Smart contract collateral Risks and learnings - Sock (Code4rena), Zak Cole, Juan David Mendieta

[Music] thank you [Music] Christmas foreign [Music] foreign foreign [Music] so welcome everyone this is uh smart contract collateral risks and opportunities what is it learnings oh risks and learnings so uh yeah I'm gonna just jump straight in no we just have to start with introductions maybe not everybody knows who everybody is oh I was gonna jump in and after introductions Oh no you're gonna girls Zach okay sorry before we do introductions I was going to ask Zach Zach why in the Kanto lending Market can I not use Kanto as collateral uh because it presents risk to the underlying system and Kanto is also the gas token we don't want to create disincentivized economies around the gas token when it's a nascent system in a developing Market damn it thanks for asking thanks for answering so straight yeah all right let's do intros hi my name is Amin solimani the CEO of Spang chain Summoner of markdow I helped make the Rye stable coin on other things too oh and indigo uh founder of autoware we're building an all-in-one smart contract auditing tool it's your boys at Cole uh I am the CTO co-founder of slingshot Finance also code arena for all your auditing needs and I am a core contributor at Kanto and I believe I am building the future of Finance alongside all of you fine folks so thank you for joining me thank you Zach I'm a picnic uh co-founder of code Arena and uh Chief of Staff of the uh org that runs the contests uh and I'm sock I'm also good Arena and uh just excited to be here with you all let's get our first question uh what is your favorite collateral that you've ever deposited my favorite collateral yeah based money I thought I thought that's what you're gonna say he's the base money God so you would have to say that I I like uh I know this might be an unpopular opinion here but uh I'm a big fan of eth Maxie let's go yeah I'd say um like steak teeth on top of that nice uh okay well let's ask some personal questions can we start with some personal questions so let's say that the the collateral that you have locked right now let's say that you don't want to lose it just assume that uh what is your comfort level with where that collateral is at and how did you get to that decision oh that's a good question I guess it depends on the contract and whether it's been audited but historically I have not been too risk averse and I have been known to just ape assets into unverified contracts via ether scanned directly bypassing the UI and I've only been robbed twice so far um so uh I have a pretty lenient approach to it this is not Financial advice don't do what I do I am not smart yeah I think it's difficult to say because hey you can understand the Financial Risk pretty well and I think those are uh pretty transparent in most cases but there's a lot of like residual risk right like the unfortunate thing is the the owner of the reskins of being the user right um but they're not the they're not the kind of The Architects of the the security of the system uh and really they have no visibility into it so like like Zach said you don't even if a contract has been audited it's been verified there's still risk there um but especially if one hasn't you know you really don't know what you're getting into uh yeah um I mean for for the rise stable coin we picked like hello okay yeah we picked only ether as the collateral type because we were cautious of all of the other risks associated with other collaterals uh when you use like stable coins as collateral well if your stable coin has a blacklist then suddenly maybe everybody who is using that smart contract can get rugged by just the stable coin collateral being blacklisted from the system that hasn't been used very broadly uh the only stablecoin Blacklist was like tornado cash itself the usdc pool but it sent shivers through the whole ecosystem with maker Dao then realizing that they had to take this threat seriously well what's your favorite collateral we're the ones asking the questions here Zach my bad uh so so tell us a little bit about auditware and what uh you know what your approach is yeah sure definitely so um I think we we see that there's like a high barrier to entry like to get audits to do audits this um you know kind of a lot of gatekeeping right it's anyone who's got an audit kind of knows this the experience is pretty terrible right they're very expensive there's like a huge wait time to get them um you know there's programs out there like you know what Zach's doing with code for arena that make it a lot easier uh but our focus at autoware is to look at the whole auditing process and see like what are the inefficiencies and uh where can we like use automation uh use Ai and like just really good uh tooling for Auditors to improve the process uh so something we're focusing on is putting together a tool is called audit wizard we basically compile a lot of different tools um and uh have a really good experience for Auditors to perform audits uh in the future uh you know their tool you'll be able to as a developer go in and you know self-aud it and have a really good sense of the uh the security of your system what you would get through an audit uh you know and it'll allow you to at least have some sense of security while you're while you're waiting to get an audit and also kind of remove the overhead of when an auditor does come to audit your platform they don't have to worry about all these uh small problems because of you know kind of found them through our platform first nice so I mean uh tell us uh tell us your most interesting Horror Story on uh the security side um I've been we got hacked one suspension uh a couple years ago our payment Channel contract uh got exploited for about forty thousand dollars that wasn't that bad uh All Things Considered uh I uh went and talked to I eventually had to track down the guy who stole it uh was able to call them up and talk to them on the phone and convinced them to give us back the money uh in in exchange for some reward which ultimately cost less than the security audit would anyway uh so that was pretty funny um probably we had we had some scares like there was some bug in maker Dow that they only found out it was like with some code path that hadn't been used uh yet and then one day one of their Engineers like dm'd us because Rye is a fork of uh die maker down and so then they dm'd us and were like hey we have this bug uh we need to you know you should fix it in this way and like uh it was scary because uh before that you know uh like it basically would have just rugged us both uh had it ever been exploited in practice it's distressing to know that there's like bugs that can be out there for years without people catching them that's the thing that's scary yeah and also zero days there's a zero day out there right now just waiting for your assets yeah the phone that everyone has in their pocket right now there's a zero day oh yeah just give it some time and this guy was like a lead security engineer at Apple by the way so he knows what he's talking about so you know that's real uh so then let's keep the horror stories going uh what what do you see on that front there indigo uh I have an interesting one actually I was evaluating the like uh not necessarily like in the application space but I was evaluating the operational security of a of a crypto company and um uh just kind of like poking around in their wikis and stuff and one thing I found was they had uh literally a map of um the locations of all their employees like on pinpoints on the this like global map but you could you know view it publicly there was no access control on it so I literally knew where all their employees lived and I could zoom in on their house and find them and I said yeah you probably want to you probably wanna put some Access Control around that yeah so uh last year I believe we did an nft sale essentially and uh we raised three million dollars uh so what happened was there was a uh it wasn't a contract issue actually this was a user experience type issue it was a it was a user error so uh the organization had accepted a PR submitted by one of their developers uh that just replaced the multi-sig address with his own address and it sucked off all those assets so uh luckily what we had to do was essentially docks this guy figure out where he was because he wasn't that smart and uh we got on a call with him uh I'll just I guess I'll just say the platform was me so it was Sushi's miso platform so to freak this guy out we found his address because we're good Elite hackers and all and we sent him like 20 orders of miso soup while we were on a call with him and essentially coaxed this guy to return all of the funds fun sapu good guys win that guy is probably not going to work in this space again so now be narcs guys that could have been really difficult time Jay oh hello hello hello so Jay Jay from jpegs uh yeah Sedona that was probably like the most one of the mo more epic things that I can actually disclose uh mostly because we recovered the funds without having to involve some third-party uh like the feds or anything like that we were able to handle all of that in-house like grown adults and Cypher punks we are so uh uh experience represented on this stage right now what is the best advice that you would give um to folks who might be building or who might be putting up their own collateral on something they're securing uh for for Builders the advice that I would give is first don't write smart contracts uh if you have to write smart contracts right as little code as you can uh every additional line of code is more code that needs to be tested evaluated eventually audited and that's all like a whole process and and and the more complex you make it the more likely that there's a bug somewhere in there yep yeah and what we say in the like the web to crypto world is you know don't roll your own crypto and I think that definitely holds true like if you don't have to write it if someone else has written it uh use that don't write your own thing because you're gonna mess it up um but also like if you're building definitely have a security person that's going to continuously you know think about security you know if you were building like an AI platform you'd have an AI guy um you know to build like a web 3 product without a security person it's just a bad idea yeah I would agree like only keep the logic that's absolutely necessary to ensure the security of your assets on chain uh defer everything off chain it's there's no problem with using a centralized server if you're just conducting basic logic um we don't need to be super decentralized Maxis about it when there's a large amount of assets on the line so uh first thing we need to be is stewards for those assets uh to make sure that they're safe and that we're doing the right thing on behalf of those who are trusting us with that make sure that it's all uh transparently provided online verify your contracts but most importantly do due diligence on the people you work with because they can just rug you really quick if you want and a lot of the issues that we see in the space aren't necessarily based on Smart contract logic bugs I feel like we're fairly mature since like the Dow hack happened like we kind of know what's up now and we have these processes down um so let's try to think about all the off chain logic which includes human error uh when we're considering overall security and collateral risk yeah definitely don't neglect your op SEC right yeah opsec for for real amine and I were Sim swapped a couple years ago uh yeah there is a whole Sim swapping thing that went out we like formed a war room telegram chat yeah and then one of the girls that got Sim swapped like hadn't changed her number and like didn't set up a Google Voice proxy and then got Sim swapped again and the hacker was able to see our entire telegram war room chat we're like we're [ __ ] idiots like and be careful at events like this because that's where Predators come because all of us are like congregating in one space so when I travel I travel with a work specific laptop I have a burner phone y'all don't even know me I don't know you so uh Indigo you you raised uh one thing that I think is an absolute thing that we've got to discuss which is AI I'm really curious when you think about security what what additional risks are we not anticipating right now that are made more possible by AI related attacks that could be out there what changes really in the entire space based on just the availability of AI right in in terms of AI yeah I think it's really hard to say because right now ai is kind of an immature tool um but I think the potential for it is is pretty scary because an AI can be hyper Vigilant right so if you can imagine like um an AI adversary right like they're never going to sleep right they're going to find the zero days and uh zero days are really like a a combination of like the stars aligning and just matching a whole bunch of conditionals that um you know just so happened to have some side effect that you can exploit uh and they take forever to find for that reason right and oftentimes people just kind of stumble on them but an AI can be you know really scrupulous and um continuously searched so I think that uh having really good uh like defense in depth and like really well engineered systems is going to be super important uh because the second you deploy a uh you know smart contract that's vulnerable You're just going to be you know instantly hacked I'm just gonna jump in on that I want everybody else get the chance to answer but when you talk about defense and depth in smart contracts let's just have a little sidebar on what what does that look like for defense in depth like what are some best practices on that front uh I mean the the way I see it is um mitigating the the multi-party risk right or I guess a single party risk uh it's it's identifying if there's any like privileged actions that are are sensitive if there's only one person that can can make that happen uh like a good really good example is like you know having a multi-sig own your contract and of course there's a lot of issues with that as well but um you know that mindset of it takes more than one person or more than one like step in the process to exploit something is uh you know really adds a lot of value to to defending and and you don't always know that the point of defense and depth is um you know your defenses will fail eventually and if you just have one line of defense then uh you know that's it but if if an attacker has to get through two lines of Defense you know you can you can see that they've broken one you can respond to it if you have time um we see this a lot in the in the web 2 space where uh you kind of have like an eggshell around your company you have like your your network security is really high so someone somebody it gets on one of your boxes usually you have a little bit of time to do something you know respond to it you know cut off their access in the web 3 space everything can happen instantly all right so there's no like there's no time to triage there's no time to have incident response uh you know update your smart contracts if you didn't get it right then you know you're done awesome uh I mean and Zach gonna give you the chance to answer the AI question go ahead oh yeah I got something so on the on the AI part um be careful what data you share and uh which like ID hello which IDs you're using because if you check out like GitHub co-pilot for example what it's doing is that it's it's essentially pulling all the code you're writing into a large data set and AI is really just a big brained way to explain a large inferential data set that can kind of make decisions based on conditional statements really fast so all of the code you write anything you write in your IDE is being pulled into GitHub or Microsoft servers where it's then being fed into a much larger data set so if you're writing something like a mnemonic or you're sending a private key somewhere it could potentially be Auto completed in the future AI isn't like really that crazy it's just like a hand wavy way to explain these like huge server Farms that have been aggregated within the web 2 space so don't buy into the marketing and be careful what data you share make sure you take advantage of Cold Storage as well and don't trust any sort of computer I mean yeah I don't know how realistic this is but I think it'd be funny if an AI tried to do the same scam that uh your miso supply chain attack yeah like be careful that's what I'm saying you know chat gpt7 as it tries to break out and steal your crypto by replacing your address with its own in your crowd sale contract right yeah and I bring that up because I was actually typing a mnemonic into vs code and it was trying to auto fill the rest of the uh the the seed phrases and I was and immediately I was like okay [ __ ] this yeah sketchy I think [ __ ] this is a great final ending point for this panel so uh thanks everybody for uh being part of it thank you thank you very much thank you thanks guys go [Music]