The evolution of Revoke.cash / Rosco Kalis

Transcript

foreign hey guys um so I'm Roscoe I work on projects called revoke.cash which is a security focused project um that allows you to manage your token approvals and today I kind of want to share the story of how it got started and what crypto looked like back then what it looks like today and kind of what changed in in crypto and and exploit scams and sort of what revoke is doing around that so let me take you back in to 2019 when crypto was a lot smaller than it is

today um I recently took the looked at the tvl back then with under half a billion which you know looking back then it was still was was really a lot but looking at today's figures that's um not too too much um and you know D5 was was coming um there were obviously a lot of things in development but it really wasn't as big as it is today and most things that we know today were still being developed things like Ave and um other other big D5 platforms so in October of 2019 um I attended DEFCON 5 in Osaka and then I met this guy

paulberg the creator of sabler which is like a money streaming platform and he gave his presentation about erc20 allowances these token approvals um and basically how this is such a big part of all of D5 really like if you want to swap tokens you have to approve your tokens if you want to sell on NFC you have to um approve it on openc um but how back then at least we really didn't think about any of the risks associated with that and I really um got inspired by stock so three days after the the

um the conference after this talk I launched the first version of revoke.cash which looked like this so um I I took this screenshots pretty recently so it looked maybe a little bit neater back then because there wasn't such a big amount of scam tokens and like spam stuff in uh in people's wallets um but yeah super basic just an overview of your token balances and all the approval you had um but it was better than having nothing right um and so over sort of the the months that followed I kind of improved a bit on it um you know added some additional features um

and that was so that was in in 2020 and then later uh later that year of course um if you were around couldn't have missed D5 summer which is what um for a lot of people was you know their introduction to defy and to sort of um you know yield and all these staking things but also to the um more to the risks of of it all um there were plenty of of forks of like these food themed um farms uh that that most of which were like rug pools so there's also also really the point where a lot of people

got introduced to the fact that you know you have to be really careful with what you do with your money um and while some um some projects like for example this unicat which was obviously rockpool um also saw approved funds most of them didn't really do anything with your token approvals and it was mostly about your deposited funds that were at risk so a lot of people while they did get introduced to the idea that they had to be careful the whole sort of risk about token approval still wasn't really um ingrained in a lot of people's minds um but then in February of 2021 I think this was the moment that

um really the the sort of risk and the sort of danger of these approvals came to light for a lot of people um with the four combo hack and four combo was this platform that allowed you to sort of chain together different D5 transactions um and they got exploited and they didn't they didn't just lose the sort of the deposited money to the hacker but also all of the approved funds just from the the safety of people's wallets um I think a lot of people here started to realize you know there's a there's some dangers there um and of course 2021 is also sort of the start of

um sort of the nft hype of course nfts were a thing before that but I think for a lot of people um 2021 is when that really um to golf so obviously for nfts you have the sort of the same concept like if you want to sell an nft on openc you still have to give openc access to your nfts um so also in 2021 I added support for nfts to the to the project and at the same time there was another big big Trend in crypto where you know back in 2019 um it was mostly ethereum in terms of like

smart contracts um but nowadays and in the in the past couple of years we've seen that there's been a lot more other chains being used as well other smart contract chains so um I really had to support all of that as well because you know it's not up to me to figure out who should use what chain for their things right um so in the meantime and So eventually that um that ended up in sort of this whole new version of revoked cache that I released earlier this year um uh that is sort of more more flexible into the future so if

we go back to this sort of first exploit that um you know people experience with their approved funds over the past years that one big exploit turned into dozens with hundreds of millions of dollars in approved funds stolen from people's wallets um most recently there was the um the sushi swap exploit in um in April and I think uh that really demonstrated as well that you know um Sushi swap is a an established brand you know the service project in the in the space um but that does not make them immune to being exploited having their smart

contracts hacked and because of these approvals um that also means that your um the funds actually in your wallet uh could be at risk as well um so that kind of led to uh another more like sort of evolution of of what revoke that cash can do um with the the exploit Checker that that um we launched earlier this year as well um because there are so many uh exploit that exploits that happened and every time something like this happens you know you see all over uh Twitter um you know people are sharing this news with each other they're saying oh you

know check revoke.cash or like check your approvals or do do this do that but for a lot of people um it's not really clear what what any of that means right so um this kind of comes in as a sort of simple solution where people can um just check in in one click whether they're safe you know because that's kind of all they care about at that point you know am I am I safe um or am I affected and if I'm affected you know what do I do about that right um and so while on on the one hand we we have all these sort of smart contract

hacks and you know smart contract hacks some of them do have uh uh these approval these approved funds at risk While others um don't and of course the ones that don't have it at risk um those those are even even bigger in the in the past years you know there have been um billions uh stolen from Smart contract hacks um I think earlier today here was also a talk about bridges and how bridges were I think the most hacked thing in in all of Krypton um but at the same time besides these uh these smart contract hacks and these exploits um we've also seen a huge rise in in scams and fishing over the past years

and so when I created revoked that cash back in 2019 um this was not on my mind at all are really sort of the the um the issue that I foresaw then was sort of what we just discussed about you know smart contract hacks you know even if it's an established contract what if three years down the line um it still gets exploited somehow um and then you still have all of these all token approvals uh lying around to these smart contracts um you know you might be vulnerable but then um what I didn't foresee is is all of this where you know crypto has grown so much

in the past three years there's so many more users um and also kind of perhaps nfts brought in also a new kind of user um that kind of yeah like all of that sort of attention and all of that growth of course attracts um attract scammers as well um and this is this is an interesting one as well that we saw I think earlier this year where Kevin Rose had over one million dollars stolen from his um his wallet through one of these fishing fishing websites and well while revoke.cash the sort of token approvals platform it can

definitely help with these kinds of cases it's not the whole the the full picture so last year um I developed a browser extension the revoke browser extension which kind of complements the um the token approvals platform by adding um sort of warnings when you're about to for example give a Tok approval but also certain other kinds of harmful actions such as listing nfts for sale because one of these things for example what happened to Kevin Rose is these fishing websites they try to make you sign a message that essentially just puts all

your approved nfts that you have approved to to open c put it all for sale for zeroes for example so these kinds of things um uh this browse extension warns you for and it's still up to the user to figure out what to do with that right so if you go to uniswap and you want to swap tokens and you know you get this pop-up that says hey your uh this website's asking you for an approval for your usdc if that's what you're trying to swap then it's pretty easy to figure out you know that yeah that that makes sense that's what I'm trying to do but if you're on for example an airdrop website and then it asks you to approve all of your board

Apes then hopefully you'll you'll be able to figure out that that is a scam just by having that extra pop-up that makes you think twice um and the nice thing about the way this is set up as well is that it out of the box it works for every evm chain so again it doesn't it doesn't matter you know which chain you prefer to use um the important parts that you're able to stay safe so I want to kind of finish this talk um with a few tips for about like what I've seen in the past years and and how to how to go about that so as I mentioned before there's kind of two things the first is

you know smart contract hacks I think um one good way to protect against that is using revoke.cash to limit your token approvals um so that uh in a lot of these smart contract hacks people had approved uh these these allowances these approvals like a year earlier two years earlier even um and then sometime down the line uh an exploit was was discovered and and they still lost our funds so they're they're usually in these cases is a lot of time to sort of revoke those approvals you know if you are done using an app like if you absolutely swap after you've you

know maybe withdrawn all of your stake tokens uh that's probably a good time to just make sure that you don't have any sort of open permissions open connections um but also as we discussed before there's a lot of smart contract hacks that don't actually um concern these approved funds um so you also just have to be very careful about you know where you deposit your funds in the first place um and I think you know that's always a case-by-case basis um but something that has been around for years and has been audited and hopefully doesn't have any like um upgradable contracts something like like uniswap um is probably a lot safer to put your money and then something that

just came around the corner um which again takes us back to sort of D5 summer when you know new Forks of of these liquidity providing things were popping up every week and you know people were losing a lot of money um and then uh and then there's the phishing scams and again um one good thing is to do is is again limit your token approvals um especially for things like openc and other other NFC marketplaces um and that's again for the case uh like for example with Kevin Rose's exploits you know um the uh the thing that these cameras do is they try to trick you into signing

these Marketplace listings but they can only do that for the tokens that you have an approval for to these marketplaces so if you don't have those in the first place then you know your your world is a little bit safer um and one other thing is you know using a hardware wallet and separating your assets between the hardware wallet and maybe a hot wallet and you know for these kind of smart contract hacks you know using a hardware wallet isn't really going to help you um but against phishing it can definitely um be that extra step that you need to not get fished and then finally um there are several like security

focused browser extensions on the market such as the one that I talked about from revoke.cash but also some others like wallet guard or pocket Universe which just have um some different trade-offs and you could even just use all of them together um to just be double protected um yeah I think that's that's it thank you guys for your attention foreign so we have three minutes to the next uh turnover I can do one question really quick thank you very much for the nice talk and also for the great product I'm wondering what's the future for the

space so for example do you think that the uni swap permit mechanism solves this somehow or is it just an incremental step maybe there are other things that are important and this is again related to what's next or revoke cache uh where it is going as a product yeah I think um um yeah so in some way um permits can definitely help with this so a few years ago I would have said yeah you know these sort of signature um based allowances like these pyramids are are great um and it is you know that allows you to just basically set the right approval every time you make a swapping unit as

well for example so you don't ever have any leftover approvals ideally um but then what we saw with the phishing websites for example um you know a lot of people have um this idea that signatures are somehow safer than transactions which is really not the case especially when you're looking at this kind of um you know signature based approvals so it comes with a different trade-off again um but I think a lot of that also comes down to like more education and you know having people understand that signatures are dangerous as well and and a lot of other things about like um safety so I think that's also

something that I I want to focus on more for revoked like ash is providing more of that education and you know telling people more about you know how how can they stay safe and what doesn't approval even mean and just all of the all of that yeah foreign [Music]