How to Tell if a Web3 Project is Secure? | European Blockchain Convention

foreign yeah so it's great to to be able to speak here after this amazing panel I think it's a perfect segue the previous panel touched upon many different aspects and now we're going to be focusing mainly on D5 projects smart contracts right so how do you tell if a certain D5 project or a smart contract project is secure right um a bit about myself I've been working in security for over 10 years now I've started like a traditional institutions working on actually web 2 pen testing because there was this discussion about like web freeze actually web 2.5 especially when it comes to security so we definitely realized that I also did my PhD in security and worked at traditional institutions like Philips and BMW but like over the more than four years from then I've been focusing on security audits at one stamp and also insurance so the the main motivation for this talk is that over the past eight plus years there's been over five billion dollars of hacks just from Smart contracts so we're not even counting any uh exchange hacks or even like I'm even excluding the Terra crash here just focusing on Hacks that were due to security incidents in smart contracts right and one important thing to note is that more of more than 70 percent of these were unaudited right so there's still the 30 percent right which were audited right so so then people might be asking like oh isn't an audit supposed to mean that a project is secure and the answer is no and I'm going to tell you more about that in this presentation so the promise is that you'll be able to tell if a project is secure answering some simple questions and this slide lists some basic questions of course there could be a few more that you can add in addition to these but these are basically things that you should always look at or you should try to answer before depositing into any smart contract or D5 project so the first question is it audited right first off is it audited and by whom right and you can just do a Google search who are the best Auditors in web3 right and you're going to get multiple different lists you can do an intersection I don't want to sort of show a ranking here or whatever there are multiple Auditors out there I'm of course representing quantstamp we've been around for over five years now we've done over 600 audits and we have over 250 customers but like what stands out at constant is our amazing technical team you know like many of the people there have phds and have been around in this industry for long before constant was actually founded the next question is are the audits public right so if someone has an audit and it's not public you might be asking well why not right it it might be very well the case that there are many problems in the audit report therefore they don't want to disclose it so if someone says we have an audit but they're not showing you the report or the full report that could already be a red flag then you can say like okay maybe I should be careful here right you can freely Google for any kind of audit reports generally there are no constraints on publishing such reports and the top projects have them right I just entered a query here for Lido which is like just checked what's the top D5 project in terms of total value locked on D phylama and Lido was the first one so that's why I'll search for Lido so no no advertisement there of course also different projects might have multiple audits the more audits someone has the better right and if you go for instance on Lido's GitHub page you'll see they have tons of audits right in a typical audit report right you have a gold mine of information right you have multiple things on the first page of the audit which can already tell you if you should invest or not right oh sorry yeah so it it already tells you if you if you should put your money in there or not right so first one is already issues in the audit report fixed right that's the first thing you look at right and here you can see okay some of the issues are not fixed right so what do you look at next is that just a showstopper it's not right you look at how severe are those issues which are not fixed right like are they really like critical and they've been ignored or acknowledged or are they just like informational or low severity risk right and if you think like yeah in this case you know like there's a medium issue that wasn't solved you can jump into it and see if that could lead to a loss of funds right if you're comfortable with that right you have a description in the report if you're comfortable maybe it's not something that could directly lead to a loss of funds but maybe just some kind of reputation damage or a risk for the protocol itself not for the user then you know you're free to to deposit right but just looking at these kind of things I just wanted to go back one slide here or two this information regarding quality of documentation and test is also very important because like there's a strong strong correlation I'm not saying there's any causation but there's a strong correlation between the quality of documentation and tests of a project and the probability that they will get hacked right or like the quality of their actual code these are very strongly correlated you can look at that to indicate whether this this might be a red flag right and it's also important to note that sometimes someone gets an audit and before they actually Deploy on chain they actually add way more code which is not audited and there's these classical examples from uh you know I like to give uranium Finance as an example which was this project that came out in the in D5 summer they Fork uni swap V2 and they changed like one or two lines of code right from uni swap V2 and they got hacked for 50 million dollars right just with two lines of code changes in in uni swap V2 so that's you know like when when someone says we just changed a few lines of code in the product protocol that is secure it doesn't necessarily mean that you don't need any audit anymore right you need to inspect what the impact of those changes are on the actual project so jumping over those questions we we just saw another question is like the final question that I like to put here because uh I'm I'm a fan of insurance is is there any insurance provider that is offering coverage for this project right and this is also a very good flag because if there's not it means that you know there's there's probably insurance providers out there that have looked at this product and they decided not to insure it right and this basically means there probably is something wrong with it right maybe it's not guaranteed but it's a a red flag right so for instance like for the same example for Lido you know like I'm I'm happy to see that you know chain proof which is um a subsidiary of Quant stamp is the first um query that we get like I wanted to just introduce Quan stamp if if people here don't know it we are the first regulated smart contract insurance company in the world we are licensed by The Bermuda monetary Authority reinsured by Munich re the largest reinsurer in the world and backed as a main investor by sample which is Japan's second largest insurance and we're of course back with technical know-how by Quant stamp which is like technology provider knowledge provider and we're offering insurance for the for some of the biggest protocols in web free and we're also offering slashing insurance so that's it thanks a lot for my for your attention [Applause]