Security - Today and Tomorrow with Ronghui Gu

Friday 4 P.M I know um we've had a long day but uh thank you for coming today we're gonna talk about security um we're going to talk about the what's present and what's in the future um I'm Jason Jung I'm representing 30k I'm a company's Chief business officer so who are we as a 30k we are a company founded back in 2017 uh by two professors one is currently teaching at University of Yale as the computer computer science student department chair the other one is Professor Gull who's our CEO he's teaching currently teaching a professor I mean in the University of Columbia we are considered the largest security solution provider in this industry um some of the five years of our uh hard work we have conducted over 3 700 projects and securing the over 360 billion dollars of the assets uh collectively we uh fund identified more than 60 000 vulnerabilities as far as the Pharma market share point of view in one aspect we own about 60 percent of the market currently we're valued at two billion dollars and we're funded by South Banks uh Goldman Sachs uh Hilltop and Sequoia tiger and so on and so forth um so what do we do um for the to build our solutions for the Cyber defense um so of course auditings are bread and butter uh to what's the auditing we have created many tools to help us to speed up the our process that includes the semantic Checkers the fuzzers and also model Checkers as well um to enhance our service in the auditings we also developed the kyc solutions Skynet is our own chain and off-chain monitoring product uh Sky traces our wallet assessment uh product and also we provide the incident analysis to our clients and for the industry as well we firmly believe where our web3 native company in order to do that we wanted to make our work transparent because of that we create a leaderboard which lists over the 3600 projects we have audited all the reports are present presented in that website and it's used by over 500 000 of our users monthly together I mean to service our business better we create also a Sky Harbor platform that is used for the 2B interface um so let's take a look at what's uh what's in related to security uh as of as of now um Everybody uh probably see this chart before this is a PWC assessment on the blockchain um it's estimate that the blockchain business will boost the global GDP by 25 times over the 10 years and in the uh by 2030 um the value locked in this in the blockchain will exceed 1.7 trillion um and so this is a prediction and let's look at the reality what's her what's potentially harmful for this industry it's about the uh the ongoing exploits if we look at the 2020 which was uh the start of the bull market in that year the whole industry lost about 560 million dollars due to exploits in 2021 this number becomes 1 1.3 billing anybody want to take a guess what's in 2022 how much total value lost it's actually very proportional so it's uh it gets to 3.7 billion dollars so it's obviously definitely hurting the business quite a bit not just from the financial point of view but also from the reputation point of view and so how do we stop that let's take a deeper look at what is in the 3.

6 billions of uh exploits so this represents about 189 percent of an increase over 2021. first of all second is that the um um The Flash loan attack uh total piled up about 100 more than 100 incidents this caused a somewhere around a 355 Billet okay and then the access skin uh kind of increases when the Bull Run kind of ends and this accounts for 317 incidents there but the biggest one biggest damage are caused by the crossbridge exploits we're talking about the Wormhole you know some other uh big uh incidents there the night incidents cost about 1.3 billion so that's the reality here so to take a closer look at what are those uh categories for instance the cross Chain Bridge uh it's about the private key exploits it's about a vulnerability verification designs and it's also about a malicious transaction and signatures uh government attack we're talking about you know control voting power private key exploits and so on and so forth and the smart contracts is very common and very carries a large volume and thus we see more very more varieties related to this uh this kind of exploits the ankles like a lack of validation re-engencies and uh you know fall over logic errors so how do we um but surprisingly I think is that uh out of the ten thousand top projects that's in this space right now only only less than 30 percent of the projects gets audited and the other 17 they just go by their own so they kind of pre created this problem for themselves that's the importance and that's why the auditing is becoming more and more uh popular in this space it's not only for the purpose of you know removing the exploits from the the space but also it kind of uses as a confidence booster so this presents a a problem for us obviously you know um the the auditing service was has been a very harsh thought after commodity to this point and a lot of projects are complaining about you know uh they're having tough time to find out the crap the the right Auditors or they're paying too much for the Auditors or you know the the time lag the the time needed to wait for the audience it takes so long and it is very true so obviously for us we if we wanted if we wanted to make the auditing a standard for this industry we wanted to somewhat to help all the projects to address this problem and also the projects are facing you know uh ever uh increased spending uh uh problems they wanted to um they wanted to reduce the the cost of the auditing and and they're trying to figure out how to do this so um so I'm bringing a good topic here to talk about it which is how the AI or the chat gbta chat uh you know can help us in this space uh we're talking about the AI based auditing wait this story uh came as one of our uh one of our clients the casino they came to us for an audit request and uh they actually did a study did use chat gbt before we started the audit and to use to conduct a pre-audit and they told us you know this is the case and we saw oh this is a perfect opportunity for us to have a study of how the chat gbt or how the AI based auditing can help us right because we are in this auditing business so how effective is it I'm gonna review some of the facts and uh and some of the studies we we did um obviously this is an eye charge it's hard to read but uh basically to summarize it um so our customers the casino they did this pre-audit surprisingly it came with some some results for instance it gives the re-entrancy attack findings it also finds the transfer failures finds the vrf feed calculations okay so we re-verify after we took this result and after we were reviewing during the review of our auditing work we take a look at whether those chair GPT findings are true or not so if you look at the 30k comments it's pretty interesting that out of the four findings from the GPT three are not valid and one of it is two okay considering the chair GPT is almost free or is in the beta version this is actually pretty encouraging result to us um so we went further we did our own code assessment and uh so now we have our own report and now we're comparing our result versus theirs obviously the conclusions that uh gbd identifies some uh security concerns however at the same time it failed to identify some serious security issues that includes the uh Project Specific logical vulnerabilities uh it's also you know the mass calculations or static models uh it was we found that it was not able to identify so this is the um you know our result compared to the GPT um as a summary so basically we um we we went through all the findings and uh so our conclusion is that uh it have for the common vulnerabilities such like re-entrency transfer failures chat GPT can identify some but with a pretty high false positive rate um our auditor um it's very I mean our auditor or human engineering result is more predictable and it's more accurate from the co-optimization point of view uh this can you know chat gbd can provide basic optimizations but it's very basic um [Laughter] the uh for the design related vulnerability to chat gbt just has no no clue about anything uh and for the complicated mathematical issues of course it doesn't address anything neither and why is it so the key takeaway for us is that one is a very good language model developed by openg open AI it's obviously obviously very revolutionized um it's but it's designed to engage in natural language conversations with people um second is that it's not trained for however it's not trained for the security related work meaning that they are going through all kinds of reports through our through the web uh you know through all the webs they can collect any reports and reading into it however what it does is that because it's a language interpreter so it does not take into account of all the um it's not trained by the security related work so the limitation of the training kind of uh limits it from handling the complexity and the the lensy code okay that's the first takeaway second is that it's lacking the hands-on experience in the real world scenario basically there are um it's hard for them to really interpret different reports and it's hard for them to understand in some cases it's even hard to understand the question um the uh the project asks okay so is uh so it's gcat gbt a suitable uh tool for us uh the answer is definitely no but the AI technology itself we have a lot of Hope into it um we see it definitely can realize that we see a lot of potential in this code assessment using the AIS so how can we do this uh better or keep looking at I mean after this chair GPD study uh we're gonna keep looking at all the AI Technologies and working with different partners to try to incorporate their technology into us and how we can do this is by we have done over 3 600 uh you know uh audio works and we have identified that over 60 000 vulnerabilities we're looking to incorporate those vulnerabilities or the findings into our AI modeling uh to train the AIS uh that's the one thing uh second is that um you know the AI based technology was really great at doing the pre-assessment meaning that when the projects completing their coding designs it is perfectly fine for them to run through the AI technology and give them the hint right and you can look at all the feedbacks from the AEI tools and trying to make some sense out of it but this is only good for self-assessment um and it still has a very very long way to being uh accountable for the result of the the AFI modeling um the last but it's not the least is that the AIG AI tools is great at uh generating the test cases um this is a very efficient way of uh creating those test cases before they go through before they send us the uh the code for final verification um so um so I hope this this patient's Nation can share some lies on you know what 30k does we'll keep trying to you know for us we're keep trying to improve ourselves and security is definitely a a very serious topic and we wanted to utilize all the tools available in the industry to help us to help this industry as well so um thank you that's all my presentation [Applause]