CVA Podcast: Hartej Sawhney, Zokyo

Transcript

[Music] hello hello this is your host raz ahmed ready to kick off another bite size episode of the crypto valley association podcast now let's discover together the growing trends of this fast-moving space and try to shed some light on the mysteries it contains we are joined today by hertej zawane principal of zokyo a blockchain technology company with a mission to secure and build web three soko's cyber security team leverages a real world attacker mentality to reduce risk and fortify code so let's dive straight into the world of hidden cyber security hey heritage how's it going hey shiraz thanks so much for having me on here

that's my pleasure it's great to hear from you so let's get right into it maybe you can share with us your first uh blockchain related experience i was living in las vegas running one of my first startups well it wasn't my first official startup it was called zeldi we were we integrated to mobile point of sale systems for the largest restaurants in the united states the most commonly found point of sale system is at that time the micros 3700 res and we built a cloud integration system to it so you could do mobile payments and mobile ordering integrated to the legacy infrastructure and that's what took me to las vegas and while living in las vegas dealing with a 7.2 mile strip with

a large number of the highest volume restaurants in the country i met a group of bitcoiners that were mining and were very early in the bitcoin space since 2009 2010 and this i met these people around 2011 and i started to read everything from the bitcoin white paper to nick zabo essays i found max kaiser i found andreas antonopoulos videos found myself extremely inspired it wasn't a lot of content at the time and then we got active in the las vegas bitcoin meetup which we then turned into the las vegas crypto meetup

and for a short period of time we even ran it and yeah so i never really became active in the crypto space other than running a meetup until we started hosho where post-etherium we found that friends were resting personal capital into early ceos we realized that there's critical vulnerabilities that could be found with with a good engineer's naked eye and it's not just a good engineer it's someone who has a qa mindset a quality assurance mindset and the right security background and solidity depth and solidity being a brand new language and ethereum there wasn't a lot of people

qualified to catch these critical vulnerabilities but we happened to be surrounded by a bunch of really good security engineers in las vegas that were just like protecting both my friends and myself from investing our own capital into projects that may have vulnerabilities in their smart contracts and so we kind of stumbled upon a business there we at that time googled into who else is auditing smart contracts is that even a thing it was a zeppelin and consensus diligence at that time and along with trailer bits um as pretty much the only players at that time offering

some sort of security auditing in the blockchain space and we we saw a gate a gaping hole you know when i say we it's me and my co-founder yo sub quan who prior to this was the co-founder of a company called launchkey where they built an uh a solution to get rid of passwords which they they sold that company so i i was surrounded by the right cyber security experts who were more than qualified so yeah we it was an interesting journey into crypto i mean we when we got into bitcoin we didn't really look at it like an industry we looked at it as a movement we looked at it as something that we would go to these get-togethers and talk

about the future of money the future of humanity and we definitely didn't view it as an industry at that time it's interesting how fast that evolves post ethereum especially with the birth of so many of companies including my own even though at that time i considered myself more a bitcoiner and i went through this evolution of increasingly respecting ethereum okay and and so you're the co-founder of hosho and crazy enough ranked by forbes as the number one cyber security firm within the blockchain and cryptocurrency industry in 2019 i mean can you tell us about your experiences there

i mean what happened the key learnings we grew hosho really really fast and this was a time when icos were just becoming a thing we we knew that there's absolutely no reason for a smart contract auditor to have their own token so we never launched our own ico and we stayed focused on just delivering a really good service of auditing smart contracts using a mix of manual and manual auditing and leveraging a mix of automated tooling and making sure that we have the right team built out to do this and hosho did not survive the the previous bear market to be

honest after when that bear market hit we were unable to sustain the business with that number of american employees and and that that model just did not work out i then basically turned hosho into zokyo i moved to ukraine and we rebuilt everything up and so you know now everything is operating under the name of zokyo and it's not just focused on security auditing we are doing on one end we have a division of cyber security services which partially includes blockchain security where we do security auditing of smart contracts we do security auditing of blockchain

protocols but we also do like traditional offensive security services spearheaded by our head of security anand prakash anantagash is a world-renowned white hat hacker he's hacked into facebook he's hacked into uber he's ranked as one of the world's top hackers on facebook's developer portal pretty much all of the top silicon valley tech big tech names anand prakash has hacked into them and uh working with the non-spearheads our penetration testing team being a black box testing posting bug bounties deep white hat hacking experience and it's the combination of traditional hackers that have had the incentive to also

learn solidity deeply is basically one of the sweet spots of having the qualifications of operating and what is basically a brand new industry which is blockchain cyber security not a lot of people in traditional cyber security know solidity and the necessary languages that are used in the blockchain ecosystem or the nuances of building in the blockchain ecosystem and not and good engineers that have been building in even functional programming languages the world's best engineers tend to not always be security-minded and so that's a very interesting nuance of the blockchain space

where you know we have solidity is a brand new language which is what ethereum is built on and there's not a lot of people in the world to both be qualified to build let alone secure even less is secure no no yeah definitely come back to that point it's a very very interesting one and uh before we do i mean you mentioned that you're based out of ukraine i mean why not the crypto valley in seoul why why did you decide to be based in ukraine yeah so ukraine is a wonderful place i was able to find an astronomically large amount of full stack blockchain engineers in this country in an array of tier 1 and tier 2 cities that are all easily accessible and

i was able to partner up with all of the right people partially that was due to the fact that i am extremely established in this country my wife is a native ukraine of the city of kiev so i am married here i have two children here and essentially quite established here in ukraine in the big pictures it's a great time zone it's gmt plus two you're able to handle business from all around the world and i'm just a hop skip and jump flight away from zouk zurich or geneva wherever any side of switzerland i'm happy to visit any time yeah we're happy to have you here as well and so i like to be close to the engineering talent and i think

there's just a shortage in the world of good blockchain engineers and good blockchain security specialists and increasingly even we're having a hard time hiring here to be honest like it's increasingly really hard to find world-class talent there's no market for a senior blockchain engineer if you're a engineer you you only have to text shiraz and shiraz will probably get you five jobs in 24. but is that because the technology is so sophisticated or that people haven't invested enough interest in it why why isn't there enough supply to to combo list amount i would say it's well the people who are already qualified enough to be world

class are building their own projects or are building projects for other people and are already highly paid they're not sitting free they're not contacting recruiters to find a job if you're fine if you're contacting a recruiter to look for a gig and you're a blocked engineer chances are you're not very senior and that's okay that that is our sweet spot in a way as well we find mid-level engineers and groomed them into becoming senior engineers but that's the reality of anybody in the ecosystem who is hiring lots of engineers right now those days of just picking up creme de la creme i'm not sure they exist and so seeing this shrinkage of senior level

talent in the world has made me realize that okay as far as i see it the places that i'm comfortable hiring engineers for the next decade and making sure that companies that we build and companies that we invest in are always going to have the right engineering power we know we can build teams in india and ukraine and that's our comfort zone eastern europe and southeast asia and south asia are engineering powerhouses and the companies that i invest in and build in i'm happy to have the engineering teams there and the heads of sales and bb in places like london and switzerland and new york city hong kong singapore okay and do you do

you believe that this this tendency of not having enough good developers will change i mean maybe have you thought about uh building up a a blockchain developer university or something whereby you can you can create that that's a supplier we basically have built one but that's for us yes that makes sense what pretty sure that's what the likes of consensus and everybody else is doing as well and already has done there's a there's a race uh to build things which is why zokyo is evolving into being not only an auditor and not only a blockchain developer but a d5 studio right and so now increasingly we are building our own

projects and partnering with the right people to go out and launch those projects and to run those businesses right so this year in 2020 we began the development and recently launched yield.app which is kind of like robinhood for d5 and we built uh bridge mutual which is a decentralized insurance solution to compete with nexus mutual which is gonna the tge is actually next week end of january 2021. and yeah it's been interesting to kind of shift gears from our perspective and say we have to take advantage of all of our expertise and now we've seen you know we've secured over five billion dollars worth

of smart contracts so now it's time to take all of the lessons that we've learned seeing companies launch token generation events and launch more of our own that we've built and we've secured the right way and built for the long run so that this code base can also be handed off to another handful of engineers who are at least impressed with what they're looking at right we need we need code bases to be built the right way for the next decade the next two decades and we need good engineers to constantly be shipping code and so who better to invest in than yourself very very true and we'll come back to some of those those projects in a bit but i'd like to touch on the

point of security as you're kind of one of your mottos is security is always your top priority i mean how do you ensure this with your clients so security for us is our focus honestly has been security auditing we're just the auditing has been our focus does the code do what it's supposed to do you know you have a vision that you've presented in your white paper does the code do exactly that are there any logic flaws can we leverage uh do any static analysis leverage our automated tooling and go through your smart contract to make sure that there is no exploits no possibilities of a flash loan attack which has been a big thing recently in d5 and you know we go above and beyond to make sure that these

teams have fundamentally even written their own test suites more often you'd be surprised how often companies come to us with their test suites not actually fully written so we're doing far more than being just an auditor on these projects so from our business perspective this is how we're helping with security on from a friend or investor or partner perspective we are encouraging companies that are early stage to make sure that they engage with third-party cyber security services and that they put their ducks in a row by at least assigning somebody to be head of security maybe that person can evolve into being a ciso or maybe they already are a ciso

but to think about a ciso for the company sooner rather than later because the reality is if you work in the crypto industry you are a target if you work at a crypto company or anything close to crypto you are a target you need to think about your name being on the internet you need to think about the safety of your children the safety of your loved ones and these are things that are not very often told to people and i'll tell you that a lot of times i've gotten phone calls or text messages in the middle of the night when someone is being threatened for their crypto or there's a hack for their exchange has been personal threats to people's loved ones and these are the kind of things you think about and so in order to protect

yourself from people to set up their two factors for themselves and all of their employees i encourage them to think about like the cyber security opsec checklist 101 is everyone all your employees using company hardware company laptops company phones are they locked down are you are you talking about sends things on the right platforms have you made sure that all your employees have set up two-factor authentication plus a hardware key like a titan key or a uv key right like i prefer the google titan key personally because there's no supply chain issues from google they have a really good usbc and bluetooth titan key that everybody i work with has one i i force them to you work with me you have

a google titan key here you go and like it's my gift right i give i give them a google titan key the business of the blockchain by william mogeyer and the latest book by camila russo the name is slipping my mind but yeah camila russo's latest book excellent rousseau we'll google it later on she has the book but yeah the this is the on board this is the hertheid sony onboarding package and uh and yeah do you use vpn and do you have a password manager you're using complicated passwords are you changing them regularly i'm not a genius you can literally just google you know cyber security 101 for a corporation there's so many blogs on this so much information

and for this stuff needs to be talked about more often in the crypto ecosystem more than other ecosystems this is the financial ecosystem we are writing smart contracts that are casually moving millions and millions of dollars we're launching these smart contracts live for yield charms with unaudited code which people are aping their money into into blatantly unaudited code and you go to the website and it says warning put your money at your own risk this code is unaudited most of the money in the yield farm is often made in the first 200 000 blocks and during the first two weeks which is the first 200 000

blocks most of the time these days in d5 that's unaudited code and that's where you are seeing these astronomically high yields which are unsustainable but that's a different topic but yeah thousands of percent apy for the first two weeks of many of these yield firms on completely unaudited code it's wild not a good trend for the industry at the moment and it's not a good trend to see projects list their token live on a decentralized exchange and then come to us for an audit engage with at least one third-party auditor prior to listing your token even on a decentralized exchange just play it

play it safe engage with the second third-party auditor after you make some changes to your code and then the third one i mean every time you change your code you should be auditing your code and i i i do understand that a lot of companies are upset because they're like you know you guys are taking some time six weeks sometimes nine weeks and you're charging anywhere from 20 grand to 70 grand for an audit and it's like that's just becoming the reality of being in the space and it's becoming the reality of having to deal with the nuances of the complexity of these smart contracts this week alone multiple of our statements of work that we sent out for zopio were seven week audits six weeks on audits

and we know that other people in the space that are auditing smart contracts are are booked up for months in advance right now they are just turning people back and i pushed back on my team and i said can we you know this team really wants to uh list on uniswap within three weeks we gave them a seven week statement of work and they were like absolutely not like we'll be able to finish the manual portion possibly in a two two and a half week period so they'll get a manual audit but usually by the time we complete the manual audit we have found a lot of things in the smart contract that we would like to encourage the team to rewrite and that's not a typical role of the auditor

and we you know kind of hold the hand of the company and we say look we we encourage you to rewrite some of this and then we're going to write custom automated links with this specific smart contract after and so sometimes we'll break it up step by step so yeah it's a seven week total process but you might have in your hand within one to two weeks to do something at least some sort of a report and you are in the process of engaging with the security audit okay and it's probably not often that you just don't find anything that could be a potential risk we always find stuff right and it's not always a security vulnerability often it's it's a logic flaw right you'll have things like fundamental math

issues still actually numbers to be distributed to founders can still be an issue wow okay that's quite crazy and so so how did uh this whole covet situation then impact your business well we have we've definitely multiplied our business and i wouldn't say that the business has grown because of covet it's that crypto is already online we've already been a decentralized operation we've already been thinking about clientele that could be anywhere in the world from korea to los angeles and it makes absolutely no difference to us we want to know you wrote a smart contract it's an erc20 token what blockchain okay it's on ethereum we don't it doesn't matter to us

you know where you are and so grateful that our industry overall uh was far less affected compared to the more physical domains like such as retail or running a mall and so yeah we weren't really affected it and if anything right right after cobit hit we entered summer which was d5 summer and we were seeing just an abundance of demand to do security auditing and so we were able to work with some of the top blockchain protocols and d5 projects that have come out in the space we've been able to touch all the leading protocols that are coming up it's been exciting to work with some of these newer polka dot projects

some of the newer cosmos projects it's been exciting to work with a lot of the tasos projects we we actually partnered with the tasers foundation so really looking forward to supporting more projects in that ecosystem and so yeah kovid if anything i would you know one thing that's changed for us is i'm an american citizen with indian roots and i would say that originally when i was spending time in ukraine and i'd catch up with people who would say why are you in ukraine and like oh wow ukraine the reaction was a bit more obscure as to why are you in ukraine and i'd say after kobed no one asked me this question because

people that were in london are now hanging out in the swiss alps and people who were in zuuk are now hanging out in some farmhouse i believe you are no longer where you normally were you are also out in the countryside somewhere right and so everybody's reality has shifted to the point that they realize you need quality humans that you trust that have internet and electricity and they'll be reliable and it's a game of time zones and this is where ukraine being basically in the center of the world is very convenient to do business with anyone in the world and so the difference between switzerland and ukraine and time zone is minuscule and so we're basically in the same place as far as i'm concerned

it's not like meet face-to-face during covid so it's kind of an equalizer and it's just a matter it's now now all that matters is time zones it's not about geography it's about time zones and i don't think that i don't think that those times of lots of people being in one place full time is going to come back anytime soon i think that we're going to all live wherever we live and be work live wherever you want to live you want to live on the off the cliff of a mountain with your family go for it but you know show up to a conference every few months so we can all see each other face to face yes i feel like that's what's going to come to we're going to have these very strategic

get-togethers where you better give me a really great reason to kiss my babies goodbye and come fly pack my bags and come spend some time with the right people and it better be really fruitful and everything else i'm okay with doing virtually i've set up my i've set up my camera and my mic and my lights ready to go that's wonderful it's wonderful and uh the the whole story with the time zones i mean when crypto uh never sleeps i mean uh it's it's hard to be in all time zones at once yeah at least from uh you watched watching the market perspective i'm not really like day trading or anything of course i have my personal investments but

at least anybody who has a trading perspective they know that a lot of things go with the flow of asia these days and whatever there's been a recent trend that every time asia wakes up they dump the market and so i'm sure a lot of people around the world are being mindful of when asia wakes up maybe you can tell us what your vision for this whole industry is what where do you see the future blockchain analogy and society and everything well yeah i mean so i i honestly recently quite a bit of the focus is on specifically d5 in investing and building the future of defy and i really think that the benefits of d5 are going to be major

across both developed and emerging markets and you know in developed markets defy is going to provide a greater choice to consumers it's going to reduce the cost of legacy financial systems it's going to bring greater liquidity and product innovation to financial markets but in emerging markets defy essentially provides a more secure store of value with the rise of stable coins where financial services are going to be offered essentially for the first time ever to billions of people who currently lack access to existing financial systems and the trust layer of finance is being replaced with decentralization and decentralized finance and so we're

saying goodbye to massive financial intermediaries but you're not even saying goodbye to them in the emerging markets you're just saying hello to d5 and you're saying goodbye in the other markets to people like banks and asset managers and traditional insurance companies and you know you're replacing that with with code with uh permissionless blockchains and smart contracts and so finance finance by far is the best product market fit for permissionless blockchains so fintech is fintech is the first place for innovation finance is the first place logically for innovation for for d5

and for crypto and so i mean you know bitcoin is the first d5 the success of d5 didn't didn't come overnight this is not just a new thing bitcoin is the first d5 but it's a bit it's been difficult to build proper protocols on top of bitcoin given its limited programmability and then and then ethereum came around a permissionless blockchain that's turing complete and has smart contract functionality that made it way more possible to build complex financial systems and today ethereum is kind of like wordpress you know wordpress may not be the most secure way

to launch a website but it's really simple you just do pop up right you know we're at that point of of development and i had it i mean i would say that you know what only other thought on this is is really 2021 a big thing is going to be the rise of stable coins and cbdc's potential bank digital currencies and for the third world especially and for the second world for emerging markets it's going to be exciting to see them go from their fiat currencies directly into a stable coin yeah it's not going to be directly into ethereum or above

bitcoin the excitement for them is going to be into a stable coin and so that's something that i definitely have my eyes on and something that i'm watching so i mean it solves you know one of the biggest obstacles that prevents crypto for being widely used as a medium of exchange right and so the total marketplace has grown five times over the last two years and we have we've crossed a 10.5 i think billion dollars in total supply of stable points and you know total value of transacted on chains yeah total value transacted on chain of stable coins on ethereum that overtook ether itself last year in 2020

right it's like stable coins are definitely filling this massive gap of demand for u.s dollars that just cannot be satisfied through its traditional channels and like the biggest one is obviously usdt and every time the market goes up you see a bunch of fun about usdt and who knows what happens with that court case but honestly i i personally think the money is in the bank i think it's one to one i don't believe any of the fun but you know i trust usdp i trust usdc and i'm a big fan of dye i'm a big fan of the maker community and i'm really excited about the work uh being done by mac matt verbinowitz in the maker die

community in regards to the cross between real world assets and and defy and make or die and one of the one of my passion projects that i'm exploring for this year is taking a a massive amount of antique art and antique weapons that are indo-persian from the sikh community from my forefathers and my four mothers of our heritage that have been preserved in london and we are going through an exploratory process of tokenizing this collection of arms and antiques and antique art

in order to preserve the heritage and legacy of a people and making sure that we don't sell the collection to someone like the sotheby's or a massive museum so that it's just gone and in the ownership of a museum and that a community can actually viably own this tokenized collection and pass it down through a legacy of generations so like these are kind of things that i think are gonna really shift humanity and you know switzerland being a place that has just so much real art and real world assets worth millions and billions of dollars all stored in one country i think that that is going to be the

country where we're going to see some very interesting competition and experiments occur when it comes to the cross between real world assets and tokenization well that's great to hear and i can only i can only hope so so heritage thank you so much for joining us today and well to everyone listening if you enjoyed this conversation feel free to check out more on our website cryptobody.swiss where we host plenty of events educational content and even provide information on how you can join our growing community so thanks again hartej for joining us thank you shiraz for having me oh my pleasure stay tuned stay safe and until next time from the crypto valley in switzerland bye [Music]