Security Is Infrastructure: Designing Resilient Systems for Ethereum’s Future

Transcript

Uh hello everybody. Uh my name is Dima. I'm uh uh co-founder of Hacken and ex-CEO. Um also I'm like auditor for almost 18 years. First I was auditing some boring financial statements and controls at Deloitte. And then I founded Hacken together with my friends. And Hacken is now 9 years old. Doing some uh not only security audits, but also building products and chain monitoring.

And we have amazing bug bounty platform. So, today um the topic is um security's infrastructure. And I would like to tell you and explain you uh what critical component of infrastructure is missing in our uh ecosystem. And we will explain how we will try to to fix it and build it. So, before we start I want to engage with you a little bit. Um so, can you please um reply which protocol is more uh less risky? Less risky. Aave or Compound? If you for Compound, raise your hand.

Okay, less risky, right? And who thinks Aave is less risky? Okay, great. So, we have approximately 60 to 40%. Yeah? And uh 60 that's Aave is less risky, Compound less risky. Why we have so many different opinions, yeah? It's it's fascinating. Yeah, we can't explain why. Yeah, but we will maybe we'll try. We'll understand later. And now it's the same exercise. Which one is less risky? USDT? C? Please raise your hands.

Okay. And Tether? Okay, all right. Here we got like 70 to three to 30, yeah? So, people think that's uh USDT coin is less risky than Tether. So, great. >> [clears throat] >> But we don't know in fact, right? Um do we have some um rating agencies or risk agencies who are combining and publicly showing us some dashboards that everybody's trusting? Like how did you base your opinion, you know? Um all right.

So, [clears throat] uh few steps back, yeah? Uh when we um look at our inf- like security infrastructure um in crypto, first thing that we are comes to my our mind is that oh, we are so vulnerable industry. Yeah, we are having so many hacks. Yeah, obviously the auditors or whoever are not doing their job rights. Um and what we need to do uh we don't know what need to do, yeah?

So, if you go to the rekt.news and this is the leaderboard Bible of the security engineers uh why Bible, yeah? Because no one wants to be there in this leaderboard. Uh uh we can see that from all the projects that are listed there with the explanation how the hack happened, uh we can see that 75% of that project has the label out of scope when it comes to audit or NA or no audits or whatever. So, how did it happen, yeah?

Um the reality is that um security like the audit is right now became a badge. Yeah, a marketing tool. Basically, when you want or like your tickets um to get to some exchange, like you show the PDF, you're secure, go. And this is the problem of our industry, um and [snorts] um we are um we are vulnerable because the the the reality is that uh the this security badge is not done for either for the full protocol. So, we call it coverage risk.

Yeah, or the teams have already um made a great protocol, made a proper security audit, but then added some new features. And then uh actually the audit is no longer valid. And then when they added new features, it's uh it became vulnerable to new type of attacks. And then ooh la la, it's got hacked. Um so, it's approximately like this, yeah? When when some projects are claiming that they are secure, basically they they are saying that we did some security audit with some company.

Um but the reality is like we we don't know how their keys are stored, you know? We don't know if they have proper governance, multi-sig, yeah? Today yesterday uh hack is very [snorts] fascinating. By the way, I really like the take of Hayden today the um >> [snorts] >> the Uniswap founder that he said that let's distinguish what is DeFi, yeah? Let's uh the companies that have the keys that can be hacked and the whole protocol will be uh the TVL will be leaked and not DeFi, they are CeFi, which makes a lot of sense.

So, yeah, we we don't know how the upgrades are done, infrastructure, we don't know operational security. Yeah, a lot of crypto people are uh don't follow any operational security practices at all. Um so, we don't know this. And um and generally, you know, like that the audits right now they are audit the data plane, yeah? But the system falls in the control plane. And um while audits are checking the code, yeah? Hackers are which in many case uh we we as auditors we already I think at a pretty good standard of um finding bugs in the code. But hackers are no longer looking into it. They are

looking how to exploit the system, the infrastructure of the project and to steal money uh from [snorts] our pockets, yeah? Um let's um again, another view on on the problem. So, why does why does it happen, yeah? Why we still don't have all these in I would say investments from the project teams into their infrastructure with doing proper assessments? Um I would say that we have this culture in crypto, yeah? That's we want money fast, uh ship fast, yes? Be rich within a few days. And that's why the because everybody is at this

super speed and that's why I um security is not a priority for many many founders. Um and and that that's true. Uh and let's uh think about um when the founders start to invest money into security. What is what drives them to do it? So, first uh in crypto, of course, it is like I I we we we select the like three factors that influence them, yeah?

Uh is when security incident happens. In crypto, it's already too late, yeah? Um while in uh traditional web2 sector, you can uh you can lose some reputation, some uh maybe you get some fines. But in crypto, yeah? Your uh TVL is gone, the trust is ruined forever. It's too late. Um and again, in traditional world, um billions of dollars uh um spent on cybersecurity because um the regulators are asking them to do so.

Uh and um they would trust me, they would never spend so much on on on different security stuffs uh if there was no such strong regulation, especially in US. But in crypto, it's nothing like this, yeah? We like I personally um uh working with regulators for the last 3 years uh on DORA, on with ESMA, with ADGM and VARA. Uh they always be a little bit behind from understanding the risks, uh understanding uh what needs to be enforced. They don't have enough tools.

They don't don't have enough expertise, people, yeah? They and it's okay, yeah? They they are um grown people with very good knowledge in web2 cybersecurity in many cases. But web3 is completely different thing, yeah? And uh we won't see we don't didn't see even a one single fine yet in crypto industry for bad security practices. Not a single one. Yeah, so it's right now the regulatory regulation completely doesn't affect the security how companies are doing that.

But there is uh the third one third factor is when the companies are starting to lose revenue. Start to lose competition if the if they don't do proper cybersecurity. Uh right now what we can see, yeah? Everybody is claiming we are the best of the best. We work with these guys. Look at our badge. Yeah? And people cannot verify it. They cannot check if that's true or not. Um and but we started at Hacken we started with one small experiment.

Uh back in 2018 when we first uh we built the cybersecurity rankings of exchanges. By the way, I'm big uh um big hater of centralized exchanges. I think this is the biggest evil in our industry and uh uh having this uh untransparent fraudulent uh monsters uh is um and nothing really changes. Uh this is really really sad. So, uh we do what we can do. We do what we can do in order to um influence them.

Like back in '18, we also uh we're doing a lot of investigations on the wash trading and we have co-founded with CoinMarketCap Data Transparency and Accountability Alliance and and pushed to introduce order book metrics, which is good to have, but still not enough. Then we built the cybersecurity rankings of exchanges and we were lucky enough uh to partner with CoinGecko and we have pushed our cybersecurity's uh ranking into the Trust Score, updated Trust Score, which is 20% uh dependent uh 20% our data.

And so overnight, a lot of exchanges uh Trust Score has dropped. Uh of course, there were a lot of unhappy founders of exchanges same pointing fingers at us like who we are well, why do you uh what do you know? >> [snorts] >> Um but um uh slowly slowly like like because the methodology was open it was pretty straightforward. Slowly slowly, the um um and it makes sense. Uh exchanges started to uh do uh pen tests, bug bounties, uh public certifications like ISA, SOC 2, and so on.

And we are we're collecting all this data. And uh of course uh I would say cybersecurity uh like if you see in total, yeah, like the cyber attacks on the exchanges uh is less and less comparing to what was uh in 2018, 2017. And uh and they do spend much more than they were back that that time. So, uh today I want to well, actually today is our launch date uh of um of the product that we call call Core 3.

It's all about the risks in crypto and um I would like to thank the team that's uh is shipping it quite fast. Uh and yeah, we we're going to go through this um um idea uh with again thinking from from our side. So, yeah, the answer for what is the missing part of the infrastructure is risks, is public risk dashboards with the aggregated data >> [snorts] >> and with uh bold um um metrics.

Um we simply don't still don't have the Moody's, Standard & Poor's, and Fitch in crypto. And this is also stoppage factor for a lot of institutional investors. We just don't have it. We have some risk agencies, but their data, their risks assessments are not public or they're super biased. Uh so, uh again, a small comparison, small um story from my life. Uh I uh received the uh Whoop as a present. Do you have Whoop guys here?

Anyone? Okay, one. May- That's it? I thought we were bigger community. So, when I received the Whoop, uh the and uh it starts it collects a lot of my data, a lot of different data and it has calibrated for 1 month uh like um from my lifestyle, it learned who I am. And in the end of the month, it gave me the my Whoop age. And it gave me the Whoop age that I'm 5 and 1/2 5 and 1/2 year older than my biological age.

And I was like what what the hell is this? Like how do you know? I feel normal. Like uh I don't like you. And I stopped even charging it. Uh like I start start not wearing it. Like I don't like I don't care. And then I met uh I was in the crew with some some other guys who were like uh in the good shape and showing off between each other. Hey, my Whoop age is 3 years uh uh younger than my biological. Ah, you're a loser. My Whoop age is 5 years uh younger. And I was like, "Hmm."

Um okay so uh I want to be younger uh according to my Whoop age as well. I want to improve it. And you see it like on the graph, you can see here yeah, it's like it started it gave me my age. Like it's was 46 almost. That was the period of uh uncertainty and doubt. And then I slowly slowly slowly started like to go to the gym three times a week, sleep properly uh [snorts] sleep enough and um I've started to run first time in my life.

And um yeah, I'm on my way on my goal to to get finally to the younger Whoop age that I am. So, yeah, the uh the core of our Core 3 product is the uh metric, one very simple metric which we call probability of loss. So, we have uh analyzed um around 100 we have 100 different uh data points that we are collecting for 2,000 projects um with open methodology and we are converting this data metrics uh into the one score, probability of loss.

Um the Yeah, so we uh the main idea be- behind this project again, it comes to that we are thinking we we think that's our industry is unaccountable untransparent very insecure, and we want it to become better. We want good founders to um use the methodology which is open uh as the um like to-do list uh what they need to do in order to prevent as many risks to fail as possible. Yeah, so um this is how it looks. Um by the way,

I hope like it is live right now cuz uh that was our plan. Yeah, so it's live. You can already start checking it at score3.io. Um all right, so uh So, we have six categories of uh the of the risks. It's security, financial, regulation operations regulatory and dependencies. Dependencies like supply chain um risks and um and we [snorts] can go one by one. Yeah, and to check some examples um um of real incidents uh that's would been have highlighted uh by

uh Core 3 data product. Yeah, Euler Finance hack. It's a pretty pretty good example like explaining security risks. Um yeah, so as you know uh Euler uh had uh great uh Sherlock contest on the protocol. Um They spent a lot of money, uh but then they decided to add a small donation function which they uh didn't audit uh in uh how it works in the combination of the the main protocol.

And that's donation function created a vulnerability that's resulted in almost 200 million hack. Yeah. So, here is uh what would been not seen uh what what Core 3 would highlight. It would highlight that the code was updated and there is no audit on the code. Yeah, so it will Okay, 3 minutes left. So, this would be like the the problem that people will see. Yeah, so Core 3 main idea is to check all the audits. Even we know that there a lot of audits are not public. Yeah, but this if the audit is not public, probably there are critical mistakes that are still not covered. Yeah, so

we we in like we're friends with a lot of auditors and we disc- I pitched them to this product as well. So, uh we're okay to cooperate even in these cases. But yeah, uh we're tracking all the audits in the in the space, of course. Uh financial risk, I'll be quite fast for each risk because I run out of time. Financial risk is mostly tokenomics, it's uh an analysis of the yields, is analysis of the treasuries um and uh of the revenue, of course.

Um operational risk, um mostly it's the um is the risk of um uh the business, yeah, and the um the the founders, um who are they, where are they from and uh is are they real or AI people? We don't know. Uh compliance regulatory risk, this is maybe not that important from one point of view, but we need to engage regulators.

Core 3 is also product for regulators for them to understand uh the industry better. Um by the way, we we've been we we had built already one regulatory dashboards for one regulator and they expect on this as well. Uh, reputational risk. Yeah, we also want to see uh we want to follow uh the such things as the fake Twitter followers. Um, you have uh fake engagements. We want to highlight all the unethical activity of the projects, yeah.

The trust should be earned, not faked. Um, dependency risk. This is the most complicated one, but one of the most important is supply chain uh risk assessments, yeah, to understand uh the codes uh logic which other dependencies um can be exploited. Uh, and yeah, there is for sure a lot of risk overlaps between each other and um uh the more risk we identified, the lower is the score and um the more warned you are about the project.

Um yeah so >> [clears throat] >> I kindly ask you yeah, um uh in the end I'm kindly asking you to have a look um to look at the methodology, uh suggest what else can be added. Like uh this this product goal is to make our industry better. Uh, we are we want to adjust methodology uh regularly. So, uh we want to add new metrics. Uh, we want even competitors, yeah. We want some other three companies to make the risk scores um because this is a missing uh piece of infrastructure uh in crypto.

So, thank you. Um, yeah, for attention. Maybe we have some questions. >> [applause] >> Are there any questions? Is this basically a a wrapped-up product or is there an SDK behind it that people can use to to build a customized version or a Yeah, uh thank you. Um, uh we actually have the um we we'll have the uh the the the

subscriptions uh where you can um use our data that we collected and change the values and create the custom scores based on this data. Um yeah so yes The answer is yes, but not as SDK in a little bit more convenient way even. Yes. Hello. Thank you very much for your speech. It was amazing. Uh, tell please is it such kind of evaluation can be applied to the small startups or the companies who just started? So, they need a lot of even time and uh experience in order to be not complied,

but uh gain this uh evaluation and have a good um business practice. So, can it be applied to the new companies? Yeah, I think so. Yeah, I think yes, but this is the reality, yeah. If you're a startup, you're a little bit more risky. Yeah um but uh you can use methodology to understand what is the what steps you need to do, yeah. Right, uh and there is nothing so complicated uh in the methodology that's uh the startup cannot plan from the beginning of uh developments. Yeah.

Hi, um I'm Deborah from Yap Global. Thank you for the presentation. Um, so if Drift had used this risk dashboard, would the exploit have been avoided? What kind of information would have been surfaced for them? Drift protocol that was hacked for 285 million. Yeah, yeah. So, for some from what I remember, they have uh um they they have uh the the keys leaked. And >> one admin key was compromised. >> Yeah, yeah, yeah. So, so definitely they would have the governance highlighted. They would have the operational security highlighted.

Um, that's um uh risks that's uh uh no no We will we would transparently explain that if a key of this protocol will be leaked, then everything will be hacked. For example, at Uniswap, yeah, you there is no there is no such thing as one key that can drain the liquidity. Thank you. Thank you. [snorts]