Adair Kelley Addresses Abstract's Security: Ensuring Trust with Permissioned Application Platform

Transcript

right let's let's talk a little bit more about the the protections and the security so like you know if you look at like ethereum um contracts for example you know we have like the opland Zeppelin contracts uh these are tried and tested contracts that have been you know audited used by like thousands of projects um and um are very like um carefully scrutinized for for bugs and vulnerabilities in the case of abstract how do applications know that the modules that are being published by just so you know for lack of a better

word random developers are secure and are not going to jeopardize their users security yep yeah that's a really important question uh every abstract app so our our platform is a permissioned application platform so every one of the modules that gets uploaded needs to be approved uh and develop we have a standard for developers to upload metadata for those applications uh with links to the audits uh to the name description and um details of the developers themselves we want to make sure that anyone using uh modules on the abstract platform uh can be assured that they're using something that has been audited and is secure um and so they don't get exposed to unnecessary risk

right and and when you say they're uploaded like they're uploaded to all of the CM wasm chains that support abstract or is there some sort of like centralized um orchestration mechanism for all these modules yeah currently it's every CMM chain uh that supports abstract and uh the check sums are verified between the chains so that we can assure devs that if they depend on uh an app on one chain they can get and they have the same version on another chain that they can be guaranteed at the same check sum between chains okay I mean the security um kind of process that you described do you think it's sufficient I mean because

like as this scales um like one thing that stands out to me as potentially uh problematic is that you know people can publish modules there okay there's maybe like a link to some audit uh but that requires some kind of human verification to check whether that audit is real uh for you know at the least and um and you know that that might be difficult to uh to scale if there's like lots of different applications being built there um and it it I don't think it takes very like you know I think a targeted a

targeted very targeted vulnerability you know with one very highly dependent application or an application that a lot of other apps depend on you know we've seen this with like um kind of supply chain attacks in web 2 um yeah like how how do you how do you ensure that supply chain attacks can happen in abstract yeah of course we can't guarantee that this is never going to happen uh though there are two types of um two types of modules within abstract there are app modules which are per account per instance um and there's uh they have specific configurations per instance of the application and there's

and the adapters are not migratable so if you have a a DEX adapter you actually get a static address that does not expose the migrate function which protects you from the publisher of that Dex adapter migrating it and kind of potentially rugging you of your liquidity um on the supply chain side we are looking to uh create a platform to incentivize people to expose these vulnerabilities uh on test Nets or on testing environments uh by having like continuous hack of funds um and continuous bug bounties where if you expose a bug that might expose you know 100 million worth of liquidity then you get a very sizable Bounty for uh giving that uh bug report and uh exposing it

additionally on the application side every app has a suspend function that is callable by uh the owner of that application so if there's a vulnerability that's published uh abstract can expose a uh a service that would automatically pause the applications that may be affected by one of these attacks this is something that's very common in uh web 2 companies uh but it would of course be an opt-in Service uh as would for example automatic updates [Music] [Music]