Trillion Dollar Security

Transcript

Hello everyone and welcome to the September edition of the D5 security summit monthly webinar. I'm reminding you all that uh uh DSS this year will be held in Buenos Cyrus on nove on on November 2021. It will be held in Lural in the same venue as dev connect and tickets are now live. In order to enter DSS you will need a ticket to Dev Connect but the DSS tickets are free. You can go and claim them on our website. So go ahead and do them now. And also we're working on the agenda. You've already seen some speakers being announced. We thank everyone that has applied to speak as DSS. We got a record number of talk

applications for DSS this year and we thank each and all of you for it. We have a slight delays but we'll give you results very soon if you will be speaking or not in DSS. So stay tuned and follow us. Today's webinar will be for a topic that's relevant for everybody that's interested in security and actually far beyond Ethereum Foundation's uh trillion dollar security initiative. So what is and how it came to be? We have a wonderful host of panelists here and the first of them is Rajie security researcher that has been very helpful with DSS in the past few years. Uh

Rajie, take the stage. >> Thank you. Welcome everyone. Um so really excited to be here at uh the DSS panel on trillion dollar security. I think this is probably the most ambitious panel uh that I'm moderating. Um so really glad to be here. Um yeah, so like Uri said, I'm a security researcher um and founder of Securium. glad to be here moderating this. And the panelists are Frederick Suantes from Ethereum Foundation and Mahedi from Sigma Prime who uh I believe most of you already know but we'll start off with a

very quick round of intros. So Frederick and Maddie, >> you want to start? M >> you go first. >> Okay, thank you. Uh yeah, so I'm Frederick. I uh lead the protocol security team at the Eternal Foundation. Um yeah, I guess that's it. Medi, >> nice and quick. Hey everyone, my name is Medi. I'm a co-founder and director of Sigma Prime. Uh Sigma Prime has been around for nearly a decade. Uh we're a blockchain security and research firm provides security assessment services to the um web3 ecosystem. And we're also the founders and maintainers of Lighthouse, uh, an Ethereum consensus

client responsible today for about 40% of the blocks on L1. Excited to be here. Awesome. So, um, yeah, I mean, um, I guess the first sort of question to kick this off is if people haven't heard of trillion dollar security, then what what is that, right? Um so Frederick um if you could sort of give us a give us an overview of what this initiative is um I know there have been a couple of articles that the you know team has worked on. So yeah please please take it away.

>> Yeah. Yeah for sure. So um yeah I guess a bit of a history of the of the initiative uh where it came from the and the inception of it. So as I mentioned I am part of the protocol security team at the foundation and we are primarily focusing on uh protocol level security matters such as ensuring that the uh specifications are secure uh that hard forks are secure. We and we do that by for example writing fussers. We do um manual reviews and we work a lot

with the various parts of the ecosystem for coordination. Um the feedback that we have been receiving is that the the main concern that people have is no longer the security of the protocol. people feel quite um confident in that uh especially given that we've had 10 years of uptime now and uh no major security incidents but we do have other issues in the ecosystem uh for the whole blockchain ecosystem I would say which is on top of the protocol um

so basically what we try started to do is try to map out okay what are the security concerns that people are facing today um as users projects institutions etc etc. So basically we set a goal of uh trying to get uh one like basically billions of individuals uh who can feel comfortable storing at least $1,000 on chain or uh getting institutions or governments or other types of entities to store like $1 trillion or more in a single smart contract and what is required to do that. So that's kind of the core of the

concept and uh we have uh multiple contributors to it. We have some sun, we have sack overant and we have Medi who is here. Um we also have people within the Ethereum Foundation who are helping out um such as Josh Stark or Tyler Holmes. Um we've had Jason who helped out as well. And then um obviously this is not something that we can do on our own. So we are collaborating and coordinating a lot uh which is probably an understatement but we're focusing a lot

on coordination with the ecosystem as a whole to try to solve these issues that we found. Um, we set out and we interviewed about 150 people and got probably 300 submissions to a form that we set uh created to kind of get feedback from people. And from that data, we then figure out, okay, what are the key areas that we need to improve on first? Um we have quite a long list of things that we need to figure out but um we have created this kind of priority list now where we need to figure out.

The main thing that people mentioned was issues with uh with wallets uh which is a big of a very large scope. But a concern they had was that they felt um worried when they were signing transactions because they weren't sure what they were signing etc. Uh they could be concerns about privacy uh censorship persistence and other things. So one of the topics that we've uh focused on now is creating some kind of minimum security standard for these types of wallets and for that we've uh uh started collaborating with the wallet beat to do

that. We also saw that and this doesn't come as news to many people for sure but there is an issue with the blind signing where you know as you are transacting and interacting with contracts it's very hard to understand exactly what you're doing um because all you see is this kind of call data which is very hard for people to decipher. So we're trying to solve that. And then uh another thing is uh making it less likely to deploy vulnerable smart contracts on chain um so that projects don't end up being compromised

etc. So those are the three focus areas uh the main ones right now and then we have like multiple minor projects as well that we're working with but yeah that's basically it. Cool. Yeah. Um so I guess uh to to recap right I mean there is a lot from from for people uh who have not read these blog articles. I suppose uh you know we'll be sharing those again. I I believe DSS has already uh shared them on the post but these will be shared again and uh yeah Frederick has just posted them here on the chat as well. So please do take a

look. Um so this is I mean when Frederick says uh this is not I mean it sounds like an understatement. It truly is. We uh in some sense are really trying to boil the ocean here. Uh because you know in security right it's really all about the weakest link. And in this case, there's just so many links here and and maybe this is where uh you know, I would ask Medi who's been in security for the longest time. I mean, there's just so much happening here, right? Uh so if you look at web 2 and web 3, web 3 has several sort of uh more levels of complexity and then obviously the assets

are risk. I mean there are so many differences here. So could you sort of uh highlight the seriousness of of the issue that we are trying to deal with here? >> Sure. Yeah, absolutely. Um I I really like um the wording that the EF used in the first blog post that announced this initiative which um I think I think Frederick may have been actually behind this. Uh but it it's no longer enough to be the best in crypto security for Ethereum to be the best-in-class in crypto security. I think we've achieved that and we should be really proud of that. But to achieve the goals that Frederick was talking about, trillion dollars of value on Ethereum, um we need to go above and beyond that. Uh Ethereum

has been setting the standards on so many different fronts over the past decade really. Uh so it's up to us, the Ethereum community, to really raise the bar and demand more to a whole bunch of different providers and ecosystem players. Um you're right in the sense that web 3 is you know perhaps a tad more complex than web two. Uh the attack surface is certainly a lot greater um when in web two you know a web application firewall could save your ass. Unfortunately uh we don't have that luxury in web 3 when uh smart contracts you know bake the business logic that developers uh have have committed to. um it's you know everyone and their dog can

potentially interact with those uh so it is it is very different um but at the same time it's very interesting to see over the past 12 months the latest hacks that uh we've all uh been following I'm sure very closely um you kind of start realizing and I probably sound like a broken record here uh that the vast majority of these issues or at least the most value that we've lost to hackers is not through smart contract security hacks uh it's through poor web tool like security hygiene uh so poor private key management poor access control on certain uh cloud uh hosts and things like that. So there's definitely things that we should be reusing uh from the

web two world and keeping in mind obviously the specificities of our space for the web three specific uh stack. Um but I'm very excited. I think the initiative is three months old. Um it's been it's been really good seeing all the progress that the EF has been able to drive over the past few few weeks. >> Cool. Absolutely. Um so maybe um uh Frederick maybe uh we can can we recap the the blog post? I mean so we started uh I guess a blog the first one where the initiative was launched u essentially outlined three phases to it right the I think it was mapping uh where we really seek out um from the

ecosystem sort of map the different layers different aspects of uh web 3 I mean in this case specific to Ethereum obviously and then uh we reach out to all those parts of the ecosystem and then we uh as you explained we sought their inputs about what what the status is what uh the current gaps and challenges are and what the sort of the opportunities and priorities are right u so can you maybe sort of highlight uh I mean you you sort of zoomed in on the three priorities but if if you step back uh I think there were six of those areas right can we start with those again.

>> Um yeah, so um yeah, like I said, we're the first step was to do some mapping to figure out uh what kind of issues that were existing in the system. Um then actually executing on them and then basically communicating more about how we are secure. I think that's something that we definitely need to improve on. Um but uh yeah at the moment we're in the execution stage um which is uh like like you mentioned it's covering a bunch of different domains.

So we have uh UX for example which is um I mean in in one sense that could encompass every single thing that we're working on but UX in this case is basically blind signing like finding a solution to that and then front end security which uh we have a few ideas about how to solve. We have uh this thing as we call verifiable front ends um which we hope um can be can be done. Um we have uh wallet security which uh can also be a bunch of

different things. It can be firmer issues for example on hardware attacks. It could be supply chain attacks both on hardware and software. Uh for that we are we're looking into things such as um like we're not trying to reinvent the wheel unless uh if there's already a solution. So we're looking into things uh that is working in the web two space but to see if we can um if we can improve it in for web three.

Uh so for example no there was a supply chain uh issue um I guess about a week ago maybe two weeks ago uh with some library which kind of luckily there wasn't many losses but obviously it could have been worse. Um but for example for that we're looking into things like how to solve that we're looking into solutions such as sig store which exist in in web 2. um and seeing how can we do something similar like that for for web 3.

Um there's the smart contract security which like Medie mentioned is I mean it's it's very important that we try to solve this but uh it's maybe not as um as big of a focus area right now. Um right now we're trying to figure out how can we avoid situations where uh people lose funds because of hacked front ends and uh malicious transactions and so on.

And then we have the infrastructure part which is things such as cloud security. Um and then we also have the consensus and protocol security parts which is uh the service risks and like on a on a bigger scope we're also thinking about things such as the infrastructure of the internet where you know as a DNS provider you can uh potentially sensor uh you could uh as a you know ISP you could prevent people from accessing nodes by blocking ports and and so on. So we are thinking about that as well,

>> right? U so yeah, I mean that's I think you summarized a lot of it, right? Right. I mean the blog goes into the details of a lot of these and uh we would certainly encourage the viewers to take a look at both the blog articles a second one which goes into the mapping and all the details here. Um so so Frederick um and and Maddie u so clearly I mean this is an EF le initiative right and Frederick when you say we are looking into this I guess for for all the viewers one of the burning questions uh maybe you know if if they're a security researcher if they're a security project or a company u and involved in any part of this ecosystem

right u so the burning question may be that hey how do how do I get involved how do we get involved How do we reach out? Uh those kinds of things. So what what uh what is the plan there? >> Yeah, when I when I say we, I don't mean the the EF. Uh I mean we as in the various parts of the ecosystem that are uh working on on trying to solve these kind of issues. Um I think that's one of the things that has very much uh inspired me even more uh that you know this is this is actually going to work out because there's been so many people within this ecosystem uh various

entities various um people who have been willing to dedicate their time and effort into solving is um which has been a big success story to me. Um there are people who or entities that are normally competitors that have come together to try to figure out okay but we understand that we're competing about the same market but let's try to figure this out so that you know the market can grow even more uh so that we can uh you know get more users etc. And I think that's that's something that's been super good.

um the EF may be coordinating it but uh the actual work is actually I would say primarily being done by the the ecosystem as a whole. So whoever is interested in participating and helping out please please reach out and uh you can reach out to trillion dollar security.org or um and we will try to coordinate with you on the project that you are interested in contributing to.

>> Got it. Um so yeah and and this is going to be an ongoing process right um my guess is I mean the okay the three phases mapping execution and coms um you know it's going to be done iteratively right so we finished sort of the first set of uh mappings and priorities like you said um and we are in the execution part and then you know uh communications this panel right here is one uh channel of communication and this is going to happen on an ongoing basis. Um so and a lot of that is going to evolve you know based on uh whatever the priority

becomes right. Uh to go to go back to what Mary and you said smart contract security seems to be uh we seems to have a reasonable hold on that now and that's probably because we saw the biggest hacks uh in the last 10 years. Uh well right u when smart contracts were new when people were not really familiar solidity was new the whole ecosystem was really the tooling was not as uh robust uh we saw basic smart contract security hacks and billion I mean millions if not billions lost. So now we seem to have reached a point where there are other things that have become the longest uh poles in the tent if you will uh like the wallet security right and especially

things that are touch points for the users uh in terms of wallets and in terms of uh maybe other aspects. So um uh I so like you said the for the ecosystem to get involved right now um do I guess they reach out to that email they can potentially reach out to uh to you uh in in some sense uh are there specific uh you mentioned a couple of things but are there specific things that uh you're looking for um you know at this point where you want somebody to sort of uh u propose some solutions or standard s and reach out u you know both open to both you and Maddie.

>> Yeah. Do you want to start Medie? >> Yeah sure. Um I was just thinking about what Rajie was saying about um the the sequence of actions that uh this initiative has has triggered. So um as as as you reminded people uh first step was to essentially speak with the ecosystem gather input and understand the priorities. Second step would be executing on those priorities and third step would be communicating on those priorities. It was overwhelming um the signal that we received when doing that first mapping phase. How bad of a UX security we have and we uh probably

include the entire blockchain ecosystem. Let's just focus on Ethereum. And and this is something that came up from conversations with institutional actors and also kind of like beginners, noobs that haven't interacted with the chain yet that are perhaps a bit overwhelmed. Um so UX security was clearly uh the kind of winner of that contest which triggered uh or led the Etherum Foundation to really prioritize this topic. And in fact uh one could argue that uh there's so much to do that we could very easily parallelize all these efforts. But I think the decision that was made was actually quite smart. We can notice very easily that UX security

is really the priority. So we should tackle that first. uh and and and that's what uh the the one has been uh has been doing is really doubling down on solving the hard problems like you know blind signing and and things like that. Uh so this I I speaking under Frederick's supervision I do believe that we are now in really the nitty-gritty of of tackling this issue. Um I for one I'm very excited about the possibility of having an L2B equivalent or wallet security. Um some folks have been doing great work. Um basically trying to replicate what L2B has has done. Um

they've asked for funding from the Ethereum Foundation which has been I believe granted which is super exciting. Um, and this is, uh, Wallet Beat, I believe, um, is is the name of the the project, and it's composed of a whole bunch of people that have already been doing tremendous work for the space. So, I'm very excited about that. Uh, and I think anyone who would be willing to um, help basically push a standard, create a standard, push it for adoption, and make sure that we have at least a common denominator when we talk about wallets and their security properties.

Yeah. And I think uh I mean I I I will mirror what Mary said, but I I do think that with regards to the the areas that people should reach out about, I think the most important thing is to reach out about something that that you have a strong desire and um enthusiasm to to improve on. Um because I mean there isn't that much um there's a lot of personal responsibility when it comes to fixing these issues. Um

there won't likely be a product manager that's chasing you and getting it fixed etc. Uh we're looking for people who can take the role of ensuring that things are actually done. Um so uh you know for example as like I think the wallet beat one is is a good example where you know the wallet beat team uh will coordinate with uh with other actors such as uh co- inspect and and others and um try to come up with a uh good standard that's relevant for you know the wallets and they will obviously communicate with

the wallets and such as well. Um, but it has to be something that that you're actually interested and involved in. And if you have some area like that, if that's, you know, trying to solve the blind signing issue or if it's trying to figure out how to do verifiable front ends, um, to avoid people, you know, going to a website they usually trust and have it compromised and end up losing all their funds. um then that's what you should reach out about.

>> Makes sense. Um so maybe uh you know maybe let's given that UX seems to have bubbled to the top right I mean unanimously that is what you heard is u something that requires the most urgent um solutions why u you know let's let's talk a bit about the the reason for the problem right is it a technical issue I mean we have had wallets I mean ever since we had to uh work right with u with the blockchain Um and we have so many of them, right?

Um so is it a technical issue with the wallets? Uh are there sort of fundamental things that u need to be fixed or that cannot be fixed? Is it a coordination thing? >> Is it an education thing? I mean there there's a reason why if you go to web two, there's a reason why uh you know the the most common password is still 1 2 3 4 5 6, right? So why I mean how do we think that magically uh we are going to solve that um with key management I mean here with trillion dollars at stake I I I can try to have a crack at this um you started listing all the potential reasons I think it's all of the above um when I was hearing you outline them um

well the I think Frederick might agree I think really the main problem that people relay relayed to us during these interviews is that there is actually no way of knowing what you're signing. Like let let's be real, even for like highly technical folks, we can't actually review thoroughly what state changes will be actioned by a given transaction. Uh which is a bit crazy when you think about it, right? Like we've been doing this for over a decade and we still don't have that as a tool in our tool belt. um which means that people are effectively signing and a lot of them if not most of users are signing things that they absolutely can't reason about.

Um so I think that came up and again it came up as a feedback from institutions and also as a feedback from people who are wanting to enter the space and there's a lot of people throughout the years that have tried to solve that problem or at least conceptually have thrown cycles to trying to think this through. One of the uh solutions would be to potentially come up with the um an intermediary programming language if you will. you have your call data that gets parsed into essentially a language that kind of resembles English so that people can effectively you know in simple layman terms know exactly what they're

about to sign but there's a whole bunch of challenges with this approach as I'm sure a bunch of people have already figured out uh mainly that you know we need a collection of database uh or sorry of function signatures that is accurate and uh up to date um so it it it it's not Not a single in my view not a single technical problem like a difficult technical problem that needs to be solved for these problems to um disappear. It's a collection of things and the most important I think um link is going to be making sure that there's collaboration and standardization across the board. So I am hopeful that um

institutions or or folks like um wallet wallet beat can really be that uh engine of standardization of communication uh across the industry. Um but it is it is it is a big problem. Uh and I I I perhaps hadn't realized how big of a problem it was before the one TDS um initiative. >> Yeah. I I definitely agree that it's it's a it's a chain of problems that needs to be solved for like the the entire solution for blindstein for example to be to be solved. Um there are steps being taken in many of these

chains now. So we have verifier alliance for example who is providing um databases of um verified smart contracts which can help in some parts of this chain and uh there are other uh ways being looked into on how to solve this. Um, with regards to the wallets, I think it's obviously there is a technical aspect to it. Uh, like medie mentioned, you know, you need to solve some of these issues. Um, because people can't read the call data.

But I also think that a lot of the wallets today have been designed for the current users of blockchain which are I would say technical power users most of the time. They are quite wellversed with technology. They're not afraid to try out new things, not afraid to like learn uh how this new technology works. So um it's very hard I believe to get someone on technical to install wallet extensions in a browser understand how to

send some type of coin from their wallet to another wallet. They need to figure out what is a public address. What is this seed phrase I have to store? Why do I have to store it? It's just quite complex on a technical level. Um, which is fine for you know the more advanced users who want full control etc. But you know those in in web two they would be like Arch Linux power users while most of the users like if we want to reach the vast majority of humanity we need to have some type of iOS like experience I believe um where people can

just use something like simple as Apple Pay basically to just transact while being uh on chain and um like reaping all the benefits of uh being decentralized and um yeah having having the the uptime of of the blockchain. >> Got it. Yeah. I mean I I think two critical points right I mean for me uh the takeaways from what Medi and you said uh the the current sort of set of users the the power users and and the solutions that uh that have come out for them right uh in terms of let's say

hardware wallets and using air gap machines and being able to run simulations of the transactions and being able to verify the call data. So all that uh may work right for institutions uh sophisticated entities who have the uh the the privilege of sort of spending that kind of effort right uh to to educate themselves to be able to afford those devices to be able to u really play through all these scenarios because presumably the assets that they are working with are you know are at a trillion dollar per institution or per contract as an example. example, right? Um, and then there is the on the other end, right, is the $1,000 per user

for the billion users that we are talking about where um I guess the expectation of somebody I mean everybody really to own a hardware wallet, a dedicated air gap machine being able to understand uh simulations. I mean what role do you see of sort of this fork right or or two sort of extremes uh the clearly I mean education educating uh people more than sort of the technical stuff the coordination stuff is all great but then there is probably a big education component the comm's component as well right >> I mean in my view yes partly but maybe not for every user like you don't

educate someone how to use a uh payment. You know, when you pay by credit card in a restaurant, you don't like give them training on how to pay with their credit card. It's just they know they can trust it. They know it works. That's how I hope like we can come to a step where that's the case for most users. Um obviously for institutions in other parts the that are let's say power users and that can spend like if you're a bank uh you're not too and you're doing like very large

transactions of uh like millions of dollars then you're not probably too unfamiliar with having to sit and like double triple quadruple check that everything is correct. Um, and I think that's probably reasonable as well in uh like if you're transacting as an institution on a on a blockchain that you would be going through those kind of things. The checks are probably different though and for that there needs to be more um documentation and best practices and training uh available. But for the vast majority of the population, I personally feel that it's unreasonable that they have to write like read this

20page manual on how to be >> secure online when or like having their wallet secure. That should just be built in uh to the to the experience like if we're going to reach um like civilization uh level of use usage Uh I I totally agree. I think for for too long we've been focusing on power users um like throwing solutions uh technical um measures um that power users can reason about that power users can go and apply. the problem now or the problem the challenge the position I believe Ethereum is in

today I is that it needs to cater for um a a a group of people that is not currently a part of that power user group um and one of the I think there were two suggestions from uh the initial report that I believe could have a substantial impact um the first one is to have a beginner friendly wallet like a a wallet so dumb that you can't really mess anything up a while so dumb that you can't really lose your funds. I know it sounds silly, but um and it's perhaps in opposition with some of the ethos that Ethereum carries, and that's arguably something that I'd love I'd love to debate. Uh but we should have a

way for, you know, true beginners to interact with the chain and to do so in a very safe way. Um so I'm very excited to see that hopefully that wallet come to uh fruition. Um and on the other side of the spectrum, we should probably the ecosystem should probably have an institutional grade wallet that these banks that uh Frederick has been uh mentioning um banks like the ones that Frederick's mentioning can use those uh existing uh processes that are now baked into an institutional app. So I think uh a lot of these UX security challenges could be solved by having two new wallets. One wallet for beginners and

one wallet for highly advanced institutional actors that need to be very diligent with every single transaction that they issue. >> Makes sense. Makes sense. Um so maybe in the interest of time um I think we've touched upon UX wallets uh quite a few issues to be solved uh challenges to be solved there and then uh uh we do have a whole bunch of wallet projects as well right uh taking a stab at this so we'll uh definitely get to discuss and hear more about this um in the coming months of this initiative u so maybe let's let's go to uh the smart contract side

right I mean the these are two things that are very unique to web 3 uh that we don't sort of carry over from the web 2 world right um wallets we talked about smart contracts um so I mean that that's where so I've been a security researcher focusing on Ethereum smart contracts uh you know uh for for a while um and I think we have raised the bar right I mean we used to have all these I mean we do see some of these now now and then but but the extent of the exploits are much smaller. Um but then we have we still have issues like uh the entrenches which was like a huge deal a few years ago. I think because of the tooling,

because of uh education, the developers sort of realize what needs to be done in the for the most part at least, right? Uh but we still uh I mean this is this is my pet peeve is u we do still see protocols that do not take uh the security um um at a level that they need to be doing it. Right? I mean, this is where I I I love I love Sera's uh uh sort of phrase, which is move move fast, break uh nothing. Uh well, I I would I would argue that we probably need to move move slow and break nothing. Um but so many issues still continue to

persist, right? Frederick brought up u sort of the verification of the contract. So, people interacting with contracts have no clue. I mean even if you're a power user it takes a whole lot to figure out okay which contracts am I interacting with has it been audited even if you assume you know audits are silver bullets they are not but has this sort of had a third uh party review have there been any I mean are there any components there that were upgraded right after the audit uh and what was the extent of the audit can I mean what sort of risk uh latent risk is still persistent in these smart contracts.

Testing, I know Sigma Prime is huge on testing, validation, our protocols. I mean, there's there's again sort of a um a distribution of the protocols, right? Obviously, uh we have some of the blue chip quote unquote blue chip protocols that take this very seriously. Fantastic coverage, uh fast testing, formal verification, what have you, right? But when do we see this as sort of becoming u table stakes? I mean it is it should be table stakes from our perspective but how do we convince every protocol right to to take this as seriously as possible?

I I've been doing this for 10 years right and I think I'm convinced now that we can't we can't convince every single project unfortunately. Um I I was in the camp of know everyone should really understand how serious this is and how important that is. Now I'm at peace with the fact that there is always going to be people who will cut corners and go to market and put their user savings at risk just to be able to you know be live because they promised to go live there to their investors or what have you. So it I think it would be uh almost unfair to try to judge us judge the success of

the one TDS uh initiative um solely on the number of projects that are indeed doing the needful because we'll always have the outliers. Um to answer your question I think a bit more specifically um there's a few things that Frederick mentioned that got me a bit excited. Um, a lot of the web 2 security world relies heavily on um um an institution called OLASP, right? Uh and it stands for someone's going to help me uh open web application security standard practice something like that. Anyway, it was really the bible for web two security and these folks have decided to essentially port their top 10. They're most famous for

their top 10 that gets revised every year and they're creating one for smart contract security. So that's super exciting. Uh and I believe the FC intention is to try and support that initiative in some capacity. Uh so that that's going to help. The reason why I think it's important is because it shows that as an industry we're maturing, you know, because the the real serious folks are now, you know, dedicating resources to provide um at least the top 10 for for our crazy space, which is very exciting. Uh, another thing I believe that Frederick has um also mentioned is being able to have a database of exploits, right? So all these audit firms, you know, we're

all sitting on a gold mine of of vulnerabilities. How can we potentially source these and put them in like a database that is sanitized and accessible to everyone, right? So that that that's probably something that could be quite exciting. And then obviously the use of um of LLMs. Um I think nowadays a what I see uh is a lot of projects using LLMs to generate tests. Right. So, they write their tests, plus tests, prop tests, um, with LLMs. Um, I I don't know how I feel about that. I think it's better obviously than no tests, but you got to be extremely careful as well. LLMs aren't going to be able to think about

the high um connected end to end scenarios uh, which need to be tested manually. Yeah, I think uh from a knowledge level for an LLM um smart contracts and such is also a bit tricky. Um obviously there isn't as much documented documentation compared to or code available such as Python for example. So it won't be as as good. Uh that's kind of why we want to create this uh open data set as well for vulnerabilities uh just to be able to

provide more training abilities for or LLMs so that you know um teams such as Sigma Prime who are working on LLM tooling and such could could use this huge data set uh containing you know hopefully the vast majority of previously found vulnerabilities in this ecosystem to train their models specifically on smart contracts um on previous found smart contract vulnerabilities which will then hopefully help um secure the ecosystem more. I also think what you mentioned Rajie um

is interest is very interesting regarding the smart contract security. Um to me it's it's kind of shifted and it shifted in the same way as it has done in in real life. um where crime just because something like a crime doesn't work anymore, it doesn't mean it stops um it they just the criminals don't stop with doing criminal stuff. They just shift their priorities in a way. So back like quite a few years ago now I guess people were doing quite a lot of bank robberies and then they figured out ways to to

solve that. Um, so now there aren't that many bank robberies anymore, but instead, you know, people are being scammed through various ways instead. Um, and companies have been scammed through other means such as CEO scams and fishing attacks and and so on. And I think that's what we've seen in the web three space as well where you know this the attackers started with the compromising smart contracts which could be you know in a sense viewed as a bank in this scenario and then when the smart contract security got better over the years. the um criminals shifted and now they're targeting users through drainers

or developers by uh you know obtaining access to their machines, stealing uh API keys and and whatnot to gain access to to stuff that way. So it's kind of shifted away from the smart contract security issues into more becoming a human uh issue. And that's it's a very tricky problem to solve. Um but uh yeah, hopefully we can we can uh minimize the the damages. >> Yeah, absolutely. I mean um all great points. So u in the interest of time, I think we have about 10 minutes left. Uh there are a couple of questions from

from uh um from the listeners from the viewers that we can take in the last five minutes. Um but I mean for for all of us who've been in security for decades we know that uh this is you know it's a chase right you fix one thing they go for the the I mean it's a good and the bad guys right u some a particular hole gets fixed it's like the Swiss cheese model there's so many analogies there then there's so many other holes that they can go after it could be you know we fix the wallets it could then they go after let's say the smart contracts, right? And if those are fixed, it's really the front ends. And if those are fixed, then you have DNS

hijacking. If those are fixed, you have supply chain issues, right? And u it is it's a matter of sort of uh plugging as many holes, the biggest ones, prioritizing and so on. But um in terms of exploits, it I I guess the best thing is to be always prepared with the mindset that they are going to happen. It's a when, not if. So given that u one of the areas that is uh of a priority right uh listed in the in the article is monitoring and incident response right um so protocols it could be users it could be devs uh how good really is our monitoring capability

today right I mean we do have at least on the smart contract side we we have uh I think several projects that build these monitoring uh capabilities uh but that is just part of what is being monitored right there's still a lot of blind spots. Um so that is one and then from an instant response perspective right let's assume that the monitoring doesn't prevent exploits exploits happen and we have seen teams scrambling uh and this is protocol teams it could be users who got fished u and medi maybe you can uh sort of talk about seal 911 in this context in terms of how they are playing a role

>> but I guess the the question is we need lot more coordination uh we We need you know more war rooms unfortunately where people sort of white hats come together. We need more white hats. Uh you know we have bug bounties. We have the seal safe harbor. We need more u sort of as a fallback option. We need insurance uh because when things go wrong then who will make u uh it whole right. So there's whole spectrum of things. just wondering what you guys think is the status and what what sort of challenges and priorities in the space.

>> Um yeah, it's it's super interesting. I think it's one of those areas that has been less invested in um as as as an ecosystem. I'd say we haven't spent as much time and money and effort and blunties u setting up decent monitoring and working on our incident playbooks, incident response playbooks. um nowhere near as much as what we've been investing in um you know audits, bug bounties, etc., etc., etc. I do genuinely think that the monitoring landscape is somewhat okay. Just looking at my clients, how uh much monitoring they've set up and how they set it up, uh it's usually okay. There's obviously

sometimes gaps and things that they could be um monitoring a bit better, but it's it's it's usually okay. However, most of my clients, I'd say, don't necessarily have good incident response playbooks. So, they know they can get alerted when things go wrong, but they literally have no idea what to do when things go wrong. And that's that's quite scary. So, I've been trying to help some of them at least reason about uh what what to do when part of my friendship hits the fan. Um obviously we are lucky today to have the support of SEAL the security alliance as you mentioned seal 911 has been really instrumental in helping project and users that have been

facing um malicious activities from threat actors. So massive kudos to Sam and Pascal who's leading the 911 team. They've been doing a tremendous job. Um there's other things that Seal has helped with in the past uh initiatives like war games uh with tabletop exercises um where you know Isak and his crew would sit down with some of the top protocols in the space the blue chip protocols as you call them regime and really you know brainstorm scenarios fork mainet trigger an incident and see how devs respond to those incidents and uh it's it's yielded tremendous results uh both for seal and the projects that participated. So, highly highly

encourage you uh if you're listening and you are responsible for the security of uh your protocol to uh think think through these hard hard problems. I think uh one challenge also in this space um is that as someone who is interested in technology um you might have an idea and then you decide to write uh a DAP for that idea. you deploy it um and then five days later you have a TVL of like a hundred million dollars and you're like this one

person just maybe maybe even in high school or something like that and you don't really like security might not have been the primary thing that you were focused on when you were building this and that's maybe not you maybe don't have the experience etc uh with that but you built this really really cool thing um compared like compared to the web two world where that is quite unheard of I would say so the opportunity is obviously super exciting in this space um but I I do think that we need to has to be more support for people

who are starting out and building these successful projects um and give them some um some insight on how to think regarding security etc. >> Great points. Yeah. Um I think we are just about running out of time. So So Frederick, back to you, right? Um trillion dollar sec security initiative. Fantastic. I don't think anybody is going to uh think twice about it. So we welcome a lot more of the ecosystem to engage with us and u like like Frederick said there is that email you can reach out to uh there is going to be a lot

more communications and maybe there's a good time for me to uh call out that um trillion dollar security is coming to Dev Connect Argentina on uh November 22nd. Um so there has been an announcement and maybe I will share this u announcement on on the chat as well. Uh so if you are a project a security project um that is not already engaged but would like to engage please do apply to be considered. Uh so we would uh look forward to that. So so Frederick um what I mean we we've talked about how Ethereum the success story has been zero downtime in 10 years. What would that

success story for oneps for the trillion dollar initiative look like let's say in 2035? >> Um obviously we will still be having 100% of time. Um but the yeah the main one of the key areas for me to to measure the success is to see that you know we Ethereum has become the um has become this type of civilization scale infrastructure uh that secures uh the vast majority of transactions. And that to me can

probably only happen if we have uh trust and security uh that's uh that's required by users and institutions. Um, and yeah, I I just want to take 30 seconds to just also say that for uh anyone who is interested in uh helping out with this on a like more direct level, we're also looking for someone to join uh the one TS project as a coordinator slash project manager that will be uh basically ensuring that the project moves on and that we are uh yeah providing um good

progress. So if you're interested in that role, you can uh you can probably find the job ad um on online. Uh I can post it on the chat. Oh yeah, Nathan already posted it. Thank you. >> I just want to second this by saying this is a fantastic opportunity. You'll get to work with some of the brightest minds in this ecosystem. If you think you want to contribute to this amazing initiative, don't hesitate. Twice, click the link that Nathan just shared. Um, and potentially you'll have a chance to work with Frederick, uh, which I I strongly strongly recommend. Um, but yeah, it's an amazing opportunity. This role is second to none. Uh, please take

the time to, uh, browse the description if you have any questions. I'm sure Frederick and myself will be happy to help, uh, answer them. Fantastic. So, with that, I think we're out of time. Thank you, Frederick and Maddie, um, and Nathan Uri, and the rest of the DSS team for having us here. Now, uh, back to Uri. Thank you. >> I think today we saw that the $1 trillion initiative has an incredibly broad scope. Uh, we just barely scratched the surface. Um, but you will learn more about the $1 trillion security at DSS. So reminding you all it's November 20 21st benosirus Argentina during dev connect tickets are

live on our website and stay tuned to hear more about the other speakers and G agenda. Thank you uh Rejie, Friedri and Medie for the incredibly interesting panel. Thank you all for joining us. See you next month. >> Thanks everyone. >> Thanks Se. >> Thanks everyone.