The Next Era of Web3 Security | ETHSofia 2025

[Music] So, thank you all for coming. We're going to be talking about the future of web3 cyber security here with these fine gentlemen today. Um, does it make sense to take maybe two minutes, introduce ourselves, let the people know who we are and why we are entitled to talk about this at all?

Okay. Uh, the sound is good. Yes. Uh, hello everybody. Great to be here.

Uh my name is Krum. I'm Krum Pashoff, founder of Pashoff Audit Group. We have been doing uh team audits, auditing some of the best protocols in the space. We have done over 300 audits for projects like a like Lido, like Katina, some of the biggest names in the space. Uh and we're here to do even more security collaboratively together.

Hello, I'm Marco Hexter. I worked as an offensive security researcher for like five to seven years uh in web two security but most uh working for government or or contractors with corporations. Uh but I actually came from Bitcoin before where I even contributed a little bit to Bitcoin core but noncon non-conensive code at the time. Then I went to this offensive security research side that was not very well developed in web three at the time. the web tree didn't even really exist and in 2023 now I came back to Ethereum and web three and everything else and I got some bug bounties started hunting found some clients some friends and partners and have been hopefully bringing this offensive security side that I worked but for for web which I think is somewhat l lacking in other in other parts beyond on the smart contracts or it is going to infrastructure and node code and things like that.

That's mostly what I work for with

this. I'm the humble Chad Riptide. I I hunt bugs for a living and I host a podcast where I talk to other bug hunters about hunting for the bugs in web 3.

Very nice. And I run Fedesium. We're an automation and developer tooling company from a cyber security perspective. So let's maybe dive in I guess uh as to ease ourselves in here. What do we think is the bleeding edge of web3 cyber security and where do we need innovation in this space?

AI easy AI it's a field that is uh bleeding edge that most audit firms pass audit group uh dismisses the advancements in AI auditing that is going to take over like a big title wave uh honestly I think that um it's it's an incredible field that is hugely promising and that we shouldn't write off the initial results that everyone got using GPT and the AI slop reports that are out now. You could take those things and advance those and use it in a manner that's uh shown to consistently find uh very good findings and the technology is is promising. There's no I don't think anyone should write it off at all at this point. Yeah, it's kind of silly to say the fencing, but AI of course we have formal verification which is a very high IQ field and there is much to do yet. Not my specialization but I know it.

And for AI I see what I see is that there are two sides nowadays. One with the hype like oh AI we replace everybody tomorrow. That's kind that's kind of stupid now with the with the foundations of transformer foundation that we have for AI right now. But also it's not like I see people that use the most generic uh interface like the most generic interface like chatpt on their most generic input interface or codeex or whatever. Do not provide context for that and then they call it a day and say oh it doesn't work.

It just gives me false positives. Of course it gives false positives if you don't give the right context for the probabilistic model. So in my experience at least I have at least one bug one vulnerability in which I got 50k in a bug bount which was we could say AI found it but AI didn't find it I give I gave it lots of context with my knowledge with my security knowledge or the humans there and then it helped me spotting that so I think that's the way for at least for now with this infrastructure we have now the transformer based LMS that we can work. We have to give the right context. We choose the wars and then h it can help us spot things that we couldn't spot or you didn't have the time.

That's partly the thing. So I have this small success cases. So yeah, I I believe that with people working it with time it will be better and better and better. Yes, that's the bleeding ed for sure.

Yeah.

Okay. This working now. Um okay. I like what both of you said. I really like it.

Uh I have to be a little bit on the other side of the spect spectrum to a little bit bash on AI so far because uh it's either one of two things. It's either that nobody is okay with showing his tool uh to the public and showing that it is actually working and explaining how he's using it or nothing is working. And because uh at pushoff audit group we are not putting that much emphasis on AI. I feel like it's the second at least this is what I have seen so far. I have tried running some of the best AI tools on cold bases that we have audited where we have found endless amount of amounts of issues like many critical many high medium severity vulnerabilities and then you get like so many false positives.

you lose so much time when you see them uh to really understand that they are not vulnerabilities at all and maybe someday sometime you catch another bucket that you didn't catch but uh usually the time that you spend working with this tool is much more than the time you would spend if you just go deeper into the code and I want to say one more thing that u I'm trying to be very open-minded about it and I uh the way I'm thinking is But there are many people that are like 10 times smarter than me. And when we disagree, I try to understand why they think this way. And maybe about AI, it's uh it's really about not understanding what AI insecurity is. Because in my opinion, when I hear AI tool for security, I um I envision something that is I just run the tool and then it puts out vulnerabilities ready to be reported. Well, this is not the case.

And what you said, what you said I liked a lot is that it's actually an extension of of you and of your brain and it helps you go even deeper. So I like this this viewpoint, but overall I feel like it's more of a burden than it's helping right now. Yeah, that's one one thing that that Pash is saying is very true that I've been seeing and most teams that are working with this and doing at least screaming they are having results. They really hide their work. They have the reasons for that for sure but well they hide it.

And I think there's there are some incentives. For example, I have my own context files for for AI that I work and I never publish that to anyone.

Why?

Uh yeah, exactly. Because I think and maybe and maybe that's maybe that's limited and that's totally not hacker actually that I I want to keep that to me that to me that I worked for that so I can get the value from that before anyone arrives there. So that's the reality. I'm holding for me so I can get the bounties and that's it. That's the reality.

But I'm not trying to sell a product to anyone. I think the guys who are trying to sell product to to people, they should be a bit more open when they are ready for that. Yes.

Yeah. I think it's invitable. Definitely AI is an improvement and the way to speed this up is to to work collabor collaboratively together because if everybody is working on in his own lane progress is much much slower. It's like 10 times slower. Of course the person who is working stealth and he managed to do something that is crazy crazy good.

He'll be the first to really capture the value. I don't know maybe for me it's not just about capturing value in terms of monetary rewards. Maybe it's also about just creating a better space because right now web3 security is a little bit like almost funny like so many hacks. Everybody's doing so many audits and we're still getting hacked for like billions of dollars. Like are we doing any job at all?

I feel very bad. So we need to really make some progress. Maybe the maybe AI is the answer.

I don't know. So it seems that there is a natural tension here between AI assisted audits and less so uh especially when it comes to kind of the collaborative nature of cyber security as a ecosystem or in an ideal world as it should be collaborative right we're all on the same team here um and there's plenty of people on the other side of the fence so I guess kind of dovetales quite nicely what do you guys think uh AI or otherwise does a cyber security professional web 3 look like in say 5 years like what skills do they have that it's that they don't have today. Is it just context engineering and prompt engineering? Is there something else? Some other tools that are out there on the bleeding edge that we should be exploring?

What does what does a professional look like in this space?

That that's a tough one, man. 5 years from now, I mean, this space moves incredibly fast. You could you could look one year ago and two two years ago and you're you're outdated if you haven't improved your skills, if you haven't kept up with all the changes with uh with the ecosystem. I mean, LLM's caught us by storm with all this these prompts and what you can do with the prompts. And now when I audit a codebase, you see prompts in the codebase that that the dev team makes probably made the prompt through another LLM to, hey, make sure we got all these bugs, no re-entry, blah blah blah.

So, like, what does it mean to be an auditor now versus five years from now? I think you're we're going to have to embrace uh everyone's going to use AI for their tools whether they're using it now or using it in the future. That's a given, but using it effectively uh and I think still the same core for at least for for an auditor or a bounty hunter is still going to be that attention to detail because I don't think that anything is flawless. Could be AI, could be whatever. And essentially what we're doing is looking for those edge cases that haven't been found that no one thought about.

And really that boils down to asking the right questions. It's just like when you make a test suite or you're auditing a test suite, you're kind of looking and this is a a really hard problem to solve. And a question to ask to the protocol team is like, well, how do you know that you're doing all the right tests? Have you tested every possible scenario that could be that could exist out there? and they may only approach this from a developer mindset, not an adversarial mindset, which is kind of the flaw in why if you don't have a dev that's been on both sides, they can't kind of think that way like a hacker.

And so, you need to come in and be able to see those those different scenarios and run those kind of tests. So, it's about having that hacker mindset now or five years from now. That'll still be key. If you don't have it, you don't have it. Uh and then you have to evolve with the ecosystem, evolve with the tools and whatever those tools may be.

Yeah, I like the part that you say that the hacker mindset will will still be useful there and I mean five years said is a huge time nowadays uh for at least for what we are developing now and even the model that we use for AI may have changed a bit because the big brain guys in AI are trying to scale new types of uh architectures be beyond transformers uh symbol olic stuff and I mean don't ask me all details I really wouldn't be able to answer uh but there are other other foundation foundations to build what we call AI beyond LLM that's the so in five years that may come and may bring new results but for a security professional what I see and well let's extrapolate five years but we never know is that yes the mindset is very important because as I said for in today I think that we still choose the wars. We choose the wars and the LLMs. They help us with bread mostly. But I think any it's not even five years. It's now I think any good security researcher will have to incorporate AI LLM as it is in their work one way or another.

Be it for trying to find vulnerabilities. It's harder nowadays. It's gets too much work yet. uh but at least for Brad for example if you are researching a code base it is it excels a lot in helping you understand the code base faster knowing where to look of course you you sometimes I saw a tweet in another day from another researcher who said like oh AI doesn't work if you have to double check its work no it's not like that I mean you have you have a junior or you have a junior developer or something sometimes you have to double check their work but they are still useful. So if you if you at least can decrease the space uh in which you have to check things that's already an improvement.

So at least for this AI will will have to be with a secret researcher but the hacker mindset and the offensive mindset it is uh is will be essential especially even for for questioning these new tools. How can we attack these new tools? How can we prompt inject the the tools that are verifying the contracts? Because there I think there will be lots of research on this side even on more advanced things like state actors uh poisoning poisoning models and making them trigger for for for being more more for being more explaining. Imagine for example, it's just a an analogy, but imagine for example that guy uh in the movies that hears here's an award and then he knows that he must kill the president.

That's a dumb example, but it's just an analogy. Imagine if state actors uh with ears and AI getting more and more used it start they can start to poison some of these models and the training data for these models and we never know where can we get with that. So you have we may have models in the future that we can't even totally trust. So that's another reason why open sourcing the models and our practices is also cool. So yeah, I think that mostly defines what I am to do as a security professional, but that may change next year.

Who knows? Okay, very interesting points. Uh I want to give a little bit more um judgment to today as well. uh to think of the of the constraints because at least in my brain for now I'm thinking the constraint is that it just not it just doesn't give good results whereas you say no it works actually we can we are finding bugs okay this is starting to happen this is great progress but let's think about other constraints as well which are time how much time does it take you to run it because with some tools it's a lot and how much time does it take you to check the false positive and stuff and also money of course because those are the biggest constraints. Maybe you can have one model that will really do a great audit, but if it costs like $200,000, it's still not viable.

And from what I have seen, well, AI has been improving, it's also becoming more expensive kind of to run it because it's more complex. It needs more computational power. So, there are many constraints that you need need to solve for. So let's get back on the question that you asked pretty much about the uh AI auditor in five years which is a very interesting topic and myself as a founder of a security company I would love to work with somebody who is like u 50% web security 50% AI and is he's an auditor and he's very ready to push himself just to do like AI audits but kind of he does the audit kind of the AI not fully this is an interesting interesting approach So uh this is the way uh both AI needs to improve but also the auditors need to improve mostly on working with the AI because the attack vectors are need we we can count all the attack vectors how many are there like 200 300 then we need to combine them together but AI can really help with this I agree still we need to fight fight with the constraints money time this is very important Whoever is building in AI, you have to really think about those constraints. Very important.

Yeah. Just one thing is that uh just because I I I had the experience with this my one of the last vulnerabilities I reported for a bug bount success successful bug bount I used AI to make the PC the pocket for the the proof of concept for the go part and it probably has good context on that but it didn't have so real good context for rust for example and a simple a simple PC on cosmo which is the contract language language that uh that Cosmos use with a simple PLC it wasn't able to do it I I I spent some time on that and then I got the I cut the code and code that in like 13 minutes and another thing about cost is that nowadays uh we have to account for it's even worse than the cost that's scaling now because most of these tokens in we use on OpenAI cloud Jin whatever they are subsidized. So those are not the real prices which means that many people if you don't find another way to scale the costs to scale the resources for the cost many people will be priced out eventually because these companies are really the VCs are subsidizing the tokens. So if I pay 20 that's actually I don't know how much it is but it's much much much more than that those 20 USD that I pay or 200 USD that I pay so you could check that out the cost and things it's being subsidized at the moment I think the cost is really a problem. Yeah.

So a couple of interesting points there, right? Uh especially around so fundamentally like maintaining deep modern context as we speak to AI systems or otherwise and maintaining an adversarial hacker mindset are I think agreed upon here as important. Um and as we all know uh most of the counterparties or significant percentage of the counterparties are sophisticated governmentbacked entities with functionally bottomless coffers. Um wherever we all may have come from we are now no longer on the adversarial side of the coin. How do we maintain an edge and maintain a modern take on adversarial mindset and understanding of emerging threats are out there in the face of evolving increasingly more sophisticated risks?

Um, and what steps do protocols need to take to mitigate this as well?

I'll take this one. I talked we talked about this uh earlier on on the panel but uh we we discussed having like a a total ecosystem security and I think this is what um web 3 firms that that do security audits need to transform into is a comprehensive security suite that's offered it's you man they need to do web two web three and physical testing as well like like check check the doors and locks of the dev have make sure everything's good. He's got the private key. You know, he's part of the multic. He should not be mixing and matching that laptop with his private life and your work life.

It's just like it's crazy. We need to

opse operational security. So, we need to do a a total comprehensive security wrap up by um audit companies as a service. And I think it needs to be ongoing. We need to abandon the audit cycle. We need to lock in and say protocol engage with me.

This is going to be us. We're going to review every git commit. We're going to review uh every proxy upgrade, simulate everything. The whole cycle needs to be encapsulated just under like one provider. These these offerings will be the future I think of of web 3 security.

I agree. I feel like operational security audits uh should be faster to come to market and shouldn't should become um every company should be doing this before even we get to great AI toolings like OBSC should come first definitely because it's a bigger pain right now we just had the $ 1.5 billion hack and it wasn't because we didn't have AI toolings it was because OPSSE is so underdeiminished nobody really thinks about it So very good point.

Yeah. And uh of course uh as I've been hunting with bug bounties part part-time on web3. Now what I see is that of course this is kind of the ed of the vulnerability research. We are like on the on the first responders of a vulnerability research after I mean after code goes to mainet. And what I see is that uh this has a limit of course because I come from offensive security.

I worked with red teams in which we use it use it to do very comprehensive security analysis. So some clients wanted physical attacks too. There are guys that are more specialized in these. I have some knowledge but I'm not the most specialized. And we had a team a very comprehensive team using uh lockpicks uh drones uh everything that we had at our disposal uh to really try to compromise a company of course not all companies want that some companies want want just to check their code or something and what I what I have come to learn is that the more you harden your code uh and I think that's important for web three right now the more you harden your code and the guys are hardening the code like with pashops audit security has been doing.

Uh and the more you harden your code, uh the more interesting your obsac becomes. But the more you harden your your OPSAC, the more interesting your loved ones, your family members, your friends become. So we have to go much further than that. Of course, we have to start somewhere and hardening the code is important. But if we aim and we strive to become like the the main the main the main railroads for finance and for money, we cannot play around with these other parts because if you have a good code, you have if you have a good governance and if you have everything that there will be a guy that will come to your house, there will be a guy that will come to your server and it's not even new.

Uh the first company that I worked with Bitcoin was for a very short time. I was young. It's Quinnaput. Some of you may know or not. It was a wallet, Bitcoin wallet and other service providers.

And even at the time in 201 15 or 14 around that uh 15 or 14, we had like there in Panama a guy that was that was arrested one room before the server. So even at the time so I mean it's not it's not nothing new it's here I think the attackers of course will always attack what's easier so the code was being easier but some some some guys here are doing it difficult to attack the code so they are going to the to the software spots and there will be the opsac and everything

yeah and just on that 80% of the hacks are private key compromise it's the wrench attack it's it's not all this focus on smart contracts but it's wrench attacks.

This is because we do so good audits so there aren't many anymore.

This is true.

But but that's true. I mean that's marketing but that's also true. Uh and I and I don't have a share on pash on pash company. So yeah I mean if you we the code was very bad. For example, when we had um some years ago, we had things like oh in the the DAO, I know it's now old in web3, but man, there were very good guys involved on that.

And re-entry is not something that Web3 invented. Re-entry is already a problem in distributed uh computing since always. So they didn't spot that. So what I what I mean is code was very software was not as good as it's now. Now it's getting very hard and and that's real.

So they will go for your private keys. They will go for whatever they will go for your model man. That's the truth. And criminals will do anything to get millions or billions. Look at the values you are moving.

We are moving lots of money. So an interesting take obviously around kind of full spectrum continuous security right uh and one I agree with wholeheartedly right but I guess the question I'd love to pose to you here is while in an ideal world everybody would have full spectrum end to end coverage throughout the entire life cycle of their protocols you know physical pentest and keyman risk analysis etc etc uh let's say 80% of the protocols and businesses in the ecosystem of them are startups that don't quite have the funds for those kinds of security analyses. So what would you say is an 8020? What what would you say what would you suggest a person building in this space focuses on given that they probably cannot afford, you know, red team, blue team against their office building? Well, ultimately it comes down to the the discipline of the person, the protocol team because everyone knows what they should be doing and there's a lot you could be doing that doesn't require any funds.

Proper obssec doesn't require any funds. Just separate everything. But so it's about the discipline of of people doing that. And the flaw we're always going to have is that this is a permissionless system

and that that 17-year-old kid can launch whatever he wants and that's going to get to EVL and he doesn't know what he's doing as far as security goes or or any of these rules can all be broken by him and um people are still going to flock to that D5 protocol or whatever. So you're always going to have these issues. So I think um you know 8020 like realistically what someone should do with sound mind and a limited budget and time is you know the rule right now is what pass off three audits is that what they say

three audits is not enough

three audits at least 10

only one pass off audit is enough I would say I would say that uh definitely get peer reviewed by devs this like this is free You should have devs in the space that you work with. Get peer reviewed by them. They'll check your code for free. Uh even put out, you know, a little bounty for them to to check it out, a grand or something like that. Hey, look over my code.

All this could be done pre- audit mafia. You can use your AI tools, uh anything you want. So, at least cover the minimum bases. Don't be an idiot with hot wallets. Um yeah, don't don't have your front end compromised.

Just basic basic things. And I think we can we can almost get there.

I think uh good advice. Also, if you're money constrainted, you have to be more creative. So think creatively about uh where to find people that uh they're not just about money. So they would help you even if you do not pay them just so that you can be friends or that they get fulfillment of helping people or whatever. There are many people like this.

I think many are sitting here right next to me. So yeah, just ask them. probably they can do some very short and small security checkup, give you some advice, give you some videos to watch uh books to read or whatever and maybe just start with a small sole audit from a new up and cominging auditor who is actually well proven but does not charge too much. I think this can give you great results for very little resources.

Yeah. Uh I agree I agree with both of you guys of course those are very reasonable and correct points. So what I could add is that bro you have to learn to I mean uh when do we have a technical founder that needs to sell what do you what you tell him to tell him or her what to tell uh is either you learn to sell enough to be able to sell your companies your product or whatever or you find who a person to sell it or you find a founder that will sell something. So I think that applies for security. Uh if you're working with with money and very liquid money, more liquid than any bank, I mean it is just a private key, a string, some bytes that will move millions.

Uh you have to learn and the minimum operational security for your life. We still we still see in 2025 we see founders with millions on a hot wallet on their laptop where they watch whatever they download all the games they want there. They they download all the movies they want from torrent and they have millions there. I mean that's not North Korea man. That's your that's your that's your stupidity because if you lose millions on on a computer with a hot wallet that that's the problem that the problem starts there.

Okay, you got exploited that's bad. We can't we have to take the criminals anyway but you have a responsibilities. So I think the summarizing these is that you have to learn if you are just a scrappy founder you have to learn. You have to learn design. You have to learn everything.

Why not security? It's not impossible. Our work is not uh I mean you can you don't need to get to the top of being a security professional to do the basic work. So at least you'll be miles miles ahead of many of the things and that's what saves you sometimes. Okay, you may be hacked because of you.

You may have bad look, but if you are better than the other people and your hot wallet, you are not with a hot wallet on your laptop. You have mig or whatever makes sense for your for operational security and for your security threat model. That's it. You have to learn or find people to do it. Like everything else, I think security is not is not that much of a mystery here.

I think it's just part of the business nowadays. So, and a couple of interesting things came out there, right? So, I think one thing that got touched on is the fact that ultimately we are moving billions of dollars down these rails that we're building. Um, and security obviously is an important aspect thereof and we to some extent have to have the best people on it, right? Uh, if we want to be this new economic system.

So the question I have is given that hype cycles come and go and right now there's an I hype cycle. How do we attract and retain the best people in the world to do this job and out compete AI, traditional cyber security, quantum compute, you name it? How do how do we do it?

Two ways. Money, which always incentivizes everyone. And the the promise of being on the frontier that drives a lot of people. I remember when the internet came out and a bunch of geeks just I'm old. A bunch of geeks started riding that wave because it was something really cool, something they could just dig their hands into.

No one had to tell them, you know, they couldn't do this like it was free, it was open. This is even more free and open web 3. And so I think just by continuing to build in an open and decentralized manner like what Ethereum is doing and keeping it permissionless um keeping it distributed decentralized brings in people that believe in in the ideals behind it in kind of the cyberpunk aspects behind it and the fact that it gives it makes the whole world this whole online space in meritocracy and that will pull in the best and the brightest who know that they can succeed without being held down maybe in their host nation by nepotism or class or any of those things that applied there. They don't apply here. I think when people see that will naturally pull in the best and the brightest.

Instead of going to Wall Street and maybe AI, they come to crypto instead and apply their talents and they should be able to make as much money as they want to make to be honest.

Yes, I agree 100%. And I think those are the main two things basically great incentives, monetary incentives. People want to live a good life, people want to feel successful. And also it has to be very interesting. It has to be exciting.

Like this is one thing I like about AI. It's both kind of scary. It's also very exciting. It's like the new thing. It's so interesting.

The the majority of smart people are going into that direction and everybody wants to work with the smart people. So it's mostly about having the funds and making something really interesting, really innovative.

Yeah, that's it. Uh money is the baseline. It's important because after you reach some level in expertise in most technical fields, the money is kind of guaranteed, but you have at least to offer the money. There's no way around it. And I hate those guys that that say like, oh no, people will work for love.

And no, no, they won't. They will work for money because money helps them with the things they love to. But then you have to guarantee that our technology and our developments are really at the frontier because I see that attracts lots of of new minds. For example, I came I I came back actually but I came back to this new web3 security that was all developed before I came back. uh because at first it was not and it started around 2020 2021 I think it started developing more uh of a security of a security mindset on web three with code arena and all these things and what when I did this move of course it was the money and we taking but also a money that I can have with more freedom because my kinds of work contracts and uh brings some may bring some gold golden shackles too.

So also the recognition of this open arena. So also giving people recognition uh because recognition actually what what it means it means independence because if the person has recognition he knows the this person knows that he can work in another company or for his own project afterward it is he accumulates his identity capital in a way uh his his social capital that he has by working. So it's mostly this we have to give money and interesting projects to work and that's why many people are going to AI now because they are seeing this is the frontier and many of them still see web3 either as lots of scams and frauds uh or or sometimes as stagnated not developing going to centralized solutions. If you're going to do it all against super satellite solutions with our new tech, bro, that's boring. People, good people won't come to that.

And I think we we must strive to keep innovating this this space and bringing bring these people to our side. It's being at the frontier really for as cheese as that is, it is the word frontier. Yes.

So, I think we're near enough at time now. So, I'd love to take a couple of audience questions at this point. Uh there's a slido QR code over there.

Thank you.

Yes, thank you so much gentlemen for this wonderful uh panel. Now there is actually so far one question that came in. Thank you for keeping some time for that. So the question is this one. Marco said that AI helped him uh find a vulnerability.

Does that mean the question is that hackers can now easily use AI to give them hints for attacks by analyzing the target? Feel free to to answer whoever feels mark.

Uh for now, no. Uh because so let me be very the easiest way to answer is being specific about what I found. So I what I found is a field. It was in a field that I'm I have been working a lot lately. So I have lots of context on that.

My own files, my own notes, my own vulnerabilities that I found, my own invalidated vulnerabilities that I found invalidated sometimes not because they are not possible vulnerability but because they are not exploitable. So they are unworthy for bug bount they don't accept that. So I sit on that of course and I have all this context to add to the models that I use and in a very specific in a very specific field and the same the same tool when I needed to do a simple P simply didn't work. So I don't think we are we are there but people can and are building uh very cool tools now that would make many script kitties or people that are not very knowledgeable to do some kinds of of hacks for sure. The most difficult here is tying contexts.

So if you have a a website that's easy to hack that's very very possible right and somewhat easy to make that kind of tool but you have if you have to stit many context like your blockchain web and crypto crypto analysis and this and that those are not so ready to use by anyone. No but we we can get pretty close to what people fear but not uh not right now I think. Yeah mostly.

Wonderful. Well, thank you very much. I think that we have maybe one two minutes more for the for the final question. A few more are coming in. Thank you for that.

Uh, someone is asking to part of when Lambo that that was not the question I was going to pose but in any case. So maybe maybe a good one uh they're coming in a lot actually like okay so the one that gets most upvoted is what's the most surprising vulnerability found by you or your team? Maybe you can try to keep it short whoever feels like replying.

Interesting

for surprising vulnerability. Nothing comes on top of my mind because every vulnerability is very unique. Like when you get re-entry, it's not that interesting. But even with re-entry, you can have many multiple attack vectors joined together. Those are the most interesting ones.

When it's like one, two, three, four attack vectors together. This is the most interesting. But it's very hard to get to and we have had situations where we find like one attack vector then we uh join it to another attack vector and it gets very interesting third attack vector and then we cannot find the fourth one and we we do not even report the vulnerability and after that somebody reports it or somebody might exploit or whatever but uh those are the most interesting ones where it's like multiple layers of attack vectors. So I I would like to chime in here with what I consider to be the most surprising one that we found and a slightly different take on surprising. Uh one of our customers had a function which allowed them to burn tokens.

Fine. Uh they asserted that the wallet they were interacting with had enough tokens but then they allowed them to pass in any wallet to burn from. It was not a complicated vulnerability but it I it was just that is what surprised me.

You were surprised that he can leave such a

Yeah. I was it was surprising at just how dumb it was just basically like you know

wow he or she I mean you never know just ladies and gentlemen in the room and just mentioning this quickly as a founder myself

them yes very correct wonderful um that leaves me to say thank you very very much for this very insightful panel. Please put your hands together and then we'll move on to another epic keynote. Thank you very very much everyone. [Music]