Fraud Prevention for {Smart} Wallets - Peter Jung

Transcript

[Music] Yeah. So, hello everyone. Thanks for having me here. I'm Peter from Nosis AI and today uh this thing is not working. So, today I would like to present something but maybe not. Can you follow me? Ah, okay. I'm there. Cool. Perfect. So safe fraud protection uh from Gnosis AI. But before that I'd like to have a few words about AI agents in general in web 3 because since chbt was released the AI agent use case in web3 is just

booming right basically anything that can be automated uh by function calling with LLM is automated with function calling by LLM and that's great. So let's try it out. That's many stuff as we can and something will stick and some will not. But what I do agree about is that AI is not just LLM and is a huge field or many different uh sub fields with many different use cases uh for many before GGP went out and in web 3. We could well take some inspiration uh from web two and try it out. And one of those maybe kind of boring but very important use cases is security because

in web three we have our private key and security for it is basically everything. If we lost it then we are done. If someone steals it and transfers all the money from a wallet there we are done as well. There is no one uh who will help us. No centralized entity that would require the funds or anything. So life savings could be at stakes and for this the safe project. So the safe smart wallet is doing very good job and solving many many problems. So we have possibility for multiple signers for spending limits for account recovery. So if you ever lost your private key then your family or some closest friends can help you recover it. And with a lot this

upgrade even any EOA can become a smart wallet. So this is all great and solving many problems. However, there is still a lot of use cases that are judged by the end user. So there is so many scam tokens just pump and dump schemes. Uh there is blend signing. There are unsafe contracts. So it doesn't matter if the contract is unsafe because of some like honest bug from the developer or it's a malicious actor that wants to steal everything from you. Uh it's problem in any way. And even the most advanced like tech heavy users of web3 are sometime doing blind signing. And all of this is judged by the end user. And it's perhaps fine as long as the web three users as is right now the average user is

probably very technically like knowledge level and knows what is doing. However, if you want to on board like million or billions of people, there should be some layer of security. And for this I would say that standard banking systems in web two at least the better banks are doing like quite some fine fine job. So there is perh thousand of attack vectors that are being checked for when you are paying with credit card when you are sending some money to a different bank account and similar stuff and for that there are hardcode rules there are some like algorithms a lot of machine learning not necessarily LMS and if at any point your bank thinks that your transaction is for some reason malicious

that your credit card was stolen or anything they will block it and perhaps even call you in a few hours about this transaction that hey it is really you is everything okay or what's happening at least it was the case for me like a few times in in the past but in web three we don't have this so the private key if I pay something from my wallet today like right now and in a few seconds someone try to use it from around the globe like no one really cares about it because private key is everything and so for that I would like to introduce you agent in cosigner so basically an agent that is running 24/7 every day, every week the whole year and it's a co-owner in your safe and

whenever you create a new transaction, this transaction will go to the queue and the agent will pick it up and verify it for you. And of course, he will check for uh many different attack vectors. So if for any reason your transaction was like modified on the fly for example if you are hacked and it's not going to do what you want it to do if there are any malicious addresses being on in this transaction it will flag it or if there is any odd behavior. So if you are doing something uh some kind of transaction that is not really in the pattern of your historic behavior then it will also flag it and also warn you that hey there

is for us some problem uh you want to double check it and after all of this it will either approved or decline the transaction and send you a message about it to inform you why this happened what it thinks is wrong etc. So we can take a look at some examples uh that I tried out. So the first one uh the green one this is an example of a valid transaction that's okay. So what it says everything is okay. The transaction involves swap of €250,000 uh for USDC with no indication of malicious activity. And off top of that you will get a list of all the checks that the agent performs uh with

some brief overview of what it's doing and why it's okay uh or not. And then if this is okay, agent will just approve and perhaps even execute the transaction uh if you want to execute the transactions uh for you. And in this case, swapping even a large amount of euros for USDC is not really a big problem because both are well-known tokens and if we swap them then the money or the funds are still in our wallet. So like uh not be nothing going on. However, in the second example, the agent is saying the transaction is flag as potentially malicious due to the large amount being transferred to a new recipient address that has not been

observed in the previous transactions. And again, a list of uh checks that the agent agent did. And in this case, even though the amount of money is 20 times lower than in the first transaction, this one is like potentially malicious or something weird is going on because like a lot of money is being sent to address that you never interacted with before. So what's happening? Is that something you really want to do? Or is that someone hacked your account at your computer? I don't know. And he's just sending all of your money uh to his or hers wallet. But in any case of course the agent decision is not final. So in the case he flag it as a malicious you will receive this onchine rejection in your safe. Uh you can read the agent

message and decide for yourself like do I really want to go with this transaction true and it is okay because I don't know it's my new friend or a new employee in the company or you can be like okay this is wrong I will just reject it and then you can debug uh how this happened why this happened. And so to sum it up. Yeah. And so to sum it up, it's a agent e cosigner and it's open source. So you can run your own agent. Right now a few agents are running on grocery servers. Then you can use consigners to yourself if you want. But of course there is like a big ask to ask to add an agent as a consigner. So if you want

it's open source. you can uh check the code and you can run your own agent if you prefer prefer it and of course it's good to mention that agent's permissions are limited. So even if you have this agent as a co-signer in your safe and for any reason the owner of this agent becomes malicious or the private key is leaked or whatever agent cannot just well steal all your all your money. So the permissions are limited and he cannot do like just anything. However, it's still a big ask to act other agents as a cosigner. So, if you want, it's also available as a API or web application that you can find in the square code uh where you can verify basically any transaction on safe uh without adding as a cosigner or doing

anything with your wallet. So, you can just try it out and see for yourself is this is working for you or not. And right now it supports Etherum and chain. And that's about it. So there's the same QR code, there's the link for the website and you can also reach out in the Gnosis Discord channel and thanks for the attention. Yeah, thanks a lot Peter and we don't have time for questions so feel free to reach out to him. Thank you. [Music]