How Do We Secure One Trillion Dollars Onchain? | ETHSofia 2025

[Music] How we doing everyone today? I'm a humble rip tide, humble bug hunter, and host of Bounty Hunters podcast. And uh great to be here today in Bulgaria, the great country of Bulgaria. So topic today with these three esteemed experts is how do we bring the next one trillion on chain and that that kind of encompasses everything from grandma to JP Morgan to everyone because right now the narrative over the last what year two years has been we're going to have everyone on chain institutions are coming well they're finally here everyone's here everyone's talking about RWAS, everyone's talking about blockchain, crypto, the president's talking about of America. Uh, it's it's it's here.

So, it's growing and our space is not secure enough. I think we all can agree that we have a lot of work to do with security. I think um the the metrics speak for themselves with I think it's 22% of all hacks in crypto are from smart contract vulnerabilities and the majority of the rest is from private key compromise uh through fishing um or just mishandling of private keys malware installs. So we have so many security problems that we can't really be taken seriously as an industry with with these kind of issues. So I want to discuss a few points and ask these experts here uh kind of their opinions on what we could do to to help secure this on chain.

So uh number one uh I'd like to talk to Andre about uh this question to you is as far as cert goes auditing goes protocols are out there they have a project and they say hey we need an audit we need this secured there's an audit scope and there's an audit scope in my issue a problem with that audit scope is it's not comprehensive enough so what do you think about that and what do you think should be mandatory as part of an audit scope Yeah. Uh absolutely. Uh you're right. So sometimes projects uh want to audit the core logic because they want to let's say uh wisely use their resources when it comes to audits and so forth. But that's not enough and in my opinion there are a lot more things that should be expanded to in order for that audit to be comprehensive and for the project to be uh secured in my opinion.

So what we do at Certora is we advise people to include u things such as deploy scripts which are very important the data aspect different kinds of integrations with u protocols they might have even interfaces. So from that perspective uh those things even though they might seem minor they are really important when it comes to securing the whole protocol and not just the core logic. out.

Yeah.

What do you think about adding like fuzzing to would you consider that to be because I'm thinking like we need some sort of standard where it should be a minimum that's covered.

Got it.

And I don't know what that is.

Uh so absolutely um first and foremost the job of a security researcher is to push the boundaries of a project to make sure that all those edge case critical scenarios are covered. There are no uh critical exploitation scenarios that may happen due to that. Um for that to be the most effective uh work done by the security researcher the protocol needs to cover all of the happy paths within the project have a 100% uh unit testing uh end to end tests fuzzing is a great alternative as you mentioned as well uh so that the security research in that aspect can focus on uh things such as uh those uh like I said edge case scenarios that really push the boundaries.

Okay. So if I have to mandate a standard, it would be definitely besides like uh expanding the audit scope, it would be 100% test coverage. Uh end to end tests and fuzzing is also always a great addition. Yeah, it's I I think it's it's it's such a hard thing to try to capture all of the bugs and then staying within the constraints of time and money from the client and try to deliver a product at the end that it that you could be uh proud of and say, "Hey, this is secure. This is certra.

We did this and we're proud of it. We think you can deploy on chain."

Yeah. especially and that's why I mentioned the testing part because like um if you cannot outsource security like every protocol needs it own security from day one you need to build with security in mind you need to build with uh basically every step of the way so for that security to be effective and for the security research team to do its job you have to make sure that there are no like little obstacles along the way that like basic integration bugs and stuff like that that will just trump that uh audit scope during that fixed review time like you mentioned.

Yeah. Yeah. No, I agree. Uh, next thing I want to discuss is the so we we talk about the back end. We'll talk about more about that, but there's also the front end which is where most users interact with.

They go to the website, interact with the DAB and then and whatever happens out of that. So, Vasan, you're the man. You're the the king of front end. what are we doing wrong with front-end security that that we need to improve?

Yeah. So, one of the biggest issue uh that I think it is has someone who is working on the web two side of the web 3 because I mainly do dev audits is the scope. uh like when we do an audit of an a application uh the team usually says okay only this is in the scope other than that everything that is third party related it out out of scope and attackers and hackers usually target that aspect they they target the integrations they target the things like DNS poisoning as we have seen in the past few years uh DNS cache issue was very common and now we are seeing that uh hacking the pupil uh is kind of become very common. So I think the biggest thing obstacle we face is the integration and in the front end a lot of you can say JavaScript integration and third party libraries are used and hackers are finding it way easier to hack those uh libraries directly instead of uh hacking the front end itself of the application because we can make the front end secure but we cannot guarantee that uh the libraries we are using are safe and that that uh that area is I I would say it's very weak in terms of security and we we must work on that thing.

And I think there's there's two big things here is web three and web two is this whole out of scope thing. Auditors love like bug hunters, hackers love this. They look at it and they say out of scope and that's the first assets we look at. It's like okay out of scope for you not for me. And same with web two.

It's like it's the dumbest thing in the world and I get it. You got to budget. You got time. You got to scope things. I get that.

But we have to find a way to really consider are these really out of scope because if I look at an out of scope asset as a bug hunter or a hacker, I shouldn't be able to it should be pointless, right?

Yeah. I mean, when hackers look at a website, they don't look at what is out of scope, what is in scope. So that is this is one of the main things that we should consider and we should give more importance to it. That what I would say

and what this is another thing should be in scope is the biggest thing that I see with web two frontends. You type in balancer whatever and boom the first SEO result is like one character off and then boom you get fished. And this is for every DeFi protocol. Like they've manipulated the results. And uh I don't know who's doing anything about this, if there's any of the security firms that are doing this, but that should be like number one.

Hey, get that ranking off. Get that scam site reported. I don't know if this is considered right now.

Yeah. Yeah. Especially if now we're talking about how to secure like $1 trillion on chain. This is a very important thing because we know about these things that okay, this is the correct website. This is not the correct website.

But suppose if someone who is 50 years old or 60 years,

your grandma's not going to know.

My grandma doesn't didn't know about this. And if she receives an email from a website or a protocol which she has invested in it, she's definitely going to click on it because she she doesn't know about it.

Yeah, it's true. Uh so and then um Demetra, I'm going to go to you because I you're the king of hack and proof CEO. you see all these behind the scene bug bounties, you're dealing with clients, audits, and so I want to ask you more about like total ecosystem security. Uh when these clients are coming to you with bug bounties, they say, "Hey, look, we think we're secure, but we want to put this out there." Uh like what are you seeing on your end as far as their concerns in the market as far as security goes?

Yes. So you know um it's a good points where arise here that actually when companies come for the security they usually say hey you know we exchange we would like to have trust score at coin gecko and someone is calculating for them budget and say okay uh web application penetration cost testing costing like this uh application for is here and they're like okay we need just to cover trust score we don't need to cover the whole whole stuff for penetration testing same with the bounty so just to understand how a bounty works. So companies place program on a website, researchers come looking for issue and get money. So usually what we see right now that we try to push companies to have everything in scope because they for example can run back bounty like three millions back bounty 5 10 and just doing PR and when it goes time to pay for this issue they like oh you know we don't we're not ready to pay 5 millions uh and etc. Uh but at the same time uh they can lose more.

Yeah. for example exchanges um you can find that for example BitMart big one some um BTC Turk and etc they lost millions and uh few months ago they actually were not ready to pay for example even I don't know three 3k per critical issue but now they ready to pay 50 millions to back at least 150 million they lost yes so um and previously we had only back bounty programs. Now we have recovery funds back bounty programs. Yeah. And um the market actually um is growing in terms of bug bounty.

So what we see also that um when you do penetration testing or when you do audits it's something or some action when you do one time. Yes. But back bounty it's ongoing security because when you do audits you then still uh work with the team on something you develop something. Yes. You not like develop smart contracts and fire the whole team.

So same with bug bounty like um I know you actually found many issue. Yes. Uh on our platform and try to help companies to um to protect themselves. Yes. Uh and it's more like what they ready to pay for and how they implement security.

So for sure we advise them to make everything in scope and uh pay honestly for what they build. Um yeah, this is generally what they see and we also implement some um stuff to help them to have integration with even AI have integration with some uh applications they use daily and etc. because many companies they even pay for onchain monitoring tools like monthly or actually annually subscription but never even set up it because like hey it's very hard to set up. We bought this license from some company and that's all that's what happening right now. And what we see uh for example even with SUI ecosystem yes after set case they try to push the whole ecosystem for bak bounty and for last few months they emboded 10 plus uh programs uh and they're going to do more.

So it seems like uh ecosystem itself L1's they going to be those uh companies who actually will push uh security uh from their sides

and we need to get the this attitude of protocols putting out bug bounties. They need to be honest actors as well because I'm deep in the bug bounty space. Guys are white hats trying to earn a living try to find these bugs. They spend an enormous amount of time looking for these things because of these big bounty payouts. And then what we see a lot of times are dishonest protocols to say, "Well, that's just really for marketing, this million-dollar bounty."

And they'll deny bugs, deny bugs, or close it out or ghost the the hunter or any of these things. I mean, that's something that we could work on to, you know, I don't know if you have any suggestions there, but

you know, sorry for interrupting you. You know that one more issue that I believe everyone right now have is also that companies who actually came for bug bounties and hold their programs they like don't like that uh researchers submit reports AI based reports you know there are still some players in our industry they like generated 100 plus reports and try to submit to each programs and then companies like hey we don't like uh those bug bounty programs because via based reports but to be honest among those 100 plus reports there for sure will be reports where you can lose money.

Yeah, I I totally agree. And my solution to this, you charge per report a dollar, 10 bucks to submit a report, all your AI spam goes down. And my analogy is gas fees on the blockchain. If you have no gas fees, you have crazy spam. Remember when Polygon launched, it was crazy.

people first started seeing like you could just spam the blockchain. Um anyway, so also on the topic of of what we need to do to bring trillions on chain, I think a big issue is the upgradable patterns and I wanted your take on this because everyone loves the proxy. Everyone loves it and when when I first got into the blockchain I was like oh immutability immutability everyone talked about it and there's few protocols that do it and I think curve is a good example of this that does it uh unis swap their model they deployed v1 immutable v2 immutable everything's immutable and just go to the next version what are we doing wrong with with proxies upgradability why do clients like it so much and what do you think about you know maybe moving to just a pure immutable capability model would that help?

Okay, so um first as a precaution before I say this uh every project needs to take their security seriously. So there are a lot of projects that from a psychological perspective think that uh once you have a proxy for example that you can react immediately and like deploy a fix and so forth. But that doesn't work always that way because for example if you have a threat actor there's not they're not going to wait for you to deploy your fix. They're going to steal the funds. So that's not the fix in both proxies and immutability.

Now there are different business cases for both I suppose. Uh but when it comes to immutability and like you mentioned why not everything is immutable I can share a recent example. For examp uh last month I believe there was this protocol panoptic and white hat uh reported a critical and that protocol was immutable. So they had to involve uh some really uh like seal 911 to rescue the funds on chain and then redistribute them to their rightful owners. So for example, here is somewhere where um immutability kind of has a minus when compared to proxies.

But I completely get your point like uh if you know that something is out there that something is immutable, maybe you would invest uh more resources into security. But in my opinion that has to be in both cases. The only difference between the two needs to be like just business-wise if you need it for some kind of a protocol functionality that you might have to upgrade it later. But I mean, you could pause an immutable contract. You could put certain safeguards in place where it doesn't just have to be, you know, just just kind of ride it out there.

But I think um as far as from a trust perspective from users and institutions uh because we see this a lot with you guys and other audit firms would note these things and about um trusted owners, trusted roles and projects would usually kind of dismiss it like oh I have the key and I'm trusted don't worry about me. But in reality we see these fishing attacks. I'll give an example with Tapioca where they went live. They had all the audits, all these lines of code and it wasn't it wasn't the code. It was one of the devs was looking for another job and he gets compromised and that private key held the the keys to the lock.

And so I think that's another thing is like these trusted roles that needs to be another level of the security umbrella that we that we look at is because these devs are are on their own computers doing their personal things and they're also working on these billion-dollar blockchain projects and I don't think there's physical audits being done at all. Are you aware of any? Because I mean you'll do web three audits, you'll do web two audits. Is anyone doing physical security audit? Like is there a full multisig in the room right now?

Probably. Like these are issues we're not even looking at. We're just like, "Oh, you know, this is crypto, but you just can't have this." It's not like grandma's going to say, "Hey, JP Morgan just got compromised because the multic was in the room. They got kidnapped."

So, do you have any suggestions on on like what traditional web 3 firms could do better to kind of you know do like an all-encompassing total security approach?

Yeah. first. So the human factor is becoming more of an issue as we go and we haveident identified like with our partners very sophisticated threat attempts like uh not just fishing emails someone sends you and hopes you click on the link but actually people taking months to prepare to impersonate uh possible client or possible like a candidate for a job opportunity in order to infiltrate your organization and possibly like uh do some malicious stuff from there From a smart contract perspective, first and foremost, there are some impressive examples out there which have like automated mechanisms. If you like initiate a transaction which is suspicious under some parameters like the contradict is going to pause itself and they're going to wait for the whole multisc to pause it if uh afterwards like something was identified as an issue. So that's one problem to solve and of course like uh definitely operational security needs to be upped and uh people need to understand that even though the role is privileged and they can be fully trusted you know there are other ways to compromise uh set actors like from the protocol devs.

Yeah true. Uh next I want to ask is AI right getting better and better every month. How can we use this to improve security to and how are you using it to improve security? Can you give me a a web two front-end kind of take on this?

Yeah. So uh I can share some stories like I personally think that AI we should not rely much on AI because recently we have seen examples with our clients like where we do a scope and while where while we give a timeline for our audit uh our client used to say like uh why are you giving so long timeline just use AI and make sorry

and I think we should not rely much on it but there are many things that we can improve using AI Uh one of them is like especially in cases like uh getting an understanding about how things work and uh maybe you can use AI for things like that can be automated like report writing. uh but or you can do or you can use AI for things like reconnaissance where you have to like find uh suppose you you have like uh you have shortlisted all the list of libraries from uh the front end and you want to use AI for like okay these are list of uh 50 different libraries that are getting used what bugs uh and outdated vulnerabilities these libraries have we can use AI in those cases so I think we can use a lot of AI in auditing but I think the best audits are those which are still manual audits and but we can take help from AI a lot

but you're not using it right now

uh I would say not much we only use AI for like automated stuffs but other than that no

okay any opinions on AI from the cert front is it replacing you any days

uh not right now uh so we invest actually a lot of R&D resources into um developing like the right frameworks on how to utilize AI to be uh an augmented part of the security researchers. So how to best use it to to your aid to discover vulnerabilities to find them more quickly or just to flag some things. But it's definitely not right now replacing us in terms of like finding those edge case uh criticals which are contextuals part of the business logic and so forth. I I do believe actually that I don't know if you develop some projects um and you understand how much cost right now audits by firms um but some audits cost more than million just to understand and um so I believe um AI first of all will help to reduce cost and find a good bugs for sure right now we see that uh some auditors already have a good AI um tools and they really like shows a good score in terms of finding valid reports. Um for sure uh AI also uh gives some kind of helps even for our triage team since actually just to understand monthly we have more than 2,000 uh incoming reports on a platform and of course even if you have 10 people who is working on a triage it's not enough to have everything on time.

So AI for sure helping when you have already data sets of huge um like uh reports and etc to validate something uh as a basic. So for sure we already rely on AI but we have to just double check from our side and I want to say that um there are lots of cases when we have a call in the middle of the night when co of some company is calling say Demetro we lost a money and the issue was for example they hire some guy throughout uh they have actually some kind of interview uh then he shared his GitHub as working as a part of team for half year and he said to me hey Jimro he did so so great his job we had everything from his side and just in a few months they realized that this guy just left like he decided to change the work etc and a few months he just decided to use all credentials to steal money from the exchange so for sure uh I believe EI might also help this monitoring ing some stuff um where some GitHubs already were used or maybe some uh faces or maybe some biometric stuff were used by bad actors. So to help you to not hire those people to the team for sure.

All right, last thing I want to finish with, we got about five minutes is there's this incentive issue with bug bounties, right? We have projects that are secured all these audits and they put a big bug bounty out there and then they say they offer a million bucks but then a guy finds a bug and he can exploit it for 10 million and then they don't know their chance of getting that bug. They don't know if it's 100%. If they submit the bug bounty because they can get it downgraded this and that. So you have a problem where white hats will go gray hat and or black hats whatever and they'll just take the money and then they wait for the offer of 10% of the hacked amount which is greater than the bounty often and so hack first ask questions later has been very common.

How do we how do we fix this? This is not good. This is not what we want. I do agree if you follow some cases for GMX I guess. Yes.

Um they were hacked and then actually they offer it um 10% um I don't remember it was 5 millions or more. Yeah. uh for for hackers to back and it's some kind of behavior that I don't want to see in the market because in this way companies shows that okay you really can be a bad actors and then they will state publicly they say we will not touch you we will not apply any legal stuff against you just back us uh 90% what you stole and uh in this case industry just pushing uh hackers to play like this for sure. I don't know how to change this. Maybe ask companies to be more responsible because even when they set up bug bounty, we as a players in the middle between hackers and companies we sometimes like pink team security team per day twice three times and they reply in one week you know and and then some guy is appear say hey you know I'm on a vacation please could you remind me about uh some issue in one week and we like hey man it's critical it's critical ical issue by reputable uh researchers on the market.

Could you please not just uh reply but immediately fix this issue and there also were cases where u like companies decided to not fix low issue and then through those low issue they were hacked for millions. So when you have some issue from community especially from guys who is well known in the market you for sure have to fix them as soon as possible.

All right so we have a couple minutes I just want to kind of rehash because this will get lost in all these talks and no one will know what we actually talked about. So let's quickly rehash. We want to secure the next trillion dollars on chain. How are we doing that? Expanding the mandatory audit scope, right?

Including things that aren't included now. So deployment scripts, we want to ver verify onchain state after deployment. Uh maybe add fuzzing in there. We want to look at more when applicable immutability. People are going to trust something that's that's immutable rather than a dev can upgrade the proxy that's been fished.

Uh continuous coverage, total coverage umbrella uh for protocols,

formal verification.

Yes, sir. Sure. Uh moving from more like audit cycles to more continuous monitoring where we see like immune fi's got this thing, Magnus, different people are exploring this kind of thing. Um also using AI to kind of either pre-run the human auditors or run posthuman auditors just to kind of double check everything. focusing more on the web two front end fishing vectors like the real life vectors that affect 90% of the users probably legit the front end and I think we don't we don't take that into account enough guys like me and and you will just look at the contracts but most people look at the front end so that's another huge vector we need to secure uh and then the last thing I guess is is make sure we're asking the right questions and and to think like an act a hacker and not say out of scope dope.

Just think realistically if you're a black hat, can you hack this or not? So, I think we're out of time, guys, but thank you very much for for coming on.

Thank you so much.

Thanks for having us, guys. [Music] Heat.