The Current Landscape of Web3 Security, Krum Pashov, Pashov Audit Group | ETHSofia 2025

Transcript

[Music] Okay. >> But if you need, let me know. >> Yes. Sound is good. Very good. Uh, let me see. Perfect. This is okay. Uh, it's the wrong presentation, but it's fine. We sent m for once. It's perfectly fine. Uh I think we do not need too much of a presentation anyway. Uh because uh I can speak to you just from what I know because I do web3 security day and night now for maybe three or four years. And basically today I want to share with you what's the

current state of web3 security what's maybe the future where we are standing right now and where we are going to. Uh I want to speak from two viewpoints. One is from the security researcher viewpoint which is many of you and many people that I have been speaking to. Um there are freelancer freelance auditors. Uh I have also been speaking to many clients. So this is the other viewpoint whereas uh all these clients are facing so many problems when it comes to security and they're finding with their constraints which are again time, money, talent, quality. So there are so many issues that need to be resolved.

Um yes currently as an auditor as a security researcher there are multiple options that you can take multiple parts because you can choose first you can choose your technology you can do solidity you can do rust you can do move you can do golang you can do so many types of audits also even if you are a web two security researcher if you have been um cyber security guy in a company where you did pentest testing or some traditional security. Sometimes you still have been reviewing code here and there, maybe reviewing AWS configurations. It's pretty much the same mindset. You're still trying to find the error. You're kind of like a

little bit like this negative person who is always trying to find the wrong thing in what the other person is saying or doing. And this what you're doing through code. But many web 2 security researchers have been transitioning successfully to web 3 because it's the same mindset. And again now you can start with many different things. You can start with solidity. You can start with move rust whatever the technology doesn't matter too much. The the next thing you have to decide pretty much is um of course you have multiple levels like you can be an employee, you can be a freelancer, you can be like a bug hunter, very very many different levels and when it comes to newbie security

researchers, you usually start most people start with security contests like you know the platforms which are Codorina, Sherwoke, you know canina all these platforms uh are paying very big rewards even right now if If you open a website which aggregates all the security contests, you will see that there are probably maybe three or four million dollars in rewards that are actively being given out to successful security researchers, people who can really find vulnerabilities. So this is this is huge like and it's permissionless because when it comes to a job job is also great but um one problem with a job is that somebody needs to say he's good enough. Somebody needs to approve you. Somebody needs to

uh allow you to join their company, their culture, which is kind of a blocker. This is kind of a constraint. And you do not have this with security contests. You just need to register. You just need to have a GitHub account and you can submit vulnerabilities there. And it's like total meritocracy. If you submit great vulnerabilities that other people are not thinking about that they are not creative enough to think of and and if those vulnerabilities are like critical severity so you can steal lots of money like millions of dollars you'll be getting paid very well which is exciting I was very excited about this when I was starting out with web3 security um then another option when you can um the great thing about contest is that

you have this permissionless nature where nobody needs to approve you, nobody needs to even like you. Maybe everybody hates you, but you just go behind your nickname and you just submit vulnerabilities and you'll be getting paid. The next level is when you start to build uh some relationships in the space when people start actually saying this guy is good, he's a great auditor, he's a nice person or whatever, you can start this is you're building kind of a brand because what's what's a brand? A brand is what other people think of us. their gut feeling when we're not in the room maybe. So this is it and when you actually start getting great results in contest, people are starting to say, "Oh, this guy is good. Maybe we can work with him." There is a little bit of

connection being built here. So then then you can start doing this thing which is called saw audits which I have been doing many of. I was one of the guys who did lots and lots of saw audits. I did over 50 um and I had great success with it. So this is something that when you get some success when it comes to contest you can start doing you can start doing so audits which is pretty much you are the only auditor and you a company hires you to handle their smart contract security by yourself which is a great thing because you don't have to share the profit you you get all the payment for you you don't have u like you you have to negotiate with the company how much they pay you but then

this money comes to you you do not have to split it with a colleague or it's not going to your boss or whatever. But again, you're working, you are auditing by yourself. So you do not you're not able to create the same quality of service that comes if you are like four auditors. Like if it's one great auditor, it's always less than four great auditors. Of course, it's simple math. This is why so audits um when it comes to price, which is a very interesting topic with which we should discuss. So audits can range from really like a few hundred dollars up to I would say even hundreds of thousands of dollars depending on your brand depending on your skill depending on the amount of work that you need to do. I

can tell you that I personally started with I I did like six my first soul audit was like six hours of work very small code base like 300 lines of code and uh I got paid for 6 hours $100 hourly pay so it was $600 and it got me crazy motivated and I saw that there is a real opportunity. The client was very happy. Uh they really got some security. I found like two high severity vulnerabilities which was very valuable to them and they also paid me just $600 which for the a business of their size was nothing. So this is a great way to actually uh a great path where you can take as an auditor. First you start with the contests then you get to a soul auditor and here you can actually um

join forces with the companies where they will be paying you directly and you start creating a partnership. From this you actually start working with more and more companies with bigger brand bigger bigger names and you get to a point where you have now worked with some very big names. you have been getting paid very well and more and more people are starting to come by themselves to ask about your services. They just come and say do an audit, do an audit and at a certain point you'll be doing so many audits that you cannot do anymore. So you you have to hire people, you have to team up, you have to hire other smart security researchers. Uh and then it's another point where you realize that

maybe you're not even that good. Maybe other people are much much better than you. So it's even smarter to hire them and they should be actually doing the audits. And this is what many companies also realize and this is um another point where uh why they don't work so many with so much with so auditors is because uh team audits are just they're just better. They're just better. There is no um no fight around this. Everybody knows that team audits are better because it's just more people. If all of them are smart, it just works better. But of course you have the constraint of money. it's much more expensive. Still what we are seeing in the space um the space is growing very well. Investors are pouring lots and lots of money into it which makes it possible that so that

startups some small teams of people that started the company they raised a few million dollars which is very very common. It's like it's almost easy nowadays to in crypto to to raise like a few million dollars. If you, let's say, you raise $3 million, like 10% of this, if you uh put it aside for your security budget, it's like $300,000. And with $300,000, if you if you plan well, if you don't have a too big of a code base, you can really get both a soul audit, a team audit, maybe you can even do a contest, which is great. So when you are a company, you really want to have the multi-layered approach. You really want to take advantage of all of these levels. Also, there's a level even be be behind these the ones that I just u

mentioned when it comes to the uh to the companies. One thing that is not enough of a trend but it really should be is uh hiring security researchers inhouse or maybe external security researchers but maybe like u virtual chief information security officer viso or whatever you want to call it like fractional CTO whatever name you want to use but you really need highly paid highly trained consultant on your security no matter how good you are if you're a founder of a project you're not a security researcher. you do not know enough about security to make the proper choices. And one of the biggest problems uh about your choices will be that you'll be

spending too much money. You won't be efficient with your security budget, which is a huge mistake. If you if you hire this guy, yes, you'll spend more money this way, but he will help you really nail down the actual um being a little bit stingy with your money and being smart with him, being frugal where in my opinion being frugal in a business is very important, especially if you are money constraint, especially if you didn't raise lots of money. So this is the way it's very smart to have a security consultant guy who is it's it's even before a soul audit. It's not even this guy would won't be even looking at your smart contract code. He will be really um consulting you on your

security strategy. He'll be teaching you how to spend less money, how to be more efficient, how to plan for audits, if you should do audits in parallel or if you should do them sequentially, when can you do them in parallel. He'll teach you how to get a um working with a bug bounty program. We know immunifi are great. We know hacking proof are great. Now uh Cheryl has a bug bounty a canina guardian I think so many companies but we have a few that are very well proven and it's working so good. We have saved so much money uh for the space from all of these u people who actually reported vulnerabilities as bug bounties with instead of actually exploiting them. And it's a great thing but again you need to

have the multi-layered approach. First you can first of course if you have the uh the skill to hire uh better you should really be looking when you are recruiting technical talent when you're recruiting developers you really should be focusing on recruiting people who know at least at least a little bit about security because some developers especially some developers who come from web to world from the web to development world they have just been writing Java Java is so safe like it's it's so hard to make mistakes there. Like the EVM is just hugging you all the time. You're just feeling warm and welcome. Whereas with when it comes to solidity is the opposite. Like uh every second is is

scary. Like you can make a book, you can write a book, you can write a vulnerability like every line of code and you can even in a single line of code you can have like three vulnerabilities. It's so scary. This is why have a focus when it comes to recruiting your developers. And if you are a developer yourself, you can learn from this. Know at least the basics of web3 security information is freely available. You can look it up on Google, on YouTube, on Twitter, whatever. And you will be a better developer. And as a founder, you recruit better people.

If you think about this, the next step, get a security consultant. If if uh usually companies are founded by one or two co-founders, usually they're not security focused, make sure to get a third one. Even if it's not a co-founder, at least a consultant. Make sure to get this guy to work with him and to trust him a lot about your strategy. And then he will probably be um advising you on the following. First, get a so audit. Of course, it matters. Your budget matters a lot. So, this is where this guy comes. He will ask you about it and he'll figure out the best strategy.

First you start with the sole audit, then you start with the team audit. Maybe you have to do multiple ones. If you plan your security well, you wouldn't have to do multiple audits. Do having to do multiple audits is the best sign of you missed it. You were too late to think about security. If you thought about security early, one audit would have been enough. So you wouldn't have you you wouldn't be having to spend uh twice or three times the money that you are spending. So this is a good sign that you need to be checking. Do not do multiple audits.

If you have to, of course, do them, but try to not to have to do them. Next thing after the audits, check your deployment scripts. Check your operational security. You'll be launching a project that will be handling probably millions of dollars. You want it to be handling millions of dollars, so prepare for it. Check the deployment scripts, check the security, have at least a little bit of um incident response preparation, all the basics which again information is freely available. You can find it uh in a tutorial. If you want, just reach out to me. I will send you one.

But after you deploy and even before you deploy, you need to have a bug bounty program set up. Like companies still do not do this fully, which I really don't understand why. Maybe they just don't know how to do it. set up your bug bounty program. This is 100% very very important and um even after this maybe the next thing to do continuous security is to really build relationship relationships with hackers. I have seen let's not name projects let's not do this but um I have seen many projects that have done all these uh steps that I set and they have been doing so well with security and they're so respectable everybody loves them but when it comes

to their relationship with hackers it doesn't work well it is just not good when a hacker reports a critical severity vulnerability they fight them they say no this is a low severity vulnerability and why is that there are multiple options maybe they're stingy with money. Maybe they do not want to pay for because critical severity vulnerability will be maybe 50 times more than a low severity. Maybe they don't want to look stupid because people respect them for their security best practices and uh now if they confirm they uh had a critical security bug they will lose trust which to me makes sense but still what's very important I have been part of many such situations where web3 security auditors do not get rewarded

properly for finding vulnerabilities on live protocols. This is a huge mistake and uh it's a big reason why many people who are great auditors, they don't really try to do bug bounty. They don't really try to find bugs in live protocols. They just do audits because they believe if I'm finding bugs on already live protocols, I'll be just getting into fights. People will be trying to downplay my achievements. They won't be paying me enough money. They will say the vulnerability is not even real. They will invalidate it. So this is a huge problem and this is why many protocols get hacked. So this is a very easy mistake to fix in my opinion.

Another easy mistake to fix is the consultant which I see so many companies just don't have it but they badly need it. They badly need it in terms of security researchers uh viewpoint. You have the career mapped out. It's so good. Like you start doing contests. First you make like $50, $100. A a few times you'll make a few thousand dollars. Then you can do soul audits. With so audits, you can start from again a few hundred dollars. It's not too hard to sell like a $5,000 audit, which is like huge amount of money when it comes to a normal IT specialist guy, for example, in Bulgaria. And you can sell a $5,000 audit, I would say, easily if you have at least kind of a good brand. And

this can be for like maybe three days of work. And from there, you can scale it further. You can even charge more money. You can do more audits. You can work as much as you want. You can create a really great career out of it from which you can actually move to if you want to actual to an actually uh full security company a full team that works and provides audits to many many projects. For example, in pash group in my company I think today we are doing maybe five or six audits in parallel. So we are almost I would say fully booked. We're working with huge projects. Some of them are even live. Some of them are holding like 50 to$100 million life in their protocols and we're trying to secure

this. So our job is very very important to be done well. This why we're hiring only the best auditors. This why of course we charge a premium for this. But the story I'm telling you is basically you can start from just a newbie. You can start with doing some contests, making like a few hundred bucks and then you can get to really managing a big security company and actually not just making money but helping this whole security community grow and the whole crypto community actually grow because we are very constrained from these hacks. It's so bad when you see $100 million hack so many people just leave the space and never want to be DI users and you know most web3 security researchers are not really D5 users

because they know how bad code is. So what we need to do I hope many more people join join this mission many more people become auditors and they start growing a career out of it and they start building in the space maybe as soul auditors maybe as companies maybe something even bigger maybe at someday because for now we haven't seen much acquisitions of companies or mergers mergers I think it's about time we see them soon we'll be seeing probably acquisitions of security companies or maybe even two big companies merging into one and this will be so exciting. I think with this we will do much much better security. So the main point maybe the final point is really make sure to

be collaborative. Make sure to be collaborative be positive work with people. This conference is a great place to meet more people. Speak to as many as possible. Speak to me. Speak to your friends the other guys. people want to help here and it's really nice to see such a good community in Bulgaria and I know that we can be building more and more because every year it's like three times bigger than the than the previous years. It's crazy. I have seen multiple 19 year old guys create huge businesses making millions of dollars and these are guys who like one year ago they were like like just looking for a job just I want a job for like €2,000 or whatever just I want to be appreciated and they

find this thing they find web3 security they go allowing and now they create this huge business they're not just making millions of dollars but they're changing the actual security space changing the quality of the crypto defy space. So again any positive note be collaborative create teams work together. [Applause] Thank you so much. I hope that you were taking notes. The slido exploded with the questions but we will only choose uh two questions because we don't have too much time. So uh the first question for

the beginners nowadays it's hard to join the space. So do you have any recommendations for them considering the current landscape? >> Um I would say uh it's hard because it's worth it. Keep grinding. Put put efforts. If you're thinking it's hard it's just that you haven't put enough efforts towards this. Um to do this you just need to put more just put more of your wake hours into this. Read more books, read more, watch more courses, speak to more people. Here there are like maybe 50 to 100 auditors like come speak to us, speak to me, speak to I will um show you people that you need to speak to. They will show you the path.

But the basic answer is really put more time and effort into this. >> Okay. Thank you so much. Uh, and the next question, sorry, just one second. Too many questions. What was your hardest security audit and why? >> Hardest security audit. So, we have done many many audits. We have been my company push audits group has been live for just two years. I I it's not even two years. It's less than two years. But we have already done I think three 350 audits maybe even 400 which is really crazy. I never believed we can do so

many but we are starting to do even more of them. But recently like two months ago we have had our first hack which was a big pain for us but it's inevitable. Nobody can guarantee 100% security in our space. So we had our first hack. One of one hack out of 400 this is a great statistic but still it's very bad. like $3 million or something got stolen. And probably this was the hardest one because we missed a vulnerability that got exploited and it was so hard because we actually found the vulnerability. Uh we found the attack vector but we couldn't find a way to exploit it. So web3 security is so complex like you can find the issue but you might not be able to explain it and maybe the hacker will be able to explain it. So it's scary but

it's our job. >> Yes. And as you said, web3 security is very complex and there are so many questions. So please you can find Chrome later in the networking room and you can chat with him. >> Yes, meet me outside. We'll chat there. Thank you very much. Heat.