Building Blockchain's Emergency Response Layer w/ Bobafetador (Drosera)

Transcript

[Music] hello and welcome back to the strange waterer podcast thank you for joining us for another episode let's imagine that you and I just founded a new protocol maybe a DEX and let's imagine that not only did we successfully ship our code but we got the whole Community incredibly excited about what we're doing and So within just a few weeks people deposit over $1 billion dollar worth of crypto assets awesome now let's fast forward a few months and you and I are shopping for mansions in Switzerland and our phone

starts blowing up most of the messages are just the entire Community forwarding you you and I a tweet from PEC Shield hey strange water decks you might want to take a look the rest of the messages come with an ether scan transactions and say something to the effect of hey someone just withdrew 60% of your tvl are you guys doing something and in that moment you and I look at each other who will be the first to admit it out loud we got hacked in this moment once it's too late and the hackers have already disappeared back into the ether we ask ourselves one of those questions that seem incredibly obvious in

hindsight why was it even possible to withdraw 60% of the tvl in one transaction and if we're really thinking clearly one of us might ask there's no way a transaction with that kind of profile could be valid why didn't we just build our system to identify it and to mitigate it even just a few years ago the answer would be pretty simple it just wasn't feasible to build a rapid response system within the confines of the evm but in this industry a few years ago might as well be a lifetime and so in 2024 not only is it feasible but thanks to the efforts of

today's guest it's becoming almost easy drosera is the first decentralized incident response protocol leveraging a deep bench of security expertise some of the most talented builders in the industry and the incredible magic of zero knowledge technology and today we have the perfect guest to walk us through drosera and all crypto security co-founder and CTO Boba fador over the next hour we go deep into the challenges and intricacies of building security systems for the world computer not only will you learn so much about what it means to be operating in the exciting but dangerous environment

that is the evm you'll learn just what it means to build safe and responsive systems in the blockchain environment for anyone building a protocol that houses really any tvl this conversation is a must listen one more thing before we begin please do not take Financial advice from this or any podcast ethereum will change the world one day but you can easily lose all of your money between now and then all right and now for boba fador boba thank you so much for joining

us on the strange waterer podcast yeah man it's really good to be here of course man I'm so excited to talk about Jor sah and like the work you're doing in probably the most important and least talk talked about aspect of like Financial Computing but before we get into like the meat and potatoes of what you're working on I a huge believer that the most important part of every conversation are the people in it so with that as kind of a frame will you tell us a little bit about yourself how you found crypto how you found maybe Security in crypto and uh maybe why you decided to build a company in it yeah yeah absolutely some background of myself probably come from like a bit of a different background than most people um I actually worked uh like a GPS company or worked on something called

mg which is an acronym it stands for military GPS user equipment so I basically worked on a bunch of like really crazy stuff uh in their weapons program where I worked on like anti-jamming Tech um and like mind detection and stuff like that so you know using as6 um and like lowl Tech um you know to to be used out uh in the field um and I I basically you worked there for a couple years uh and I think I basically got to a point where uh it was like 2017 is right this is like where crypto kind of starts to hit a

little bit more mainstream more people are talking about it I start to look into it a little bit and I'm like oh yeah sure I understand this blockchain stuff uh but then I ended up looking a little bit further doing some hackathons and stuff and I was like oh like I actually there's tons of stuff going on here um and so I started to kind of build like little side projects um and mainly like starting out making like Arbitrage Bots uh doing me one of the first things I did was I made like a a flash loan bot that did some like flash loan calculus to do Arbitrage between dexes um and so this was something that I thought was like super awesome because I basically could make the software that would just like print money

and uh this was like during the most volatile time kind of uh 2017 2020 lots of stuff going on in crypto space um uh from there kind of like moved on to doing monitoring in general right it's like I'm already looking at doing like Arbitrage so the next step was looking at monitoring certain types of data in the space so I looked at uh doing monitoring systems in the evm polka and Cosmos and so I saw like a lot of different ways for how you could like see what's happening um and naturally I kind of fell into doing security because like obviously a very big part of security is like dynamically

monitoring and looking at um ecosystem wide events right um and obviously those are some of the like the biggest things that people care about is like all these hacks like Bridges getting hacked uh Dex is getting hacked um in just like huge huge uh events and so yeah I I naturally kind of fell into doing uh security work for that because honestly it feels like if we can solve the security problem in in crypto then kind of all All Ships will kind of like rise right like everybody will benefit from that and I think that you know that's like part of

the space right is to make something that has a huge impact that helps everyone yeah so that's like where I get a lot of inspiration from as well I think you're spot on to with the Insight that like if we solve security problems it lifts the tide for all boats and I think we hear about this a lot more frequently and a lot more directly in the me world where it's like it's called maximum extractable value being that like these people are extracting value from users and from builders and if we can solve that then like literally everyone except for the scalpers benefits and it's exactly the same with security where like the people that are able to take advantages of these

weaknesses are not like are not positive some value added players in this and so by solving these problems it's not like we're rearranging the chairs on the the Titanic and making sure that it looks better but the same people are able to do the same mouth Seasons it's like we're making this a better and therefore more viable system yeah it's about aligning incentives right I think it's all about aligning incentives to where it's like a net positive for everybody and um yeah that's like a big part of uh why I was just interested in the space in general was it was like there's a way you can actually align all of these different like pieces in these pipelines to actually you know feed liquidity back

into the system and help grow the ecosystem as a whole and I I think what's really cool about your background compared to like the more typical like enter through the finance realm uh background of crypto people is that for for many of us myself included we needed to like learn what an adversarial space feels like and like how to basically exist and thrive in a space where there are like actual villains around every corner like trying to trick you into doing something stupid and your background is like you like forget just like military stuff you working on active field military stuff like literal War stuff which is the most adversar of adversarial and and I just wonder if you

have any Reflections or thoughts on how your time working like in and around the military really made you the right person to like be like founding a cyber security Empire within crypto yeah I I think it gives be like some very unique perspectives because um although it may not sound sound like it um you know GPS is actually like very um cryptographically heavy like there is like super important cryptographic stuff happening inside of those little embedded machines that are like running this this this GPS software and then uh getting signals from satellites and

interpreting data and so that has to be something that like is a major design a major piece of the design is making sure that those keys are kept safe on those those devices and so um from that perspective it's like I already kind of had this um this like perspective of like there there's an adversarial piece to this like when I'm writing a software I need to make sure that it's secure like I'm not just writing like some web 2 app and I'm trying to show like some nice dashboard or or you know facilitate emails or uh work with a DB right I'm

making sure that like secure military codes are safe and can't be captured by the adversaries and and on top of that just uh from like an Effectiveness perspective of like the the quality uh the efficiency of those machines is super important uh you you'd be kind of like surprised know like in that field you tend to learn how interconnected um time and space really are in in GPS uh in GPS world like I think like one nanc of time error is like equivalent to a couple feet um of like positional error so not only do you need to like look at this stuff from the

perspective of like everything needs to be secure but it needs to be like highly highly accurate because well people's lives are at stake and that I think that it's kind of similar right with what we're doing with security it's the same thing it's like we're making systems that are protecting millions and millions billions of dollars and we need to be highly accurate uh deadly deadly act accurate right um so yeah I think that that's definitely the similarity that I see between uh those two roles uh you know what I'm doing now and I think I I don't ever want to equate like the risk to real human life to like Financial risks right but there is something about

the parallel between like in war if something happens there's no like you can't undo that you can't try again like if someone loses their life it's over and and again I hate to draw the parallel but it's similar in crypto where like once the hack has happened like the Carnage is over there's nothing you can do you can only move forward and I think that this is about building the muscle of when you ship code it's not that it has to work it's that it can't fail right yeah and I think that really with what we're doing is with drer is about uh mitigation like there are going to be cases where an exploit occurs and there really is no way to prevent it right but does that mean that we just

kind of give up and let it go no we have to have systems in place that immediately take action to try to mitigate risk right if a pool gets hacked we need to do something to make sure that other pools don't get hacked if a bridge gets hacked we got to make sure that other systems in the ecosystem can uh disable that functionality so that people aren't just like blindly sending money into a black hole right so I think that that's really the thing that we're focusing on at D era is that like prevention is absolutely something that is the um it's like the the um a a a golden Milestone it's like the the thing that uh the Holy Grail that we

want to be able to achieve but the reality is that prevention is uh basically impossible I mean it's it's it's borderline impossible to do 100% prevention and so I think that what we're focusing on is like if you can do damage mitigation and you can set it up just by deploying a smart contract why not right and so I think that that's what we want to be able to show the world is that it's possible to do damage prevention and mitigation right um and you can do it just with smart contracts yeah awesome so I think this is like the perfect Pivot Point to bring us to jera but instead of going straight there and talking through like what it is how

these smart contracts work what's the goal blah blah blah I think I always like to ask um help us understand what drosera is through the lens of the founding story so how did you realize there's a problem how do you realize there's an opportunity like what is that moment yeah um I think that it came from just my experience with making monitoring systems uh in like kind of like three big ecosystems and it kind of found like a very common theme when making them which was always like you always felt like you had two really big jobs one which was like well you need to have monitoring for the informational piece like you it's good to get alerts that tell you oh you have an uptick in users or volume that's all good stuff to

know and it can help you to kind of like be like okay in the next day or two like let's kind of look at this or let's change this or maybe like let's let's do something but uh there's like a whole other spectrum of monitoring which is not only do I need to be like alerted about this but like an immediate action needs to be taken and building that Tech um it's a challenge um but it's honestly not the biggest challenge like the biggest challenge is actually managing it because like if you're a protocol you shouldn't be spending like all this time and effort managing all of this uh infrastructure right you should be focusing on your application you

should be focusing on like the core value that you're providing to the ecosystem um and so that's when we kind of thought about well like what if we could make a way where people could like delegate their security infrastructure to to a network of decentralized operators that run it for them um and so he said okay like is there something there like let's kind of like look into that because um that could really mean that a lot of smaller Protocols are able to get security infrastructure that would more or less be like totally impossible for them to set up their themselves um and how do you make it effective how do you make sure it's like actually effective um and so that's when we started to look into what are the

different ways that we can make this uh this system um yeah so we started to dig into it and figure out what what's the most important part um and what do people care about what needs to be the easiest piece of the system um so with with drer the way that we thought about it with my like kind of me background was that it has to be something that is like incentivized and so we thought about how it can actually form itself as a security Marketplace and so this would be the security Marketplace um it kind of manifests itself as what we're calling a incident

response protocol where there's like some incident defined by a protocol a protocol is one of the players in this Marketplace they come to drer and they create a smart contract called a trap and it defines what they considered to be an emergency incident what is like an emergency condition that they believe is something that's super important for them to take some emergency action uh so they have this security infra that they Define in a smart contract and they basically want to Delegate for uh operators node operators to run the security infra so uh node operators are the other uh player of this marketplace

where they go to drer and they say okay let me look and see what are these like different traps that I can opt into and Run Security infra for and how are they incentivized you know does one trap particularly have like a lot of incentive right and maybe it's like a really big protocol maybe one has a smaller incentive but it's for a smaller protocol right and so there's kind of like an equilibrium there where people can kind of come and say hey like I need like three operators to run this this task or maybe I need like 20 50 operators to to run my security infra then they can use drer as like a kind of

permissionless trustless space to connect these two groups of people um yeah and so that's that once we kind of like started with that idea we started to realize that uh this is actually something that's possible to do um and it requires quite a few pieces of tech to accomplish it it's it's definitely an ambitious goal it's very ambitious um but I think that from all the conversations I have with people uh it seems like everybody's very interested in what we're doing and they think it's actually something that that can make a difference yeah dude makes so much sense and before we even get into it it's

obvious like there's a need here and there's an opportunity here but so let's uh let's let me just review everything you said and make sure that I got it so the Insight starts with as someone who set up a lot of Monitoring Solutions the realization that in order to do monitoring right you need to hire like a like an operations team let's say forget about setting up all of the infrastructure you need to hire at least a guy probably multiple guys to be sitting there at the infrastructure waiting for all these pings in and then to make decisions based on the things that are coming in and that's like totally fine for someone like a or Unis swap or starkware someone with like billions of dollars right but that is

much more of a problem for like Stanley the guy who just got his computer science degree and wants to build like the an idea of a DEX or you know some maybe like Venture back company that just raiseed $2 million but like just wants to run as fast as possible and doesn't want every sing single you know deployment to be like added two months just getting security rigging in there right and so that's the opportunity that you guys saw yeah absolutely and I think it it goes even further to where like um I think that a really big concept that we see is just people are uh you know there's this theme I guess in in the

crypto space of devs getting an alert at like three or four morning and then having to like sign on multisig and take care of it and I just think that like we have to be realistic right and we can't say that that's like the standard uh for for the space like that that seems like you know certainly you should get an alert and you should take care uh if there is like some really big issue to to take care of um but like there should be systems in place like a plan basically in place to mitigate damage already without people needing to like wake up and like scramble and figure it

out so I think that it really is just about standards right it's about setting a standard um something like simple and straightforward that is going to have like a net benefit and help everybody uh and we're just saying hey like we came up with a standard this should be like something that every serious protocol sets up because it's as easy as deploying smart contracts which is essentially what you are already really good at it's what your all of your infrastructure is already made with right um that kind of leads to another really important uh Point uh about why we kind of did this as well we went with this approach of like make it as easy as deploying a smart contract and like have

uh protocols create the security infrastructure with smart contract code um that that's like super important because uh being able to test your security infrastructure is incredibly important um you know you need to make sure that when you set these systems up that you like run it through scenarios you try it out against your protocol and what better way of doing testing than testing using tools you already use rather than like setting up some whole other system and like combining these pieces and kind of making like a Frankenstein that you need to maintain and update constantly right so yeah it's all about trying to make this stuff as

seamless as possible for people and as testable as possible yeah and I think there's there's an Insight in there that even if the tools are available if they're not like easy to use and they're not like part of your regular tool kit it doesn't really matter if they're there people aren't going to use them and so like it sounds like what was really important as you're building like the just the basic tools of draer to make sure that they look and feel and act like just what the application the company or the protocol or the developer is actually working on feels like yeah totally yeah at least that was my experience with making these monitoring systems was that it felt like um when

you're at that evm level writing smart contract code It Feels So natural like if I want to grab this data I just write a line of code that goes and grabs that data if I want to interact with the smart contract I write a line of code that interacts with that smart contract it's very natural and straightforward but when you are making like monitoring infrastructure um you end up you always have to end up making like a wrapper around like the evm where you're like mapping data from the evm to whatever language or um framework that you're trying to build monitor in and it acts as like this severe bottleneck uh for

how quickly you can adapt and how quickly you can evolve your software because you always have to keep adding this like mapping piece and this translation piece and you have to keep making sure it's correct adding tons of tests around it um and it becomes like a huge huge hassle uh the analogy that I like to use here is it's kind of like at evm level when you're runting solidity it's like you got your Lego blocks right and then in monitoring World it feels like you're using Mega Blocks where it's like well like yes I can put these pieces together but you know I don't get as much like granularity and like it's just not as easy to use and it's honestly not as fun and I think that

that's like a really big part of this is like setting up security infrastructure should be enjoyable and I think that could be a big part of why we kind of have an issue in the space right is that if it's a barrier like it's it's difficult to set the stuff up um just because a number of challenges so give the people what they want let them use the evm you know to the full extent of what it provides to us yeah and just to hammer home your point like how many times have we all written code where it's like module a we like know it works and module C we know it works but for some reason like the the whole system isn't working and then after like 35 hours of debugging realize that in

module B which connects them you just forgot to multiply by two or you've just forgot to do a negative sign or like and and that's exactly what you're talking about is that before drer if you wanted to set up monitoring and then like action plans against that monitoring you're responsible for basically frankensteining together like the the enough tools and like even if you're willing to do that you're just introducing so many more opportunities for bugs and for issues and for latency and like all this kind of stuff yeah yeah that yeah that's so true yeah it really hits home because that that was the number one issue that I saw like right out the gate so working on rera

and making this feel like a a natural component uh for for developers it makes me excited about using it because like you know I want to be able to set this stuff up and have like you know a whole host of different like security infrastructure uh uh traps where I can just like deploy something and then I don't need to worry about making sure that I'm hosting some server somewhere Etc I can just make sure the Trap is incentivized and then the operators in the decentralized network will pick up this trap and start running it right so you kind of get to fully leverage you know

decentralization you know trust minimized compute um and and evm like Allin one so let's I think it might be useful to like kind of walk through a hypothetical here so let's say that I just rais a bunch of money to to develop and deploy Rex Swap and um sorry VCS that just gave me money like all it is is just a super simple deck it's like uni V2 but I don't even have multiple pools I just have e to usdc right so I realized that this pool is going to have $10 billion in it very shortly and so I'm like freaked out about security now I if it's helpful maybe talk through what I would do without jera but really what I'm interested in is like what does it look

like for jera so first of all do I need to do something special with my smart contracts that are just like the Dex smart contracts do I need to give any privilege access to like drosera operators yeah so uh this like really cuts to like a very important part of like how the system actually works Works um the the the way that we have it set up is that um essentially if you have some privileged functionality maybe to pause uh your your contract freeze some part some functionality of it uh do something about a dependency you have or just really like take any type of action

that requires uh some type of like higher level privileges um all you really need to be able to do is make make sure that you add like a require statement that that functionality can only be triggered from the drer uh trap contract and the derera trap contract can only trigger that action if there's been uh an emergency response payload that's been submitted to the contract from The Operators that has at a minimum 2/3 signatures of the operator that are running your trap um and so this acts as like a threshold signature right to make

sure that there's been you know if you have like 20 operators right you get a majority of them that say uh an incident has occurred and the contract will verify uh this these BLS signatures uh that they're actually correct that these people did a test that saying that your emergency condition did trigger and then uh once it's verified that that's true then the emergency action the function that it's been pointed to is allowed to be to be hit so it's it's like less of an operator specifically having access to hit your functionality and it's more

about the the the network that is opted into your trap uh and them have coming to consensus basically on whether this incident has occurred um additionally inside of there we're using um risk zero uh as a way to do fraud proofs so basically there's like a dispute window after an emergency action has been triggered and in this dispute window uh a disputer can submit a ZK proof that says I have like evidence of what really happened right it I can say mathematically that the incident didn't occur and that the 2third of operators that submitted this actually colluded and so

then they can all be slashed and removed from the network um yeah that that's like a really big aspect to the system to make sure that you have like accountability but additionally we have functionality where um even if you don't have any of these operators that are uh you know coming to consensus you can still submit a ZK proof that an incident occurred as a validity proof rather than a fraud proof so that validity proof means like um if nobody has attested that the incident has occurred I can generate that fraud proof and I or the the validity proof and send it onchain

and it'll trustless uh cause for that emergency response to trigger without they needing to be any type of social consensus super interesting so I want to put a pin in this and come back to it ESP especially around like what are the implications of having a challenge window for an emergency response right like those seem intention but but let's just continue walking through this Rex swap example so okay very clear on how this is architected I deploy Rex Swap and I decide like if I ever see more than 10% of the lp leaving the smart contract I'm going to consider that an emergency like that's probably a hack if it's not a hack I still want to treat it like a hack and then kind of go from there so first thing I do correct me if I'm wrong

is in my Rex swap smart contract I create this special pause function that is only called by Whit listable addresses and then in there I might put myself the other multisig owners but importantly I put the drosera emergency response smart contract correct yes that's correct yeah yeah you specifically identify yeah this the Trap contract yep so then I'm like okay so I've got everything wired up now I need to create my trap or my emergency condition and through solidity and and however whatever tools I'm using I essentially through code right if you see more than 10% of the lp withdrawn trigger the emergency uh function okay and now I

give my trap template to the drosera smart contract so my question now is like what happens is it basically everyone in the drosera network is now responsible for monitoring that trap are uh participants opting in and committing to that trap like what's the next step in this process yeah yeah there essentially the participants H can opt in to whichever trap that they really want to support and run infra for so these participants are running a drer client and when they opt in the client automatically picks up that they opted into the event and then it'll essentially go query uh for the the trap information uh from a seed node these

seed nodes are essentially just nodes that uh are given this trap information uh from the user the user uses like a CLI to create uh their trap and so uh basically these operators are able to opt in get the trap information and then just start running it uh just start running it for every block um and yeah and so that's essentially like how they're able to opt into the system um and we we've yet to do any like benchmarking on this but uh we peree that like operators should be able to run multiple traps um and so this can actually be really really nice because

then they can get incentives from all of the different traps that they're running the more traps you run the more incentives you get and and so when we're talking about um incentives so I've created my trap more than 10% of the lp trigger the emergency contract how am I incentivizing it and am I essentially saying if anyone ever uh triggers this condition then here is the like you're allowed to take this bounty and then for the next one I'll just need to reup my bounty am I paying people just to have them constantly R like monitoring the Trap even if it doesn't trigger how does incentives work yeah so with incentives um basically set it up in a way where you create token streams um and these

token streams is essentially like I submit let's say like a 100 usdc um and this 100 usdc uh will be given out to operators on a passive basis uh but then a a big portion of that usdc actually goes to something that's like kind of considered a bonus pool and this bonus pool is like the reward that gets distributed to the operator that submitted the the incident and it goes to gets distributed to any of the signers that participated that that said yes I saw this issue happened um and committed an attested that that

issue happened um so it's a mix of kind of passive and active rewards you're paying for people to be able to uh run this passively uh right because your emergency may not happen right but people are still getting paid a passive rate uh Just for participating um and the way that this works is that you know let's say that you created this token stream um you know you create this token stream and over a month period and you reup on this token stream every month that bonus pool it will still fill up with uh over time and eventually kind of get you to a point where there's

actually like a very large incentive for operators to uh perform your emergency response when it happens because it's kind of like this big jackpot where everyone wants to be the first person to submit that emergency response and to get those rewards um this acts as like a really nice pipeline for making sure that these emergencies get caught as soon as possible but also they these emergencies uh these emergency like transactions uh can actually be included on Chain by making sure that you work with like block Builders to make sure they also get some part of the incentive right to make sure that you could even have a emergency response happen the

next block right that's really what we want to shoot for with drer is to be able to have that emergency action happen as soon as possible uh to mitigate as much damage as possible and and just this is a clarification question that's much to in the weeds for podcast like this but um are so so we have the like the big bucket of money that is paid out to like any who actually catches incidents does that stay isolated to each uh trap so for example like let's say rexland actually turns out to be pretty good code and so even though I'm paying you in perpetuity for this monitoring service it never gets triggered meanwhile the Ronin Bridge gets hacked again and uh but

fortunately they're hooked up in drosera and so someone is able to like step in and and do a mitigation is the money that I paid in to the bounty pot going to pay out the person who stopped the Ronin Bridge hack or does that stay isolated just to my um security thing exactly exactly it it would stay isolated to you it's kind of like you you're you're you're putting gas in the tank of uh your security infrastructure and I think that's it's really important to think about it that way where uh a trap is kind of it's not like a consumable thing where it kind of has like a a start time and an end time and then it's done it's when you create a

trap it's yours it's something that you own and it's something where you can update the security conditions you can update your emergency conditions on it so uh money that gets put into that jackpot uh you know the more that fills up over time it kind of is like this large incentive for people to continuously perform uh emergency response for you and run your security infrastructure um whether like you change your emergency conditions sometime down the road maybe you just added a new dependency on an insurance protocol or or or a DEX another Dex maybe or a bridge like Ronin right and you want to make sure that if if Ronin

gets hacked and it gets paused that you take some type of emergency action to make sure that your users don't get affected that jackpot money will then go towards the operators to make sure that they are like actively performing your emergency response for you and do you foresee a world where like let's say okay I've got rexland I have a lot of money but I don't really want to be paying anybody in perpetuity for something like security monitoring but I would be interested in let's say dropping 30 eth into the jackpot pool knowing that if that swapped to stake eth then like that could create enough Revenue to pay for the streaming part of the incentives is there do you ever see

a construction like that yes absolutely yeah it's funny you bring it up because like that was kind of the first thing that we really started on when we started thinking of incentives because like obviously we want to be able to lower the barrier to entry for this stuff right so we want to be able to make sure that those costs that people have to pay um are really like as small as they can be um and so we do kind of have like a plan that kind of have this idea of um defi incentivized security where you can have uh like an LST uh staked on the platform and then uh you know a percentage of this the LST yield over a year is actually used to help

incentivize drer traps right so it could be something where you know you've been an active participant H in the drer ecosystem you've been running traps and maybe there's a way for you to get some of that yield because you've been such a large participant and this like lowers your cost it lowers your cost to run the infrastructure um and the way this infrastructure this payment infrastructure is set up is also where we want to be able to whitelist uh Native tokens for protocols so if you're uh what was it rexex if you have a native token if you have if you have a native token um you perhaps as part of your

emissions the your your your kind of like yearly uh emission rates you may choose for a portion of that to go to your security trap right and so uh those tokens would then flow down to the operators uh running your security infrastructure and that helps align the incentives right because now those operators really want to make sure that your protocol uh is doing really well and has a really good health Factor because well they're kind of economically like attached right because they're getting paid in those incentives right um and so that that also allows for people to kind of uh make sure that

there's an alignment here um yeah which it kind of like leads itself a little bit into the igen layer piece when talking about like alignment right alignment with an application and then alignment with ethereum itself uh right um you know what we're talking about here is like uh basically with igen Lair you can actually make sure that validators are uh aligning themselves with your protocol not you know validators are not only doing um verification uh and security for consensus uh and execution layers on

ethereum but now they would be doing security for an application layer your application right and so this helps to make sure that your dap is aligned with ethereum itself uh which is like very beneficial right to make sure that you have like a growing ecosystem and and I definitely want to get to igen lay but I'm going to push this off to the last 10 minutes there because um I this the last piece that I want to unpack with integrating or using jera is like you have to craft your protocol knowing that it's there so we'll go back to Rexx decks like we have agreed that we have this pause functionality that drosera and and maybe the maybe a few other

people are Whit listed on cool makes sense but the problem is like if I don't build into my decks a let's say five block delay between when the withdrawal command is sent and when the assets actually come out of the decks really doesn't matter how many people are monitoring and how many people are willing to push that button if like when you hit withdraw the assets immediately come out there's just not enough time for someone to like get in the way of that hack and so I would love for you to spend some time talking a little bit about what does it mean to design protocols with one just this kind of security in mind but then two like what

are the particularities about making your protocol strongly aligned with the jera um security Paradigm yeah there's kind of like two pieces to that one is actually like certainly you can create your protocol with uh drer in mind right where you maybe have certain functionality you know you want to be treated as emergency response functionality um but like obviously there's also upgrades being able to upgrade and add new functionality is certainly another way that you can become like derera aligned uh but additionally there really is no uh constraint on uh making sure that

like your emergency functionality is built into your protocol you could set up another smart contract that has functionality that you want to be executed as well right so you can make new contracts and specify emergency functions to be hit on the on those as well uh Additionally you can also have a functionality where an emergency response is triggered and you could have offchain systems see that this emergency response has been triggered and you didn't take any any types of actions like maybe you're using a zapier right and you have zapier looking at uh looking for like

whether this emergency action is taking place and then it does a couple different offchain things right to be able to like maybe send you additional alerts or maybe do some other things off chain um so you you're not super pigeon hold to having to integrate it directly into your contract you're able to kind of use it really kind of however you want to be able to use it though obviously I think integrating with your contract is where you get H the biggest punch right that's where you get like the strongest value is being able to do something with like Authority at your your protocol level um and then I guess uh the the the second piece here is this idea of like uh being

able to uh react as fast as possible like if uh there's like a drain that happens and there's like a sixc withdrawal window right um you want to be able to make sure that drer can act as soon as possible Right like that's the thing that's the most important for us is that uh we want to be able to H have this emergency action happen the next block and so uh you can look at previous hacks that are multi-payload where uh the hack occurs over like you know 50 blocks 100 blocks multiple pools are being drained uh all you really needed to do which rarah would be able to see that one of these pools got

completely drained and then taken some action in the next block and saved a couple million doll uh because then the other pools wouldn't have been drained if it had been paused or some action had been taken so I I take your answer to be like yeah it's important to build the smart contract with like emergency functionality built in but that's not really that heavy of a lift does that sound right yeah it's I would say that you know if a protocol developer has created a whole protocol then this piece of the functionality should be like very minor I mean it should be a very small lift yeah I guess like last piece on this is

I as you kind of like describe some of these use cases like a part of me is like yeah this is super valuable for protocols but also I think about like myself as a participant in Defi and there's like so often that I just don't really want to put my Assets in protocols not because I don't trust the protocol but because I don't know what's going to happen and like even to the point where like I'm concerned with putting like Ethan a to take out a US DC loan like probably the most vanilla thing you can do in this industry but because I know that like it is very possible that something happens while I'm in in Colorado next week without my uh private keys right or I'm just doing

something where I can't respond and so I guess my question for you is it makes so much sense to build jera as a kind of like a B2B or protocol to protocol business but how much opportunity do you think there is for just like users who want to be like sophisticated and safe in this space to use either jera or platform like that in order to um just like take their OBS sec to the next level yeah I mean uh I think that like in terms of uh I suppose like your question is like how easy it is or or or or what are the uh what should they be thinking about

uh to increase their opsc yeah well I guess my question is is as your as an entrepreneur and as like a a leader of uh jera do you find this to be like an interesting segment of like power users and whales that have enough at stake that they are willing to pay for like protocol level security or is that like a little bit of a pipe dream and really what this is about is about making protocols more secure yeah I think that absolutely it opens the gates for uh protocols to do B2B plays for individual whales Insurance protocols um I mean I think that this is kind of going to open up uh the space for like

anybody to have some type of like decentralized compute that they can have have done where it's going to help uh uh potentially like protect them from really bad situations or really honestly take any type of action that they just determine that needs to be uh made right like a really good example is like if usdc is deping right maybe you want to be able to have your funds get swapped out to to a different stable that's like a very simple use case where it's really easy to see if it's dep pegging or it's like dep pegging very heavily right so that would be a case where it's like well uh I'm about to get on this plane and it looks like it looks like the stable coin is is deep pegging

like I don't know what to do right and then have to like wait it out and just like pray and hope that that everything's going to be fine with something like drer um it should be as easy is basically like setting up the smart contract and then deploying it right and you know you could pay uh you know like 100 usdc or or 100 eth right 100 yeah 100 e yeah uh you know you should be able to essentially like pay with like any kind of token um to be able to incentivize this and I think that there's also a play there where there'll be operators that may have like a focus on particular uh protocols or

even like for particular whale groups where it's like hey I'm an operator um I I run under Sarah and you guys uh are basically saying like you have the security infrastructure that you need uh me to run we can kind of like set up a deal and we can use this Marketplace to facilitate that deal it's like I know you you know me we can run this infrastructure uh and it can it can allow for kind of like broader Network effects um where people can kind of become experts at doing a particular type of uh monitoring I think FDR puts it uh kind of like looking at a new form of like security engineer uh called

Trappers and so these Trappers uh kind of like expect to see uh them like look at all the different unique use cases for how you can build a trap and like who what type of trap is the uh best like template or framework for a particular protocol or to a particular uh Dow even or um to a whale so yeah I think that it's certainly a wide reaching um and the biggest goal here is really to make sure that we help like the little guys as well right because that's I think the the kind of like lifeblood of of the space is is the people that are still small but making

really cool stuff and making sure that they're able to survive long enough to uh get out of uh strange Waters right yes yes no man and and as you just kind of walked us through that you you made one comment that was essentially like we're trying to build a network of computers that allows you to like take um to to do compute like when it's needed and and on this show we talked to so many companies that are buil essentially figured out that with ZK you can do offchain compute project it back into the evm and like blah blah blah cool things from it and we've talked to a lot of people that have essentially said we're building uh a network of

computers to do computation and then put it back in but with draer this is the first time that I am hearing someone say we are building a network of computers to take action based on time sensitive information and like that I think is you know I I I very much appreciate the the entire Framing and the focus on security and like that's of course what you need to do in order to raise money and to like stay focused and to build and all this stuff but just taking a step back like everything that you're talking about is so much bigger than security like for example the usdc dpeg that you just cribed yeah I can make a trap that says like okay if you start to see usdc

dpeg trade out all of my usdc for usdt right but you could also do it the other way you could say in the event of a usdc dpeg take all my usdc and buy as much unpegged usdc as possible and now suddenly your your security infrastructure becomes just about time triggers and about of like seeing these like very specific like articulated things on chain and then doing things related to that absolutely yeah it's it's it's like under the umbrella of just risk management in general right because that's really what we're talking about here is it's all about risk management and what and we're not the ones saying uh your trap has to be this way or it has to have this functionality

like we're saying hey like you you guys are the ones that want the security infrastructure you should be the one to Define what it looks like and we definitely are going to give people lots of examples take inspiration from but yeah we want to be able to make this be like this risk management framework right uh where people can come and and just set something up um and uh it kind of reminds me of something I've kind of talked about in some other Twitter spaces which is like the way that I kind of see crypto right now is it's very much like reminiscent of like you know your web 2 days where things were like still very simple websites kind of had maybe one or two Services right um but

you know now I think like with uh new Innovations in the space I think that we're going to see protocols that are using multiple Services similar to how web 2 is now where there's like one website that uses like 15 different services and I think that with drer one of the really main points that is unique about it is that it should allow for people to create these uh security conditions where it's actively monit ing your services and your dependencies because if one of those things goes down like you want to be able to have your system react to make sure that there is no like Fallout you know you want to like contain the damage um and I think that you know this space is like super complicated right there's just so many

different pieces of a system that could break down and as of right now I feel like we don't have the dynamic piece built in yet I think we're really focused on static kind of analysis of contracts which obviously you need but it doesn't feel like any of these um any of these protocols or contracts are like going and looking over at like what's happening over in this ecosystem that I'm like heavily attached to right it feels like that part is much more social uh and manual and I think it needs to be automated so that when that things do happen that we can like activate and we can make sure that something is done to protect users to protect your own funds

to protect yourself just in general right yeah makes a lot of sense so I I promised that we get to this let's with our last like five or 10 minutes here uh talk about reaking and talk about how that transforms what jera is doing so I uh with I can imagine without putting words in your mouth why don't you just like walk us through um first of all like how at the basic level does reaking uh get integrated into jera and then maybe you can talk through why jera is a much more powerful platform when the participants are leveraging reaking versus basically everything that we've talked up to this point which is really just more about people acting like somewhat

altruistically in this network uh for for incentives but also just because like they believe in security so can you talk through how reaking transform stera yeah yeah absolutely yeah so I think that it's like a big thing in the kind of like reaking and I layer ecosystem of like we've created these systems that has tons of tons of incentives but we need some uh disincentives right we need some way to make sure that there's like a counterbalance and I think uh with reaking you basically can make it where um people kind of have uh a voting power right they have like an amount of capital that they can use to say you

know I am putting my money where my mouth is like I'm an honest actor and I'm putting my money here to say that if you catch me colluding for me to get slashed and obviously anybody else involved to be slashed and and this is like super important to make sure that you basically have the super trust minimized way of doing compute uh is holding people accountable right with this kind of like punishment slashing mechanism right um and so with with reate it not only gives you that ability right slashing but also comes with it and this type of cryptoeconomic security the amount of reate capital that is

available to be slashed or you know at that's used for accountability uh acts as like a barrier for corruption right the higher it is that means the harder it is to kind of uh uh have the participants collude um it kind of comes down to like really basic equation of uh what is it uh cost of corruption versus profit from corruption so you always want to make sure that uh your cost of corruption is higher than profit from corruption and that's how you kind of have like a non- gameable system um where like people if they wanted to collude they would only

lose basically they they wouldn't really gain any um and so with reaking you could make sure that with drer that people are staking up to a certain threshold to where uh the amount of operators opted into a trap uh have more at stake than perhaps the amount of uh capital in the protocol they're protecting right I think that is like definitely a longer term vision of imagining having you know whole host of these operators with reate capital um you know protecting all these like smaller protocols and kind of like

lifting them up over time right um then and then obviously like aligning um these these operators uh with ethereum itself right by them uh natively restak versus like an LST right that's also like really important to make sure the incentives are aligned between ethereum and your application uh and its Security in general right yeah and and I'm so glad you said that like I I always was and still am a fan of Igan layer but the second that it basically became a smart contract to put your lsts in so that maybe down the road we can have some

sort of delegated proof of restake thing like that is nonsense to me native E3 staking makes sense to me um and so I I just love that distinction but I think um so I've been like really working hard on trying to articulate why this whole reaking thing is happening at the same moment that like the ZK Gold Rush is happening because like on on face value they just don't seem that similar but I think where where I'm really getting and I think what you just said hammers at home is that with ZK it it is actual magic but it only gives us one half of what is so cool about crypto right it

only gives us like perfect Fidelity and like trustless trust that whatever happened was supposed to happen what it doesn't give us is liveness and like what what reaking does is introduce an economic um like you said an economic penalty that allows us to like re bring in liveness and re like to to use consequences to like kind of reput together what cry crypto Economic Security even means and that was like super generic big picture like what this means for jera and like really what I've been struggling with this whole time until right now is like how do you guarantee that the jera network is going to like

move on your trap so we're at Rex deck somebody just came in and withdrew 50% and like it is clearly violating the Trap and my question to you this whole time was well how do we guarantee that somebody is going to actually do the work to verify hopefully 2third so we get the threshold uh signature or maybe just one person with the validity proof but like how do we guarantee it and I think the answer is reaking right and I think that um drosera is a microcosm to that explains like what is so magic and like explosive about the moment that we're in yeah absolutely yeah liveliness is basically where this stuff shines

right it's where you can make sure that people are are acting uh in accordance with like whatever rules you basically put in place your your slashing conditions right and I think that uh liveliness tends to be a very hard thing to solve um I think like in ethereum I think it's like fairly complex and then other chains actually do it differently um and so I think we're going to see as part of like new AVS is standing up different ways of doing liveliness checks but they're all like underpinned by the idea that like there's this resect Capital that kind of has a hammer over its head in case it doesn't act right and so I think yeah truly that is the other half of the coin there ZK and

reaking they're kind of like doing different things one is kind of optimistic and then other one is more uh objective right uh and so I think that that's where why they're on different sides of the coin but in general I think using them both is how you can get some really strong applications they have strong guarantees you know mathematical guarantees like objective slashing conditions and then also like liveliness uh being backed by your restate Capital yeah and I just I just want to like package that up in a bow again because this is such the perfect kind of concept to walk out on is that like drosera works so perfectly without reaking and

without like the stick right except for the fact that if nobody wants to like run a trap then no one has to and so like why reaking is so important is because by introducing consequences you can really have that holistic system that says like this is what's supposed to happen you're rewarded if you do the right thing this is what's not supposed to happen you're injured if you do the wrong thing and like that is um kind of like the magic of like the ZK reaking moment that we're in and like you guys just put it in this beautiful perfect package that makes it so easy to see yeah no absolutely yeah that was the vision it basically allows for blockchain applications uh to exist in like new

forms that you haven't seen before um and so that's that's definitely what what we're seeing with this we're not sure what to really call it it's not really like an app chain but it's kind of we've been calling it like a utility chain uh um right and so yeah very cool all right man I could go for so much longer especially now that you just opened up this whole conversation about app chain utility chain maybe like infra chain Z like oh man there's so much but just uh for the sake of your time and all of our uh attentions fans I'll cut it here so first of all Boba just thank you so much I I've been so excited for this for so long uh first since I heard FDR on the flywheel podcast which I

highly recommend to the audience please check out but um also since like your incredible news about the this most recent funding round so first of all I just want to say congratulations and thank you for making this space just like a little bit calmer a little bit safer a little bit less hectic yeah it's awesome to be on here man thank you um I'll be on anytime just let me know of course of course we'll definitely have you back but before I let you go can you please just share with the audience um where they can find you where they can find jera and maybe if they're hearing all this and thinking like uh maybe I could use for some emergency monitoring and planning like what's the best way to get started yeah uh I mean reach out to us uh dr. uh you can find the dev dos there

and we just started some Dev dos you can check them out uh get in contact with us in the Discord um and on Twitter as well um and I think that uh that should like give you some good uh Headway to basically figure out how you could create a trap and how you could create a security infrastructure with the native solidity code awesome and are you looking for um jera node operators yet or are we still a little early in that process uh actually we've got uh quite a few groups that we've talked to uh a little bit over subscribed for upcoming uh test net uh but we're certainly still like reaching out to as many as possible because I think that those are that's like the lifeblood of of drer is having

these operators uh having a really large set of them okay so note operators maybe wait your turn but what that means for app Builders is that there's already a very like wide and deep bench of people that are ready to be running your traps for you so good news uh even if it means a little time if you want to run one of these yep absolutely cool man well once again Boba thank you so much much appreciated and uh have a great rest of your day see you man have a good one n