Security Summit 🦺 Why Crypto Security Matters

[Music] really excited that you guys are all here um and yeah looking forward to to getting into this uh security focused Summit and you know if you're doing a hackathon you might wonder okay why do I need to care about security um I'm just G to build something uh quickly and you know put it on a test net maybe you'll even end up putting what you build onto Main net I think that would be awesome um but I also am here to warn you that if you do put it on mainnet um it will probably get hacked uh and and I can say that uh with a a little bit of confidence after um you know going through a 100 audits with Sherlock and and working with some of the top protocols and teams in the space uh writing solidity is extremely difficult and there are all kinds of gotchas and there are all kinds of things that you think it's safe and it's broken for three different reasons and if it's broken a little bit you can steal everything out of the contract so we're going to get into some of that stuff um and hopefully convince you that you know it might be uh worthwhile to spend a little bit of time focusing on security uh if you're going to take your hackathon project seriously um after the hackathon which I hope everyone does um so great getting into it why crypto security matters uh let me see if I can okay great if you're new to crypto um you've probably still heard about a lot of the hacks smart contract hacks uh wallet hacks private key hacks um over the last few years I mean starting with the Dow hack it's been it's been many many years of crypto hacks and very large very large hacks I mean I think everything on the screen right now is a you know a nine a nine figure or eight figure exploit um we're talking about very big numbers when things go wrong in crypto to um and they go wrong often and even the best teams using the best security practices working with the best firms um you know still end up having issues and and there are still mistakes and so you know one of the most important things to know when you're starting out is like well why is this even happening you know like why is why are there so many hacks in crypto but like Bank of America or bar Clays or you know banks that I'm used to um they don't get hacked or at least you don't hear about it um so the first thing to understand is kind of like why is crypto why is crypto so bad like are there are there is everyone just reckless in this space or or what's going on here um and so you know the question is like well does Bank of America get hacked and we're going to get into that a little bit but the short answer is yes Bank of America gets hacked but it doesn't matter if they get hacked because they can just if if somebody hacks into Bank of America's Mainframe code you know whatever it's written in cobal and they change their own account balance from $0 to $10 million um Bank of America doesn't care they can just go in and fix it uh and that's because they have admin control they control their database um and so the difference which we'll get into as to why crypto hacks are much more deadly is because no one controls the database um the code controls the database so you might be thinking well then Bank of America is a lot better because they can make sure that if you hardcode $10 million in your account they can go in and fix it and if you send money to the wrong person a lot of times they can fix that too and they can fix all these things that make the traditional Financial system like really awesome and make it it it has a lot of advantages compared to crypto um but there's a few disadvantages too and there's one massive disadvantage which is okay you know money always comes out of the ATM but sometimes it actually doesn't and if you live in the US like myself or if you live in Europe or you know some other countries most people don't have any problem with the banking system and and the bank works and money comes out of the ATM and and things are generally good like why do I need to stop using my my Chase account why do I need to put all my money in crypto well crypto is really good for sort of the edge cases and sort of the things that you don't think will ever happen and then all of the sudden they do happen um and I don't mean to call out Venezuela or Canada here I'm sure there's plenty of people from those places and um and and they've experienced a little bit more firsthand compared to someone in the US why crypto is actually good and why it can be necessary um and and again the answer is Bank of America has admin control and and who has admin control over Bank of America well the politicians have admin control over over Bank of America um and so you know in Venezuela the politicians can control the supply of money they can print more dollars out of out of nowhere and they've been doing that super aggressively obviously the US has been doing that a little bit too but it hasn't quite caught up yet um and you might have heard about the Canadian Trucking crisis we'll call it um a couple of years ago where you know Canadian truckers were parking their trucks in the middle of Canadian cities as a protest and instead of giving them tickets and arresting them the Canadian government shut off their bank account and said your money is no longer your money and so that's kind of one of the problems with having admin control someone else having admin control over your bank account is they can shut it off um and we haven't seen a lot of you know awful examples of this which is why most people don't see the real use case for crypto but in the extreme examples and if you're heading into certain scenarios you know with a country or politically or whatever all of the sudden crypto becomes the most useful thing in the entire world when it's a matter of I have access to my life savings or I don't um so to recap traditional Finance trafy you're trusting Bankers you're trusting politicians you're giving people admin access to your money essentially in defi you're trusting code only the code has access to your money and you um and so depending on how you look at it that sounds really great um or that could sound terrible you know it the code has to work very well um and if you're trusting the code well you're trusting it with your life savings effectively if you're putting your money in defi um so it's really a double-edged sword but in the scenario where you want to have full admin control over your money and you want no one else to nothing compares to Defi and nothing compares to trust and code on the other hand trust and code is extremely dangerous here's a quick pop quiz I actually can't I don't think I can see the chat but I'll leave this up for a minute this is just an example of a really well-known and well-intentioned um function I guess that works really well except in one slight Edge case and some of you may be familiar with this some of you won't I'll give you a minute to kind of see if you can spot the bug in this uh in this small example to give you some background on this piece of code uh it it was it's a POC written by a top security expert his name is herard Pon and it's for an audit that was conducted about a year and a half ago at this point and I believe the third bzx hack was also related to this exact kind of mistake and there was another $30 million hack that that was related to this exact mistake that happened here or a very similar one um so what you're looking at you know 38 million dollars or so has been lost um because of of essentially the problem in this code um and so now that you've had a little bit of time to look at it I'll explain what's going on here so all we're trying to do is transfer balances from one account to another and this code works really great except you might see this line balances memory balances from equals balances from that is stored in memory and the only way this code can be broken essentially which was not thought of which is an edge case sort of is if you set the from address and the to address to be the same exact address you can steal all of the money out of this protocol the reason for that is because if you look at balances memory balance balances from and then balances memory balances to you'll see that essentially what we're doing is we're setting the from address and the two address we're we're essentially overwriting the from address with the two address because it's the same address so if you put in the same address for from and two you overwrite in memory the from address and you only have the two address so essentially you are able to you subtract the balance from your account but then you overwrite that account and you add balance to it and you essentially create money out of nothing like you create a balance out of nothing um and this is the only way that you can take advantage of this is by putting the same address in the from and to parameters um and if you do that you will be able to steal all of the money out of the protocol that has this code so that's just a small example of everything is well intentioned everything works really well tiny Edge case every bit of tvl and your protocol is gone all the money's gone um so it's it's It's Tricky and to get back to the main point here bad trafy security usually means your information gets lost you know we've all had our our credit card information stolen we've probably even had our social security or or whatever stolen you know 10 times at this point and every time you see you know an Equifax hack or a Target you know hack or whatever um your your information gets stolen again and it's on another another list and this is this is bad and it can end up in you know credit card fraud and things like that um but for the most part you don't lose your life savings when that happens and a lot of times you don't even care that much if a database gets hacked and some of your information gets out there because it's probably already out there to some extent um so bad trafy security means you lose your information they own your information bad web 3 security means they own your life savings they are able to act they're able to access the database and hack everything out of it so if it was Bank of America's database they could take literally all of the money out of Bank of America and say this is mine now you know using a bug like the one we just looked at so and that's why the bug Bounties in web 3 are like a 100 times higher in a lot of cases than the bug Bounties in in web 10 to 100 times higher uh because in web 3 the severity of the bug means that you can lose everything or the protocol where you're putting your money the app where you're putting your money can lose everything um whereas in traditional Finance there the stakes are usually lower and there's a lot of just guard rails and different things put in place to make sure that you know even if your credit card information gets stolen there's there's uh you know um different Services visa and whatnot that will make sure that you're not losing your life savings your bank has has different ways of doing that and that's because in a lot of cases they can basically just put in whatever they want to their database and if you change their database they don't care they'll just change it back um so web 3 security is like way more crucial than it is you know tradition than traditional cyber security um so that's really important to keep in mind because it means that everything in web everything in crypto has to be focused around security um so I guess you know and from Sherlock's Viewpoint uh we kind of see three main blockers to mass adoption this is a little bit controversial but it's essentially scalability which is making sure that transactions can go through quickly they can cost you know a small amount of money ux you know you can have an app on your phone you don't have to memorize your seed phrase you don't have to do all these different things and then security is kind of the last one like if you are losing your life savings to a hack um you're not going to want to use that Financial system anymore and and if that's how defi is is going to be going then defi is not going to be successful so security is at least from Sherlock's view one of the main pillars to getting crypto to mass adoption um and for a little bit of background on Sherlock Sherlock started out as a smart contract security smart contract coverage provider um so basically if a protocol gets hacked Sherlock would help pay it back um if a protocol has a bug Bounty submitted to it basically a white hat which is a good guy saying hey I found a bug uh I'm not going to hack this because I don't want you know to be a bad guy but I do want you to pay me something because I found this bug that could have caused a lot of damage uh and so Sherlock helps protocols pay for those situations and the reason Sherlock does this is because you can never prove that a smart contract is 100% safe so security is super important we already established that and now we're bringing in the next piece which is oh by the way you can never prove that a smart contract you write is 100% safe and so that's why shlock has this coverage protocol that we've built on mainnet we've done all these things to try to help other protocols in the case where they have exploits they have bug bounties they have to pay out large amounts of money um and again that's to help us get to mass adoption because mainstream users are going to require not losing their life savings if they lose their life savings they're going to stop using crypto and so that gets us to auditing if you want to do smart contract coverage well you want to limit exploits you want to limit bug Bounty payouts you want to limit bugs essentially and the number one way to limit bugs in crypto right now is through auditing and auditing just means people look for bugs in your smart contracts um and to give an example that's close to home when Sherlock first started out we weren't doing any auditing we did not have our own audit process um we built that later and so we relied on existing audit firms and we built the protocol we actually built two protocols we got them audited by I think five different audit firms and we had frankly really difficult experiences um the audit firms looked tried to find stuff and it turned out they didn't find everything and Sherlock nearly got hacked um I say nearly because a good guy a white hat found the bug instead of a bad guy if a bad guy had found a bug the bug that was missed um then Sherlock would have been hacked on mainnet but instead it was submitted to us through our bug Bounty program we paid the guy a ton of money for finding that bug and you know by the way this was about two weeks after we had just paid a lot of money to an audit firm to try to find that bug and they missed it um so auditing and security it's really really hard uh you can spend you can have one of the best people in the space spend spend weeks looking at your smart contracts trying to find bugs and they still might not find all the bugs um and in this case it wasn't the Auditors we hired who found the bug it was some guy we had never heard of you know never interfaced with and he just happened to be looking through our contracts and and found this bug so that shows a little bit of the difficulty because of that Sherlock got into auditing we built our own audit process um and we combine an audit contest which is essentially anyone in the world can participate and try to find bugs and we'll pay them based on the bugs they find and reserving top Auditors more like a traditional audit where you say hey I know this guy is good I'm gonna pay him a lot of money to spend all of his time looking for bugs in my smart contracts and so Sherlock combines those two things and we've been doing it for a little over a year now we've audited optimism and and a bunch of other cool protocols um but in this case focusing on optimism this is a little bit how this was the first um audit we did with optimism earlier this year there were two reserved Auditors Zack obbr and Trust really great guys really top Auditors um they were paid $10,000 a week just to show up and look at this code and Sherlock you know paid that on behalf of optimism and then there was also an audit contest where you could win up to $750,000 based on the bugs that were found and so we got over 300 participants who all came in from all from places all over the world looking for bugs and the combination of these two forces found three critical bugs um in optimism's 7eventh audit so they had already done six more traditional audits where two people uh you know work in pairs to try to find bugs in the code um and and these three critical bugs that could have caused you know massive amounts of damage were not found until the seventh audit until Sherlock looked at it um so again just showing how crazy security is in this space and how difficult it is um and to break this down a little bit more uh to give you some context a lead senior Watson is just what we call reserved Auditors so there was one bug that was only found by the lead senior Watson team Zack oon and Trust there was one B one bug that was only found by the community um and so that means some random person who just decided to show up and spend their time looking at this looking at at these contracts found the bug and there was one bug that both the the lead Watson's lead senior Watsons and the community found um and so the really interesting thing about this is if you only had the community you would have missed a critical bug if you only reserved the lead Auditors you would have missed a critical bug um and this is something that Sherlock has seen over and over again in our own Audits and it kind of is a good metaphor for the difficulty of smart contract Security in crypto after doing 100 audits we've seen that if you don't have lead senior Watsons if you don't Reserve Auditors uh you know top Auditors hopefully then you'll miss about a quarter of the bugs uh you'll miss about a quarter of the critical bugs that will cause potentially all of the money in your smart contracts to be lost and if you don't have a community focused audit where anyone in the world can come in and participate and it's open source and they they earn bounties uh you'll miss about one-third of the critical vulnerabilities um in your code base so anyways that's just a little bit about why you should care about smart contract security I think I'm running up on time here um and a little bit about what Sherlock does and is doing to try to make sure that smart contracts built by you know some of the top teams and the and the most talented people in the space um are able to be secured as much as possible but at the end of the day you can never prove that it's 100% secure so security is is really difficult in crypto and it's something that everybody should be thinking about if they're thinking about seriously putting smart contracts on mainnet um because it's so difficult and there's so many gachas and you can have the smartest people in the space try to look for bugs and they will still they'll still miss some bugs you know as we can see here if you don't have the lead senior Watsons essentially you know have missed onethird of the critical bugs in the audits that Sherlock has done um and those guys are the best in the space that the most talented Navy Seals of of of smart contract security so anyways the takeaway is crypto is really cool because you don't have to give someone else admin access to your life savings but it's really hard to make sure that the code is safe because you're only trusting the code and if you are going to build something that you want other people to use and put their money into and hold value you should care about security because it is one of those problems that will never be 100% solved so you're just trying to get to 99% 99.5% um and have a great bug Bounty program and do great Audits and do all of these things um and that way you'll have the highest chance of making sure that your users don't get affected by hacks and that's pretty much it for