Heist Movies and the Evolving Layers of Web3 Security | Slay Huff - CUBE3

[Music] all right hello eth Denver thanks for coming to my talk today my name is slay and I'm here with the cube 3 team uh Cube 3 kind of in simple terms I'll get into this in a little bit more in a second but we are a smart contract security solution for Builders um and before I get going I did want to say I'm actually local here in Denver so really excited to kind of join you here on stage at eth Denver um and I did want to say this before on behalf of all the Denver locals we got you if you guys are coming in from out of town you probably are running around in a t-shirt yesterday uh but not so fast you got to wait till tomorrow for that and so um excited to be here um and my talk today let's see if I can get this come up okay uh what I wanted to do today is my my the title of my talk is heist movies and the evolving layers of web 3 security and what I want to do is have a little bit of fun and use the movie Oceans 11 to paint a picture uh I guess for some of the common practices and methods that we're using today and perhaps kind of point out a few opportunities we have to uh increase the security of our smart contracts and of our protocols and so before I do that I this is a disclaimer so true story I told my wife a couple weeks ago that I was going to be using Oceans 11 as an example she had actually never seen the movie if you haven't seen it this is kind of your spoiler alert all right um but it is a 20 year old movie so I don't expect that to be the case and to get into that I kind of start with this at the very end of the movie The Thieves get away with all $160 million from the casino Vault and if you haven't seen the movie that is a pretty big Point uh it's also a good backdrop for kind of what's happening right now as it relates to the funds that are leaving our smart contracts being stolen uh in the industry uh if you've kind of been familiar with security at all you probably heard a statement or a statistic uh back in 2022 that says something like $3.8 billion do was stolen from uh our protocols our smart contracts in the year of 2022 this chart kind of gives you a bit of a a graphical View at the trend line of that so some things discouraging some things encouraging uh in general one thing that I would point out is that during bull markets or when things are heating up it does seem that we do start to see a spike uh so it's just something to be conscious of now I wanted to kind of take that and bow that down into something that's a little bit more personal if you will and so I actually stole this from I believe it's Patrick Collins from Cen he recently did a really great talk on web3 security and he kind of took that 3.8 billion dollar and he boiled it down into something a little bit more personal like I said and he said that in 2022 if you are a retail user any user entering Defi and you you know put your money into defi there's a one in 20 chance that by the end of the year your money was gone and so I think we're all here because we believe in the technology we believe in the prom in the future of web 3 uh and blockchains but this arguably is just unacceptable if we want to build for Mass adoption this is an extremely large problem secondly uh this year so kind of moving into 2023 uh the folks that certic came back and they said something to the tune of $1.8 billion stolen from Smart contracts in the year of 2023 um so on the good side that's obviously a lower value but we also want to be kind of cautious as to what success and progress we're making and kind of think of it in terms of this so I kind of took this from defi llama as just uh tvl over time and you can see at the beginning of 2022 values are a bit larger we obviously understand and know what happened in 2023 uh and the starting points and the ending points around volume and values were uh much lower so whether or not making as much progress or not I I can't make that determination but what I can say is that we still have some way to go and so with that kind of want to talk about uh at Cube three how do we think about the different layers or measures teams are using uh to lock down and secure their code and their smart contracts and I think about it in maybe three stages and there's a timeline of events that I think is really really important and so um in this context like I think you I I think we can kind of think about it in terms of pre- during and post factum right so on the Builder timeline uh if you're following along the top you know we have code security the guy at Sor just came out and did a great presentation around audits you I'll get to that here in a second then in the middle you know there's this lifetime detection and understanding of if something malicious is happening can we identify that in real time and then lastly in the event that something bad does happen what tools do we have available to us to uh remediate the effects of that so what these tools T tend to look like these are kind of the more common ones so you got Audits and Bug bounties on the flip side of this you know you've got the ability to uh trigger alerts maybe pause the contract entirely if something is happening that's malicious track the money flow uh eventually in worst case scenario find the thieves and negotiate the stolen funds back and then in the middle I think in the year 2023 it seems that more and more teams are opting for some sort of real-time lifetime monitoring uh to use this as a potential means of uh limiting or containing you know potential uh negative impacts of a thief or a crime now with that is kind of at the top the Builder's time timeline what we think is really important at Q3 to understand is what's happening from the attacker point of view and there's a little bit more Nuance to this and a bit of kind of timeline of events that we see is really important and determine what you can do uh to potentially prevent any malicious transaction happening to your smart contract right so at the bottom you'll see kind of you can even if you don't know too much about security this probably makes sense as an attacker you're probably surveilling what you want to attack creating your strategy uh you're then going to build and deploy a smart contract uh interact with that smart contract fund that that contract and then eventually make the tax transaction and then you know obviously try to get away with the funds which I'm sure that's fun now this to us is kind of that line of demarcation right everything to the right the tools that are on the right side of this you know effectively are not too late let's just say but at that point funds are getting away and everything prior to this line you know you potentially have the opportunity to do something about it so all right that's a little bit of a buildup what I wanted to do and have a little bit of fun with is walk through a couple scenes from Oceans 11 that maybe create a mental picture or maybe trigger some ideas around what opportunities we have uh and maybe kind of how we think about our uh smart contract security a little bit more uh intelligently so I've got five they mirror the uh solutions that I just uh mentioned and then I'll present a little bit of a new idea for what we we can actually uh include or add to that set of solutions um first of which okay so if you're familiar with the movie you're familiar with heist movies at really at the beginning of almost every heist movies there's this scene where they get the team together right and they go over the blueprint they talk about you know the impenetrable Vault right like in the movie uh for Oceans 11 uh they say something like you know a groundhog couldn't Nest you know in a 100 mile radius without you know the bagio knowing and this more or less I think kind of mirrors a little bit of the posture around Audits and this maybe defensive uh model for how do we kind of build the castle walls if you will to protect our smart contracts right let's make it as hard as possible for them to get in um and still funds from the Vault but I would say just about every Heist movie this story is about how the team uh pulls off the impossible and actually makes it invol and makes it out with the money and you all know that that's kind of what happens in this this movie as well uh secondly I had to get Bernie Mack into this presentation somehow right so when we're thinking about bug bounties or uh yeah bug bounties uh I think the idea that kind of comes to mind here is like in the movie he is one of the dealers hired at the balagio and he is a plantant at the bagio and he's dealing cards and he's also funing information out to the Oceans 11 crew um he says something really funny in the movie uh hope is appropriate he he says it should be called white Jack uh instead of Black Jack I just kind of use this as it's an interesting kind of way to say you know when you're doing bug bounties how do you know if you have white hack uh hackers or black hat hackers um you know I guess that's kind of the question and then we get into call it the during phase right so the actual attack um kind of that middle section around monitoring um if you're familiar with a movie they actually have the whole security team looking at the monitors in real time and watching the events as they unfold now obviously they pull some tricks and kind of flipped over the monitoring feed but the idea here is that and and I'll just kind of get to something else as well you know at Cube 3 we believe in monitoring we believe is a great solution and helpful but the truth is that it's very human Reliant and it requires you to be always on always watching and then to do something about it to actually make a response when you see something uh happen uh for example recently I was on LinkedIn I saw a job posting that was literally was the the job posting was 247 fraud analyst um I don't work 247 and those resources are really expensive and that's just a really hard job to kind of believe we can leave to uh just just human um inputs if you will so obviously they get into the Vault while while they're watching um and then there's the the alert stage when we think about alerts um interestingly in the movie it's actually the Brad Pit character that calls the casino owner and alerts him to the crime now it's all kind of a disguise but really the punchline that I have here is that if you're at the alerting phase uh like as you look at the the picture here the funds are getting away right so then you're just kind of left to how can we contain a remediate the impacts of that and then lastly and I think this is my favorite part um so how did Julia Roberts get into this presentation so uh the great thing about we3 and blockchains is that there's immense transparency we can see everything that's happening on chain and um you know if we get come back to the progress that we're making the tools that we have around off-ramps and disabling criminals from getting away uh with the funds is increasing and improving and that's something to be really proud of um but one question I think that we have to kind of prompt now is that um take the Ronin hack of you know I want to say about $600 million right uh what happened there is that they negotiated the funds um and the hackers get away with probably to them what is a satisfactory amount of funds to get away with right um the question here and in the movie this would be kind of a deep deep cut if you can remember this but effectively the George Clooney character he doesn't really care about the money he wants to create this scene where Julia Roberts is watching the feed of him saying to the bagio owner you know if I could trade you the funds back would you let go of tests right uh long way is saying that when we are talking about remediation and negotiation potentially the criminals are wanting this as that step or that action you know they're engineering to how do we get to the negotiation part of that so with that that kind of gives us a context I think for what's happening today um and what we would say is that all these tools are extremely useful and we would be proponents of each of them um and here's some kind of thoughts I won't read through all of these but kind of like talked about them already and so now the question is maybe all right what can be done what can we improve and this is kind of where I want to talk about Cube 3 and some of the things that we're innovating on and so when you think about what can be done in relation to what's currently being done to today I think about the posture around current web3 Security Solutions is a bit more call it defensive and reactive right we talked about building the castle walls if you will um and fortifying you know our our positions uh and then reactive in nature like once uh a crime is committed we can detect it and then respond I think there's a huge opportunity for us to now think about it in terms of offensive positioning you know how can we proactively take measures to increase the security of our protocols and our industry as a whole and so Okay I lied there's one more photo here so in order to take an offensive approach in web3 security uh the win is critically important when you're able to inject in that timeline of events from earlier in the presentation uh effectively tells you what you can do and what you can't do in the movie this to me is probably the scene that makes the most sense uh for indicating when that is this is when you know the guy with the uh no shirt uh he is the funer of the project that's his role as part of the team um and what's happening here that's kind of in relation to web 3 security is that if I kind of move this forward I really want to point out this deployment and the attack transaction and the space that happens in between it right we talked about the smart contract being deployed and then the attack transaction being made what we're H what what's what happening there and what we're doing here at Cube 3 is we are using that point when a contract is deployed we are using machine learning to effectively determine does that smart contract have malicious intent or not and based on that determination we can obviously improve the machine learning um with feedback from you know what actually happened at that smart contract what was the value you know when did it happen but with that one piece of data what we believe at Cube three is that we can make um a block right so if you have cube3 deployed with your smart contract we are detering through our threat intelligence engine uh whether or not that smart contract is malicious or not in intent and based on that we are in time to actually make a targeted block of that smart contract interacting with with yours um this was just in case the previous photo was low resolution but kind of moving bead um this maybe kind of brings up a different movie this one you know actually may or may not have seen but we think about this in terms of Minority Report uh Minority Report if you're not familiar there's a bit of like a a moral dilemma with this but it's really this movie based on um understanding or knowing that crimes going to happen in advance of it happening and then proactively offensively doing something about it that's what we're doing here at Cube 3 now this is a bit of you know kind of technically how this would work but you would embed our function on your smart contract that function would ping our uh threat intelligence engine and then we will based on how we deem the malicious nature of that smart contract uh interacting with your protocol will either sign that transaction or not sign that that transaction if we sign that transaction it goes through if we don't sign that transaction then it reverts that transaction um now so this is also uh stolen from Patrick Collins as well I haven't met them but I will thank him for this if I do uh but this is another kind of like example around you know some of the hacks that we've seen uh you're probably familiar with these Got uler multi-chain Ur poly Network you know what I think I'm trying to map on this screen is that you have the compromise and then you have this timeline of events and obviously your response time is really critical and what you can do in the event that something bad happens but ideally you can take matters into your own hands in a more offensive way and intercept or inject into the security um concerns or the malicious actions happening prior to the compromise so that that is really my presentation you know I think kind of what I would say is that um you know thinking into the future uh maybe being aspirational I I think web 3 is very interesting from a security side of things and potentially kind of gives us this hope or Vision that maybe in the future we can build to this environment where we actually put together the security measures that really do lock down our smart contracts protect our users uh and bring us closer to kind of the promise of web3 and blockchain technology and Innovation that we're all here probably at eth Denver to go and explore and bring that reality uh to life more rapidly and with that again thank you um we have a booth here at eth Denver if you do want to come by we're at five I think it's Booth 502 I'd love to meet you um obviously like I mentioned I'm from Denver I want to meet anybody that's coming into town but then if you are here local you know especially do want to connect with the community here as well and so with that I'm slay and thank you for your time