Navigating Web3 Minefield: How to Stay Safe

Transcript

Wonderful. All right. Thank you so much for being back from that coffee break. I know it's very enticing to be out in the sunshine. Thank you so much for being here for another great spech and big data. Hi everyone. It's a great pleasure to be here and thank you for choosing talking about cyber security and staying on the sun. I hope it be useful for you.

So my name is a cofounder of Hen and last 10 years spend in cyb security and in crypto since 2014 have a master degree in cyber security and decided to apply my knowledge to web sphere. So Haken is a blockchain security auditing firm. We are in the market for the last six years doing audits for a lot of different protocols, crypto exchanges, wallets and stuff like that.

It includes a lot of stuff like protocol layer audits, smart contract audits, penetration testing also back bounties and recent services with CCSS audits, proof of resource and and tookomics audits. So I think that everyone knows why security matters. We hear about hugs literally every day and I don't remember sometime for at least a months where there are no hugs that we can hear about. So the the damage in web industry for last year was around 4 billion which is which is quite a lot and it's growing year by year starting from 2016.

And it's interesting that nowads security is not a feature anymore. It's an integral part of the blockchain project because before in 2017 was like nice to have audit but no one required that. ifity properly get money from investors from the community and it would be very difficult to go through that because the level of fear in the industry is quite high and everyone looking to do proper due diligence on the projects before interacting with them.

So who heard what was the last biggest hck you you heard above like 100 million anything anyone ok then let's let's go through that quickly for the recent time there were like a hack of Binance bridge for more than half half a billion that was an issue that that was done in the code itself that to kind of losses. Next one was er anyone heard about hug recently?

Nice. That's good. And this this story has actually happy ending which is not much in cryptom because Eller has a pretty solid security procedures and auditing and insurance and stuff like that and communication skills and incidence response plan. That's why they like they got almost all money back from the hacker. That's very interesting story that happened like two or three months ago. They got around 5 million from the insurance company and in the negotiation process with the hacker they were were like able to get the money back. And it's interesting because it was like quite a big sum of money and one of the users that lost

money starting complaining on Twitter I guess that I lost my all life savings and hacker was good enough to actually send him back even more that he lost. So another one was the mango markets also more than 100 million was the press Oracle manipulation stuff and all this bugs could be prevented with the proper proper security design mindset but but it happens and another one was with the more on the on the operational level issue with the crypto exchange because the hot wallet was compromised and the money was stolen.

So if we talking about the crypto project the security as I mention is a part of business because you lose not only the money itself also you lose the trust of the community you lose the the like the price of the token and the evaluation in general which is very important for crypto projects. Let's look at the let's look at the protocol level when they their TVL goes down really quick. For example in the case I think their TVL went from 200 mil to 50 in just just couple of moments.

So what to do? How to deal with all this issues that every crypto project goes through all the way building stuff in this difficult times? I would say that it's there is no single point that you can do and you would be safe. secs minim risks from being hacked everythings from mindset secure development then like external audies back bounties monitoring insurance and i would like to go deep through all stages

what is the security risks that associated with security in advance understand them and understand how you would address them be prepared and implement everything according to to best practices. Then when we are going to the implementation stage it's good to have security along all the stages while you are building. starting from design then implementing continuous testing the whole framework how you can address this after all you build within your internal team you might go to the external

auditors to check what was been done and understand how you can optimize security risks with the third party opinion there is there is is like if we are going to smile contract by review analysis and verifications of all the issues and then preparing the report for all the stuff that mention from our experience companies that do audits then do some stupid mistakes they deploy another code for example and then the security this security audit doesn't make any sense afterwards or I mean they fix issueson

from they decide to accept this risk and then something happens but it's always the responsibility of the of the project itself. Ja last year there were like no exploits and the audies that weve been done. So and another interesting methodology that we were just discussing here yesterday that once you done all this traditional method how to protect yourself you can go through the through the bug bounties to invite more hackers more talented researchers to look through your code and detect vulnerabilities to to prevent them. There is really like a good case that I like about Aurora.

project on near ecosystem they paid 6 million bounty but saved 300 million 300 million in in their project which is which is quite good multiplier for saving stuff and another important topic is to have everything monitored because if you are not aware of the problem doesn't mean it's not exist and in response plan is this helps you to minimize damage or at least to understand how to negotiate with hacker and have the

have the plan how to do that for example in case they were able to negotiate with the hacker and get the money back in many other cases this bounty for ethical hackers not really h the protocol around 10 to 20% and if all this all this measures didn't help to prevent hck and save money it's good to have insurance for the protocol itself for example as I mentioned the finance were able to get insurance for the hug that's happened.

So yeah, and security it's always important to be proactive not reactive and it will help you to like minimize the damage of of hacks. Thank you. Do we do we have any questions? I think we have time for one question. when proactivity [juokas]