More Security for Mass Adoption

Transcript

okay everyone that's cool um so basically um so let me introduce you a bit a bit more about nepture so Neptune were before an agency so we developed smart contract and realized security audits for companies and the thing is we launched several projects we launched 20-25 projects and we saw that at each launch there were several attacks so users were victim of cyber attacks it was phishing attempts uh fake mint sights and and so we decided actually to launch a product in order to avoid the scams avoid crypto threats I'm sure that's uh uh you all saw that this chart which is

representing the user adoption of a blockchain in comparison to the user adoption of the internet and so we saw that we see that it's a in a good road we will uh one day achieve a seduction but there are many factors that needs to be solved in order to get to Mad solution the first one is the real use cases and the user experiences so basically before reaching Mass adoption we need to uh improve the user experience of web3 so for instance propose a gasless experience to users because paying guest fees at each transaction it's complicated for for General people

um and also uh create real use cases like uh real meta verses that will have a huge impact on a user's life then there is a scalability and interoperability of the blockchain so how can a blockchain can communicate between themselves and without being hacked on a bridge and then there is a security and privacy so basically it's one of the for me the one of the three biggest main challenges of uh for reaching out to for reaching to mass adoption because today user security is a is quite complicated because we are losing the trust of people and so if we are getting out

that like continuing uh to to create to actually uh how can I say it if we we are still losing all this money in order to like uh still other Somalia to uh to avoid the scams uh sorry I'm just uh I'm just a bit nervous sorry so basically the user security is complicated because um security um is representing 21 billion uh in uh in in the crypto space so uh the 21 billion uh is um is actually uh sorry so I I actually segmented the the user security into

three steps so the first one is the user security it's representing so the scams The Rock pools and also the human mistakes then there is the application security so it's all the security which is um which is related to the bridge exploits the smart contract development the audits um and the all the uh the the security which is related to a web interface like uh for instance it can be a bridge attack like a datos attack or or directly into the depth itself and then there is the infrastructure security so it's um so it's regarding the 51 attack so it's really a

governance issues nodes issues um networks but I want to talk about it because it's today it's not really concerned so the main blockchains like ethereum polygon and the and other blockchains are not concerned about this problem because they are audited and they don't they are actually mature on this subject so let's talk about the application security so as I said it's regarding smart control programming uh smart contract audit and uh and so basically the problem is that uh you all heard about uh Bridge exploit like for instance uh several weeks ago there was

the multi-chain exploits which cost 126 million of dollars uh because of a just a private key hack so basically the problem is that the smart contracts can present vulnerabilities and the thing is when we deploy a smart contract it's over we can we can modify it and so it's fundamental it's crucial to audit it let's talk about the aqua nft collection so Aku was an empty collection that launched last last year and the thing is it wasn't a hack but it was a simple mistake you can see on the line on the blue line it's this line of code who

looked up 34 million of dollars uh into the smart contract so it's accessible on etherscan you can check it it's online and you can see that there is 34 million of dollars locked forever into this smart product um so you can also check your direct news so it's a journal where there is there are a lot of uh hacks of the last hex actually and so you can see also a leaderboard where there is the biggest hack so the the the biggest hack is a Rona Bridge which costs six uh thousand million of dollars um uh like lost because of this hack then

um there is the user security so it's really important there's usual security because it's concerning of all of us instead of the application security which is really focused on on the builders on the projects and the smart contracts available so the user security is focusing on rockpools on phishing attacks and also ux and it's uh particular because we can avoid it with the rest or the right practices uh the by just sending the right to the selection instead of malicious ones like a setup transactions so for instance I can talk about Kevin Rose so I don't

know if you know Kevin Rose it's a crypto influencer who lost actually two million of dollars by sending only one transaction so he has many nfts he's uh like interacting with blockchain every day like 10 15 transition per day so he's an active user and he just one day like he woke up on the wrong foot and he clicked on the button and it was a two million gun and so it's uh so everyone learned about this story because he's a famous guy but it's happening to everyone basically uh I know like a lot of people even my roommate has been scammed and now he don't want to use his metamask anymore so it's uh it's happening to everyone and it's

representing uh just in a 2023s in January 600 million of dollars so it's a it's still a huge problem we thought we thought that it was a uh just only on the Burma cat with the the bull run with uh of the nfts uh bubble but no it's still happening today uh with all the the new memcoins uh the Honeypot scams so it can be a rock pool it can be a fishing attempt it can be just a simple wrong transaction and the thing is today when you when when you sign a transaction on your wallet it's still complicated to know exactly what you're doing even for the most experienced users because sometimes transactions are complicated to

understand simple so I prepared the checklist to stay safe so if everyone has a meta mask it's perfect I don't know uh if you're really I don't know if you're really advanced in a security or not so this checklist is really for like the basics of uh of security so it's really to secure your private key with the hardware or wallet like a ledger check the validity of the URL so for instance there is wallet yard who is uh which is a good solution in order to check the URL um there is also it's important to learn more about the token that you're interacting with so the thing is

um I don't like to say that people need to need to do their own research because today it's the it's a matter of Builders actually it's important that wallet providers RPC providers daps and other Solutions proposed to the user a sufficient user experience in order to avoid scams it's fundamental but as we aren't here today it's important to do our research and to learn about the token so there is a desk tool but you can also learn more about the tokenzo and Kong or crypto also rebook your approvals on River cache so for instance I I was talking

about military chain earlier so 126 million of dollars lost and a lot of users revoke their approval so they were safe but it's uh it wasn't necessarily of all of their users so it's important to check your wallet Health on a river cache or Neptune for instance um and uh there is also something interesting it's bubble Maps so you can check the governance of the token so you can see uh directly if the token is a rock pool or not because you can see all the holders and it's a good visualization tool um always verify your transaction on your wallet avoid blendering on your uh on your Ledger and uh at the end of the story also enable to have authentication

within after so nectar security we are um where we do transaction securely so we act like a firewall but we also are giving you a score on your wallet so you can simply add any wallet that you want enter a urine your ens and you can have your wallet score you can request a wallet audit and have a real-time alerts on your vulnerability of your wallet so what's happening next today we are still in the middle of a lot of scams a lot of work pools there was a multi-chain earlier but there are a lot of scams today and so finally at the end of the story it's a matter of building

Trust people needs to people need to trust the the protocols need to trust the metamask the wallets and it's important that as a so today we are all with three users but if we want to have the new wave of newcomers we really need us Builders to to think about the security of our solution and it's important to propose in the new use cases so if you're a companion you want to launch a token it's crucial to think about the security of your protocol because it's like just not worth it to launch a new token launch a new meters and if all your user gets scanned there is no uh

there there is a lot of logic behind it so it's also proposing user-friendly experiences so it's really great we can see that metamask has improved their their security features there is also metamask synapse will which will come in a few months I think next month um and so it will really improve the user experiences behind the behind it so it's quite uh we I feel that we are going in the right direction especially with the account abstraction um because account obstruction will enable a new guest list experiences uh new Access Control Management in the smart wallet and I strongly believe that

account obstruction will be the technology that will lead to to mass adoption so I'm also proud to announce you that nav tour is a is being one of the first members of the league of cyber security on web Pro so it's a French league for fighting against cyber cyber attacks so it's really um it's really all the cyber attacks field so it can be user security native it can be compliance Regulatory and so the thing is we by trading this league the goal is to make a web 3 a safer place so we're

doing that with a red square where the initiative of this league but with the binance coin also and the other actors so thank you very much if you want to talk about security uh don't hesitate to reach out and it was a pleasure thank you [Applause] is available to enter so thank you yeah hi um yeah that was a great talk thanks and I also I'm wondering what's your opinion on

when it comes to security to the web 2 aspect of protocols and the apps because often and notice often when it comes to security it's like I mean if your infrastructure of course like the smart contract heavily audited but do you think like all the web to aspect of uh of protocol engineering and the apps is like not view as much when building the apps I'm just wondering your opinion on that um you're asking about uh how is important to secure a project with project with like a audit auditing in the Smart Control development no I mean more like the you know the web

2 aspect so let's say uh um people put a lot of effort they build a product they build the app there is a smart contract there's a user interface there's a backend and often all the effort is put into the smart contract the protocol but not as much effort on let's say the back-end uh security or like the front-end security um what's your opinion on that so um so if I understand your question correctly uh I think that there there are a lot of efforts to so you're saying about like the the efforts being made on the directly the back end and the nature like the classical infrastructure of any projects and so yeah it's uh it's quite uh it's a good question because today

um like I saw many projects so investing a lot in uh in Smart Country development and actually uh it was rookie mistakes that took the project out and uh so um I believe that it's still a bit devours even if uh if it's getting stronger and stronger I believe that um it's important I don't say web 2 but I don't like to say web to but uh it's important that webto skills comes more into web 3 because today web 3 people are really passionate uh there are a few developers who are really uh really really strong into like

in a web 2 development so back-end front-end but also a smartphone contract solidity and so today what we see in the projects it's generally full stack developers that are programming solidity but are also doing all the infrastructure and so I think that we need to to attract new talents that are really really strong have strong skills in the back-end development in Security in security and in devops architecture that can really save the product because even with big projects that we have been worked that we have worked on with big companies we were shocked to see like the competence of this skills of some

developers because so there were like rock stars in the solidity development but not as much as a back end in front end and so and so there were like rookie mistakes on the code uh but it was like a huge project so for us it's important to yeah to attract the talents of a web 2 that are really uh strong powerful on a backhand front-end uh in web3 okay thanks hey thank you so much for the talk um can you talk a little bit more about the wallet score that you're referencing I'm just curious is it looking at

private Key Management is it looking at the contracts you're interacting with or if you're basically aping into all the ponzis but how does that work yeah absolutely so basically at first we were really focused on a transaction and we recently launched like your wallet score management platform so it's accessible on a ledger lab if you want and so basically we are um we are so you can enter any wallet you want it can be yours it can be a other one you can you don't have to connect and so we identify all the token that we have of the approvals the dangerous approvals that you have we are seeing your your behavior as a user are you using your wallet uh like really

frequently or not uh do you have like the good practices or not do you have you enabled the 3fa authentication or not and we give you a score uh basically and so we are saying to you what Shout you have this dangerous approval you have a 500 000 500 value at risk and you you need to rework it right now um yeah thank you another question no okay so thank you Salim and thank you very much thank you everybody thank you [Applause] [Music]

thank you [Music]