Demystifying Smart Contract Security: Facts & Fallacies

Transcript

okay m is your thank you very much Nathan welcome everybody to the uh DSS webinar for for January we have this webinar going every month this month is about continuing the panel about the mystifying security the defi security Summit is interested in all topics related to security and we are very broad we already had uh lectures on networks on security networks on auditing on On Tools please feel free to S uh suggest uh topics you can uh ping

Nathan with is the organizer you can ping me uh you can talk to a lot of people we are interested to get many to cover as many topics as possible in addition to the annual def security Summit so let me pass to Riv who the moderator and actually is one of the originator of the defense security submit and also for the webinar so go I I'll pass it to you rajie for for today thank you mly thanks na so uh welcome everyone um to this um to the seminar to the webinar DSS webinar format and like mully said uh we hope this will be as exciting um if not more

than the panel we had at Devcon Bangkok with um you know with with all the panelists here so I'll be I'll be your moderator and really glad to be here with all the esteemed panelists um and uh we will start off by a quick round of introduction um and then jump right in so I'll I'll start so I'm Rajiv I am um the founder of secum which is known for its smart contract security boot camp uh as well as trustex which is an event dedicated to ethereum security and uh personally myself I've been um uh doing security research pretty much my entire career um looking at crypto web3 security for the

last uh eight years or so and um um right now I do security reviews with spearit Cantina so that's me and we'll we'll go around the room starting off uh well we'll try to keep this alphabetical so uh just just so that we have some order in mind so we'll maybe start with Harry and go ahead hey I'm Harry I'm one of the founders and the C of uh spe and cantina uh previously I used to work on the solary compiler um at the foundation so yeah that's pretty much about me um looks like Joseline should go next hey um yeah so I'm I'm justan I'm the engineering director of the

blockchain team at 12 bits um if you don't know us briefly we are security company where we work around all the stock from blockchain component to application security to cryptography and so on um and yeah really looking forward to continue this discussion that started a couple of months ago Matias yes um again thanks a lot for the invite here happy to be here so I'm Matias I'm managing partner and CTO at train security um similar to spare bit and so on one of the um Auditors in the space um and my background is in it security also for most of my career um both in in like big data uh AI nowadays and um

blockchain since 2017 who's next hi everyone um I'm miow um I'm security assessments manager at Sigma Prime um so Sigma Prime simly um auditing um company but we also um developers and maintenance of flighthouse the consensus client um myself um spent over a decade in um web 2 security as a penetration tester and um probably about four or five years in web 3 thank you I'm last I'm M uh I'm academic in the of programming language and formal method also co-founder of Sora together

with shy grman we Shor specializ in formal verification uh we we actually but U during we also develop other tools so last week we released an open source tool called qu which is developed with RBG it's for reviewing governance proposal and actually this week we are releasing Safeguard so Safeguard is an extension of the go etherum client for monitoring you can monitor without remote procedure call actually used now for UNIS V V4 un V3 also other V3 so it will be released open source today also the Satur will be released in few weeks in East Denver and I'm very excited to

continue the conversation and thank you R for writing great so let's uh let's dive in um so I'm I'm I mean we are told that people listening or tuning into this webinar um may have been uh you know at the panel in Bangkok or may have watched the video the recording um but just to catch you up if uh if you haven't uh done so um our guess is that most of the most of the audience here is going to be uh people in smart contract security well in in crypto security or if not are getting into crypto security so um the the title of this panel was sort of uh

you know um just to just to keep it interesting both the title and the format was a bit different um so there are many things that we can discuss in this space um and um just to put a method to to sort of the madness right so what what we said was okay let's let's do this let's sort of have one statement um and and then um every panelist essentially goes at it and says if they believe that it's a fact or a fallacy and and given that it is you know that format these statements are obviously meant to be uh spicy if you will right I mean they're meant to sort

of uh be provocative in the sense of uh um you know not not having the entire context not necessarily something that I personally believe in or the panelist believe in I mean they're obviously in a spectrum they're not binary but the statements that you may u you may be uh hearing are going to be very short and then we'll go around the panelists uh we'll have direct questions uh to each one of them and they'll essentially come in with uh their perspectives on that statement and then all the other panelists will have an opportunity to chime in uh to either challenge them or to to support them with their own perspectives right so uh so for example uh for people um to to get get an idea

some of the topics we already discussed in Bangkok where things like U smart contract or onchain security is overrated compared to the offchain web2 threats right um so that brings you know that brought in a very good discussion among the panelists about um our you know our smart contract security audits are people focusing overly on that and um you know when when you see that in the last year private key hacks really led to majority of the exploits in terms of uh um you know in terms of the funds lost right so it brought in very good discussions there we talked about uh audits as such uh being necessary or being sufficient we talked about the

opaqueness of audits are they overpriced um all these aspects right so this is uh so we won't be touching upon those neily I mean in the context of some of the other questions or points they may still come up but that is sort of uh hopefully it should set your expectations so um like with introductions we will sort of go around the panelists and the alphabetical order um and with that I think the first one will be directed to Harry and and Harry feel free to take uh your time in uh responding to this and then you know all the other can come in um as as you feel you know um necessary so um I guess the point to

hurry is the statement is Protocols are not taking security seriously Factor fallacy I think today I would say Protocols are taking it seriously if you ask me like three years ago I would say no um so there's definitely a big change over the last three years in sec um primarily because like there was a lot of hacks in the last three years and people have sort of gotten used to taking security seriously to the point that if you are taking investment from an investor they would ask you if you did a security audit if you are going live on Main net your users would ask

you if you are know if you if you're done a security audit so I would say most protocols today are taking security pretty seriously uh but three years ago that was not the case Okay anyone else want to either challenge hurry I mean this all I mean you know these are uh you're representing some of the best projects best companies in the space right so your perspectives are probably driven by the protocols that you work with so I would imagine that you guys are working with the top protocols who obviously uh put you know put the the money where their mouth is in terms of security right um but in general right so when

you see I mean I think hari's data point is is interesting that three years to now um I guess driven by the exploits and driven just by um the the things that have become a much higher priority for these protocols both from an investment perspective and otherwise he sees that does anyone else I mean does everyone really agree with that or I think I think I agree I agree I think ALS so we see a lot of uh for example some protocol put some money towards other building on top of them we see the shift toward security is very strong and we see that I I still think and this related to the what we said discussed last time that the security bar is very high especially for protocol which

didn't raise raise enough money so that's a tricky if you are trying to build a new thing it's a bit tricky uh but yes I agree I totally agree with how I think things have changed dramatically in the last three years actually even this year we have seen more and more especially with the big protocol the the fact that there are so many blockchain coming and blockchain have sufficient funding so they will actually encourage and one way to attract protocol is by security budget because we know the security is a budget which takes significant part of the R&D so I totally agree with here I like the last part mulie is reserving

the right to disagree for the rest of the panel so yeah I mean um I think I mean this is this is sort of just getting the uh you know getting our feet wet or um warming up for for uh hopefully what will be more contentious points later on right so protocols I mean anyone else I guess uh I do see a comment uh saying um comment on the channel saying that the top Protocols are serious but there's still a lot of rubbish floating around as well so I think all of us would agree to that as well uh right but from what you've seen in the last 3 to five years things seem to be improving is is the

sense that I get right Joselyn Matas any any sort of contradictory yeah to come back on the comment that was made on the chat about like some protocol are serious and some other might not be I think overall as as an industry that was definitely an improvement in awareness of security we will always find you know a couple of company that are not doing like the Baseline and then doing like the DU diligence but definitely as a whole like the industry maturity has improved regarding like security and like the awareness is definitely higher than three or four years ago yeah I think it even started earlier um in 2017 it was already a thing where people said like hey you need an audit but it was more rubber Stampy at that

point we improved along the bare Market which followed the Ico bubble um then defy summer kind of was a low perhaps in uh in security uh launching quickly and then we again improved a lot from there on so the last three years what AR was starting out with that's exactly kind of after after defi summer so to speak um and now we see multiple audits uh from the top projects I I think one new part where it's a little bit dangerous again is more heavy forking and changing where you tend to take a complex code base and you do a small change it's often hard to

explain that a small change is still dangerous and of course takes a lot of time to audit but also to operate such a system um which you haven't built your own on your own is challenging so this is perhaps the while we are in a much better like State than we used to be uh on security being taken really a lot more serious than in almost any other industry this is the one thing where I'd say like uh Beware there are dragons here um on on like building because we build on top uh more and more right and um this this comes with its own dangers one thing I think we've also noticed uh and and the talk from Peter

from K at DSS last year was really kind of raling on that is that the focus on security has been mostly around card security like no Cod review and things like that and there is however a huge gap on key management and like more of operational security issue where I think people might not take that seriously as of today we still see a lot of bad practices we still see you know people having like their wallet within their laptop they go to event with you know everything within know one one signature is enough to upgrade the contract and things like that so I think we have become more serious on at the Cod side of security but everything are one that it pretty much still the same that it was like a couple of years ago but I

think jeline this is something that we are seeing recently being improved I think with people like you the Seal team and the the awareness is is getting better also the the protocols I ENC there something like we participate in security canes and we see that so the the the protocols are maybe the big protocols but at least even small Protocols are becoming more aware of the centralization effect so I think it's we are seeing Improvement people started addressing the smart contact which was kind of the obvious but I think people now aware of the web two to web three interaction I'm sure the sigma Prime I think everybody understand that the a lot of things

going on with with many things maybe your font end or or anything supply chain attack so people are aware of all the things and I think the situation is getting better that's all I'm saying maybe maybe Peter talk next year I don't know exactly if you will be accepted but maybe it will be slightly more positive it might be a bit more optimistic than myself good I mean good to see that we are starting on an optimistic note I think there seems to be rough consensus that things are breing across the board um generally the security folks are very skeptical and sort of leaning towards uh negativity because that's what we see

sort of day in and day out so cool so uh that's that's a good start so let's jump on to the next one this is for josin related again so every protocol should have a security lead absolutely like one person like you should have someone inside your company that has a Title Security you know in it just responsibility um that's kind of like the Baseline for you to have good practices to have an understanding of of what you do and you know a couple of things to consider here that don't put this title into one of your engineer or if you have like a large team because they're not going to be able to make decision you need to have someone within

your company who can say okay we are not going to deploy to to deployment until a b and c is fixed you need someone who will be be able to drive the security practices to drive kind of like the mentality and the culture within your company and that needs to be someone internal to to your company or your team we are seeing it you know like in in a lot of customer we work with customer that have an internal security team or at least one person who has a security title within their job responsibility the maturity of what they are building is just way ahead of everyone else because of this culture because of this mentality um if you have like you know a small company maybe you have like three four five people one of your confounder M might be like the one owning security

if you have like a larger you know team with like you know dozen or even 100 of of employee then you can have like a more dedicated structure but you definitely should have someone internally of your company that has Security in his responsibility cool um anyone i' I've actually recently seen uh opposing take on uh you know on crypto Twitter about this I but I I'll come to it but I I just want to see if others have um anything I mean this is very easy to support as security you know projects as security uh people um but do people feel that you know maybe that's not the best

case I mean obviously it depends on the maturity of the protocol and what stage they in right so if it is really an early stage protocol with a with a couple of people and a lot of projects start like this um even if they have the best intentions their um uh their priority is shipping I mean their priority there have many other priorities uh in terms of spend so security um like we touched upon just getting the audit and the contest uh and so on depending on the complexity of the code base could be anywhere between you know um a couple of hundred, and can go all the way to depending again on which uh security teams you want to the protocol wants to engage right so on top of that if they need the security

mindset if they want all that I mean it can get a it can get overwhelming right so do people have sort of an opposing take wherein they do see this uh sort of Outsourcing of security in the long run even for let's say for the smaller protocols yeah I don't think you can Outsource security like you can receive help from external provider but if you if your if your mentality is that everything is going to be a sucess and you want someone to kind of know just evaluate what you do and have no kind of like long-term understanding on how to improve um that's not going to work in the long term in particular if you're building something complex or something Noel uh there is a cost obviously of having like you know a security researcher security you know person within your company but you're actually

saving a lot by having like this internal capacity versus know just having like everything you know relying on on external provider uh so there is a cost but I think it's a cost that you have to pay by walking within the prodction space okay y I thought I heard somebody say something no I said I agree I think it's it's be it's becoming more challenging with Ds because the issue that who in the da is but I think in general I agree you you cannot share responsibility but in the da is more tricking who is the responsible the for the thing but it's a

in general I agree you need yeah yeah and I would add one thing here where I think JN touched upon this earlier where lot lot of Protocols are not taking the VAP two side of security as seriously and I've noticed that in teams that have dedicate a security person they tend to be very much focused on the web2 side web2 and like the obsc side because a lot of the details um I think let's say the founders or the protocol Engineers they may not want to like share like fully to the public like how they do the key management like where the keys are and if you have someone internally in the team like these issues get caught pretty early like like we frequently hear very early

stage projects where you know some of the private Keys may be on like a laptop uh in their home and an internal security person would know that pretty quickly and tell them to like switch it and in my opinion like they're more effective than someone externally telling them hey you need good key management practices like having someone who's like a teammate telling you is like more effective makes sense yeah absolutely team this to being very effective um you can Outsource certain parts um especially with specialized expertise but uh because security like you can prevent a hack on many many levels right and the best way is of course to write

code um which um doesn't a bu right and that is something where you start much earlier than what traditionally is a scoped for security or perhaps after the fact and you cannot Outsource this culture of of thinking uh secure this can only come from inside I've seen this often very successfully even on the CEO level it's like this full trust they might dedicate it to someone they also fully trust and and embed that like yes it it must be secure this is just not a question and then um you can build a team outside or inside based on that but it must it must kind of be part of your

culture and and if it's part of your culture how can you Outsource it um so I don't agree that you need a dedicated person who has like ceso title in your company um that's not necessarily needed it's it it must simply be something something where um to the top level it is agreed that this is important and you strive to make that make that happen uh and and then it will be very individual on what's the best way to achieve it I agree I guess I guess I guess it all boils down to the fact that there has to be someone within the company

that owns security right so whether it's a dedicated ciso if it's a big protocol or a big company or whether it's someone who is responsible for looking after security things as well right um it has there has to be that person and as Matas was saying you know that's kind of starts the culture security first kind of culture within the company that you know allows everyone else to build with I guess security Focus um and I like what har was saying also about you know the web too and infrastructure and things like that and tissing you know and and um making sure people understand what those things are and what to be visualant about because it's not just smart contract security um sort of like what we talked about last time right like we we're getting better at smart contract security but there's still a

lot of other things around it you know infrastructure web to um fing all those sorts of things and that's that's a long way to go great points um so yeah we'll we'll be coming back to a lot of uh a lot of the things that have been touched upon in these responses so let's let's move on to the next one right and this one is to Maas we need auditing standards and certifications in the space good one um we can certainly benefit from like thorough education sharing and so on

right so I'd say like standards um are something which which encapsulates what we learned from the past they sometimes lead to that we forget why why they are around why we have those rules in place this is of course very dangerous um but it also allows to to kind of continuously improve and not having to learn everything from scratch our industry is still very young and the way we do work with like everything is open source and out there in the public and we analyze the code really from from its lowest

levels to its highest and so on this this is a little bit special right and we spend a lot of time on that but um when we see this becoming more something Mass Market I'd say standards become more important um to to scale efficiently but but standards not the huge danger of Standards is the gness of them right that you might have a entity where it becomes a little bit political who's allowed to give out some stamp um of course for quality assurance reasons it might make sense and so on right but this is to me a little bit

against the ethos of like this openness we have here uh a lot for us is I mean the brand uh the the reputation the track record you have of course is kind of our standard our certificate today and this is very powerful because being able to consistently protect protocols over a long time is is really something which which uh can help people to really build trust right uh a good client of us always says like yeah because of you we can sleep s right this is a little bit the thing which you

need and I I'm a little bit scared of Standards eroding this because um you yeah even up to the like uh Financial world where you had like the lot of standards and then um ey audits um like a company in Germany which then does the biggest wire fraud in history um and and then you it kind of gets picked up as like is our standards just valuable or not at all but today I think we we could we could take value out of them as like a baseline for like this is what you

should do this is where you can improve there are soft standards right the Seal team has this framework and it's just a list of best practices I wouldn't call it a standard if you come from like the words of Big Forest heavily regulated ENT entities but it's super helpful because you just read you see it makes you think right and you need to understand but it doesn't lead you to blindly checkbox a bunch of things where everyone agrees you kind of don't need to or it it's like it feels weird few people might know why this was meaningful but no one knows anymore especially know the ones who are

executing it it's very easy to miss things um so yeah this these are my general thoughts on standards yeah one of my concern to to kind of follow on what you say one of my concern with standard is that if we end up having standard within the industry we might actually lead to lower the security maturity and this is because if companies have like like you know here's 10 step you need to do if you do that you are good it can of create a Bas line and when we have a baseline the risk is that company will follow the Baseline and not try to go above that while today because you know everyone is trying to push themsel uh it does create kind of a situation where there is no kind of end goal and everyone is just you know

trying to uh to do their best in term of security while if we have a standard there a standard and the certification has like a low requirement and then it's bit worthless right or it has like a really high requirement and then like no one can really achieve it uh so doesn't seem like you know it seems like something with key where we can end up in a situation where the ecosystem is in a less secure state than it was before the standard um that's why know best practices as you mentioned Matas are a bit better because it's not like a hard requirement it's more of a soft requirements something I've also noticed that when we talk to regulator most of the time they are like behind the curve you know writing a standard writing a certification takes a lot of time and

once you have something you can release it can already be kind of outdated and given like the fast pace of blockchain um it sounds difficult to me to have like a certification or standard actually providing value to the community makes sense yeah go on I have a little bit of a different take here I think crypto today is like very different from like three or four years ago right now we have even like you know governments getting involved in uh crypto for better for worse um and a lot of like institutional players and I think these people look for these people look for like common patterns across like different projects that they're investing in for example I

know like one big institution player that would look at like L2 beat and read up on like each chains before they decide to put money into these chains so I think there is like some level of like standards that are developing along the way I don't think it would be like you know the web to standards but I think I expect like a lot more like Enterprise and like this you know traditional chafi people to look out for certain things before they invest in in protocols for example so like some form of soft standards are going to be very helpful in my opinion for example we release like Z test which is like a 10 list of question you can ask yourself for example one of

the question is do you have someone who has Security Title in your company to come back to to one of the first question um please make sense to me like soft we can call them soft standard where the question is not something you know too too deep and a bit more high level might make sense to kind of Identify some some issue but yeah it depend on what level of certification we are looking for and this has come up multiple times right I mean so to sort of um parse it a bit more and sort of Flesh it out right so the way we do audits I think that that's what we've been discussing right the way we uh approach an audit what what sort of vulnerabilities are uh evaluated um and who does the evalu

valuation from an auditor perspective who are the researchers behind it what are they looking for how much time is spent how much effort is spent I think a lot of these things have been um have been I mean there is sort of a soft standard I think like Matas mentioned right that there is some maybe not a standard at least an expectation that if somebody comes to a trail of BS or if somebody goes to Sigma prime or spear but Cantina whatever right they have some sort of uh a standard in their mind that they expect from the the audit of the review right but I think here what we are trying to also see is can we as as an industry right I mean just among the people on this panel uh like the W

uh uh test that you mentioned Jin right I mean that could be I mean that's obviously an internal effort uh you know the public good from Trailer bets and and then there has been other efforts in terms of I forget what it was called from diligence uh we earlier on right like 2018 is where they essentially came out with a classification of vulnerabilities right like the cwe cve kind of a thing um so there have been those efforts but it has been sort of driven by one player just because of whatever right circumstances but the question here is can we like like uh from a seal perspective or from some other perspective would it be wouldn't it be interesting to sort of uh at least

establish a baseline I mean establishing a Baseline has both pros and cons but at least establishing that Baseline will make sure that we bring up everyone else who's sort of below it to that you know to that standard of that Baseline right can they exceed it absolutely can we uh there are there are comments on uh on the chat box as well I mean we need to keep refreshing this on a sort of a u i don't know like a monthly basis or if not annual uh right to keep it fresh but I think all these things point to the fact that hey today maybe we agree uh on what is a let's take a simple example right my guess is we may not even agree on what is a high severity and a medium

severity right finding in general right so if you look at contests and if you look at reviews there's just so much uh so much context behind each one of these that um we have adopted you know all of us have our own versions of the Matrix that we use um I know like trailer bits I mean you give a sort of a color coding as well you have your own categorization of the the you know the type of uh classification of vulnerability and um spearit Cantina and I'm sure uh uh chain security has its own but but as a whole I mean should we give up saying that hey the space there J you know it's not worth it or is there some sort of uh

better reason for us to come together in and at least try it out right so I think that is sort of what the intent behind this uh question or comment was so I think it's a good idea to have Baseline but it has to be very low and actually for example not actually address things like what whether it's a critical issue like everybody agreed that you need an audit everybody agreed that you need something everybody agree that you need to have something to deploy and I also think in this domain I agree with Matias it must be soft it must be something like say it's something very soft say here are the process that you have to do to deploy here are the things I mean uh addressing the issue how critical is a bug is very

important for a bug Bounty or for Community auditing but it's not necessarily something that the protocol is is aware so much maybe but the issue that we want to know what are the good things you have to do like whether you have to have your key in in one thing it's almost obvious that you have to have sort of some kind of decentralization of your key so focus on some very very common thing and I don't know if it's we or seal or somebody has this some kind of list of soft things maybe it's se but it's but and then it's something that is available and hopefully affordable because some of the issues that when we talk to protocol they say we just cannot afford to do what you want so you want to make it

affordable and very very basic very very basic like get the I don't know whatever it's something very very basic sounds like you want something very high right you want to um I mean high and low is relative right I think we want a baseline I mean the the challenge that others have pointed out is if it is too low then it just becomes uh you know yet another reason to rubber stamp right so no no but people know that they want to go above the Baseline everybody wants but the Baseline is very minimum right right yeah I think that do we get right baselines are really people get hacked because of Baseline following

only baselines so the I while I sympathize with the thought of like yes a baseline can help because some people need to start somewhere and then you need to tell them the basics yes um as a standard where like the the people Harry talks about like the more traditional players the regulated ones and so on they they need someone translated right and then if they have a standard which says these guys follow the Baseline but that's worthless the whole standard is worthless so yeah this I I think what we should not forget it's almost impossible to keep standards up to date with the technology it will always move faster it's a slow process like Charles wrote

it and then he runs one of the best standards we have currently right and this is simply it but the thing is there's education who do you trust what can they do and I think there we can also think about like standards levels um and and for sure what rajie mentioned standardizing about the language we speak in in audits which trust levels if you want to call it this we give would really help and this is also something which I have seen in the traditional industry where you agree on common terms and then you know if you call something

for example like the audit versus review right stuff like that if you call it everyone speaks the same language and and we could definitely introduce a language which gives you an idea about how much effort was spent on securing it and then we can as an industry also call out players who give this but didn't invest that time and so on right we are pretty good at that um so uh but we don't have that common language so perhaps that's one of the things which standards could really help especially for people who aren't in the security industry to understand what they are getting and to be able to compare it better than than now where they kind of have to trust because my friend who's in the security industry

tells me sat Tor is a great company so I'm going with them right and and that's a little bit where we stand today sorry uh makes sense I think there there a lot of uh ways and angles to look at this um and I think U Charles on in who's in the audience is bringing out important points so the Enterprise E Enterprise Alliance or E trust so they're daging their initiative goes back to hari's point of how uh while we may not want baselines I mean there are pros and cons right I think the uh the Enterprise coming Enterprises coming in

so they definitely want some sort of ter I mean standardization I think is a very lower term right I mean we think of ietf um and and uh similar bodies but if you want some common language terminology some baselines either low either you know somewhere to pull everyone at least above a certain level then we'll need something we may call it different uh terms and and like others pointed out seal framework I think is is is a great starting point I think the E trust is uh yeah is continuing the effort of diligence on the S swc um the weakness classification um so lot of things

already happening so uh let's let's jump on to the next one um and this is for Mel Mikel um audits are mostly manual anal analysis today because tooling is still not there or still maturing yeah that's true I I agree um so it's always a mix of of of of both right um but I would say n 90% of work currently is is all manual review right so the tools are definitely used there to you know find the D hanging fruit find the the common bugs find the bugs that you know that that so obvious that

that will find it right um but the real you know business logic issues or chaining several issues and vulnerabilities and finding those really tricky little problems um that has to be done manually right so at the moment I would say that the vast majority of review is manual um that may change in the future um with you know the better tooling with advancement of AI and things like that I don't think that will completely replace it but will definitely you know enhance it a lot more um but where we are at the moment it's it's it's a manual manual labor yeah might have a slightly different perspective here because while

I agree like you know probably 80 90% of of the work is manual we are relying more and more on automated tooling like s automatic tooling from static analysis to like to like C or further like user in Aina and we are finding a lot of vulnerability using like fing and using invariant um obviously a lot of the work is still manual review but the amount of benefit you get from a tool like Medusa is just really really high uh and you know if you look at our we we have many many finding that our we that we found with fing we have many kind of like situation where finding a specific bug was difficult with manual review and just with using a further you know with h us to to leverage and find us

something within a day U so why I agree a lot of the work is in manual review I do think the tooling is an important P nowadays it's different from three or four years ago where you know maybe only a few people knew how to use this tool I think today there like a increase of awareness and and understanding on how to use this tool I agree I agree with jine we see actually the think is at the point also maybe we are forgetting one thing that manual audit requ requires auditing Auditors so what happen is that the issues that we have customer finding the bu before their purches so that's very good so the issues that they the it's true it's true you are right that you you find a lot of

bucks but actually we take our tool and run it after our best people from outside from inside and whatever and the tool find things so the idea is that it becomes to a point and that's the difference between web two and web three it becomes to a point that actually not using a tool it could be a negligence because the idea is that you have you are investing you're paying we don't talk about it but you're considerable amount to human who is very smart to review a code and now you have a tool based on fing form verification AI I don't care but you run it and this technology is finding a bug uh after your person you want to run it even if it's the case that it's only 15% of the

bug but what if this 15% of the bug is the one that gets to the to the error that you steal your money it's not an issue of percentage the human effort and also this is a case that web two is very different in web three in in web three in web two to get such a tool to work will be very hard Web Two at least in the smart contact case this is a very small call we have actually worked with many of the teams here and even even for things for consensus actually you m you talk about consensus with consensus I can show you problem that we find that actually n none of the people working in consensus working because it's a it's a delicate situation and this is a case where we have such a big compute power

why not use it of course you have the human power which is okay people are smart like you but compute power using the compute power whether it's fing formal verification static anal AI use whatever you can why not it's a it's a you're worried about the the your the life you you're always going to have a time for human if if it's only 15% people will pay for human don't wor the issues that you you want to use the tool you want to use the tool and they they're getting better with it whether it's a whe it's lean and kid found tools are getting better if they would use more use more yeah just just to be straight I'm not saying not use to it at all I'm just

saying pick the right tool for the job sort of thing right so I'm saying that this tools will pick up different things and the manual review will pick up different things right so that's actually surprising we are we are finding if you have good invariant you find actually many logical bugs with or even things like equivalent check you take a Cod that people optimize the gas and you compare the the the two things together you actually see that the optimization and look at heck like the kyar which was actually audited by very good teams it could be prevented by very simple the the the most difficult part about fing and formal verification is getting invariant but there are some cases that you don't need invariant even with equivalent checking or statical

there are some things that you can have which is even low hanging food which could be interesting of course so I think actually logical mistake could be identified by by tools too not just the S simple thing it's surprising it's surprising to us it's surprising to us you can tell the thing on compound B2 sometimes the tool find things that we don't believe good good to see the debate getting a little more so uh um anyone does anyone feel that you know tooling doesn't really matter today I mean I have a different maybe like a different opinion on this where I've noticed that a lot of the top

protocols when they come for a secure review they are really like expecting to find new Noel bugs and which is like a bit harder for a tool to detect um I mean even though like you know fuzzing and F modification can find some of this box like protocols come to us a lot of the top ones especially like they they're looking for a human to review it and you know try to think about how they designed it and maybe find like a completely new kind of flow so a lot of the top ones are looking for radically new findings and uh sometimes they need a human got it okay so just doing a quick

time check looks like uh we may need at least one more panel to cover all the topics we had in mind uh so so I'll just sort of uh steamroll through some of the next ones um just trying to see the more spicier ones right so I was going to check with mully about uh you know the space needing more Auditors but I I doubt anyone is going to disagree uh so I'm sure we'll all agree that we need more Auditors more more researchers more tooling all that good stuff so I guess uh I'll jump to uh this thing for m um so mly the one for you is protocols should do an audit first followed by a

contest and only then should they look at formal verification something sort of very close to your heart so yes yes yes so the answer is no I completely disagree uh I think protocol should use everything they can the earliest they can the cheapest they can and and and the think in particular what we are trying to do and I've been trying to do for a long time in a very limited success is to to convince people to think of specification early whether it's fing formal verification I don't care stud think of and think of things before the Cod is deployed and use our tool or lean or whatever you want I

don't care we are seeing people protocol that comes to us actually after they go to the to the competition and then we told about the property say we wish we knew them earlier we actually I don't know if you know we work with li we actually now have the Dual governance we work with them before they have one line of code actually and we found we found a b which is acknowledging the design of the code so I think actually and this is of course we need we don't use tool we only use humans we use Smart humans at the moment but it's the case that we want to work with tools with everybody and of course Community is great you want to start with the tool early you you want to start writing spec early you want to write starting Things Early

whether you use Foundry fer form verification you can actually work with our tool now in partial code it doesn't even need to be compiled we we don't want to do we want we don't want to wait late we want to start early we we we have been doing it for s for while now we're doing it for and actually we work on the evm level but now we work Sol B code format web assembly we want to start we want to start early we want the security researcher at Cantina to use this tool and some of them already used we have seen now recently with people report on immuni that's great that they use the tool that's fine we want people but we want them to use it we want the

protocol we don't actually want even we are seeing security research are adapting which is great but we want the protocol with the people people WR solidity they can write in variant it's hard but it's actually Innovative you once you get it people you like it it's there is some kind of a learning care to write envir whe but you you the benefit is very high especially when you have tools and you have compute power so I I say no the the the the I would say formal verification first or or or formal specification first then go to manual audit then go to to and then actually manual audit can review your specification we can have a bu in the specification and the community can review the specification so so it's the

case you probably know a lot of you know about the notion or some of the protocol that work with us and actually they had a bug in the spec of course the you can have a bug in the spec to it's not a bug in the tool so we we actually want to to find bugs in the spec and if you do the way you are you're not going to find bug in the spec and okay maybe you trust Sor which is great but I think actually you don't want to trust theor you want to trust yourself you want to trust yourself you want to write these specs using our tool or other tools English right is natural language and actually even auditor I believe when they know so har said that actually they're looking for people to find bus which are unnown formal verification is the best use of

this is to find unknown buxs if you have the specification because we're not specifying what's right or wrong what's wrong we're specifying what's right and then the formal the the tool find what's wrong so the issue that you want to specify the truth you want to specify what it means that you deposit and you want to do it early sometimes before you write the C and whether you use T or English whatever write the spec say what you expect sorry I har disagree no no no I actually agree I think I think writing speack early is always like extremely useful when you're building code and like building software in general um it can

be a bit slower to do it but I think a lot of the strong teams we know like something I've noticed with like very strong Engineers is that okay like there is this notion of like test driven development where they try to write a lot of tests early on while they're building and it helps you write better software so it's very similar in that sense where if you want to use tooling if you want to use like automated you know tooling of some kind you need to start implementing it like right away as you're building the software and waiting until the end is it it's just not effective at that point it is effective but yeah by the way it's not always slower look at Unis the spec for UNIS SW V2 is the spec that is used now until Unis SW V4 so it's could be slow slower

at the beginning but then it faster to if you are building software and you think that you want to stay around if you are building the software for one year and then you're disappearing maybe slow but the idea is if if you want to stick around once you know what you are right we we the spec that we wrot for compound V2 we use it for V3 and we so that once you have a specification you can upgrade your code faster because you know what your code is supposing and you're adding a new feature so it's actually look at the the spec for un V2 says it's con Conant Market pool it's a very simple environment and you you can use it we use it for V4 yeah to come back on what mly was saying this is what we've been try

trying to push to our clients to and it's what we call invariant driven development where similar to like know test driven development where you you develop your protocol on the testing you develop it are on the invariant no matter if you use a tool or if you just check manually or if it's just you know within the documentation knowing your invariant you know beforeand doing the design and doing like all the different step of life cycle is going to be like a huge Improvement for for like the end product good points so um in the interest of time I mean just like with audits this is a Time bounded panel so uh we will steamroll so I guess uh you know maybe one direct one quick direct uh fact fallacy thing to each one of you

just trying to pick the best one so this one is goes back to hurry so by 2030 all of us will be out of jobs because smart contract Security will be solved by AI right so we may have uh just like your deep seek we may have a deep find I don't know foundational model for smart solidity smart contracts that finds really everything wrs invariance does the whole thing and we'll all be out of jobs to fallacy okay I think all of us will have jobs but it will do look very different that's that's my take I think uh Security in the future would look radically different than today and I feel like we are getting to a point where we are like fundamentally

rethinking like what do intelligence means and some of the like AI models are getting very very smart so I'm pretty confident all of us will have a job but it's going to be very different we'll all be writing security prompts so uh all right um so going on to josn um coming back to the present right 2025 we will see a billion dollar exploit oh um I hope not but uh we will see I think if it happen there is some chance that it's not going to be a smart contract one but it might be like a operational Security One um that would

be like the most likely but yeah I hope not okay Maas this is a a touchy point so Auditors should have more quote unquote skin in the game again yes um me see the skin in the game is of course the brand um having more in it um in the financial terms is an usually an insurance business um can be blocking too um I really like that our space is so open that we can have um like startups new single person companies coming in one example like

Harry might know right there is this guy called Chase who runs light Chaser one of the Bots right it's common in the crowd competitions to have that is just one person doing this and um this uh asking for people to have skin in the game um would stifle this for sure right so if you want to have skin in the game you do an insurance um and if you want to have the like best talent who often happens to be 20 years old um checking your stuff you you do that right you don't mix those two things good points all right moving on to Mikel um so this may be a a lot of

interest to people watching this uh for people getting into this space so the point is smart contract security is a rewarding career for anyone interested in security 100% um it is rewarding well monetary if you're doing back banties you know if you're working in industry but also rewarding personally um you know if if you're like tinkering with things and um you finding finding bugs um particularly something that has immediate monetary impact then it's it's it's a really really good good fun um I guess that's what also interest people straight away because you know if you get into like let's say traditional pen testing you know you may working on the

web apps that not necessarily carry a lot of monetary value if you hack them right you can't really you know you don't feel like it you're making that much of an impact right but with smart contract security for example um there's a lot of money at stake basically all the time so it feels really good you know being a big part of securing it and also um potentially it's a little bit more motivating for some people hopefully the you know the good guys the one hackers to actually learn and upskill in this and you know help us secure the secure the industry uh so no absolutely very very rewarding um in in all regards that's that's why I actually moved from Web Two to web three also super super hard so that is awesome right if you want to be do something which is very hard and very rewarding a

few places where you can do that uh and and uh just uh cack some of the hardest puzzles we we have which are actually crackable um so yeah I agree there so much good content so I think it's great actually that we have this domain great so to wrap up I think the the final one is toi which is web 3 security has a long way to go and a lot of things to learn from web 2 web 1 security I think I agree and disagree I agree that you have to learn but actually we have to teach the a lot of things that we are doing which is actually very interesting and very unique and people can see it whatever it's the is the security the back bount

I think we are we are the two model there a lot of people including people here that actually innovate a lot and the companies I think it's very interesting and I see what Harry said about other players coming into the space I think it's a we need to learn of course the lot of things that we need to learn but we can also teach there's some things that coming in web to which are unique I actually work in web 2 I think it's it's very interesting with a lot of things coming in web 3 security which which can actually be beneficial to outside this domain whether it's gaming whether it's other things a lot of people can use this not just in in crypto actually fantastic I think that's all the time we have um and U from my side I

think the fact that I need to I I would like to share is that we need many more panels so we can discuss more facts and fallacies which has been true since Bangkok so hopefully we'll we'll uh see you all very soon on a different panel somewhere else online offline so thank you all thank you Rajiv thanks M thank for thank you byebye thanks L thanks everyone thanks Nathan bye