Investing in Web3 from a Security Perspective, Today and Tomorrow

Transcript

all right give another round of applause for hares everyone Hi everybody in the meantime I will just get started uh my name is herani I'm the co-founder well founder of zoko I'm used to saying co-founder but I'm the founder of zoko actually Soul founder and um I've been laser focused on the intersection of blockchain and cyber security since 2016 when me and uh a house full of hackers living in Las Vegas started investing like one to 2K into pretty scammy icos and then one day my roommate came in and said dude we're we we're going to lose all of our money which was a lot of money for us at the time because we were on like a Ramen diet building our first

fintech startup and uh I said how how do you know we're going to lose all our money and he said there's I find critical vulnerabilities or I found critical vulnerabilities in at least three of the smart contracts that we invested in and I found them with my bare naked eye I didn't do any fuzzing I didn't do any I didn't write any tooling um and we stumbled into saying why don't we create a company that sits on this intersection of blockchain web 3 and cyber security and uh here we are today I mean back then the company was H show uh between 2016 and 18 we audited more icos than anyone else in the world and then fast forward to 2018 we went from being uh a Las Vegas based company

to extremely remote um hosho never raised any Venture Capital hosho never launched a token because it's unethical for an auditor to have a token and then zoko went remote first so zoko we've got people in 19 countries there's about 30 of us and we mostly are known for auditing smart contracts on all the major chains but evm is where all the action is at still um I'll start the presentation um this might be familiar for those of you that are in cyber security it's the the classic swiss cheese model um and each layer of the Swiss cheese uh you know it it's it represents a layer of of defense and as you can see

each layer of Defense just like swiss cheese has holes in it and uh what I will say is you know this picture is it's a riskmanagement concept that is extremely normal in cyber security Web 2.0 but I'd say in web 3 you can multiply this by about 10 in terms of the size of the Swiss cheese and the size of the holes in each layer of the defense um in in the world of assets and digital assets whenever there's a lot of assets you attract black hats and what's super important for us in web 3 is we need to as an industry increase the incentive

that there is for white hats to not only be in the industry because the world's best cyber Security Experts especially in North America and a lot of Europe can casually earn extremely large salaries and it's been continuously difficult to incentivize especially American cyber Security Experts to take the turn over to focus on web 3 to learn languages like solidity um because especially in the United States they they stumble into jobs that pay them half a million dollars a year and they're like I'm not sure I want to join your scammy industry and so incentive does matter um this is taken from defi Lama this is not my information many of you

are probably familiar with defi llama we've hit a point now where almost $7 billion total has been hacked of that five of it is from Defi and a substantial amount of the hacks as most of you know and has actually been due to Bridges which is it's uh it's it's it's a massive fact and um each of these bars actually represents hundreds of millions of dollars if you look at the first blip the first blip is actually November 2016 when we got introduced to re-entrancy vulnerabilities because the Dow hack and then if you look at the second blip

that's parody but the last two years is uh about six you know 6.3 36.2 billion is just the last two years it it's pretty Savage um there we go so we can classify crypto hacks based on the layer of the stack that was exploited and the method that was used um the crypto application ecosystem consists of interoperable protocols that run on Smart contracts that rely on INF infrastructure that includes the blockchain and the internet itself and

um what's super common is Flash loan exploits um we always we we we tend to see exploiters use these flash loans uh in order to exploit smart contracts because they don't have to actually put up any collateral to execute the transaction and they can extract money without putting up collateral because as long as you um as long as the funds are returned within the same transaction you don't have to put up any collateral and so flash loans and Flash loan exploits whether it's flash on Oracle attacks uh are pretty ridiculously common in our space and as you can see in this kind of chart it breaks down all the different types of uh attacks and the frequency of

them in each ecosystem uh flash flash loan price or Oracle attacks dominate so infrastructure is everything that's not related to Smart contracts and I I think it's important to recognize that a significant amount of security vulnerabilities in the in the space are on the infrastructure layer and it actually has nothing to do with the smart contracts has nothing to do with the Auditors it's about web 2 it's offchain it's about custody security flaws and custody and that actually accounts for quite a significant amount

of frequency of hacks um but everything else related in the space the other 77% is smart contract related so you know a lot of blame does still go to the security uh prowess of both the team the Auditors and maybe the formal verifiers like sir Tor um some upto-date facts so as of today in the last 6 months we have now hit $656 million lost in scams hacks and rug PS 471 of that was lost to 108 protocol attacks we had $108 million stolen in various fishing scams and we've had $75

million stolen from a total of 110 rug po um arguably this is actually better than 2022 believe it or not but that's still again uh it's pretty ridiculous if we expect all of Wall Street and the world's financial institutions to tokenize or come on chain for them to put hundreds of million dollars in smart contracts um this this is completely unacceptable pretty much uh we're going to have to improve as an industry if we expect the world to co- onchain um

here we have the frequency of smart contract language hacks by type um I think what's most what stands out to me is actually the fact that developers really need to ensure that uh only trusted contracts are allowed to be used with delegate calls and that the delicate call the function I mean fundamentally it allows a contract to delegate a function uh to delegate to another contract and it fundamentally needs to be secure and it's very often that we find security vulnerabilities when it comes to the delegate calls and how they're written here's a a brief picture of the frequency of hacks by Chain um as as mentioned before all the action

is actually still on ethereum uh I believe the upto-date number on that is actually 75% so about 75% of all the hacks today um the most upto-date numbers have occurred on the the ethereum blockchain um but that's also once again because that's where all the action is at as much as we're seeing some new blockchains pop up like suie or maybe Aptos that are not building evm I do cons I do at the moment view them as isolated islands that are really cold um and sadly people do still suck at math and we noticed that running an auditing firm um because 14% of the

protocol logic hats are actually just math exploits um and I think that's also a ridiculously high number um I think we can we can do better as a space um on a more positive note um I'm very excited to announce that 45% of all the stolen Assets in our space have actually been returned and that is a really drastically different Trend as to even last year funds were not being returned in such substantial amounts and this year we've had $215 million of stolen assets returned the only hack to date that crossed $100 million is

actually the uler hack and that's that was even after a lot of money was returned but um a part of this actually I think is about improving the process of a hacker being able to report report an incident and having more companies monitor the social media feeds in real time to try to monitor for an innocent hacker actually trying to help them uh we need to have there is some platforms I don't want to throw anyone under the bus but there's some platforms where uh ethical hackers are going out of their way to report an incident that they found they found a vulnerability they went through the

effort of looking for the vulnerability because there was was potentially $100,000 on the line in a bounty but sadly a lot of those bounties are not being paid and um that's really it's it's a shame that uh it's a shame that that happens in addition sometimes companies are not responding the right way when someone emails them or messages them on Telegram and says I found a security vulnerability instead of literally giving them a reward of hundreds of thousands of dollars sometimes they're still threatening them with the lawsuit um it's a bit ridiculous and on a positive note uh recently there was a firm that found actually was cerk believe it or not cerk found a

vulnerability in sui and sui paid them half a million dollars so Bravo certic you did something right um here's some I I'll quickly run through this I think I'm getting close to time but um um it's super important when when launching projects to go through fuzzing using tools like etch Nida and testing how a smart contract reacts to randomly generated transactions um using static analysis tools like Slither and Mythril um automatically detecting vulnerabilities in smart contracts um these tools are super great for quickly picking out

common vulnerabilities but they only catch a subset of predefined problems and formal verification tools like sir Tor are a massive step forward but the weakness of formal verification is that the test is only as good as a specification so if the specification provided doesn't account for certain behaviors um or maybe it's too permissive um formal the formal verification process will not catch all the bugs um and then last but certainly lot not least uh you definitely need in-house and third party Audits and multiple of them um but audits usually fail to address how the interaction

between multiple protocols in the ecosystem could be exploited and audits are not foolproof and I say that as an auditor as a running a team of Auditors they're not foolproof humans make mistakes and most importantly the biggest flaws that are being found are still logic based and those logic flaws are only found by Auditors spending time manually to find those logic flaws and to think like a black hat and so you need to be hiring people who have an ethical hacker background a QA mindset a strong cyber security uh knowhow passion for the web 3 space in uh strong knowledge of the

language that they're now uh looking for vulnerabilities and really become proficient after years of ideally building ins solidity um um there's not a lot of human beings like that on this planet and people continue to hire like low-level smart contract devs to turn into an auditor overnight and that's also an underlying problem in the space and there is no AI tools today to find these the the math errors or the logic flows and the vast majority of the biggest vulnerabilities that have caused um detriment to our industry have been they back to back they're all logic flaws um and so it's a bit of an

elephant in the room still um there is no such thing as 100% automated auditing that was the pitch that was made by a lot of people when they launched their Ico as an audit firm that fast forward two years guys you know fund our token we're going to automate smart contract auditing that's even the bet that Andre and harwitz made that's why they wouldn't give me money I went to Simon Dixon and I was like dude give me money he was like no Chris Dixon he said no I'm not he's like smart contract auditing won't exist as a manual thing in two years and I was like all right you know you have your opinions and I have mine and here we are way more than two years later and it's not even close to being

automated um the future of web3 security is going to be treating security as an ongoing process even when you look at the nomad hack it was caused by not doing another audit after making upgrades post the audit uh this can't happen and we need better tools and processes in place to do continuous security monitoring and to not treat security uh on a basis of reaction and letting events occur and you know we can't be kids burning their hands on the stove and then reacting that way it cannot be reaction based it needs to be an ongoing process um onchain monitoring we're actually seeing

a lot of companies claiming to leverage AI or machine learning which is a bit controversial uh because where does the data set actually come from but we are seeing a a growing number of companies uh take a stab at trying to leverage AI uh to do proactive onchain monitoring um the first one to pop into that space to claim decentralized uh proactive monitoring with the token is for the network uh more recently we've had some noise about hyper native uh cyers Shield uh we at zoko are building something still a little bit of stealth more info to come um but it's so I'm glad a lot of people

are taking a stab at this um but I will say it's it's rather early um because um in theory you can give early warning to a com like when a composability attack occurs um but during a a flash loan attack the funds are usually stolen in a single transaction and so um when you're screwed you're already kind of screwed so in our space it's kind of a race to how how much can we reduce the time between alerting a company proactively that something's about to go down and how can we actually help them do something uh in the traditional asset security space we've seen companies like

mandiant who have been acquired for a lot of money by Google Google Cloud establish pretty fundamental asset security principles both through they have a they have a network they have a a dashboard but then they also coordinate the actual physical red teams and they have what's called cyber security playbooks uh in traditional cyber security having a Playbook is very standard and sadly in web 3 we literally don't even use this word we don't have playbooks yet in web 3 and and so I think it's going to be these newer players like fora or hyper native or mamoru thatai some of these players that are going to uh help solve that problem

in the space of implementing playbooks plus proactively giving us onchain uh alerts oops it's definitely time to proactively prevent hacks um one thing I want to touch on here is actually not as much on the osex side it's actually on the fundamental opsc side and this is where the investor Lens comes in actually um when we're investing into companies we've started to go through a bit of a cyber security shower and to ask companies hey do you guys use company laptops do you uh what messaging platforms are you using to talk about sensitive company

information uh do all the employees at your company have physical UB Keys how are you managing passwords if you have a physical office is what are your security measures for allowing somebody in that office do you have scanned ID cards uh is anybody just allowed to walk into your office and wear one of your company t-shirts pop on headphones and hop on an engineer's desk and will anyone even recognize him or her um you know uh who has access to the actual router in the office uh in the past we have caught a cleaning lady being paid to tamper with the routers of an office um you do need to think about these things and I think these things make people really nervous and over the years

as an auditor I've gotten a really ridiculous amount of calls in the middle of the night with people very very scared uh you know being threatened by a hacker and they're like they know where my wife is they know my my kids names um that's not the time that you want to be reaching out to an instant response team it's important in an earlier stage to have engaged with uh someone like the cipher trace or any of the other um um instant response cyber security teams in advance of something happening so that you can have a contract in place NDA is already signed so if and when something goes down you can call an instant response team and they're there for you instead of your lawyers and their

lawyers talking to each other for about five days while you're literally being drained of all of your funds um and you might actually be in physical safety uh your physical safety might be in danger and so you know have have a cyber process uh train your employees regularly have fishing training um web 2 already figured this out let's just copy and paste to web 3 it's actually not rocket science uh we just have we have even more money on the line uh and um a lot more to protect uh it's time to kiss goodbye to to wall Gardens uh we need to be transparent to anyone from the users to

the abusers it's super important um and uh I guess I'll just end with this positive note to remain Vigilant and to treat security as a continuous process not an event-based one and um you know I I'm really looking forward to the a more streamlined and organized process for crypto hacks to be reported like most of all um I'll be hanging around here I'm easy to find I'm 6'1 with the tur been in a beard I'm arguably the only one so find me and I'm happy to answer any of your questions I might give you a hug um and that's about it

[Applause] and