Securing DeFi - A sneak peek in the world of Ledger Nano Ethereum plugins

Transcript

okay what nice hello everyone i'm jean i'm a firmware application engineer at ledger i've been working there for the last four years and i'm very happy to be here today to talk a little bit about recent work that we've done around improving the situation of smart contract interactions using legend nanos so just a little bit of context for those who are not familiar with our platform so at ledger

we are building secure hardware so this is buttons a screen and a secure element that is connecting these elements and on top of it is running our in-house operating operating system it's called bolus and we are it's a programmable sdk so there's a open sdk you can create new applications on it so most applications actually are written by third parties and some of these applications are built by ourselves so such as a bitcoin application and of course the

ethereum app but with secure hardware it doesn't work alone of course there's a companion app that we call ledger live and it provides a rich interface to create accounts on blockchains and receive phones send some money and recently we added also swap functionalities if you're new to this space you might wonder why should you use a hardware wallet rather than using just a regular software wallet well there's one very obvious reason is that you just don't want to have your private keys

on your computer because it's much easier to to hack a computer or a mobile than to hack into a dedicated hardware wallet that has this sole purpose and that is banking grade security also it provides you one of the pillars of security of hardware wallet is to provide you with information on screen so we have a philosophy which is called what you see is what you sign so here is a very basic flow for a simple ethereum transaction so you see that

you will have displayed the amount that you are sending then as a destination address and the maximum fees and then you have the choice to either accept or reject the transaction so you always have this information and this is a guarantee so this is a secure flow however what i'm going to talk about today is about an issue that we have in some cases and if you are a ledger user and a d5 user or dap user you've probably already encountered this issue it's called the blind signature issue so let's take an example

a transaction like landing some assets on compound for instance if you in the ideal world you will have the right flow on the on the green side on the green side sorry where you have a detailed explanations of the transactions that you are currently signing so you see oh i'm lending some assets this is the amount of usage that i am landing and i am talking to the compound ust contract okay this is his secure signature i can approve but actually in 99 of the cases you fall into the orange flow on the left which is not secure at all and

this is blind signature because as you can see there's not much information displayed on device you just have the screen data present okay it's not much info so this is pretty bad and i'm going to illustrate how you can exploit this so let's say you are on curve for instance and you want to claim some rewards you're going to click on the claim button of course and it's on chain event so you get a pop-up from metamask telling you to sign this transaction and in this case

well bad luck your computer is compromised by a remote hacker and what the guy has done is that he has replaced the metamask extension with a slightly modified one which has the ability to replace on the fly the transactions so instead of signing a regular claiming transaction from curve you are going to sign the hacker transactions that will move your phones so metamask will show you just the regular screen that it always shows and you will click on confirm and then your impostor transaction is sent to your device and you will get a approval flow that

doesn't give you much information and as you always get this kind of information well you are not surprised because you see it every day and you're just going to accept it and oh no your phones are gone you might think this is a theoretical attack it only happens to others and it's a rare thing it's not common but it's not meet hugh carp so this guy is a founder of nexus mutual which is an insurance fund for defy and last year well he he lost eight million dollars

just with the scenarios that i described before so it was pretty bad like he he was using the industry best practice like having a hardware wallet dedicated to managing his private keys and yet he lost money so this is pretty bad for us hardware wallet vendors like it's hard to to to react to this to give a proper answer because it's a hard problem to solve actually there is a feature embedded in our devices that allows to have a deeper look into what you are signing so you can go into the settings of your

ethereum app on your nano and you will see that there is an option called enable contract data debug so debug is in the name so maybe that's not something we want to push our users to use and it will display information contained in the in the transaction so here you see the selector so it's a method id it's four bytes and it shows it is bound to a method name of the smart contract you are interacting with and then it will show all the contract data 32 bytes by 32 bytes i speak hexadecimal i don't know for you guys i don't know for your grandma or friends probably they don't

and even if i speak it i don't know by heart the selector and the order of the arguments of every method in the small contract i interact with so even though this exists we can't advise people to to use it so at this point while the situation is pretty bad we have identified a problem and there's no easy solution to fix it the nano application is not able to pass contracts and there's thousands of contracts so there's a lot of work to fix it and we want to do it but

when the nexus mutual hack happens well we make an assessment of what it will cost us to to build a solution for this issue and as always the roadmaps of every team are full and it's going to take some time but actually we've been lucky because uh there was a big project a ledger that was being built and we realized that one of the hard requirements of shipping this project was to actually fix the solution as a issue of blind signatures so let me present you this new shiny big project

it's called ledger live app catalog and remember ledger live i talked about it before the companion app for our devices well we are turning it into a full-fledged dap browser so now every dapp can be accessed directly from ledger live rather than going into a browser and access it through metamask even if your keys are in a nano device so we are integrating more and more dabs into this it's very fresh there's many advantage to move to this solution like for for ledger users it's very nice because they stay in control

so you can explore the boundaries of d5 from within an environment that they already know and they don't have to install third-party extensions and things like this for developers it's also very nice because there's not much work to do to integrate into this project uh we are basically basically uh linking an iframe to the front end of your dap and then injecting our own custom web3 provider in it so it's pretty easy thing and it allows you to access to a large fully converted crypto user base so all the

ledger users sounds like we sold like three million units i think worldwide and these are people that are not necessarily using defy but they know how to what is crypto and how to use it so it's nice to access them directly from ledger live and of course for ledger it's great because it removes our reliance on third-party providers to access web-free device web-free services so we can push updates much faster than before and yeah this is great for us but how does this relate to the issue i mentioned earlier like the blind signature issue well that's easy it's just that we have

a philosophy in uh ledger live it's that what you see on agile live you must be able to check it on your device so this is just what you see is what you sign both on laptop and mobile and device so if we want to have that and integrate the apps in ledger live then it means that device must be able to pass smart contract transactions so now we had to fix it and we got resources to fix it and we got pushed to fix it so we fixed it so how did we did it well a natural solution if you want to fix this issue of passing would be if

you're familiar with solidity would be to use apis so these are big json files big descriptor of the interfaces of smart contracts so for instance it gives you information about the name of methods the name of method arguments and the type of these arguments and if you combine this with a raw ethereum transaction then you are able to extract extract the useful values and eventually display them on device but there are issues proceeding this way the first one is the size of abis because they are

huge files and we have a very tiny target so let me present you the nano s it's just 10 kilobytes of ram 28 megahertz and 320 kilobytes of flash single threaded it's very squishy but even if we managed to compress smart contract abis to make them fit in this tiny chip this would not be ideal either there would be a second issue because this would allow us to build a generic smart contract parser but actually when you

investigate some of the methods to support in smart contracts you will see that there are some parameters that you really don't care about and that you don't want to pass and you don't want to display i will take an example in paraswap which is one of the first daps that we support in the nano devices and this swap method takes a lot of arguments that are totally useless for the users they are not security sensitive and we don't want to pass them there are some that are very important like what is the token that you are swapping what is the amount that you are swapping what is the token that you are receiving this is important but then you have all the roots custom

structures that indicate to the smart contract where should the money be swapped like on any swap on curve whatever if we were to build a generic parser we would have to display this information as well and we would end up hello where was i yeah so you don't want to display all these informations to the to the device to the user sorry on the device because

then you end up with dozens of screens with useless information and we know our users and they are just going to do click right click right click right until the end and not check any information on the device and just approve and we fall into the case we had before people are doing blind signature so this is not good so instead of a generic parser we will have to write some custom logic custom parsing for every dapp is it difficult well actually not that much so this is a raw ethereum transaction for the case i

was talking about before like a compound landing transaction and what is colored is the useful information that we are going to that we need to pass to display to the user so in the blue you have the contract address of course so we get this and we check that it's compound then the method selector so four bytes it's always four bytes so it's easy and it's unique to the method and then the arguments of the method so here 32 bytes to for an amount because ethereum evm only has 32 bytes elements yay so you see it's only three elements to

extract from the transaction so it should be easy to write some custom logic to extract that and pass it and display it to the user so where do we put this custom logic well we had multiple iterations at first we did the easiest one which was to directly edit the transaction parser within the ethereum app to add this custom logic but this was really bad for at least two reasons the first one is that the ethereum app repository is pretty sensitive and we really don't want people to do

dangerous things in it by contributing to it we are talking about hundreds or thousands of adapts we don't want people to to mess with our repository and even more with the transaction parser it's very very sensitive piece of code so adding custom logic there is really bad also we have an issue with size because if we want to support many dabs then it means adding a lot of custom logic to the ethereum app and it grows bigger and bigger and bigger and then it doesn't fit in our tiny chip so this was bad we switched to another model which we

which was a little more work we re-architectured the transaction parser so that it becomes hookable by external logic so this external logic then got a name we called it a plugin and so we had the compound plugin and it's fairly simple the ethereum app gets a raw transaction to pass it start passing it and that several steps it will call the custom logic and hands in the things that it's just passed so that you can do some custom logic on it and

create useful strings for the user for instance so this was a good improvement but it was not enough it was better because then developers don't have to mess with the transaction parser which is the most sensitive part of the code but still you have the issue of the ethereum app growing bigger and bigger and not fitting into into the tiny chip anymore if you have hundreds of plugins it just doesn't fit so we move to something even better which is the external plugin so this time it's exactly the same as previously except that

we move the plugin out it becomes its own application actually so there's a downside the user has to install another app but it's a very small app and this app talks with the ethereum app so let's see into details how this works oh yeah first so this is solving the two issues we had before because you only install the plugins that you want so it's not it's not going to to take space on your device like if you're not a compound user you don't install the compound plugin and then you have space to install other apps it's fine you only install the plugins for the dapps that you actually use and as it's out of the ethereum app then it's very easy to

contribute as a third party developers because you can just create your repo and then it's not bound to the ethereum app so you don't need a qa and security reviews from for from ledger i mean we are going to review that your plugin is not is not a trojan but that's it we don't have to check that it doesn't break ethereum so now in details so this slide is way too complicated i made it for blog post and didn't got time to made it make it again sorry i will go fast over it this is just to talk about how the ethereum app is talking with the compound plugin or

any plugin so we have the bolos operating system which provides a cisco to jump from one app to the other and save the context of the caller so we can come back to it later and this is how the transaction parser inside the ethereum app is going to send some of its unparsed data to the plugin the plugin with its custom logic is going to to parse it and do something useful with it and then return useful strings that the frame application is going to display to the user in the approval flow and yeah so that's it

but now you understand that well there's going to be a lot of plugins so this talk is actually a call to action in disguise we are going to write some plugins but uh i need every dab developer out there to write its own plugin for our platform it's a c code so it's actually not so much work the plugins are very small like for instance this is a main file even if you don't know c it's not so hard so this is for the leader plugin first we hard code the selectors that we

want to support so the methods to support here for leader it's very easy because there's just three so staking wrapping the token and unwrapping it and then you have a standard function so dispatch plugin call the second one and here you have all the hooks so they are declared but they are not defined and these are the hooks that are called by the transaction parser basically so these are the functions that you have to define as a plugin developer and here you will do very basic operations like oh i'm getting a 32 bytes element and i know this is an amount i'm going to turn it into decimal and

add a token ticker next to it and return that basically that's the work to do but we didn't find a way to automatize it so we need humans to write this code um plugins are small like really small so you see for little compound it's like 1 500 lines of code and we have a boilerplate plugin so you can start you don't start from scratch you start from this boiler plate and it's already like a thousand lines of code so actually the custom code to write is really small and it ends up in very small binary sizes like the little app is much much smaller

than the ethereum app for instance some plugins are harder to write for power swap it was a little harder because there's a lot of function to support and they have custom solidity structure so it was a little bit more work but it's really feasible so yeah thanks for listening to me here are resources to start building keep doing uh great dabs and please start writing plugins please clone the app plugin boilerplate repository you don't even need a hardware wallet to you don't need a nano s to program we have an emulator called speculos it's working great

also we're here to help we have a developer slack and we are working on a step-by-step tutorial to create your plugins so it's coming soon thank you thank you for your talk um my question would be so you mentioned that you're using your own web tree provider um so uh yeah basically can i hook this ledger live app to my own rpc

endpoint or do i have to use yours and trust you and you know i care about privacy and trustless setup so whether it would be possible with this maybe someone in the room can answer to this question better than me because i'm on the embedded side so can i connect ledger live to my own node basically to my own rpc so currently we have multiple way to handle air pc we of course have ledger internal ipc nodes but if you plan to use the app through ledger live actually it's going to go

currently through alchemy's lpc there is no way to use your own but actually it could be quite easy to do not laughing about it so yeah that's definitely a possibility if you want to use your own node that's possible that's a feature that could happen in the following months yeah you're welcome thank you for this talk i have two questions first on the ledger live app why i i is it not another chrome plugin also because also maybe i want to use my my brother because they can have other additional tools on it so why this approach of having a separate app and

not the other way around and the second one is how do you trust on the on on the ethereum app in the ledger what's happening from the plugin is it you do you double check everything or you just take parameters from the external plugin is there reasoning on how you can trust what's happening in this code so i'll answer the second question first as we we as ledger are reviewing and signing the plugins there is no security issue because we know what the code is doing so the frame app is transmitting information to the plugin and it has an internal check to know

if it is the right plugin to call from the content of the transaction actually so it just works this way and i hope i answered the question okay and for the second one um well first if you had a ledger long time ago we had chrome apps we were there was knowledge alive and it was pretty bad we were dependent on on google chrome and we don't really want to be dependent from google chrome so i guess this is part of the answer so we built our own native application and actually

like our competitors are also moving to this approach like for instance trezor is releasing the treasure suit i think and it's also an independent application it's just we have more capabilities it's easier also to communicate with the device through usb because you have like regular usb hid rather than using weird things from the browser when we release ledger live there was no easy way to talk from the browser to to a device we had to use a weird hack using u2f as a transport layer which is broken now by the way so i guess yes it's both it's a very

historical answer that i'm giving to you hello uh as i understand a plugin is a kind of application in the ledger but on a ledger s nano s you um you have only four applications load so it takes so you uh your ethereum application you will take in fact two application slots and you'll have

you'll be left with two uh free other is that right it's not so we say to customers yeah we you have you can install four apps because if you install the four biggest apps they fit in the device and you can fit another one but actually not all apps are equal there are some small ones big ones and you are not limited in the amount of in the quantity of applications to install like some are really tiny and plugins are such tiny apps so you can probably install like 15 of them on a nano s with the ethereum app so it's something it's better than four and on nano x you have room for much

more than that because it's a beefier version of nano s there's like one megabyte one point two megabytes of flash instead of 320 kilobytes on noise okay ah well thank you guys