Securing the Future of the New Financial System – Richard Ma

all right so I'm Richard ma a CEO of quant stamp and so we're a security auditing company and recently we've been auditing a lot of D Phi projects so my talk is about securing the future of the new financial system so since about two years ago so you know two years ago there was basically no real new financial ecosystem something like D Phi but today there's more than a billion dollars locked into D Phi and people are basically actively lending and borrowing and using derivatives and Dex's and what's pretty cool about it it's kind of like there's all these different Lego pieces that people are putting together and because everything is open-source and on the blockchain you can just leverage the existing LEGO pieces that other people have built so this uh you know this is the chart so you know since the since last year there's 4x more value locked into D Phi and this ease of use with these money Legos also means that there's some potential security issues so you know in the last between 2011 2019 there's about you know slightly under 300 million dollars of smart contract really losses in the last year one of the security researchers called Sam son he's a independent researcher he actually found five different significant vulnerabilities and he's kind of doing almost as a hobby so there's a good post that he actually wrote last year in September about a way to take under car lights loans for funding for profit and I'll get back to it later because it's very relevant event actually happened today that underscores this so I'll talk about that a bit later the main reason why security is important I think in D Phi is because of composability so you can put these different blocks together and make new products and it's also why the speed of new products being created is actually getting faster and faster and probably like at this hackathon many people are gonna build some pretty cool stuff so one project I want to talk about is our trees so our trees it allows you to donate the interest from your idle capital to plant trees and there's nonprofit that's doing this and it's possible because of two other protocols so one is called our die which we help to audit and what it does is that it separates the principal and the interest from your capital so it donates it allows you to send the interest to some third party and the other money in Lego is called compound so it's a lending and borrowing marketplace and it allows you to make interest off of your idle assets by lending it out to other people who want to borrow it for various purposes so this you know allows this a really cool project to exist and hopefully plant more trees and so the problem is that if there's a vulnerability one of these applications the intact entire stack might suffer because it could affect other applications that are built on top of it so you know if these applications and projects are to become our new monetary system then the security is going to be really crucial for the money that's managed by these apps so it's because you know a lot on the back end of this it's all using smart contracts and it's automating a lot of the overhead from different processes and autonomously running these things so yeah in 2017 alone there's about 250 million dollars that were stolen or frozen and any anonymous person can exploit a vulnerability so sometimes you cannot track down the value after it's stolen and the more value that is sitting in the application the greater the incentive it is to hack the application so now talk about the case that happened today so one problem with defy is that there's no consistent price feed that's based on global consensus there's kind of different local price feeds so the prices of individual projects they can be manipulated so for example if you're relying on a price from a decentralized exchange or maybe several different sources someone can actually for example if they have a lot of funds or if they take out a loan they can sell assets on that exchange for example like a rarely traded altcoin or even perhaps a more liquid asset and temporarily deploy a like a depress the asset price and if another lego block uses that price for example to give out loans and die or do another transaction you thinking that price is stable then there could be a temporary arbitrage opportunity in like traditional financial markets where I used to be a derivative trader this is harder because there would be a lot of other arbitrage that would try to price out the asset so for example if you temporarily try to crash some small coin stock then some high-frequency trading firms they would immediately buy it up and you would actually lose money doing that but with smart contracts you can actually link all these transactions together so if the transaction is basically to sell on decentralized exchange and then immediately take out a loan on a different product and perhaps you know try to lock in the value that can all be done in a single transaction so it's very hard for some outside party to prevent this from happening so this is kind of a fundamental difference with smart contracts it's this type of atomic price manipulation so at that moment in time you know it's kind of like a rubber band that's been pulled apart but then you know afterwards the attacker can just everything had river back to normal so this is still we're currently also actively looking at it so I think more details will come out but it's good that these things are happening on a fairly small scale because that's how the whole ecosystem is going to mature and eventually it will be able to handle more and more assets and potentially be a part of the future monetary system so I think small things like this is good but it's definitely important to secure each of the Lego blocks and also for developers to understand that these things are possible so you know if you're building a project that the hackathon that's I think it's important maybe to try to get prices from different sources or not to try to rely on a single multiple to centralized exchanges to get the prices so this type of development it does require a change of mindset because you have like less guarantees than in web development or if you're building something for like the stock market and I think that there's definitely a need to adopt like safety and security workflow so they can try to mitigate these risks before deploying because effectively in the current market there are some insurance solutions that are coming out like open and Nexus mutual and others but the default insurance for a lot of projects is actually to back it up with their balance sheet so if something bad happens usually I think the project tries to do the right thing and back it up with their own balance sheet to make the users whole but you know if the programs get much bigger and there's more Network value that might not be possible in the future so next I want to talk about some foundational building blocks for these Lego pieces so the first one is maker and you know they've been trying to create this censorship resistant stable point backed by the US dollar and now that original project is called Sai and it has really proven itself because you know in like 2018 there was a lot of interest in Sai but it was untested so during 2018 when the ether price fell by around 90 percent SIA was actually able to maintain his peg to the US dollar and this proved that future financial projects can be built on top of it so it's similar to a central bank but controlled by algorithms that are making sure there's a stable amount assets and also it's controlled by the interest rates so maker doubt it's also helping to advance the ecosystem because since last fall they've launched multi Calero dye and also the DSR it's a savings rate baked into multi color or dye so it's back to the US dollar but now you can also collateralize it with other assets and I think they plan to add even more and this savings rate is pretty cool because it's currently 75 percent which is way more than you can get in the traditional financial ecosystem like your checking account it's usually zero I don't know if you bank at Chase or if you try to get some savings account I think it's also still basically zero it's like zero point three percent and so I think this is gonna attract a lot of more regular people to move in to defy and kind of an appreciated part of a maker is that they also have this grant foundation that helps promising defy projects so we've helped 11 different grantees with audits so far including pulled together sadly a cava and many others and I'm gonna talk about some of those so I think what's cool is that yeah they help lots of users to engage in economically healthy behaviors like saving money which is good because you know a lot of younger people they don't it's not used to saving money in like America and it also allows a lot of people to access crypto directly without using any centralized exchange and now some projects like kava they're helping Bitcoin also to be used as a collateral 45 which I think it's going to actually onboard even more users into using smart contracts because there's much more people that hold Bitcoin than ether and lastly the streaming money which I'm going to talk about so first there's ramp network so it's really cool because it's kind of like stripe it allows people to connect fiat currencies and ramp it into digital currencies and yeah it allows more liquidity to get into defy so reducing the friction for people to onboard because right now if you actually want to use a lot of products you have the KYC and set up different accounts and like buy crypto and like there's a lot of different stages so this is basically connecting your checking account in to directly to defy so I think this is currently working in Europe under this kind of open banking license which was pretty cool and you can integrate it with only six to twelve lines of code so I do encourage people who are thinking about adding more on-ramp to consider using something like that the second one I want to talk about is pull together so their team actually started last year at this hackathon and what they built is incentivizing savings through this no loss lottery so you know instead of buying these lottery tickets and every week now you can just put some savings in and you still get to participate in a lottery but you never lose your principle and on the back end they're also leveraging things like compound finance to basically redistribute the interest randomly to a single person and now this has over a million dollars and I and the weekly prizes are $1500 so if you're currently buying a lottery ticket I recommend using this instead the next one is sadly a so it's pretty cool because like actually you're like if you work out a job right now your employer basically like they're indebted to you most of the time so you know you get paid every two weeks or every month and during that two weeks they kind of owe you maybe like a week of salary right and you don't have access to that money so and before it's kind of like too much overhead for them to continuously pay you every day like that would cost so much money to do but now they can basically stream the money to you so as you're doing the work just trimming the money to you and also there's like less overhead for the banks things like that so I think in the future this can be used for a lot of things like um maybe like inheritances because you know instead of waiting for somebody to die you can get some slow streaming or like allowances or grants and scholarships lots of things like that and the last one is kava so it's allowing you to collateralize different loans using bitcoin or Adam or even B&B and you get this kind of like stable coin from the collateralized loans so it's bringing a lot of different other assets that can be used as collateral and yeah I think like with Bitcoin having a market cap we hired an ether this can actually be leveraged to bring in more users so where does content fit in we're securing the money Legos and we've audited over a hundred projects with over 1.5 billion dollars in value and yeah we we plan to help the mainstream adoption of these applications so if you're building something awesome come check us out and we'll we're just up there but I think it's still early days because basically two years ago none of this stuff existed so now there's way more money Lego step people can use and so I think that's pretty cool this is probably like the most interesting thing that anybody can work on right now so yeah that's that's it and scan the QR code and get 2,000 experience points and happy hacking everyone that's it thanks everyone done scanning no I see more more scanning okay yeah get those experience points [Music] you