All the Truth - an Ethereum Security panel (Devcon5)

[Applause] no it's not okay hello everyone I'm Dean I work at status I'm a security researcher I used to do the entire object thing I haven't done it in the years it's been super interesting to see how this space has progressed and I have a really competent pedal so I think it's probably best if everyone just goes around and introduces themselves maybe says what they're working on and what some of the most interesting things that have happened in the past year in the security space of it maybe advanced encounters changes things which are addressed in the right direction there are things which we're still seeing which we didn't expect me to see when they're all hey guys my name is Gonzalo I'm here representing the diligence team were farted in Census Bureau also us washing bugs in squashing bugs for the best three years I guess I'd like to say that Allah has progressed through her just talking outside about how it kind of has not I think it's amazing I think it's normal for stuff to progress slowly even it's like we mature of the ecosystem matures things will start progressing I'm Malcolm Astana and I work with if they're publishing with security stuff regarding ethereal and not so much smart contract about mentor auditing but more the entire ecosystem the entire infrastructure area and so less depth oh I thought the big change in the security scene was that the security awareness in the entire security community around the theory had really started to grow this business in security group which we become large there have been a long new new companies formed building new cool tools for analysis of smart contracts and this last year the illusionist and continued a loom having become better there's more tooling and I think that they may be least changed in the last series that all these security folks who started coming to the scene through smart contracts they also started looking into the easy the base they're looking to actually solve am works hopeful works and they've given inputs to hard Forks and the potential changes in email and things like that so that's a good development nothing hey yo hey over from constant mr. Joe Joe we're being an audit and also the life changing security consulting for enterprise focus solutions over the last year I think the manual audit process hasn't changed that much the tools are getting better but there's still kind of a transition like manual on it's fully automated which I don't think is gonna happen decades it's just a very odd question in terms of stuff we've seen this year I think a lot of stuff related gas costs obviously there was the concept of the heart for which is kind of delayed because of some changes related to gas price there still a lot of stuff that we learn as company one thing that we're about focusing on is how we can mitigate risks even after they happen so as a secured company were aware that nothing's perfect in all our clients and everyone should be aware that even if you get a security guard it okay nothing's gonna be perfect so people are I guess becoming more aware of that and they try to plan what happens if actually vulnerability comes up or anybody comes up we've been kind of facing our kind of rethinking through our audit process as well and how to kind of learn from our mistakes so I think that's been kind of a [ __ ] man there's been a couple of three big security building findings in space things kind of invading security groups and I think just as an industry in general or kind of being more proactive and kind of responding more rapidly to any findings and I guess that's the quality progress by Malenko and with opens up link we go the the tools people know us for complex and real slow security audits and we need security risk esteem and I really good thing I think there's been a more forward push for more automated tools and this have been developed and a lot recently I also think that there's a bit of over reliance sometimes what you just said that it's gonna be a long time still realign them fully but I think maybe that we saw it's a move not only to like a lower level about to the higher level like incentives and presence we had a comment on it this year which I created a lot of controversy before they actually they could back with going try running so it's a question it should be like parties and things often of not to work with like nobody or threat models so it's like the concert on somebody don't know what we report on record on something it's and sometimes the next bomb on us you look at the incentive that's very interesting otherwise it's been an interesting year I will say last year Japanese really announced and I think we really felt the impact we'll see a lot more delegate cost then we were seen one year ago due to all the proxies and so on so and that definitely has happened and still of course we're seeing a lot of sparks but I think we're seeing box of the different and the Lightning talks they were making interesting radically now the average for deaths of contract has gone up a lot like we see in contract that they're like quartets up to 10 DB or something like some country that was kinda network that letter that caused their compound and so unlike the complexities going up a lot so I think security has generally gonna but because complexity has also gone up sufficiently many bucks all right I will say Jerry it's been positive you yeah so with the whole coma thing that you mentioned I think whatever what we realize there is a year ago a lot of us were mainly I take I seal contracts into it the contracts and not people are actually building those products and I think some of you here probably retain some of the people in the eye cos that you were auditing and are now actually auditing the products which they're shipping do you think that they learn from the things you were teaching them a year ago and the general maturity of their code bases is going up reducing we're still making the same mistakes I made I think that they yeah so I think that I mean thanks to the great work by open 7 that is understand that has been said and like it's become a lot easier to write good code in this kind of like there has been that kind of a template for and that's why I think in general it hasn't yeah we just went to that person a guide to checklist for what - its what takes what we expect on the code before starting in order to look like that I think this has worked and so we did we see and echoed in a much more mature stage that we used to see before it this is what are some of the things you do on the checklist what do you would you expect from your clients documentation we put a lot of emphasis in the additional testing like things that like talk about the health of the process and we have the solidity compiler on it last year and a lot of the issues with power line like the bus factor were a few people working in a language loss factor is a factor or they how many people come in a hostel rushes for the project to an intern and we'll say two guys run this whole industry sentence so so and so these kind of things we have in this checklist and I think versus having necessarily lives think the bus fact was probably something interesting for you as well from like what things that happen in Shanghai when everyone was on the same flight and no one was able to respond to things that's the EF kind of like develop new strategies to ensure that if things are found omein that there is always someone who's able to responders or we still in a 2-3 metaponto sailor there so there is no lies structured way that it's ensured that there are always people on wall bus hello the I mean EF is pretty spread out and for developers are pretty spread out but if you know quake was to think of Europe then yeah but there are still some people in using its maturity topic I have exceed people right better go people she price that we are there I there I SEOs before or not and I think it's also due to the bear market to be honest like everybody was enough like there was clear low like nothing was happening in people were actually building felt like it wasn't me but it was also true like they were building products through another cheating those products and we see maturity we see my computer and all that that shows you the quality that reaches us as a companies the ayats that we that we the class that we move engage me like they have good teams and I'm like that shows a little yeah I want to talk about the tech waiting obviously open second all the work around templating this has been a major contribution and I think it's a great path to continue down at the same time as the contracts become more complex there are these custom there's this these feature that come where general that people want to use but might not be available on open simply so same time we've been seeing a lot more cases of these very complex functions and then when of all really is found in one of these and you just needs across contracts so being able to kind of maybe submit these kind of complex contracts were more objects to happen and turning them into necklace making them before but I mean it sucks that the the first company to actually develop it has to have carry on the burden of pain for auditing and the people who just copy it or basically free-rider a lot of people like to use templates yes yeah not just us but they go people there's no contracts about open source so people just take what's good and what's working and then they don't have to pay for security afterwards so I mean it's a challenge promise all kind of distributing the costs across the first person spike in everyone who just comes to cook okay so now that we've kind of moved away I said from i ciose from the auditing simple token contracts to more complex systems how has that affected your practices are you guys finding yourself using tools more in addition to doing my annual audits are you focusing more on doing manual audits or what's what's changed in your workflow van pastured due to the changes we're seeing I think having like a solid understanding of the business model and what they're trying to achieve has been a crucial part of that process just understanding the cases logic and figuring out how that's translated code has obviously it has consumed a lot more of our time if it's like a simple talking contractor you are still not sure I think it's fairly straightforward what kind of futures are available but once the contract start talking to other contracts and other projects and becomes a lot harder to kind of map out what does what and that still gets a lot bigger so I think in terms of stuff we did last year now the kind of contracting of the project is consumed or time they did bust me I can I can touch on the topic but that we were asking Martin's work and say that beef like I personally found out that we were or that we were not that we're active for east-end responsible honestly like as you will have shipped more products more stuff has happened I can read that right like there's a lot more in the the groups that were eating the security groups everything like that like people are always discovering stuff and like easily responses becomes more and more important and I've honestly thought that we're not that bad yeah that'd be me really really really but you needed to step up our game I think for you guys we're also in that security Chuck we've noticed that there's people now like shout out to Sam whenever you use I hang Bub's every throw these in my to maintain I call the PCEHR lay they're amazing I don't know how you do it you need to sleep a little more I guess with the incident response we can learn from two companies here who've done what it's in all of us miss things sometimes for 0x4 chinna consents diligence that was this year wax audit and for chain security it was doused at where both of them I don't remember the dow stock vulnerability the consensus diligence one mistake a return size check in the 0x contracts thankfully none of the trades were affected but when things like these are discovered what what have you learned from that how's that affected your practices what will you do further on to try and minimize that yeah that's also very good in going for the question we we we learn something so that's good in the mostly us processes right it's not like Sam is probably a I don't know I don't know that's good that's good that he's a good guy and not just explaining everything from that but internally we discovered that we needed to play again we need a mighty process great process wise in mainly the you know very specific part of an audit which is mediations great so what happened like for the students that don't quite know like this in the spec all it was like a problem with the with a called a to return and we discovered that what happened was that we were not treating the mediation spec speak like the part after you got it after we after we provide a report after we provide the artifact to the plan they obviously fix the wallet right that we find the vulnerabilities now we were probably not turning these mitigation space as as a new body it should be reflected its new coats it's a completely you got it there you got a check I guess and since in you eyes it's just not fixed that's right it's not it's not like you go is new come that's it that's mostly the most important thing that came out of that that we learn internally is that nucleus Cuba there's no two different ways two three there's no mitigation there's not that you cannot care less just because it's it's after the joint that comes after the augmentation basically so we are now just realizing that we are like we all collectively have been capable of just like didn't like share these teachings and learnings obviously so so there's been quite a lot of instant response during the last two years from my part and channels what I can say about those are they've all been channel different and they can't really we can't apply a template okay so have it and incident we do gather in this channel and communicate with these people because they're all very so widely for something we didn't discover that there's a bomb ability and solidity compiler that most democratic privileged information and first couple of poor people need to find out exactly how what triggers this bug to appear and chemists and the entire office the contract see will perfect as it can actually exploit the can we talk to them protip by the way it's really good idea to put some contact information in your own verified source code and then we are these are constants where yeah there's no built-in CAF so which is just getting or there's like parity have number of watts which and one can take same ownership on where they're actually needs to be a group of people who are willing to basically exploit these which can be seen as kind of invasive part and this white hat group has allowed good for the community in general yeah yeah Christmas lists directed us then yeah so and very good question so lost it actually was what would I had was mentioned before trust model and so the investment was entirely the it wasn't clear which which contracting for which convict whether they prefer can be replaced with an untrusted contract and this is a more faster than them so yeah it's already well I find it it's definitely a matter of processes making sure that trust marks they're making sure there are conditions to be making sure that this is - very clear which contract can be replaced with unrest accomplishment progress can be replaced with country across the court and then was a very yeah very subtle back in the end but of course with every part when you see it then you're like but then how could we have missed this but they are just too repetitive cause to a gator which then which is the constant but then of course if you candidate as not a common person anymore breathe yeah I think a general lesson to is we are all the leaders we will all miss accidentally so what whatever it means and with that it's not a guarantee of security but just an assessment of security and we will all miss Baxter and Tony and yes what I think this is an important message to that it's important these things are are visible that we acknowledge them when they happen and so that people know what to expect we also will be safe because a paradigm and security and also to your previous question and I think to leave on the body the things we look up in the threat wall our sensation all right so speaking about how audits are actually back to you security it might be interesting to hear from you guys what is it all in it actually item are they written for right so with crypto is kind of that bird with this industry which were kind of interest in where we open source a lot of our audits and that feel like Martin coming from a more traditional thing before in theory how did that work there what's different here and do you think those differences are good for the user or doesn't even matter like should losers have to care about a company having gone about it is it really that important who who's really the client of one of these audits Graham yeah I think it's rising to to another earlier so to get some context [Applause] from me like regular security industry it's very clear who is the customer to order to do it it's the company that wants to be audited and typically you go in and you do security audits and it's highly classified you deliver it to the customer and the customer that might be probably only like five people read it they probably don't spread it internally because they kind of gonna forget all about it but one picks it's an electronic product it was fixed it's no one would ever dream of like polishing it and then in this office was world it's kind of expected that these results are published and in some cases they're saving kind of an expectation that the audit should be phrased in a way that describes how good this thing is I thought what for the last 30 years but I mean in smart contracts but before that I know several customers who I wanted to do pick out some snippets of where all the water where it was really positive words and that's not how I ever wrote the words I was put into the work that this only highlights all about stuff doesn't even mention I've had that experience where I've written and all that many people came back to me to say that they were sad about the art result because it didn't highlight the things which they did good I don't care about what you did good I care about what you did bad and that's the only thing you paid to highlight I'm not gonna give you two thumbs up on like wow you're your c20 was really beautifully written exactly so I'm something and I think that that's a good thing if it comes into smart comfort to be given to the open source world up boys they're not like Pat's on the back saying you did good in my life you suck here in here in here nuts it that's almost really yeah yeah I guess the question was how we identify the variability present quite precisely I mean having said the beginning you need specification and this match of the specification is forgotten probably also a lot of experience right I think a lot of us have looked at code over excessive amounts of hours and when you start to get a feel for which lines start to look dingy and then you start analyzing those lines and then I won't point your leg yes this is definitely dingy but it's probably for most of us it's a multi or multistage process it's definitely my expectations the mismatch of expectations if you provide us the specification then we will try to match the code to that specifications like really it's about expectations like your expectations if you don't provide us to the specification we will have to come up with one ourselves ratings what Dean was talking about we look at go to lots of me to like mainly just like we try to come up with a specification that me being do you want but that might not exactly be what could come you one so yeah just write a specification so we know what to check or otherwise it's really really hard for us to do the job that you want to see my classification you mean the way of a group I need no human tension of any sorts that was up they all say ISIL is from one part this is high level thing where you like these specifications may be written and like it flow or business you space something but the most refer to it I think is more like be lower level assumption you believe it as a snippet of code and see what are the assumptions being made here there's an assumption that this study will not be negative there's an assumption that this loop will learn long before a certain defector I ask you because I'm also do security audits and sometimes it happens that they're smart contract is without any bugs so it's beautiful it's written very good equality quote but it was different then it stopped did you spray the white paper yeah so this yes so here's how my process used to work when I was still auditing what I would do is I would expect a specification for my client and then I would go off and look at the code and write a specification for myself and then while looking at back home and look at black and everything I write my specification and then I compared it to the specification which they handed me and I tried to analyze do duty behaviors which I have found and interact with what they've given me and the reason why I write my own specification before read theirs is because I don't want to cloud my judgment by their by their predefined assumptions so I go in completely black that I do that I look at that I compare and I go off that I continue off of that so I think for everyone it's probably a multi-phase process which starts off by just first it's simply a scan for like the stupid bugs like stupid calculation reaction see these stuff like that then you continue you gopher you always go one layer further yeah and just to quickly follow up I think that really ties in to your question before was the poor needs of the Amish and because actually what we started to do is this for ico height that you mentioned when we started doing about Hornets was we always clearly wrote what to talk and ask for what I see or does like for example how many percent of the tokens does the Creator get because that was sometimes not so clear on the website mystic and we found this was really important for the people and also if we don't write it in the report in the we said other works that now it might not be upset anymore tomorrow and if you do we'll say like oh but you said this is correct as is and then so we found it's important to document certain core features because to us the general public is also like an audience of the older people I think the stuff what everyone said but one thing that I think bothers talk about is the centralization issue and how sometimes it's not documented in the white paper if that's what we should highlight this reports obviously I think the reports are kind of targeted towards the community in some way but not it's very technical so it's very hard for someone who doesn't understand solidity because I go through the report and see how good the coat is obviously we're pointing out where the mistakes are so it is gonna sound pretty negative but it doesn't mean that the codes absolutely trashed right their mother the even bin projects have had liabilities that might have been addressed to and we phrase it that way so there wasn't there wasn't one ability to be fixed it but readers may think that oh if it had look in the first place and I'll be a good cook so kind of managing these vacations is kind of also important we're going to do that which might make it fair so we point out the mistakes but we also address how they fixed it and obviously the centralization and also kind of up the creative ability so the thing with some our contracts is that it's not supposed to be upgradeable but there are ways to kind of the abilities of that case the code might be safe for now whether I was conducting but we can't actually guarantee that at the future so we tend to kind of talk about that report said kind of work with the clients to go out have a three-set what they expected how they cannot litigate walkability that might come across from these ability and sent relationships one thing we started doing recently and actually in consensus two were doing it before us and we really like it's a nigga's summary post aside from the full report which is less technical and putting the summary from the project works and takes out the threat model we either have right Malachi where we assume and summary of the main corner if this we found and link to the a quandary over the city angle so it's a much more adjustable thing and thanks guys variational a second way to in from community without that technical high part of reading economic report yeah regard to Western earlier which I forgot to actually answering so I think it belongs to good floor and should be included in the security what it is basically the trust assumptions or contract so there is an admin who can do whatever he wants and there are these kinds of elements which can these transactions so if the report is published that that should be published with it yeah because it should be communicated to the community not think it is their responsibility all the orders to to outline at respond I did have a question break I said well when you talk about that the trust model you highlight that even the specification of the client says that that's what he wants right do do do you feel that there is a like an s people obligation to auditors somehow is that is that where you guys are where you are right you get there like an ethical obligation to fly penny defeats to specification that's the way the money yeah I think so because it also yeah highlight so this is how it works these are the the built-in trusts in this contract I think there's a question over there yeah so it's just going to go back to the public reporting so and it might sound a bit cynical but there's I think an incentive to disclose it obviously we have the honor especially since these very poor particularly good Pierre but a lot of books and their expiry think that they're different census to exaggerate the severity of log will be between them in a way in the report that makes it seem like it was more difficult laundry thing and also if that exists it does exist that you manage your relationship with clients so they don't perceive it so don't receive this enthusiasts method is not having any marketing yeah that's not a new problem this is the same thing from from classic security and what tip that was is the you deliver report yeah communication with the client and they say that's not really high because there's only like blah blah there's only you can only access the something that's not important and then you can we put it down to medium stuff so this is and then you deliver the final report that's usually what happens Republican quest for you know they aren't public I mean basically the same back before the agree with your client and at the end of the day it's up to the auditors deliberate work and it's up to the client to decide through one publicist or not and if we publish it we can make no changes to it but we can say and we think that the record is us because we don't think this yeah go back to the contract this very classification we try to be as objective as possible like if someone else who wasn't involved process or say how superior will be thinking it so we do have a company has have standards on what the classifieds I mean well professional at the end of the day it kind of depends on how much impact if I have off that user the people who uses smart contracts so there's going to be significant financial loss obviously it's high severity the again we do work with the clients figure out if this law were to be exploited what even impact and how how easy it would be to kind of exploit it not we don't take it into town like how hard it was for us to discover I think it's learn about the impact what happens to users so it is about we do upgrading a kind of dominated securities during the all the process is fun and if we try to guess it's where the mics I think there's a question here I think I can my voice carries two quick questions one is it's around the tooling and in relation to that with like vulnerabilities that appear a contract has been running for a long time so so what what what's up too late you know it's like with accent children's weather tools are you guys using work for the security analysis on the one hand and then the second question is around the crypto economic security analysis if you actually do that as well um because you know you have behavior in contract that you know for example if you know life is assumptions around rust a key mechanism is right you know do you and then it's it's not a specify or there's there's there's something that's that's missing then you can't know that it's actually something that there's there's plug because they don't check for example for block number I'll say that it's also kind of like the conversation to the class right not that's only part I love that look yes we passed inspiration and good souls are great there's a lot great building the space though like I heard that EPM is also getting the open source it's Thursday well that's an example of very good yeah yes lovely not the Kenya today I don't know how to pronounce it yeah there's a lot of great tools or tool sorry kid but yeah answering the other question about the aggrieved economics sense about it I think that comes with the dialogue with the client so normally you'd ask right you can see from their specifications what parts they want you to focus on but they also come to develop like we actually asked like what do you want us to focus on like well what Bart's maybe it's just go maybe it has nothing to do with the economic part maybe they just want us to Model T the the economics behind the they're smart conference right they take it very smart basically so I'm just thinking aspect about crypto economic security which i think is largely overlooked is the fact that transactions flow trommel network provide further action into it and people can make bets against what they see is going to happen then investigated transaction pools to know what's compelling and of course to you know inject such as before certain events now until Diana's giving a talk later today about how about things that can happen like for example it can be profitable to do to reorganize part of the chain and move around with how about state laws in a way that even though it costs two lakhs from the mining perspective the actual value you can cash off on that attack makes peaceable yeah to give you life was another thing so I think that kind of plays into the fact that we're now building all these protocols and there's all these externalities the classic security of it probably doesn't need a look at you being like one of the main people that EF security knows a lot these things on how the protocol works do you find yourself getting more questions from people building things on top of it or do you think you've left more interaction with people vivia and on top of if you're in a general to come and ask about these externalities to kind of learn about all the things that can go wrong outside of just the isolated small contractor yes I definitely think that I mean as I said earlier a lot of the security folks who came into this place to study smart contracts gradually turns arise towards the the rest of the infrastructure and that's really great I think it would be a good thing if more people in England of developers and people who wrote smart contracts knew more about the infrastructure as a whole yes I think to that as a plug to anyone working on smart contracts and stuff there's this great telegram channel with a bunch of us in it a bunch of security guys a bunch of deaf developers called ed security and it's easy to join and you can always get opinions from multiple people there ranging from not just marketing but trade bits is in there we're all in there so to anyone who wants to live see think something looks a little weird you can usually go in there and ask and someone will be happy to help them explain from top to bottom what could go wrong so even before I wanted to control in there it's a question about that is it is it a good idea to have anyone be able to join obviously there are some expensive stuff that are being disclosed there say like a black hat rejoice and they're just x place that's tough there I'm not sure what the best approach is - yeah so that I think it's already above 200 people in it though so interesting thing with it with the entire black hat philosophy trail of bits is usually very sensitive on how much of the audit they released because they're from a very traditional security standpoint where where they believe that the audits shouldn't directly be able to source whereas when I was always saying I had the philosophy of if the client doesn't want me to open source and on it I won't even work on it I think in this space because everyone can look at your stuff already if there's a bug someone will have probably already especially as we start growing I believe that if there's a bug someone will have found it already they may just not exploited it yeah so if it gets out it gets out and we've had these sensitive things on like on protocol level as well where there was the Ralston hard fork where we had to very slowly it was Ralston or iffy and I remember Ruff's yeah we're a parent II had enabled a feature that wasn't to be enabled yet and there was a there's a network split there was us in that problem of how do you start to slowly communicate to all the actors in the network to start updating their note so doesn't happen on laugh because it was something that couldn't and I don't think there's any way around that yeah that person could have easily done it on Ralston domain that yeah which only didn't know with it would be a hacker work yeah don't have to come up but it was it wasn't researchers would try and gospel contract things yeah it was it was totally innocent but it could have been something completely different I think you try to keep it silent but I think the main point is acting as fast as possible and we I remember being all that melts quite hectic reacted as fast as possible from contacting my crypto first to update their notes to slowly get to miners and I get to exchanges I'm making sure that you keep things big enough while you can but just ensure that people are actually doing their stuff that's not like y'all update my note tomorrow [Music] they get all the grease or just stunning and now are a sort of things like so I think it makes a lot of difference in things like protocol or call transfer where or if it's like something to be released and it's yeah but making a series he was a chemical genius and he had a bunch of different products that all essentially were safe by themselves but as they came together since you were doing her last poll DESFire so let me I think about complicity with this model that we're talking about my audits that happened on an atomic level that can pass but then people are putting narrating Legos blocks in such a way that there are vectors that may not have been considered because the use cases weren't anticipated and right now it seems like there's not see anybody that's looking at it you know when people are playing these things together in an open source way and I'm wondering if this is something that concerns you see people building on top of all of their products and assuming that because they're safe or they're a lot of it in their atomic way that perhaps they're safe in a motherless child yeah and that actually comes where they're very much next week just assumptions right which every religion capital plan so I totally agree with what Alan said before they have to be clearly mentioned in a lot of reports and ECC transactions in order for Zeppelin luckily I brought this up this year with the comma on an ethnic made a really good one day which I think really has a lot more community and so you see the trust assumption so I think I can kind of answer discretional to that I think on the honest mark perfectly accessible if you assume that like that it could interact with anything else then of course possibility will not always be there but should be there and if you clearly document the struggle the transaction and if you can see how much is composite culture and on the other side there's also but there's also the normal water coverage where I also find this interesting and I mean we know coming up and there I find is quite interesting because they are you clearly have this composability problem because yeah now we have kids where one half are aware one deity influences the other right like um and like by themselves they're fine but like then you put them all together and they also find anymore so they're I think because these these actors are connected both of these months of live for small projects that generally find it a bit easier to think about company you get them in the traditional InfoSec space as well a lot of the time you find a taxon like servers and find back doors it's not actually and you want software that's a problem it's like a configuration [ __ ] between two things that leads to that problem so I think we only get better investigating use cases and testing against those various use cases to try and find those problems and that's probably one place where tools can definitely how about where you it's just there's a big world out there and we can look at everything right yeah I just want to note that these happens all their votes their presence in our open 7 conference we have legacy single inheritance or you like creative things of small building lots and you have taken a very explosion of possibilities and of course we have all these possibilities as Anderson a presence if you do move inheritance the unionization problem and if you do it wrong you might have broke and so on so this is not only I guess it's a bit more complex lots of attention this is something really big we've seen that happen right like with PRC seventh 7/7 for example just recently we see their like like it's like so many interesting problems right into that everything I'm sorry guys we did that every day right all this rain and again like just to that earlier body wants to relax like esthetical we assume like our trust model assume that that was okay and he was not right we're like really overseeing the thing that was happening below in the stack so even composability even not only about Smart Objects but about like the way the protocol plays with those were contractors it's also liking people there's a lot of problems there waiting that's a hard part about the finance financial outside as well like if you give your product booking on all products are interacting with other projects and other projects ability if you're extremely paranoid about security then you might take to get other things all your dependencies already as well but that's probably not most of the most projects do want to the kind of control costs as well so again if there is kind of this financial limitation as well I think in some sort of way and that's as well the trust sauce was coming I can't conduct okay for this bar code based on the trust assumptions it in projects conference hi I do dates first how valuable are quick informal audits in your estimation then you're in an upgrade world where you're going to be pushing out all the changes and whatnot it's somewhat valuable at least to have someone looking over your code just basically giving it a quick read through or do you think that most of the value comes from being able to do a deep dive and then go this question throw the way to die quick auditing every code review I've gotten from Nick Johnson or like Martin Mull spam that's been more valuable than any audit report I've ever received by anything I've built no offense to any of the guys here because they're all super confident but a lot of the times informal I find informally they also don't care about language and how they talk to me which I found a lot more useful like when you're in the businesses of the wallet in you have to keep your client happy otherwise they won't later on it when I asked someone like Nick for a plot to reduce something you break it in every way possible because he thinks it's fun which you can't do it audibly there's a certain limit on what what you can do and how would you can be to continue having a clan publicized a to us the guys staying issue with just is like a week for them it's it will be fun yeah I think it's right but it's the same thing it's getting same pair of eyes on something that you made assumptions on your first look at it you get positive I think the important thing is to be clear on the expectations yeah quick look if you're a bad thing and we very carefully I think it also differs on the stage that a product is that great like you might get a lot from weak in their yard but at some point you should get like real heart rate I'm so not one whereby like a device while you go at some point yeah yeah just a goodly I think it can really have a dinner message especially with the architecture because you can design smarter mix and how they're changing with many different ways and before you visit all the little details if you kind of designed them in like a more optimal way you can actually save yourself a lot of time that we have some cases like this where you save early why don't you do like this because be a lot easier to order so regarding what would change an EVM just minor things so right now when you do a call don't get returned call fails that is zero so error is zero and success is mom we know from the UNIX world that's just wrong I mean zero that's what works when you have an infinite number of ways in the wrong and now we cannot change that we can't have it without the gas we know we didn't go to gas actually revert it or some new thing interesting ever happens we just can't act and we can never act unfortunately because of that kind of the system go just a little bit value so maybe to you especially because we're I think it have to point I was like the big buzz with things like that without the EDM designed do you find yourself talking more closely to the teams working on an East 2.0 to ensure that we don't fall into these bones like the one thing which I know annoyed me a lot of the times is the way storage works in theory is that it's very mathematically sound and very like every computer theory book will tell you to build it the way the EDM in it but in practice it's never actually don't like that and I know Nick Johnson hates this as well as it's the word size and that's like something I would change do you find yourself working more closely with teams to ensure that like the protocol follows more of these age-old design philosophies and is more sound in that design no actually would you like to yeah some degree but so at this point he still has these different execution environments and I think the vision is that one of them will be he wants the base which is design already by some other people were supposed to this part and I assume it's good and rolling is one means we kept multiplying is one and I don't think there is an intention to have like a new kind of f1 virtual machine in is to where we just yeah refactored first with a video yeah I don't think there's a push class be nice if these things were to permit so going back into protocol II IP 1283 delete Constantinople I think you guys felt that issue a bunch of us were on the call discussing that on why we should be late or not and the Yankees is kind of this like rough thing everyone can kind of submit it and no one seems to review it probably no one seems to audited how do we improve that I made sure that like we don't delay a hard for it's last minute every time because last minute is then when it's most interesting for everyone to look at how you made sure that we get into this earlier and don't need to get so far as to having to be on a call at two o'clock in the morning and whether to do they Constantinople or not so Hudson mentioned this great business but this idea that we should do each sent reports so that there is we changed a bit have a process for Eve's with the previously we have that's all spent in need a couple of people who phillip and so like yeah this is great is going into whatever next mark ferguson and we said yeah we look through these bodies into that work work which is gonna happen on June 1st then we were started Dropbox province was for but stop doing that the idea is to have the whole process yeah these fives the great go at least not so they don't support number nothing and then the work starts they actually build things and they get it in accepted into clients once it's been accepted into clients in the form that it can be enabled by testing or biogenesis switches that makes it possible to actually web test cases work as well so then they go have an increment test they do security coverage look at this from security perspective when they ticked all the boxes yes it's imperative you test cases with a happy path the test cases public work cases we've done security review and yeah another five workplaces in emphasis plus as well yeah Anna done they get back to the McCrory let's say hey we have check both boxes went over on South another person says yeah about two months from now that's a fork number blah blah and that's what it's activated so it's not like we have a big heart for coming it's more like this eve is now ready to just be enabled works done more than that like stabbing and I wanted people like a big shout out to Martin in the back because he was the one asking for security considerations VIPs so that's beep beep big stunt or it's not letting these hippies [ __ ] up the network and it's exactly how this is not done before right it's not like it's not requesting a lot of the first like if everybody's just review these things after as opposed to the one proposing them being aware of like how these things can affect the network the least they can give some focus to do the security guards rate if you are the one proposing it you should at least at least advised kind of respond say oh this is how this could affect them so yeah so so I think it's not like snow okay so with 1283 was interesting because it's like it's a behavior from the gas type and which isn't easily found you actually have to know the protocol quite well to understand what the side effect what the security consideration is there which any IP editor might not even like the ideas and everything but up until you know that nice behavior of how the cast like that works you can provide any useful information so is there an effort or should there be an effort where the protocol is documented better with all these like edge cases that got merged in previously IDs that might affect other things so that when someone wants to make an upgrade to the protocol they can go there and see what they might interact with and if not is that something which we should ensure for each to my know that like really everything is properly documented because Google if you're in gas I can't find any so I went any first payment easier one of the things I like the most and I think a lot of people will actually disagree with me here it was the yellow paper so people hate it typically but coming out of the Bitcoin world where thought was the documentation this was fantastic like this was way better than was there before and I find it a bit said well again I understand it has been like I don't we tend to blame anyone but it has formed with behind but it's so like knowing the constitute open of course a part of the current yellow paper so like you don't have all the kind of quotes in the air so that's of course my idea I mean I guess I could also say it another word in another way saying like a big shout out to like Georgie and so who did a lot of the great work that episode unfortunately we haven't been able to keep this up and I think the air we have to do a bit more again because that was to me and a lot of people like to blame but the lay in the end that's one place where you can go and you can check and that has always been super helpful to me so I think that would be great and yeah so and to quickly to the previous question about the FPS home yeah it's actually it was much before decomposability problem right back so because like you have these low level problems of like gas constant zone you have higher things like solidity dreams things away and so on and transfers and so on so these when these come together then there's these assumptions that are three-dimensional and it's also yeah one of what we saw now with this new hot dog that there were some things being broken where people make assumptions about air force being fixed right there now the cost of s ball is going up which is a good thing but like still is breaking from some things that people were not expected to be broken everything's also it's becoming more and more fear that actually there should be somehow more connection between there should be more discussion about it should still be clearly separated because developers don't want to think about it and they should have through too much but there has to be some homework into actually doing this to work and certain cause ability as the fall as you were getting really close to an end here yeah so given that Loretta concurrent users but really cuts my contract so the first question Donna you feel that coin dirty Pamela biomechanism allowed with so horny certain pure not even call back using that I hear 200 restore first question same person since that we are going to switch on the zero day or may be responsible disclosure of any issues that you haven't seen it so using this black cream with some tell that pure switch either freeze the spa whatever quick removal comes out with some higher privilege like long sick best parties in terms of is help your name disclosure of ongoing already findings at this in the opening we used to suggest is have those in there up until you can prove that your code is mature enough to them feel safe to turn it off I think we're still up so early in this space that we can backdoor sock racism with what we did with compound this working before is chasing not only us but the community suggesting a time where you yeah none of the thing and yeah it just gently yeah like I hear that question a lot there's I they're surprisingly they're selected resources basically I think the answer is that they're selective resources for security in theory immoral still even in the blotching right but but specifically for a through him I maintain this best practices revolt which is like it's basically a community effort by now like we still maintain it but it's mostly crowd sourced people just like T which we submerge changes and keep it updated but it's it's the best one that I know of and that's kind of and we have the ether know again more different those when you hack your way up on stuff like to headphones Levin immunity in it simple science it's super interesting super fun to play so let's say that we learn the protocol or vivia learned hustle ADT Marksville compiler works and that start giving your friends free audits or code reviews and slowly appointment they'll offered to pay that's how at least it works for me there's yeah there's a couple more CTF step there's there's forget the name of the video capture the enterprise-d parts which is really really really good and really fun yeah there's a couple more that like that we've also been win maintaining like the one life from CC to this so there's a couple of those any other questions a question about that process it's like as what's always saying for serious days when you didn't really report days and fixes are coming up and you have to deal with it was a new audit and you are having new clients and new audit so how would you juggle the audience and the previous how did you love it because new audits and new mediation give you both and also always where are we done many states don't take on too many clients that's all so we so you're talking about like fixes to Cobra oh really or like no grounds for all flat so when you reported they come back to Texas and we have putting in this goes back and forth yeah yeah it's part of the service that clients will come with like implementing the fixes we recommend and it's part of the whole different thing and then for like you know coda or clients it's very weak like try to prioritize them before it's it's planning it's from Ikea classical dirty we would totally I mean in your follow-up you verify that the findings are fixed and if they also redid the whole thing it doesn't get any more and then we'll have to find one with this is like on a couple of take the check boxes just these things that we found my question so it's very important that US auditor to cover your ass read exactly we worked at this hash of the code in the repository the follow-up was made on this hash and it specifically only covered checking that the previous findings were fixed you should put these kinds of text into to specifically say what did and what you did not cover in the audit ten if you don't do that test you can get blamed later that they discuss-- didn't see this where as inhabiting say yeah but that was after this Natasha the directory coming in second story classic security company on ssh the probably critical by Isis agent Lee and I reported it fix and then when they say statistics but something else was implemented and they look at it and find that in the end it was a again everything introduced by the fix is not recommended under not blame for years for introducing about working at various sites that yes we were perfectly algorithms reporting some affairs to have this error languish but it might be a good tip to actually look at some flexible security reports you know spent on security reports and templates without that you will see that there's like five or six pages just boilerplate text and saying I was to secure to what it does covers but it is somewhat it is often maybe two pages that are actually multiple findings unless it's just don't blame us are there any other questions otherwise we're gonna wrap this up just pretty much run out of time thanks guys [Applause]