How to Not Get Rugged with Nestor Bonilla

about how to not get wrecked 12 security best practices. So first of all I want to say that all in this presentation is only my opinions and not uh the opinions on on sell. So first of all those are my handles netor everywhere twitter lens es whatever. So first guys, who has been rocked? Okay.

And could anyone of you tell me what is a rockpool? Like one definition? Anyone? Maybe one definition about what is a rockpool. But you say you were rocked, right?

Yeah. Do you want to say it? No. Okay. So, the thing is that everyone think and agree on the idea of being rocked, but it's hard to define it because it will vary by definition by by perception of every person.

So that's the thing. What is the meaning of rockpool scam? Okay. What else? Just scam.

And why not why don't we use just scam and we use rockpool miner. So that's the thing just asked you guys about. Hey, let's let's think about that word. And I have one exercise that I I just created one poll in Twitter. It's just click it and it's a Twitter poll that is going to ask you about the presentation that I'm going to do here about trying to do a definition about what is a rockpool.

It's it's just that and I want your opinion on that. So for that let me go here. So based on the research that I did about what is a rockpool, people think in two ways. First is a loss due to project execution or due to an externality. First, what do I mean by externality?

I mean like you have one asset, right? ERC20, ERC 721 is up to you and then it drops. Why? because probably an externality and for that as a security best practice if you want to avoid get affected by that you will need to keep up to date with macro events like I don't know like news about a recession and armed conflict probably that is going to affect the project you are into based on that externality also another best security best practice is is to keep a reduced number of illquid assets. Why?

Because in an externality, what could happen if you have a lot of NFTs, those are going to be illquid and it's going to be hard to trade them. So, one security best practice is don't just own everything in in in in NFDs, for example. Then other people think that a rockpool is a loss due to a project execution and also people are very vague on that like okay what does that mean? What is a bad project execution or or or something wrong with that? So two things that I have found are is that a rockpool is a loss due to project execution because of the progress of commitment or an arbitrary manipulation of code or tokconomics.

If we go to the first one progress of commitment I have five security best practices. First is analyze of course the project you are into and have reasonable expectations. I mean if a project offer you an a thousand% APY really is that true probably no then another thing is look for a project with a clear road map it's not like okay we are going to build the next Tesla okay how it's going to look good but it's not a it's it's not too clear so look for clear road map on a project. The third one is about understand the culture foundation of the project. And what do I mean by that?

If you join a program a project that it's only about the hype, probably that's I don't know that it's going to be up to you, but it's that's the kind of buy you're going to find. Then fourth is the doc set the better because in a nutshell if you are trusting a project that is not ducks that they are anonymous. I mean I could create 10 tweeted accounts and create one NFD collection and say I have the best 10 developers of smart contract in this NFD collection. And those are 10 wallets. 10 wallets created with 10 Twitter accounts and it's just one person.

So if it's not ducks at the end it's like how can you claim a lack of delivery to whom? To how many? You don't know at the end of a a fifth one. The more battle tested the community is the better. The downside of this is that of course a community that has been in the downs and the ups probably have a a higher perception of of value at that point because they have been tested battle tested.

And then the next one is about the definition for of some people thinking that a rockpool is a loss due to a project execution because of the arbitrary manipulation of code or tokconomics. And for that we uh advise a security best p I advise a security best practice to first understand the tech. And what do I mean by that is understand what is what is the difference between a hot and a cold wallet and use both wisely. I mean you could have one cold wallet to have your more more precious assets and then just transfer the necessary in order to use a a hot wallet just to do those very I don't know transactions that you are not sure about it. So in that way you can use both also you need to understand that for example proxy smart contract are not enough.

I mean it could be verified. You could have one project that it mention okay we have a verified smart contract. So you can read our code. Yeah. But if the manager of that smart contract have deploy a proxy smart contract pretty much based on the conition of that smart contract they can update that that code.

So basically you're trusting them right and if uh if it is a project that is starting you're trusting them. So proxy smart contract is a thing to have in mind and then of course a suggestion is to read smart contract to know how to read it because basically with that you will know what you're signing of course that is more advanced and then will the the last suggestion will be interact with verify smart contracts only because if not you're blindly trusting the team behind the project And those are pretty much the 12 security best practice. And I hope with that you know how to keep safe. Sorry. Thank you.

You were saying Yeah, I think the terminology here is wrong because I don't think it should be called project. So if people invest in something that is not there yet. So it's an investment project. So it needs to be defined to people that this is an investment for future not that they get anything now. So I think a lot of people very confused with what they actually buying what like what they get what val what's going to what they get right after they bought per NFT or a token and um basically yeah so I think it's just the definition of projects on how they define is is confusing to people that just don't know really much about the space.

Yeah, I agree. And the thing is that all these three paths, the three different parts vise on what people think about it. Some people think that a rockpool is something and other people think it's another. If you are affected in a different way is another. So what I try to do here is just kind of frame it in one mental model.

Exactly. Yep. Sorry. Yeah. I think just people don't really understand what they actually buying.

So if they buy NFT and they hope something going to happen but they don't understand that they buy NFT and it these people maybe disappear or maybe it's like an investment and they will see results maybe in two years and that most of the cases or it's a social NFD or it's a sport NFT. So now it's getting better but a lot of projects just don't really explain to people what they actually going to get and what's the value of getting into it. Yeah, just to wrap that. Yeah, that's what I was trying to do. And then of course frame it in the context of best security practice we can do.

Well, that will be all. Thank you guys.