's the it's it's gonna get crazy out there and if you continue to sort of talk to people like they've been in crypto for years and they survived the bear market and you don't identify the risk communicate the risk and allow them to make like a really truly informed decision about the risks that they're taking on when they enter the space and when they interact with these defy protocols then we're gonna be in trouble so you know as I'm building my crypto we're thinking a lot about like what defy stuff do we want to integrate what do we want to give people access to and what attitudes do we want to sort of convey Osby encouraged people to interact with these protocols right do we want to say like this is just like lending with your bank you know except that the interest rates super high no I don't want to do that because it's not like lending with your bank right this is a new system most of these contracts are like six months old three months old two weeks old you know it's not like your bank so you know the attitudes that we want to convey are like you know this is an experiment this is cool you can participate in it you can maybe make some money but you can also probably lose some money you know we want to convey those types of attitudes and again deep ice core is doing amazing work and hopefully will help a whole bunch of products in the space helped their users actually know what's going on all right I'm gonna show you guys something really quick because I don't think that people realize like where we're at right now okay so this is the down this is 2016 this is like very traditional exponential curve to the Dow right we all know what happened to the Dow right right it got completely obliterated completely and then we forked our frickin network in order to see people's money because the amount of loss was so great okay and it was so early that we're like okay let's just let's just undo that thing real quick we're not gonna undo anymore there's not gonna be a doubt there's not gonna be a recovery that's not gonna be Forks anymore we've seen you know a couple things go through or try to go through and they haven't gone through it's been super contentious but my biggest point with this slide is that curve right there right that hockey stick that hockey stick to the moon okay and the same hockey stick we saw in 2017 with I cos this is insane like that's insane okay and here's the defy graph right now and that's why I say that six months ago when I said that there's no way that lending is ever gonna be hype I was wrong because that is a hockey stick okay so when you're talking on Twitter when you're talking to your users when you're deciding whether you want to put a smart contract on main and I can time to beginning I cos think about the attitudes that people had think about the mistakes that the ecosystem made and then don't make them again okay include the wrists warn the people educate the people build better products because that isn't gonna just drop it's not gonna keep going fly that's the next bit of the curve it's going to go to the moon and the only thing that we can do about it is try to prevent people from going all in and then losing all their money via all the ways that we just talked about this is just a meme okay okay so honestly though what can we do about this right what can we do so that we don't fall on our faces so that we can address the issues and the very first thing that we need to do is that we need to talk about this okay we need to engage in honest discourse we need to offer good-faith feedback we need to ask questions in public okay no more like going to DM African address something we need to be skeptical ourselves but also encourage that skepticism when I first got into the space in 2013 like it was drilled into my head that Ike nobody was trustworthy everyone was evil you should be skeptical trust but verify you know accountability transparency verify everything bla bla bla bla bla okay that attitude needs to come back so that we're questioning things and that's just a part of our culture and lastly I would really love to see more public forums come back everything has seemed to move to these like sort of telegram channels etc where you have this it's terrible you can't search it you can't keep up with it I don't even want to open telegram these days and one of the best things I would say about like the Dow is that I can literally go talk to Reddit where all the conversations were happening and I can learn from the attitudes before the down during the Dow and after the Dowell and you can learn from that because they're stored in these public forums it's encouraging like long-form communication it's not these chat boxes and I would really really love to see someone take that mission on and secondly you we need to secure and educate and share when I say secure I mean to secure everything right so we need to have secure smart contracts we need to evolve the languages that we're using we need to do formal verification we need to improve form of verification we need to do all of those things we also anything about like just key security and key management right like the key management for the smart contracts themselves and the users keys bring all of these different things and by edge other educating our users educating our peers giving our peers the power to question us and question what we're doing and point out us um that's gonna make the entire ecosystem more powerful more healthy and at the end of the day more robust and then one of the most important things is when you get hacked please share everything about it share the learning experience share what happened sure how it came to be sure what you were feeling at the time dump it on the internet and let other people learn from it because I can say I'm not a smart contract developer but I get so much out of reading the vulnerability reports and the disclosures and I think that the more sort of the more insight we have into the decisions people made and how those decisions led to acts bad outcome the better we're all going to be as we build our products moving forward hello okay lastly we need more care and empathy this is like just a trend in the crypto space it's always been around but it's been getting worse lately where we just sort of like ok ok boomer is not an acceptable response to anything ok it's not an acceptable response to someone who just lost their money either like that's absurd and that's the ecosystem right now okay it's alienating it's it's mean ok it makes us look like dicks can we just not do that anymore but also like there's just this very persuasive attitude where it's like well if they can't write down 12 words then they shouldn't be in crypto well if they didn't know the risk then they shouldn't be in crypto they shouldn't have defied that like no no no no you didn't tell them the risks you've been bragging on Twitter and promoting your product like is this failsafe freaking amazing thing sent from the heavens that's gonna make them rich and then you blame them when they put their money in it and then lose their money because you forgot to secure it like that's not an acceptable way to do things so we need to have care and empathy for each other we need to have empathy for the user who's money even if at the end of the day it's 100% their fault it doesn't matter okay it still sucks they still lose their money and it still is bad for the ecosystem because I guarantee you those people don't come back like you don't lose all your money and be like yeah crypto let's do this okay so I made another beam this used to say did someone say ICL now it says did someone say defy because that's where we're at today I'm so serious guys please do not underestimate the power of FOMO do not underestimate the power of greed it will make rational people do irrational things and it will follow beats everything yeah I got a shell am i under time no good yeah okay all right uh so six weeks each price up a hundred and fourteen percent our beta site is up 68 percent my craft is up 75 percent and our knowledge base is up a hundred and thirty percent which is like kind of crazy right like what does that mean first off it means that not enough of you are checking out our beta it's really freaking cool go to it beta up my crypto calm right now secondly it means that new people need help and they're looking for help right like we're seeing a greater increase to our support section and our knowledgebase articles than we are to our actual product and what this means is that new people are entering the space and they're looking for help so create resources to help them it can be deep it's okay people want that knowledge and by creating those resources you not only give them the knowledge but you give other people the knowledge and then maybe they can like to steal it turn it into a YouTube video like that's how we educate the newcomers as they come in okay so uh if you built a product post January 2018 and you've been like chilling in this bear market been like this super cool my best number one piece of advice for you is to go out and look and read and absorb every piece of information that you possibly can the bad things that have happened and then also hire like a bunch of support people and education people because they're really hard to hire like in the middle of a bull run my best piece of advice for those who are just getting started look be scared be paranoid but don't let this talk like completely demoralize you experimentation is valuable but you need to do it in a safe way so we have like five different castanets use the test Nats right talk to people experiment have fun just like don't have fun with real money yet and for the oh jeez the people who have been here since the Dow the people who have been here since pre ICO mania my best piece of advice is to share the wisdom and the knowledge and the experience that you have gained over the past years this knowledge needs to go to everyone else in the space to the new people building to the new users okay when new people coming in the space when things get overhyped the best thing that a G's can do is open her mouth and share all that wisdom and I really want to see more of that because that education and not knowledge is probably the number one thing that will allow this bull run to not turn into like ICO mania 2.0 okay that education and knowledge is what's going to allow people to not lose their money because at the end of the day the worst user experience is the one where people lose their money so quit it with your fancy buttons and stop allowing people to lose their money okay thank you love you bye [Music] you