Matthias Egli Co-Founder & CTO ChainSecurity - Securing DeFi

foreign [Music] I'm very happy to see so many faces here this early after rave so I hope I didn't take part so just to prepare so yeah my talk today is about securing D5 and we had a lot of amazing uh talks during this week in technical details this one will be a little bit higher higher level what is done in the whole security Community to think about security holistically so just I'll give you a quick intro and from chain security we are doing smart contracts audit for quite some time in the space and if you want to read it up our most of our reports are public on our website we also have a lot of educational material and disclosures on our medium blog post some examples like there was once a hard Fork which was delayed um then we were responsible for another heart fork in Berlin at the Berlin heart Fork then for example new bucks which are being researched on we released something where we also won the underhanded solidity contest with yeah so this is chain security just very briefly but so what this is about first let's say there there was code right and it was good and then came cryptocurrencies still the world was mostly fine then came tokens things got a little bit more complicated then came exchanges and it was still all manageable although we saw the first tax Happening Here and came Landing protocols and now it starts to get really interesting and after lending protocols we saw an explosion the defy explosion right we had derivative synthetics we have aggregators we have Bridges layer twos are coming up all of this right and what does this lead to today we mostly have chaos and this is what it does to the code so what is being done to help here what and it is really an holistic thing so I'm going over the most important areas which are being covered to secure These funds but before I do I'll quickly show you what happens when there is chaos so you might be familiar with this this is direct leaderboard and it goes on and on and on and these numbers are crazy right I can also go into details in most of these hacks they have various reasons Keys getting lost up to nowadays State actors apparently trying to infiltrate projects to steal those funds this is for allegedly what happened to Ronin bridge on the top 40 network was a smart contract bug there was a attack with flash loans on governance and I think this one was for Beanstalk Wormhole was vulnerability in the library or not an understanding of how the library Works in Solana and so on and so on and so on right so what is done to secure things so this is the primary thing which is being done I'm not saying that this is enough right it is also what we offer of course things are being audited but if I go back here just quickly then you see most of these have the unaudited tag so there is a strong correlation between being audited and being hacked so let me it's slow okay so what else is being done we have nowadays VCS protocols and insurances who cover losses sometimes I mean for various reasons right we have back bounties out there which should incentivize a blackhead to not hack the protocol but claim the back Bounty instead and they have multi-million dollar bug bounties we do a lot about education and disclosures hackers are being found they're being hunted and they are being incentivized in various means to return the funds and there is a very active community of white hats researchers and of course protocols who take this very serious and who react both to potential issues and ongoing issues in war room-like scenarios and share information these are all the areas I'll quickly go into so what's the state with audits so most audits most hacks happen to unaudited projects but why is that so audits are very hard to get pipelines are very full with the Auditors it's six nine months 12 months out that you need to book an audit nowadays there is audit as a high stress business right it has certain burnouts some people leave the audit space do something else of course a lot of new people join too it takes really time to grow that Talent also for projects which are more on a budget audits are very expensive um they easily exceed 20 of your total development budget and then this is far in excess of what you see in the traditional web 2 world the audit quality improved a lot but there is a big but on this one a lot of new joiners in that space are learning still and obviously that reduces the quality which can can lead to false security so just one takeaway because it's D5 day and perhaps many of you are running projects think of audits very very early actually think of security from day one meaning you think about hey what do I want to build and how one is how do I want to secure it ideally you already talked to some Auditors and then book something it is always easier to move a slot than to create a new one and and it already helps you from day one to to know what's coming up so here I'm talking a little bit of what others are doing so for example running Bridge 600 million hack raised funds afterwards so this is actually infinity and they used those raised funds to refill refill the bridge and basically to that degree bailout users Wormhole famously on the next day the VC said okay I'm just replenishing the funds right um some Taos some Protocols are picking up the bill this is just one example from agava Dao for agnosis we have more and more payouts from insurances it's just one example from one of the older ones from Nexus Mutual who paid out more than 100 000 in insurance claims this is to individual investors right not to the whole project obviously there's a risk to this you cannot count on that your project your VC will bail you out this is I think only sustainable as long as we are in a in a very bull market where money is very available the next thing which is being done are multi-million dollar bug bounties so the initial thing was like a large Buck Bounty used to be ten thousand fifty thousand this was already a large bug bounty in web 2 that is already very very decent money right but nowadays in web 3 that is not a lot and the reason for it being the immediate possibility to steal incredible Amounts is being weighted on with this this is a very two-sided sword because you do give incentives for like hackers to to do do the right thing but still it's very very expensive like um we we are engaged with maker we do a lot of their audit work right but also maker runs one of the biggest bug bounties so tell me 10 million bug Bounty and you can imagine how anxious we were when they launched this and it was like okay is it still secure so far nothing came up right it is very good to have that defense in there um but yeah the the stakes are very high here um I think that What's Done in the buck Bounty space also especially around creating trust towards hackers and allowing them that they are sure that like if they find something they get paid is really helping the industry a lot and we saw it with yeah I think I don't know there's millions of back bounties being paid out today then my favorite topic education and disclosures this is a little bit a messy one because it's hard for you to know where to look right and it's all over the place Twitter is the best place but then Twitter is like everything is on Twitter right it's hard to know what to look for so an example like blog post like the underhead and solidity contest what what happened there or from all the participants then of course from the larger audit companies and the smaller audit companies there are lots of educational material out there blog posts and this is often in the security industry this is kind of alpha right this is where we learn about new types of attacks and this is also very good material for everyone here because if you think of hunting like finding bug Bounties in projects and you realize hey this kind of bug this is likely also in that protocol which is similar to what they have looked at or what I am building they might often people make the same mistakes over and over again there is nowadays really reward for helping others through back bounties and obviously through audits there's very good work done on boot camp style educational material the securium security boot camp is one which I can recommend there is this is an example of a Twitter feed right so from CIA officer there's a like collecting a lot of material um there is uh also the like get get into it way to do it of course with us but also with others right and these are well paid internship opportunities where you can really learn this on a much deeper level it is it is kind of challenging to get in but um yeah they are there so don't don't be shy to try and I can also say like open the airplane trail of bits consensus diligence all of them run this right um there are YouTubes and we I was actually tempted to repeat the talk which one of my colleagues gave at East Denver which is basically going through the common vulnerabilities which we see in D5 but it's recorded so there is a 20-minute YouTube video which you can go to to get really a nice more technical idea of what you need to take care of okay so this is again a little bit more story time so what happens sometimes hackers are being found in various means very publicly The Exchange happened when poly Network got hacked right it was again one of the biggest hacks in history and they communicated with the hacker via messages sent to yourself with with data in it right and everyone could follow along and then it is interesting to you you do have here the unique opportunity to to see into a little bit the mind and the feelings of a hacker why this is happening and this is very likely I mean a single person right um so this this hacker returned all the funds another hacker which was found right um this was through a Cascade of um small things I don't want to go into detail how this one was found because it can trip off what you need to do to stay hidden right but it was really following small dots and then finally realizing it is that person who like doxed himself in some weird way and then was able to be found and motivated to return the funds even though he was sitting in a jurisdiction which is hard but there are then ways to motivate these people um this one was China yeah and then the last part of it so what's being done in the security community there is a very active East security telegram group it has a thousand plus members in there it is semi-open meaning there's not a public link to join but most of us are in there and you're free to join right in that sense ask your auditor ask someone in the security Community for that link and you'll get invited there are more um ma invite only groups a paradigm um where samsisan is nowadays part of runs one where a lot of the white hat hack activity is being coordinated this is an invite only there it's really you need to know the person not necessarily they can be Anon right but you need to know them still because they always really share information about um current life vulnerabilities and how to mitigate them yeah and then again a little bit to the audience so there's this war room-like scenario which is happening and eventually and we have seen this again and again this is going to happen and it's very good to be ready for it it's very good to know what's coming up have people and the most important people in war room are the deaths from the protocol who know the smart contracts first and foremost I'd say and then afterwards Executives you can just keep the calm and support right this is their role then in Dallas you need people who can execute so I made it executive slash multi-six sinus right so that that is the thing in Dallas you need them those who be who are able then to take action often Auditors are being added to these War rooms to um to to quickly react to If there are changes to be done what could their impact be and obviously also often there is a mix between the auditor and the Whitehead researcher who found the thing in the first place for us if we find something which affects multiple protocols what we really like to do is to reach out to the other Auditors because this is the last part I'll get into for my final words it is incredibly hard to reach projects when there is a security incident you can't imagine how often we have been sitting there and just trying desperately to reach someone and telling them look anyone can steal 10 Millions from you right now and then you finally get someone to asking friends and friends right they don't have a security contact anywhere and then you need to explain it to them and it takes a lot of time until they understand because often these things are very complicated so there it really helps to have that trusted third party the auditor on board which can translate and where they already this project have a trusted relationship with and know hey if they say it it's true because otherwise who is this random guy who tells me that 10 million can be stolen right now things so security is holistic my cryptos or nowadays metamask um Taylor she wrote this a little bit paranoid security guide which is very holistic which goes into everything thinking of end user security follow it and whenever you deviate from it know that when you do what you are doing right and then some of them you might think like I can't possibly follow this um as I said add something like security at my protocol dot XYZ to your front page make it very easy to be found also to bug bounties right even with small amounts it makes it very easy for people to disclose right and for us if you are on platforms like immunify then we know where to find you and we know we can release a bug this way and we will know that it will reach the right people it will not be leaked because a buck which affects you might affect others too so we need to have trust that you don't like go out and try to hack more protocols with that information of how you are now vulnerable yeah and then invest in security from day one so prevention is still the best thing we have in this industry it is incredibly hard to fix things in prod and no code is ever perfect and by thinking of this from day one and then spending money internally to secure your project to think about like can I train perhaps a developer to go through that security Boot Camp or so right not to become an auditor but just to be better at securing your own project that's probably the biggest Bang for bugs you can get so with this thanks a lot for being here so early um and yeah I don't know how we are on time so um we we actually have another five minutes before the next panel and I was wondering if you could tell us a story from one of the war rooms like maybe you can tell a little bit about what like happened how intense it was yeah okay thanks a lot um which one so perhaps one which involved multiple protocols so as as I said um if you find a bug in defy it is often something which is being used all across the stack because we keep building on top and on top and on top of things so this was a war room where um one of the oracles uh which are heavily being used was vulnerable and that was embedded and here parallel disclosure to approximately five six projects which you can find on the top 20 in D5 polls what's needed and that was a good thing because those projects are kind of reachable right so at that moment you start to have mostly still telegram even though security thinks badly of that but for practical reasons telegram keybase chats those two have been opened with these groups to disclose to them the vulnerability then coordinate the responses this involved yeah I mean I already mentioned broadly you can have an idea which project is involved if it's top 20 D5 parts and there it was critical that each of these does two things right you mitigate future harm this usually happens through disabling certain features on your protocol which you can do through governance and do the long-term thing of fixing your code which takes way longer it needs to be audited and also the governance steps are way longer to to put this in production um it is public by now that because projects did upgrade last Friday mostly so um yeah this is this is one and there it really helped actually to have these very good people who know what they are doing um yeah is there perhaps any questions from the audience I'm happy oh there's one I can repeat your question for the microphone yeah very good question so we get asked this a lot what's the responsibility of Auditors if there is a hack so I just repeat Wormhole has been hacked Wormhole has been audited by a company Solana code is rust code by a company which is rather new but that is every company who does this right or most most let's say this way in this space what's the liability of an auditor the biggest one is naturally their brand the stake they have in that the trust people have in a brand uh in in the people who secure you that is the biggest stake they naturally have and if a project attacks at stake that brand can take a heavy heavy hit there is usually contractually no financial obligation because a security audit just can never be perfect and distracted like that it's not an insurance luckily we do have insurances nowadays who can take up this part so it's again this combination I'd say they they audit companies to have a lot of skin in the game from that their business depends on being able to protect projects really successfully happening [Music]