Algorithmic Risk Pricing: Keeping Yourself Safe in the Ecosystem - Bock

you're going to see a lot of the same information I agree with everything he said and hopefully I can add a few extra points that will make a bit of sense uh so I'm Bach on the other side is my co-founder Abe I have a long background in deploying Enterprise level software to banks financial institutions and so on which gives me a very process driven view of risk and where this kind of needs to go uh my co-founder uh has a large background in insurex and algorithmically pricing risk for insurance companies taking en large data sets and using that data to correctly predict basically a rate of failure so the overall State what is risk posture it is the ability to prevent detect and respond so in web 3 I think most companies take a fairly myopic view of this it is a very narrow as David mentioned as well o we got an audit which is does not cover nearly enough 5.8 billion loss to Smart contract flaws and fraud in 2023 growing 250% a year so that number is keeping Pace very well with the growth of our ecosystem as a whole Security on the other hand is lagging insanely behind 5% of people get audited 1% of those do any kind of continuous monitoring and the giant Crux with audits is they go instantly out of date you get an audit done you update a proxy contract all that good work is literally thrown out the window really finicky um so what we want to do is take a wider view of risk what we face as both people and projects in the space so not only contract risk we want to look at Oracle failure we want to look at fall downs and teams and process regulatory hurdles and things that might [ __ ] your company uh front-end bugs I'm sure everybody who saw the Twitter spat between certic and Kraken will know that uh it just takes a Minor error on the Web 2.0 version and it allowed them to front run some contracts and extract millions and millions from one of the larger exchanges in the world then there is fishing and then there is the danger of over centralization so once we have a look at all these things what we need to do is figure out on a per person or per project basis where do we want to deploy our time and energy and where are we going to get the most bang for the buck do we need to look at the infrastructure our smart contracts the way we deploy do we need to look at the monitoring is it something that changes quite often and needs to be looked at because we have so many people interacting with the contract or is it something that is getting updated so often that what we really need is just a crack rpid response team so as David once again said the pause and review strategy so assessing risk just needs to get better we have an amazing amount of data what we don't have is information and once we spend the time to get that information which information isn't important and how do we use it how do we turn information into actionable information that we can trust rely upon and effect change with so doing your own research is now nearly a mem in the space it is nearly impossible you often times as uh the last speaker Mark I think showed a lot of us are simply incapable of understanding some of the uh Mass behind and we are not qualified to judge so we need outside reg agencies to let us know that this is above board and in a transparent repeatable way um the project owners are in the most danger for a ton of reasons whether that be Legal Financial regulatory so if you are starting a project in this space you need to have an eye on this particular ball it is incredibly important um so I kind of broke it down into six categories that we kind of take a look at personally in fidum there's obviously the technical risk your smart contract there is operational risk how you and your team just operate in the space there is Financial Risk the depth of your liquidity pools your tokenomics your unlock um schedules there's the regulatory risk what pool are you playing in how much is there a danger that probably most notably the us is going to throw a stick in your spokes then there is the reputational risk of well if you do not defraud people but [ __ ] up you know how much trouble are you in on that front is your project ever recover and then there is a strategic risk around what if you are building the right thing there are two main times we can really affect change right so post deploy we can do code Audits and more importantly we can have integration straight into your code base that does continuous checks on your code to make sure nothing nefarious is going to get into into a state where it could be deployed as well as looking at your financial logic your planning to economics whatever and then in post- deploy then we get into monitoring keeping update having good security practices and obviously bug bounties so the tools for smart contract security while they are out there there are many different providers that can provide you static analysis fuzzing Cod about it simulation and manual review this also falls down a bit because they are not always transparent and it's not clear what they have and have not looked for so once again to David's presentation they don't show what they didn't see right it's um so having a transparent set of rules of what has been reviewed how it was reviewed and getting that open to people will just increase the level of security throughout the ecosystem we believe that's really important for post appointment tooling there is once again many companies that offer these types of things monitoring chain analytics so you can see what's going on measuring team history the amount of social Buzz the SE semantic analysis of just the general zeis to the feeling about your project so what we want to do is take all of this take all these data points plot them out and turn them into reliable information so using linear regression and Actuarial methods we can basically deliver what is CLO known in the Insurance Land as a technical underwriter price so we return a number that we believe after back testing is the price of failure and we prove a loss ratio to prove out that price we are currently in the process of onboarding more and more new clients we take all this data and we are able to mark our prices in time when we run an audit and a risk report we mint that onchain as an nft so we have approvable history of what we said and did and we can always go back verify to see if our guesses was w were correct and then every time this goes on we get new learnings that we can feed back into the model to produce better and better results for everybody in the ecosystem um we run out a bit of time so I kind of blew through that also uh David pretty much covered everything I was going to talk about in the first half of the thing so thank you very much um if anyone would like to talk after or any more detail um happy to chat if you have any serious questions about the linear regression and the Actuarial methods implied my co-founder who is supposed to be here giving this talk I will happily connect you on Telegram and amazing this was amazing and very brief so you have heard if you have any serious questions or maybe less serious questions you can speak later okay guys thank you so much for joining uh napple eat to