Security Incentives: From Six Figures to Billions in DeFi Bug Bounties

Transcript

super I'm lucky that this setup is all in one place so I don't have to pace around just uh how it goes so uh my presentation today is on security incentives in this space and I have a very specific outcome you're here with a lot of experts from around the world in you know one of the cutting edges of of certainly of blockchain tech in general but of computer science more generally and it's easy to lose sight of the big picture and so you know the outcome that I'm aiming for at the end of this is to give you a very kind of basic Insight on the trajectory of my little corner of security of course which is bug bounties but more importantly to connect it to what that's going to mean for all of you

because there's a very practical implication of the work that we do in our space it's very flashy it's very big and it demonstrates the value of every other part of the security stack right so over the last few years uh you know anybody was in auditing knows that it's pretty it's kind of been opaque to everybody else or you've been you know building other tooling especially before the rise of defy was it was difficult to realize the market there a lot of people didn't appreciate it and the work that we are doing uh we hope is going to put Rocket Fuel behind every other security initiative in the space and I'm betting a lot of the great companies and projects of the future are going to come out of this room and are going to come

out of the people that are at this event right now but let's get on with it okay so we're gonna do a quick primer uh on what bug bounties are in terms of why they're useful where do you want to use them and how they suck in some ways what they're not useful for that's very important because we make them look good but anybody who's been on the inside knows that they are very uh filled with warts to put it lightly then I want to look at the trend line what they used to be where they are today and then finally where they're going and what's driving that Trend and my goal again is to give you the framework to understand what the future is going to look like looking out one two three five seven years and to

show that you if you want to plant your flag here in D5 security the odds of you you know being able to build a fulfilling and satisfying career or do very well financially make serious contributions to the space are overwhelmingly probable you can't lose and hopefully that will make you know some people who might be tempted to go and launch this or that or the other thing somewhere else stick around and help us because God knows our industry needs the help okay so bug Bounty let's talk about what it is or you know first show of hands how many people know what a bug Bounty is oh wow that's much better than the last time I presented something like this okay

so the short version is for everybody who's watching and they're less familiar with the inner workings of that we'll touch on the basics and if I get some spicy questions about how things can go wrong y'all you know welcome to ask those but it's a giant prize that you put up and you say if anybody can find a vulnerability if anybody can find this type of asset then I'm willing to pay you X dollars now the upside of that is the incredible promise right you can open up your code base your assets to the entirety of the world potentially Limitless number of people and say hey look why don't you do your part to protect us if you can do it you know we'll pay whatever and you can get thousands tens of thousands hundreds of thousands of eyes on code now of course this is precisely what we need in

our space We have basically no fault tolerance uh with a lot of the things that we built a variety of people here are working on giving us more leeway more slack for the systems that we build but that work is still let's call it primitive and young and it needs more support and in the meantime you know something minor goes wrong and everything explodes and you know the amounts that can be lost in our space of course are arbitrary you know you could lose a million dollars there you could lose 100 million dollars you could lose billions of dollars all of these things have happened so bug Bounty is a great protection against this a unique protection the only thing of its kind at the moment that can provide this level of security and it's especially useful and

especially compelling to assets on Mania when you've already gone through Auditors when you've already gone through formal verification when you've done everything that you could possibly do to invest in security and safety hopefully with the help of everybody here and you're pretty sure that you're safe okay well that's a a particularly great moment to say well I challenge anybody anybody in the world if they can find something real here I'll pay for it and it's with the right prizes as you know we've been able to to demonstrate with the right rewards and the right Clarity in terms of contracts because that's really what a bug Bounty program is it's a contract between you and the rest of the world

you can really get stupendously uh positive outcomes that are just kind of impossible to imagine and impossible to predict any other way what is it not good for uh it's got a lot of limitations for doing things when you you can't open up so there's like a thriving industry for private bug Bounty programs that kind of makes sense but it doesn't really Leverage The the full advantage of being able to open up your assets to the whole of the world and they're also very costly to run and very frustrating to run you are necessarily sifting gold I don't know anybody here know what gold panning is like anybody ever done it before okay brutal brutal process you're going to you go on a river an ugly River

preferably and you take a pan a metal saucer and you're you're sifting trying to capture the dirt that's flowing Downstream in order to catch gold nuggets which could be worth a ton but consequently you're spending endless hours dealing with dirt and in a bug Bounty program you're doing the same so there's a lot a lot of draws that is going to come while you're waiting for that one wonderful report to come in and a lot of stress that can come with it too so it's like you know when you're going into it you need to be prepared to make this type of investment now uh let's do a quick overview we've kind of gone through what it can be

useful for hypothetically let's talk about the history of it and and where things have gone so our essential thesis here was that there's an immense amount of security talent in this space that but there wasn't really any any incentive for people to go and help with that because programs ultimately sucked and they were very lame a few years ago they were horrible user experiences you all can make more money being Auditors or doing any number of things and a consequence of course was a lack of Effectiveness in the programs but more importantly the secondary consequence is that nobody ran them and as a result you didn't really have any options if you had vulnerabilities on Main net which like

everybody did the disclosure process was brutal to the point that people who had done it a few times would just stopped doing it your burn on experienced white hats was very high we see something similar with war rooms today since we don't have a great way of monetizing that and justifying it it's just first people come in they do it generously and then they burn out and they stop doing it and that's basically what we had here and our conclusion was our core thesis and the one that's relevant to all of you is if if we could drive massive incentives if we could drive massive Rewards for live vulnerabilities on mainnet then this would effectively Drive disclosures at scale but it would do more than that

it would drive disclosures at scale to the projects that need them in the position where they most need them but it would also drive people to our community it would drive Talent into blockchain security which up to that point was like a very I remember when we started and I was looking around it's like how many you know great security people do you think are in ethereum it's like a thousand people 1500 and it's like okay that's not great we're not going to survive under those conditions for very long so our solution to that was to look at big bounties and we thought if we could do that then Not only would we drive the security of the space more effectively but more importantly and relevant for all of you we would increase the value of every other part of the security

industry you would see the value of audits rise you would see people take monitoring more seriously you would see the value of insurance rise because people would have a very clear example it's like look I have two options you know when building something in this space all these you know young entrepreneurs I can risk getting hacked which of course is horrible but at least I can blame that on an act of God or I cannot take security you know seriously enough go on on a bug Bounty and potentially pay out a huge sum and I should have invested that earlier in the cycle and the result is you're going to see money bleed uh back into the rest of the workflows there's the the punch line now I'm going to substantiate it this is the core model that we would use

to drive this whole whole loop it's not super important here big disclosures show bounties work drives big pads drives people to launch bigger bounties because they know that they fundamentally work track security Talent by extension floats more Capital back into all of you guys so that you can continue developing your work at higher and higher premiums and hopefully do better and better with that I think it's been working so far let's dive into the historical data when we started this a few years ago now there was a total of four million dollars in bounties across the entirety of the space that's every single project several hundred put together I would call it pitiful and the

exchanges were wondering you know why they kept having attacks to various kinds and people would just steal the money all the programs were horribly structured uh abuse of people was very common I think a bunch of people in this crowd have suffered the kind of negative effects of bug bounties done poorly and you know the consequence of that was the lack of use and this was I think a broader reflection of the lack of the security mindset and appreciation for security spend in the community at that time things have changed a lot since then this was all going to get worse of course and it did as we all observed you had this kind of weak security culture

basically guaranteed more hacks you had these increasing attack surfaces as applications worked more and more effectively you had Auditors who were building up Niche expertises and whatever they were but you know people launching new stuff there's just not enough time to stay on top of everything lots and lots of reasons most importantly the increase in money leading to a you know very very adversarial environment that was coming in to make it a basically a perfect storm for us to launch our thesis we launched we put this projection together some time ago and for context you know looking at uh oh 2022 we are beating all these numbers they continue to grow so so far things have been working out in

terms of actually driving those outcomes that's almost 50 million dollars allocated to people in and around this room over the last year and a bit hopefully going to increase a lot and that's a huge change from where the things were before and that's all from a the development of this very basic thesis right that's all from the development that look these are very effective ways for protecting you on mainnet and it's it's a simple matter as like if you put up the money if you put up a serious amount of capital you will drive disclosures from high value people of course there's a lot more subtleties than that we do tons of work to make these transactions as safe as possible

which is really not enough work frankly there's still lots to do but that is the beginnings of things to come and that's the the success of these transactions is the most important part to the wider trend that bug bounties is enabling and the kind of hidden thing that our work is doing that is kind of lifting up uh the tides of the rest of the space a few of the teams in here of course are very strong at showcasing the value of security themselves you know if that's fortunate for them but with our work you know it's very easy to demonstrate that if you don't want to evaluate you can just pay a million dollars and that's okay nobody wants to do that and these drivers are only going to get

more and more severe and this is what we've observed we suspected the existence of these fundamental drivers at the very start of our mission but now they've become basically evident to a lot of serious people so number one is Big bounties really do work at driving disclosures the coral area that is everybody is having serious critical vulnerabilities on mainnet nobody's really protected against that no matter what you do you're likely to have something in there and so your only way like you're going to pay one way or another your option is you know do you want to get hacked because you've created this incredible Honeypot for interesting characters from around the world to partake in your

balance sheet do you want to do that no you want to invest in security okay well the next layer is us right bug bounties big bug bounties but we're also super expensive you want to pay out through us how many millions of dollars is that worth we're happy to take it happy to funnel it back to people like yourself we can prove that the ROI is 100 to a thousand X very easy for us to do that especially on large cases but the important part is of course that's still a lot of spend and so the money starts floating further up people like well you know I could do that too but maybe I should just be investing in Monitoring Solutions maybe I should be investing in you know a CSO early maybe I should be investing in better auditing

maybe I should be investing and better tooling for my devs maybe I should be investing and coaching and training them um it's further pressure on that and of course this is all backed up in practice by the adversariality of our space it's getting constantly worse and worse and worse uh and for a little insight into the future there for all of you thought that that problem was going to solve Itself by you know International legal cooperation I'm sorry but as we go into a hotter and hotter world geopolitically the law enforcement links that are connecting these various Elites across countries together are breaking down and so people are going to stop exporting their cyber criminals in the

way that they once did obviously the Russian examples are case-employing the American examples are case in point but it's going to get you know vastly worse Pakistan is going to stop exporting criminals of any kind the African countries aren't even going to play ball anymore it's going to become much safer in addition to more profitable and more necessary for countries strapped for cash such as I don't know an increasingly cold Europe this year to take advantage and to the opportunity of these things and protect their apts of various kinds to monetize them and so the whole environment is about to get you know way more adversarial over the next few years and there's no credible there's no foreseeable Force that's going to slow

that down so we have these two drivers you know driving up Bounty sizes and ultimately security spend up in the space so far uh you know number one is they really work Roi is extremely high on big bounties but they're still very expensive number two is adversariality is going through the roof so if you don't make the investment into you know as many layers of the security stack as you can especially Security on mainnet then you're going to pay one way or the other or you should expect to and number three you know the users have an intuitive understanding of this all the users who are losing their money easy for entrepreneurs to forget from time to time because they have the highest tolerance for risk uh than any other population right any other group of people in society but

the biggest threat to our space at this point is pretty clear we are turning retail users like mad because people come in they get scammed people come in they get hacked people come in and bad things happen and why would you stick around what's the point leading to tons of people okay we gotta rap why our thesis is that we're going to take bug bounties over the next few years talking 2025 into the billions of dollars and that's going to be driven by these drivers but I really want to talk about the important part this is all just a prop uh for what that's going to do for spend in the space what that's going to do for the work that all of you are

contributing in if you are building a career in Security today it is basically a no lose proposition there is work at every layer of the security stack that needs to be done and the the more dramatic the events hacks and Bug bounties especially are constantly driving in interest into the security industry and increasing the premiums both on the type of Revenue that your projects can make and in the appreciation and the risk that others are willing to take to back you so you know you're constantly going to be tempted to be pulled into this project or that project you're you know incredibly capable people in this room and listening on the call that some of the most I think interesting technical Minds in the entirety of the space

but if you do want to stick in security it will take care of you at whatever layer you want to work at a rising tide is lifts all boats and uh the work that we're doing on Buck bounties especially in my opinion is going to drive that like few other things will so ah this isn't super important what's important is at least for the thing that I wanted to accomplish here is just to give as many of you especially the younger developers or the people who are a little uncertain more conviction in the path that you're on today to network and build relationships with the people around you today your peers are giving you information

all sorts of secrets on Advanced tooling different ways of looking at your work but just to pull things back to the big picture if you dedicate yourself to your craft here and now the likelihood of the space rewarding you letting you build your career letting you build your family letting you make you know serious contributions to society and be well well compensated for that and have incredible experiences along the way is overwhelmingly high so I hope you stick with us [Applause]