The New Guard Evolution of Smart Contract Security | Mooly S, Michael L, and Kratos

and everyone's GNA chance to uh introduce themselves tweet length please all right how everyone I'm Michael lellan um I spent four years as a uh head of solutions architecture at open Zeppelin and now uh doing Solutions engineering at blockade for onchain security hey guys my name is katos I have a background in computer engineering I'm also the co-founder and engineer at drosera which is a automated risk management protocol also an advisor to groom Lake which is a private military corporation for web 3 hi everyone I'm mul AG from Tel Aviv University and Satora uh I also run defi security Summit and excited to be in this panel awesome so let's just kick it right off uh despite billions spent on audits we still saw 2.5 billion drained in exploits last year are audits just expensive security theater uh giving protocols a false sense of safety while failing to prevent catastrophe catastrophic losses uh the big the nosis byit attack highlights the role of opsc or SEC Ops Beyond code because audits don't seem to be enough I don't agree there's not billion spending security security is getting more and more affordable there is no way to to get 100% security but the more you spend you get more secure and you can start in some way and go other way we provide I mean that should the number billions of dollar it's something that invented in like many other things the security budget if you're if you're a have seed Capital that shouldn't be the the the blockage I agree but the issue is that we are actually the security like anything else it started when I started web 3 six years ago it was in a different stage it was people with you could you can take a two-line program and find programs now we have good Auditors we have good things coming so then the the the hackers are looking for something easier and and then they go to the web too so I think that the web is the the domain is getting more and more secure and there are more and more attackers and it's always a a a battle that will be continue to fight and we seen it in defi security Summit most of the bug this year are not smart contract related Michael did you have something to say actually what he just said I was going to jump on because of that $2.5 billion number like if we start with one bybit that wasn't a smart contract security vulnerability that was uh you know the front end being compromised uh signers being tricked uh the second one on the list would be the Ronin hack which is also where the validator keys were compromised uh also not smart contracts uh now if you go down further to the list you will see smart contract compromises that that led to a large loss of funds but I think it's definitely the fact that smart contracts aren't the only focus and like I know that when I was working in open zeppin we would always be putting in these system assumptions of like we assume that these Keys these operators Etc are going to be kept secure and be honest um and so smart contracts is just one part of it but I do think that um in general we we're the industry has to get better we have to have better tooling I think on like the entire stack both uh pre and post uh deployment and that also comes down to like keeping validator or keeping validators or private key secure um and and if possible if you can get like trusted secure onchain infrastructure actually putting more into that I was talking to T from your team before this and he was talking about how he wants more uh of like the govern's decisions and more things actually on chain as opposed to on multisig so that there isn't the potential to either compromise an interface kidnap uh you know five out of six of the signers whatever it might be to try to actually increase the attack service so security needs to evolve Beyond audits is that kind of what we're saying yeah Beyond just focus on Smart contracts still that's an area when you improve on but but also the infrastructure the operational security that uh everyone individually is doing especially if they have access to uh high value funds or multisig yeah and maybe just quick full I I just want to give Kratos a chance to to to say and then I'm going to move on to the next question yeah I think these guys are basically on the money here I mean smart contracts is just one risk uh security is a multi-dimensional thing and as we saw with the bybit hack right it was a more of OB situation where dev's computer was compromised and they got access to production infrastructure rure which to me is absolutely [ __ ] crazy you know at bitgo I was at bitgo previously you know I was a lead engineer and I had no access to production infrastructure at all only like a few people did and access control was super fine grain there was practices around how you access it and that the fact that this even happened is just beyond me okay so moving to the next question Auditors often face push Backs from uh push back from clients who limit scope hide scope or demand Rush reviews meet to meet launch deadlines how can Auditors ethically navigate these pressures should there be public consequences for protocols that obstruct audits or does this violate decentralization principles I think we should definitely do a little bit more naming and shaming on on protocols that rush it out uh and on Auditors I mean I I've left open up in uh so I can maybe speak a bit more freely like we definitely would have customers that would come in they would be rushed they tell us that their timeline like when they would get the code would be met and then things were delayed but they don't want to delay the deployment so something is going to get cut and that's usually down to the audit um at the same time it's like you know two weeks versus one and a half weeks versus like or or even five or six weeks usually the biggest problem we had wasn't necessarily the rush on like how much time we had to do the audit but like how rushed the code itself was and how much poor quality there was because they didn't do testing they didn't uh go through and create some fine grain rules or understand the invariance in their own protocol um so we would have to do a lot of that work or at least like go in assuming that things hadn't been properly tested and so instead of looking for very obscure bugs we're finding like very amateurish ones and that's that causes like a massive increase in um you know the complexity of fixing it of getting it done and then all in the rush before deployment so I think it's um I think it should come down to like not only are you rushing into an audit and not really taking the necessary steps but are you like even doing the necessary things to build the code securely so that the audit is just double-checking that you should be secure and hopefully don't find anything as opposed to just assuming they're going to secure your code I think you should not you go ahead I was just say yeah like 100% you know uh the point of an audit is to uncover all hidden vulnerabilities in the protocol right and it is a communial best effort to do so so both parties must put their best foot forward to get this job accomplished right and so you know if the auditor is saying it's going to take this long you know they have to obviously Source the appropriate skill set and talent um you know in like the time frame right and then it's also on the protocol to ensure that they can support you know their you know essentially their efforts right uh do you have engineering bandwidth to support their questions you know give them contacts right uh follow up on findings you know or are you just you know basically putting on the back burner and saying like yeah like we'll get to it you know adro Sarah we are actually going through audit right now through Cantina right and it's been a great experience so far you know guys are super smart you know and we basically have slowed our development to ensure that this is going to be the best possible outcome that's the only thing that really [ __ ] matters is to make sure that things get caught that's it so in Satora we are very strict probably one of the most strict company in the case we have our reputation at stake and we actually losing many clients when they don't agree with us we feel this Our obligation I work in this domain for a long time I understand it's not the norm I think it actually is the norm for people I care about security if client come we lose them we tell them to come up front we have the Prov now which is open source free they can start before the audit and they can go for free with other tools like fing and others we will we measure the the the number of lines and then we will see the complexity on Bas the weeks and this is not something we can negotiate we can negotiate the price but we cannot negotiate the sales and this is a decision that we openly we decided in 2019 and we're not going to change them and we're going to lose 80% of the market it doesn't matter we this our decision it's span out very well for us with protocol which have a lot of money we are comparing ourself to many people we started and have a better understanding before us we keep learning the domain it's good for us I think actually other companies and I'm again shaming shaming is not a good thing you should not shame anybody there are people who spend a long time and do bad job I we should not shame anybody but people should understand what they are getting and you should understand whether you are engaged with us we have two type of agreement we have auditing that you basically do like best effort but even there and you do formal verification when we do formal verification it's a guarantee and this take you more time I mean formal verification processes are pretty expensive and they do take a lot of time but it but ultimately it you know does come down to you know maintaining uh reputation in the space and so that leades into our next question you know we've seen uh high-profile exploits in protocols audited by well-known firms uh how much responsibility should Auditors bear for missed up vulnerabilities is there system systemic conflict of interest when Auditors prioritize client relationships over rigor and how can the industry of hold Bad actors ctech uh accountable without stifling decentralization or more simply uh should protocols that obstruct audits face public consequences and if yes should who should enforce them with without violating decentralization principles yeah I think obviously Auditors bear most of that responsibility because like you said it's about reputation and if you care about your your reputation then you should guard that at all costs so if you do a good job then you have good reputation and then you'll get more clients and so um I think you know if you have a bad reputation then Market forces will essentially banish you like no one's going to work with you um and so yeah I think that rigor should be replaced over a relationship at all costs I mean that's the whole point of it right I agree for us there's the separate thing if we do formal verification we'll give you your money back it's a different thing when you engage with us with auditing we have the obligation still like you say to help you with the mitigation with incident but when we have formal verification this is our guarantee it's a different thing and you you it's true it takes longer but you get more yeah and I I've been in the space for a long time and seen like attempts at standards I think one of the best attempts at that was was e trust that has a lot of like these are things you should be checking for or doing uh that aligns up with an audit but it's been very difficult to get anyone to necessary adopt it Auditors like prefer to do their own thing and it's still only going to cover the basics um really you hire Auditors because you want them to catch things that aren't going to be in a checklist um so I think It ultimately does come down to reputation without there being like a gatekeeper and who gets to call themselves an auditor or who doesn't um and when it comes to Otter they need to be able to say like when they work with clients one is this I even want to associate with two uh is the code I'm about to audit do I think that I have a reasonable chance of ensuring that I find all the bugs um it's not a guarantee but do you think that that's a feasible uh challenge for you to take on and then when you put out a report describing what you found and how you found it uh you give at least some sense of like what is the state of the code um you shouldn't say this is secure this is not because it you know you don't want to objectively say something you can't guarantee um maybe formal verification you feel more confident on that but in general um you would want to like make sure the you know users know like you know we've maybe taken it from a 95% to 99% uh chance that there's no bugs but there's always a chance um and so any auditor that's going out marketing the fact that like they have 100% secur a protocol um or or allowed a client to Market their audit as a like foolproof uh Security check uh that that's the sort of thing that like good auditor should be standing up against and telling clients you cannot use this in that way versus uh you know Auditors that allow that and you should be very wary of I mean that you know that everyone's waiting for that that check mark right and then they want to they want to be able to Market that and like it needs to be on the Auditors to to ultimately uh say you can or can't do that but there's not really any controls which kind of brings into our next question um you know anyone can start an auditing firm so how do we separate real Security Experts from opportunists and should there be an industrywide certification or decentralized uh or decentralization incompatible with credentialism I think it's great to everybody start it's actually one of the best thing that happened you have seen when we started there were like few very good auditing films there were very expensive now we see individual Auditors who are doing amazing job we are seeing people who are coming out we have seeing small company that come out of nowhere it's see amazing job actually that's what the best thing that happened to web three in the last two years is all this bug Bounty everything is coming and it's great and people should valuate when you get an audit if you are a developer it's very easy to evaluate if it's a good one or not insert a bug okay and it's very clear and the fact the more the better no regulation just let anybody start and and and private audit are good solo audit are good team audit are good Community audit are good everything yeah the worst thing a company can do is have a small bug Bounty that is not worth anything yeah I agree I think it's great that we have you know smaller firms popping up you know uh you starting to see a lot of new Talent you know diversity in thought at jera we worked with this uh one auditor called Blaze um you know very early on like pre- test net you know and they cut a lot of low hanging fruit they were great to work with you know and I think that if you sort of take a layered approach to your audits like maybe starting out with some more fresher talent that newer in the space and then you know as you get approached to mainnet you work with the more reputable names right to kind of get that name you know stamped on your protocol you know but I do think that um decentralization does not work with credentialism you know I think that um I think it's really about reputation you know word of mouth if you do a good job then like that's going to spread you know like Blaze we've talked about a lot to other different protocols and I think they're going to work with them too you know so I think yeah give them a chance but also too uh try to work with like reputable names yeah I mean it's ultimately I think we credentialism comes up a lot especially when you have like large actors certic that uh have built up a large market share but a lot of people like that are in the no question the the you know the quality of their work it's like the problem is that if you create a a you know crunchling org but you you actually don't want to maybe you know it kind of depends on on how it would go but you know let's say like sear just doesn't pass muster on that credential well if if one of the largest Auditors in the space isn't credentialed well like the The credibility of that credential is going to come into I think it's going to be challenging it's going to be challenging to get everyone under the same umbrella and agree to the same standards um I do think that there can definitely be like softer versions of that like you know reputable people in the space uh potentially some VCS that care about the quality of their uh uh their projects or or maybe leaders in the space that say hey these are audit firms that I know are reputable that know I know do good work hearing from people like you that say Hey I know even solo Auditors that do good work you should use them that it's kind of word of mouth and maybe there's a better way to capture and track that uh so that we have a better way for newcomers to understand who's reputable um right now we're just relying on wck news we're kind of working on an anti-red dential uh system and even then uh it doesn't capture everything in some of the people uh I mean for example open Zeppelin's been in wck and in those cases it was actually a case where the client uh had made modifications later on or or hadn't listened to the the details of the report that we had given them so uh in in some cases the devil's in the details on like what happened and was just say a hack that falls more on the project or the Auditors but that's just all to say it becomes complicated and you have to like find people you trust to to tell you uh you know who's reputable and who's not jumping on uh what you said a little bit earlier um most taxs focus on code flaws uh but what about threats like legal Warfare suing devs me cartels AI driven social engineering uh nation state actors how can protocols prepare for these unknown unknowns and is the industry obsessed with industry's obsession with technical audits creating blind spots and I'm going to give this one to katos uh yeah tough question of course uh a lot going on and a lot to unpack uh so with the legal Warfare right I think that Dows have done a good job to help diffuse like legal liability but of course it's not it's not bulletproof you know we've seen you know developers get prosecuted um like in the US so I mean I think there's some some room for improvement there of Mev cartel stuff you could obviously use like encrypted me pools uh or just work with you know blockchains that try not to do Mev right AI social engineering that one's like crazy to me because like social engineering was already a problem to begin with and now you throw AI into the mix and so it's like even crazier right I mean just this week you know I work with Groom Lake uh there was already an incident at this event right and so I think that people need to really arm them M eles with education to really you know guard themselves against like threats that you that could come across at like a venue right if you're a high net worth individual you probably shouldn't leave your phone on a chair and like walk away from it right it's probably a bad idea and so I think AR arming yourself with education you know working with like teams like Groom Lake that do like red team training right they test your knowledge they see if you can click on links you know it is a way to arm yourself because trust me the threats are most certainly out there I I've actually seen some interesting examples of OBC where like I've seen some very good security researchers doing incredible work but they're doing it in a public space looking at clients and potentially finding vulnerabilities so like you know maybe don't look for critical vulnerabilities in a billion dollar protocol out a hackathon or on public Wi-Fi um so like they're you know they'd be great at securing a smart contract but not necessarily like making sure that their own laptop or their own like personal devices are secure I think there is an issue there which is tricky and not a lot of people are speaking is the conflict between decentralization and security it's very very tricky I don't know if you've seen a trustex talks that I've given sort of explaining what we do with a about basically onion security we need to have a team and you need to understand all of these things come together the audit the incident respon that we need to work with them in a very and It's Tricky with a decentralized organization so we need in the case of a we work closely with bgd which is external team and I think we are doing great job when sort of all of these thing coming in a daily manner but the fact that we understand the protocol and we have holistic solution we are basically looking at all levels and incident response of course is very important for us and we are there and social engineering is a huge issue all of it is issue Cloud security everything Front End security smart contact security and it's all the case compiler security you name it every day I can show you the telegram every day we have a thing and the problem is that people are not aware how complex it is usually auditing is a one-time thing or formal verification is complex but it's still a one-time thing but formal verification is impossible to prove the human okay so I prove the correctness of your code but I tell you look I cannot tell you how your employee will behave that's not something no matter how how much time I have so that's where we have to work and in in a decentralized organization my view which is maybe not popular that you have to have an organization or a group or a set of people that you trust and this set of people maybe public maybe not they have to be involved maybe and actually we are seeing some Dows electing security councils like arbitrum and others so the idea that you have it's of course companies like doer is great but it's people and it's people that have the control and and it's also education understanding many many protocol which understand very complex stuff don't understand the simple stuff and the hacker we look to whatever the hacker can attack yeah I do agree that security needs to be a more complete uh like look at it more completely um whether that's a decentralized organization or centralized organization I I don't really have the answer for that I mean we kind of have a little bit of a you know centralized group with SEAL Team Six um and they do a phenomenal job but they're all very trusted people in the space but I mean that that can't last forever so I don't know what the what the answer is there um but we have three minutes so this is our last question Venture Capital fuels the defi ecosystem but are VC's unknowingly funding insecure projects do they genuinely care about security or is their priority short-term profits over long-term protocol safety I think it depends on the VC uh we've worked with some VCS uh at openen where they would like put us on retainer for a lot of major projects um but at the same time we also see like these VC's funding projects that are are absolutely risk and VC's ultimately it's a money game where you know you're funding 10 projects and if nine of them blows up and one goes unicorn then you you're' been successful uh if those nine explosions include a lot of user funds then you know for the VC that's cost of doing business so I think there is some there's genuine interest for most like reputable VCS in the space to invest in security I mean it shouldn't be just the cost of doing business is like that's the excuse but that's how it's valued yeah yeah and I think I I think the challenge is ultimately like balancing like you should be telling users like hey invest in your own risk when you're actually using these protocols but a lot of the times they don't have they're not sophisicated to know like like teral Luna a lot of retail like went into that not realizing just how risky it was like going into a synthetic stap coin that effectively had no backing and was you know probably it was only a matter of time and uh you know a lot of people know were questioning it and then getting Dunked On by the founder on Twitter I don't think any of the VCS are reaching out to that founder saying hey you should be you know informing your users better they were just enjoying the number going up until it all fell apart so I don't know who their VC backers were but like those are the sorts of projects that unfortunately we still continue to see it's gotten better but yeah I I I think it's still a problem so we got time for one more response yeah who wants to take it I would just say that uh what you said basically it depends on the VC right if they're short-term focused and like they're not they're not going to give a [ __ ] about security but if they're more long-term focused then yes of course but at the same time though security is not in the Wheelhouse and so they're just going to trust their Founders that they're going to do what's best you know for their project right and actually from recent conversations that we've had with protocols and even liquidity providers is that they're actually more interested in security uh in the protocol before they even deploy the capital right so and so they're looking at like okay is a protocol actually having monitoring and risk mitigation in place obviously jera does that Shameless shill uh there's other Solutions out there too but yeah I think it's really depends on the VC but I think no liquidity providers actually care a lot more so maybe just one second it's actually opportunity for VC and for Founders we have seen VCS require formal verification and getting us good client we have seen VC giving audit bank for for people which is great also it's a good idea for for a Founder if you get a an investment you check what your VC is willing to give for you and some of the VC are excellent I'm not going to say the name but you can check with your VC some VCS are giving you all the uh bank for audit for formal verification is great it's indicate that they care for you so we got 20 seconds left if anyone has final words but I will say this uh talk will be up online and it is streaming and it's on uh Twitter please retweet it if you agree with anything that was said here uh stay safe uh thanks for having me guys so for me I've been working on this domain for many many years the dream is to make formal verification useful I actually you know I'm I'm very biased but now this week we open source it on gentlemen thank you so much for your time please give a round of applause to our panelists