Are We Creating More Blackhats Than Whitehats?

Transcript

Thank you everyone for coming. Uh thank you to our panelists. I know it's the last uh panel of the day, but it should be a fun and hopefully a little spicy one uh just to get everyone up and ready for the evening events. All right, so welcome everyone. I think uh I think we've already done a good introduction to everyone. We have a good array of different uh vendors here. We have someone from the bug bounty space. Mitchell, you do something in Immunifi, right? What do you do? >> Yeah. Yeah, I I pretend to run it. I mean, really, the the team does all the work and I'm just a pretty face at this point, but I I I try to show up at events like these.

>> Okay, good. Yeah, we want to make sure that it's still running. A lot of our bug bounties are still running on Mutify, so that's good to hear. I know Omar, you're at Chain Patrol, so focusing on uh IP protection or brand protection. Um I know that Ari, you're at fail safe, you're doing monitoring. Neville, you're at Dub, which does monitoring as well as audits. And then uh Mihal, you're at Sigma Prime which also does a lot of audits as well as running nodes and critical infrastructure for Ethereum. So all of you good variety of experience here for all of you who who aren't already aware of these distinguished figures. So from here I'll jump right into some of the questions. I think the first one is around incentives and I'll probably start with Mitchell on this one uh because ultimately you know was the

first one kind of on this on the scene to say hey I think we are not incentivizing bug bounties enough in the very early days of web 3. uh trying to put that out there. So I'm I'm gonna probably pose a question you around like what has changed uh over the last few years since Immunifi first launched and how do you see the incurren incentive landscape? Are are there is there a mismatch in incentives that Imunifi sees today? Um or are there other challenges beyond uh just the price of bounties? I'm curious to hear your thoughts as we've seen more larger blackhead exploits like 1.5 billion for buy and others occur.

>> Yeah. Okay. So first of all when you ask that question it's so broad because we've we launched our thesis for the scaling bug bounty and a cryptospecific version of bug bounties 5 years ago over 5 years ago. So it's been a long journey. We've gone through several cycles in that time where mentalities have changed from, you know, 2021 where this idea was avanguard and offensive arguably to 2022 and 2023 when it was widely adopted and and proven to be extremely successful to 2024 and 2025 when things changed a little bit in terms of the overall adoption of the idea and the the kind of bug bounty model became a little bit more institutionalized. And I think that especially over the last few years, the

changes that have happened on the bug bounty side are quite negative uh for incentives. And you know, specifically the the the the changes that happened is we stopped seeing as much upward pressure on bounty sizes. Okay, that's number one. And over the last two years, we've begun to see the erosion of standards in uh the bug bounty space as a whole. And this is the big problem with the incentives. I think I think bug bounties should be larger, can be larger. There are very clear paths by which we can increase the financial lucriveness of the model that we haven't yet taken. But the more concerning issue is that the the trust in bug bounties as

a standard has become eroded because of the behavior of market actors with customers. And to be very very and this this is you know speaking of the title of this thing this is actually really driving some problematic things in the market because we have less and less white hats on a relative basis. Yes the overall community keeps growing and we're we're more and more successful in driving bug bounties as an industry still but the relative percentage of security operators participating is less and less and less and that's really being driven by I would say two two factors. Uh number one, certain players in the market are undercutting the bug bounty model and hollowing out the social and legal protections that were

originally given to security researchers. Like as far as I know, Immunifi is the only player in bug bounties in crypto at this point that will still hold, you know, projects to account. And we can't even do that all the time. We can't succeed. You like we don't have unlimited power. But we do apply what power we have to protect white hats as much as we can. It's not enough. We're constantly trying to expand that. But no other player does as far as I know at all. They basically fall to whatever the customer asks for.

And this goes in with the second problem that is kind of hollowing out the bug bounty model. And obviously this is not applying for us in the same way, but it's certainly applying for other uh industry parties, which is more and more we see them offering these products at cost or negative. And so because they're basically trying to use that to drive upstream audit income or income into other products and as a result it never makes sense to fight and protect the security researchers on most of these platforms when like you know this is just a a freebie product right this is just a loss leader for you. So this combination of things which hasn't affected all of our competitors. I think there are other upstanding you know bug bounty platforms in crypto and I really

respect them but it's affected a number of them and this state of affairs I is leading to a situation where hackers risk more and more abuse white hats risk more and more abuse on bug bounty activities because nobody's going to come and protect them. And this is creating some problems. This is a big change from where things were 2 and 1/2 years ago. >> Okay. So in sort like the number is really not the problem. Like you can have a higher you buy better number but the trust that the payout will actually happen is is a key issue.

>> This is the key disincentive cuz the numbers it's it's already life-changing money, right? These are already millions. We can get more. We should do more. But the problem is if you can't believe that's money that money is real, it doesn't make a difference how big that number is. It's all a lie, right? It's all a fabrication. It's all it's all smoke in the air. And that's where the the the destruction of trust in the institution and in the social norm is problematic. >> All right, I want to go to the auditors or and people that do security research in the panel. Neville, how like do you all have a perspective on this given that I'm I'm sure you've found yourself reporting bugs at some point.

>> Yeah. So what Michael is saying is uh sorry Mitchell is saying is 100% true uh about this issue. Um actually uh in the old days it used to be that bug bounty providers used to get a percentage of the uh awarded bounty and it used to be a small percentage. So that created an incentive for the bounty provider to um not exactly side with the security researcher but it it did create a little bit of an incentive for the bounty provider. At the same time, the bounty provider had the incentive to retain the customer for the future because people would be finding critical and high vulnerability issues, you know, for in

perpetuity in most of these protocols because protocols will be updated, you know, they will new versions will be released and stuff like that. Um, yeah, generally it used to be the case before that we used to negotiate directly with with the projects. I mean by negotiating I mean like you know go to the project and just tell them what the bug is. Um and nowadays you know with these with these bounty programs when there's a lot of terms and conditions really they should be just be bound by the amount of value that is at risk when it comes to high and critical severity issues. And even if it's out of scope or if it's in a like a contract that has been deployed

but isn't actually like part of the scope yet. Yeah. So that those kind of like uh vulnerabilities and claims should be honored as well. >> Mh. Do you want to add anything? >> Yeah. And look, I I agree with with everything the guy said. Um particularly agree with what Mitchell said that it's already life-changing money. Like so the incentives are definitely there. It's all about how we can make it that the actual researchers actually feel comfortable about submitting the bugs and whether they are going to be u you know properly I guess acknowledged by doing that and not going to get in trouble for doing so. So I think there's the things to answer but um yeah the incentives definitely are there and they already big. Yeah, if I can just add on to that, you know, I think that even if the, you know, payouts weren't there, I

think security researchers would still be hunting for these bugs and working on these these really challenging kind of issues here. But I think the the the lack or maybe the disincentivization of actually disclosing that's kind of what's really the question here. It's like it's not necessarily that people are, you know, we're incentivizing people to become black hats. I think it's more so that we're not giving them the reason to even report those low severity things, those medium severity things that because they don't feel strongly that they'll get a payout at the end of that. Can I make a comment there? It's not entirely true. We we actually with the recent shift in the

industry we we are risking incentivizing black hat behavior is because every white hat who gets screwed on one of these deals that goes bad gets resentful about it gets angry about it says I'm creating incredible value. I come in good faith as an honorable person. I disclose and do a a righteous duty to this project in their community and they screw me for it. They they they they stab me in the back and they try to get their lawyers on me and threaten me and make life difficult and make me to agree to something and I feel dirty about it.

And this has begat a conversation over the last two years which has become more and more common uh where people are asking hey you know should we just be taking the money first and then sending 90% of it back which is totally illegal extremely destructive risks huge market impact and devastating consequences but this is something that happens and it's something that we've seen a few times. It's kind of pulling people not necessarily to become strictly black hats, but this kind of gray hat which is really on the border out of frustration and a and a sense of a lack of respect for their work. So, it's even worse.

It's even worse to this this scenario. It's like it's not even that people just don't hunt as much, which is a problem and absolutely true. That that risks not bringing in more new blood into the industry, but also that really talented people who get screwed. And only remember the people who are going to have these bad experiences are only the ones that are good enough to find something in the first place. So we are selecting for skilled dangerous people, right, in these bad interactions that have to deal with all these BS terms and conditions, which is crazy. and and these people are now asking, hey, you know, maybe I should take what I can because this is the way the project's, you know, treating me. Are we all living in the jungle? Well, maybe I'm a jungle beast, too. So, it's worse than it

looks. >> Ari, I see you leaning in. >> Yeah, I mean, I kind of disagree with that a bit. I think that the the uh the real I mean, it's not so much that are we creating more black hats. I think it's more the long along the lines of are we just disincentivizing white hats from from working in this area in the first place and just applying their talents elsewhere because you know I don't think I think we're just giving ourselves too much credit to to say that uh you know these people are just going to go commit crimes because at the end of the day if you if a government comes after you it's a crime right >> much easier said than done in most places in the world these things are not crimes today. Yes, sure. It depends on your depends on what country you're in

and and who's going after you. But uh I mean I can tell our experience. We've we've been actually recently we've been participating in quite a few bug bounty programs. And there is a difference between going after uh like programs you guys put up you know uh uh hacken proof and others versus just going after okay I just found the bug in this bridge and I'm going to see what happens. Um, I mean, our experience has been quite quite interesting, illuminating. What what what we see happening is, yeah, we get confirmations and then it's kind of a black box. You you have no idea when you're going to get paid out. Uh, your bugs get uh downgraded. It starts off with critical, oh, and now it's like a medium. Um, so yeah, I mean, the the structure is is uh really wobbly.

>> So, so it sounds like there's like a general trend that like Mitchell's pointed out of like, okay, this seems like it's getting worse. there's more market players entering, there's more pressure uh to maybe cow out to the customer that is the one that is running the bug bounty program or rather like putting up the money managing the protocol. So I guess like if if this is a trend we're seeing and there there's market forces pushing us in their direction like are there solutions on the table? I know there's been a few topics that we talked about earlier when we were talking about this panel like you know using ZKP sort of disclosures or uh finding other sort of disclosure mechanisms that are going to be uh potentially more open or give the security researchers more fairness beyond just trusting the system. Like is there anything that we could be

meaningfully implementing as an industry or as vendors that could push back on this trend? >> Well, I have lots of thoughts but I I'll bias it if I go first as a practitioner. I would love to hear what my colleagues think about this first. >> No pressure you guys. >> I can I can go first if you like. >> Yeah. As reporters like is there anything that would make you more comfortable reporting given the experiences so far? >> Yeah. I mean my take on this is that like maybe 40 50% of uh contests. I mean I'm not I'm not talking about I'm not talking about like existing bugs on on you know undeployed contracts but you know uh companies that are willing to participate in say a minifi program. Uh you can actually set up very explicit rules basically for for

uh invariant uh invariant uh an invariant bug bounty uh program where you have to deploy you as a protocol you deploy your contract on a test net uh and these are you know if you can prove uh you set up basic criteria if you can drain the contract if you can violate administrative privileges if you can violate in in a particular way uh governance voting um then you're guaranteed a payout. Just provide the the hash and and uh I'm not saying that's a silver bullet, but it's a fair it's it's a it's a math way of doing it.

It's not, you know, somebody's going to sit in the room and decide how much money we have to distribute whether we're going to do this at all. So I remember around uh 2019 and before there used to be these bug bounty programs where people would deploy the smart contracts on chain and also put in the funds but they would put you know just a little bit of funds you know like 100k or something like that and then they would explicitly say you know like um you if you manage to hack it you know that's basically your bounty and you know they allow it you know for a period of time.

It could work. But I guess the question is like is that a project that's going to have 100 million at some point and am I you know waiting on a longer which I guess it comes down to the the researcher having an incentive. I guess any other thoughts on this? >> It it doesn't have to be I mean it doesn't have to be on mainet right you can do this on on testn net and then have and not everything is about locked you know locked uh tokens. Uh there's lots of other interesting kind of bugs, but you know, if you define the criteria and and have a very explicit set of rules, then you there's there's real proof, right? Just just publish your transaction that that changed the state from one to another on the contract.

>> All right. Yeah, you you make you want to jump in. >> I'll make some comments. First of all, so that like that that idea is always fun like the kind of CTF approach. The challenge is when you're on the other side of that deal, you don't want anything on chain. You don't want anything visible to anybody else because you want to limit the damage. So you would never have like a copy of your contracts sitting somewhere of your copy of your main contract sitting on test net and be like, "Oh yeah, pone my test net contract." Because smart people are going to monitor that. And if they see that pwnage occurring, they're like, "Oh, okay. Time for me to make a move. Can I reverse engineer this into an attack of some kind?"

>> But you have you have real I mean you in your contest, you have you have projects doing new new projects. That's different. Contests don't have the same risks because you don't have the same, you know, assets on chain already live. It's it's for for mainet protocols where that function doesn't work. >> And as to the explicit rules thing, explicit rules work really really well. You know, the way Neville, you remember this, like the way we we traditionally tried to design our bug bounty programs is to cut as much of the verbiage as possible, as much of the legal ease, and have really simple explicit rules. And we've we've encoded things like, you know, weird things like privacy of impact or different responsible disclosure policies which are like kind of templated structures. You learn them

once, you now know how they apply across everywhere. They're as simple as possible. Projects don't get to define their own funky little rulings wherever possible. They have to choose something that's already pretty reasonable, that's reasonably fair, right, to the different parties. That works really, really well when you can do it. The challenge, one of the challenges that we see here is that more and more project well really other platforms are basically giving way and encouraging projects to set whatever terms they want. You know, I'm thinking of examples where they say literally, oh, and here are bounties, but we reserve the final right to describe, you know, to to to choose how much you get paid entirely as we want and if we don't agree with it, we're just not going to do it. And you have things like that, right? Total control effectively, which

makes it not a realistic commercial transaction. that kind of thing is is something that's being pushed in other places. Now, if we were to bring back if we as a as an industry or as security researchers as almost as a guild were to demand kind of these types of commercial transactions that would go a long way towards solving these problems. But at the end of the day, we need all parties like we need the platforms to be willing to balance the interests or at least you know champion the security researchers as well in order to enforce things. I I would take that even further and one of the things that we have been doing we have it's not been a one-way process right we have also been pushing against this erosion so for example you might have be familiar that we launched a unifi arbitration right we launched the

world's first court system only for onchain vulnerabilities that provides real legal teeth and global transnational enforcability for bug bounties on Immunifi okay and you have a bunch of programs dozens and dozens of programs where that happens right now but there's a catch this amazing thing It's the best legal protection in the history of bug bounties in the world. The catch is the projects have to agree to it first cuz it's a legal contract and it's hard to get them to agree to it, right? We can't do it alone. We need help to do that. We are driving it.

There's lots of upstanding projects that are agreeing to this. Like the ultimate and explicit rules is literally the program is a contract. We agree to be legally bound by it. we will go to arbitration that favors the security researcher and in that sense not in an abusive way but just in a way that they can afford to go as opposed to like a traditional court system where it'll cost 100 grand to go to court. You arbitration costs 5 to 10 feels like a lot of money but that's nothing in terms of being able to get some some justice for you. We have these kinds of things. There are other solutions that we're looking at at Immunifi to try and build more trust with the community, bring more transparency to the models, create uh a safer ways for projects to pay so that they don't have to strictly rely uh

on treasury assets or otherwise. But like that's the only way we're going to end up reversing that. We have to build trust by making the the by making the commercial terms reasonable for all the parties to make the transactions safe for all the parties and we can't just throw everything on chain because that makes the transactions unsafe right for many of the projects. We can't just say oh you know pone it and own it because of the way that blockchains inherently work. can't just say, "Oh, let's make them do, you know, interesting proofs."

Because not everybody's going to know how to do that. We're pushing even more work to the security researchers. That pushes even more risk. Why should the White Hats have to jump through so many hoops, right, to do this when they're trying to do what is good? Why are we making this the most painful possible process for them? Like, where is this this calculation? Unless unless they have legal protections on the commercial contract, why would they jump through all those hoops to do even more work? It's not very fair. So where do you see uh in terms of whitehead activity? Do you see it more in terms of contests or do you see more people just going out and looking at uh popular popular contracts and seeing if they can exploit it?

>> Definitely bug bounty programs and there's a big dist distinction between audit contests and competitions and bug bounties. You know audit competitions are typically much easier to do and they attract a lot of activity but they attract a different type of person than the people who do bug bounties. We have a lot more activity. we see on the bug bounties because you know we're running you know I don't know three to five audit competitions in any given month whereas we have hundreds and hundreds of of bounty programs that are running all the time so we see a lot more activity there and that's where we see these concerns but within that category right just to kind of draw the implication the security researchers are looking for signs of trust everybody's been burned people don't want to gamble 20 30 40

hours of their life hunting on a new codebase for a bunch of guys who are just going to screw them over. So even on Immunifi and we try to curate as best we can create those trust signals from Immunifi vaults from immunifi arbitration to encouraging uh responsible disclosure to encouraging more transparency around statistics never as much as we like but always more and more but these are the things that security researchers are looking for and correlate with hunting activity. Just to add on to that, I was speaking with a security researcher uh just today about sort of this topic and um you know, I think the thing that was most interesting to me just to contextualize all of this because there's a lot of I think us there's a lot of really critical innovation that has happened in the last couple years and is happening

around this. Um but you know they were contrasting this to the web two world you know the hacker ones of of the world and they switched off of you know web two bug bounties into web 3 for the reason that it was more transparent it was more clear what was going on behind the scenes less cloken and dagger you know um but you know they were still expressing to me that you know things have gotten hard harder you know and I think only in the last maybe two to three years you know max so I think that's the main thing that we need to kind of think about is like is adding more complexity you know going to make the problem better or is are we in this situation because of certain decisions you know and just I don't know come back

to first principles again >> well I I guess there's another question that kind brings us to another theme so there's complexity and there's also like how do we target the next wave of developers and applications that are coming online today so you know there's a question of like what's a good MVP for a bug bounty program as soon as you launch assuming you have very low TVL. Maybe you have a project that doesn't even impact TVL or you're an RWA where the security landscape is very different. You don't have something very complex but the security is is actually not as you know you're using existing ERC20 primitives and other things. So there's at least some expectation that the security risks are different. But at the end of the day, my question is uh you know, how do you give someone kind of a reasonable starting point for MVP,

but then how do you make sure that like as TVL scales, assuming it maybe happens in, you know, an unanticipated way or it could happen rapidly due to a successful month like how do you make sure that now they are scaling the incentives? Is that just doing it as a percentage of TVL? I know these are topics that have been discussed before, but given that they how things are changing now, um are is there like I don't know I can start with you Mitchell again, but is there a fresh take on this from anyone on you know how can we make sure that like as potentially institutional money comes online, we're scaling incentives without falling into this trap of becoming harmful to disclosure.

>> The challenge with starting with me is I have to deal with this stuff every day. So I have these, you know, in-depth complicated opinions. I hope they don't bias my colleagues. >> We can start at the other end. start at the other end >> cuz you guys are going to have really novel thoughts people want to hear about and then I'm going to come with the boring, you know, company side. >> Yeah, go ahead. >> Look, so I I have a few thoughts about this. So first of all, when you launching a bug bounty, you would probably already gone through a security audit and you've already sort of done all the security related things beforehand. So the bug bug bounty to me at least, it feels like almost like a last step, right? that you have that to basically catch all the bugs that you

know probably have either have been missed or maybe something else basically happened along throughout the all life cycle of the project right um but I don't think you should really assume that like oh as my TVL grows it's the security is becoming more important right you should always assume that I'm going to grow to the certain level of TVL at some point so I'm going to do my best to secure it as as well as I can right so obviously as TVL grows then the problem becomes the incentives right like you have But it's assume that you'll offer a little bit more. So maybe a percentage of actual [snorts] hack. If you can prove that you have a P that hey I can steal a million dollars from the protocol. There could be like you know 5% 10% bounty that like well we can actually pay for actual assets at risk

for example could be an idea. Yeah, that that would automatically scale, you know, something like, you know, 10% up till the first million and then like anything above that 1% or something like that because otherwise, you know, the bounty payment might be a little bit too much. Uh, at some point there were like a 10 million bounty payments as well. Um, those were the days. [laughter] We should also remember that, you know, there's fewer smart contract hacks. So the people who have been you know doing bug bounties now there's there's less uh vulnerabilities to find actually at this point uh because security auditing for instance uh has become more prevalent

you know people are doing like four or five audits whereas in like 2021 it used to be the case that big projects would release without any audit. Um you also asked about um you know other innovative things that we could do and maybe we should approach the subject on on ZK proofs and things like that but you know the problem with that is that um there's um you know we don't have currently a a a full ZKVM and that's kind of like what we will need to to prove those uh executions on on L1 for instance and on top of that there's you know many different um technologies and those will not have a way to prove uh using ZK

technology that that a hack actually can occur. So it's um it's going to be very expensive to implement those things unfortunately. And real quick, just to kind of add maybe a devil's advocate perspective of if I'm an early project and I I have a large bug bounty program and it doesn't scale effectively. Um, you know, that that payout might be a fair one, but it could also be, you know, life-changing money for the developer could also be company ruining money for me, which is probably where some of the pressure to not pay out comes from. Granted, some of it I'm sure is just company interest and greed, but that's maybe one consideration of like how do we make sure that like they're never in a position where they're basically they're they're capitalized well enough ahead of time that you know basically you're like

you don't launch a project unless you can afford to have an effective bug bounty program. But do you think do you think that uh latest trends uh are you essentially DeFi projects are putting up bug bounties purely for optics that it's essentially it's hey we're we're so secure we're willing to you know have this bug bounty program but it's just it's just a rubber it's it's just it doesn't mean anything right there they're there they're there it's just a way to uh market. >> Do you I mean I'm I'm kind of curious what uh Michael thinks about that. My name keeps changing. Sorry.

>> I have a thought. Okay. I I I have two thoughts. Like number one, well, and I want to touch on this point you just mentioned about not having enough money because it's a it's a red herring. It's a lie and we should burn it with fire. But we'll we'll get there. The first thing is okay um what should we be starting with? And the reality is if you're building in crypto, I think we're at the point where threat modeling from the beginning or from the time you begin to architecture your contracts and your product is part of the thing. And you should know or you can very easily go from threat model to ideal bug bounty program, you know, assuming set product has continuity from the very beginning.

Okay? And there's relatively simple models you can do like guarded launches and kind of scaling rewards with minimum caps in order to drive a good program. It's not that hard. In fact, we typically, I mean, you guys may have all seen, but a customer will come to Immunifi and our programs may well last, you know, 2 or 3 years before we need to make a sizable update if we do a good job. Of course, if they make substantial changes to the product that changes, but there are ways to do that so that they scale because the threat model that a particular protocol will have is unlikely to change materially in that time. Why? Because we're already operating at max difficulty. We say in the beginning of the threat model, assume North Koreans are going to try

and break into your stuff. You you're like, we don't have to guess about how severe it's going to be. It's max severity. Relax. Just assume the worst case. That's how we're going to start. And as a result, it becomes much much easier to build uh these protocols. Now, the challenge that you get, of course, is the financial concern, not not the oh, is it hard to build a program like as soon as you come to specialist at Amunifi, we basically abstract all of that problem for you if you let us. Okay. The challenge you get is, well, can I afford that? Oh my god, $100,000 for a bounty. Oh my god, that's so much money. What am I going to do? And you're right, it is too much money. But there's a way around that, which is the next logical evolution in buck bounties, which we is a step that we haven't taken

and it's something certainly we thought about for a long time that we've wanted to do. We haven't been able to take it yet for business reasons because the market has kind of pushed us in in a different direction obviously with the Unifi Magnus, but it's something I would love to do. I'm thinking about doing this year. I'm hopeful that I can with with all of you, my security colleagues, which is changing how we think of where critical, you know, funds at risk rewards come from. And the reason we need to do something like this is because the industry can actually absorb a much higher uh amount of security budget than you would think. The challenge is we're pulling, and this is more of a financial thing, we're pulling security spend from the wrong place.

We're pulling it from annual budgets. We're pulling it from security spend. But where should absolutely fatal, you know, perma death, you know, life-saving money to pay for a critical scenario, where should that come from? Should that come from the annual security budget? Is that the only place that we should let it go? That's very stupid, right? No. There's there's two other great locations that we can look at. Number one is we can look at the underlying equity or equity equivalent of a set project. Every project has its own tokens that it could be like hey look yes we can only afford 50 or 100k or like this but you know what else we can afford? We can afford 1% of tokens. We

can afford that. Would you like 1% of tokens if you protect us? That's better than nothing. That's better than a lot of things. I see some shaking of the heads. You guys may laugh. >> Bug bounty. You all want to take in tokens just only tokens. You say that, but if you had a a case where I don't know um a layer 1 blockchain, layer two blockchain or a big DeFi protocol would offer 20 million instead of 2 million on their bounty, but the rest of it is payable in liquid tokens which are trading on large exchanges. I think you would take that deal in a heartbeat and suddenly their ability to offer a compelling incentive is massive. It's not 10x massive because you're still going to discount the token value, but it's much more than one or 2x. like it's very meaningful to be able to get okay

I'll get $2 million in cash and $18 million in a liquid tradable token and they can be able to to provide a much more compelling security incentive and that lightens the burden on their treasury significantly that's meaningful as long as you can trust the amount that's one thing the other thing is well we can go why can't we access underlying TVL right it's not as if these these token uh depositors don't know the risks that they're taking wouldn't they prefer prefer to be able to take a haircut on their losses versus, you know, basically abandon themselves in the in the security market to their fates to the wolves because the project doesn't feel like they have enough budget to pay. And in my view, having talked to many investors in the industry, this is a

trade that they would happily take, but they're not even given the option because most protocol teams don't even imagine how this can be done. These are two things that we can do that will dramatically change this question and eliminate this budgetary issue to the security researchers. White hats will still complain cuz they're like, "But I like cash, not equity." But look guys, you know, we can offer 10 times as many rewards in equity and and ultimately, you know, depositor funds in some form if we can come to the right social arrangement that all of us can agree upon. But cash is always harder to get.

What do you want to do? >> I don't know. Would I want to publish a security issue about something I now have equity in? That's a tough one. It might affect the value of my payout. >> Yeah. I don't know if I can add much more from uh what Mitchell said, but um I think the one thing that I was thinking about with this was how I I don't think TVL necessarily is the right metric, but I think some level of the maturity of a project uh should correspond to kind of the incentives for security researchers. And I think I I like what Mitchell said about like, you know, thinking about the threat model and thinking about sort of um what is, you know, there's the worst case scenario, but I think also we should be

thinking about sort of not just like, okay, I need to do a bug bounty program. What is the, you know, appropriate amount I should be putting into this? I think it should really be coming down to, okay, I have these problems, you know, that I'm going to be launching. How do I uh you know make sure that there's a trust and security around this project? And it's not just you know my smart contracts. It's also you know my team making sure that they are secure that we're have the right operational security the right measures in place. We know who to call you know we have the right lines of communication. These are all part of that you know that security budget that the the organization is

putting together. So 100% I think that security budget should increase. Now I don't know if this should be in some form of a tokens or something like that but I do think that at the very minimum we should take away is that that minimum bar for every project that's launching should be thinking about all these things and not kind of just wrap them all up in one solution. Well, and speaking of security budget, I want to give time for folks here who are focused on projects that are actually like providing tooling to hopefully prevent an incident or prevent uh bug bounties from needing to be paid out that are detecting issues either pre- or postp prod. So, for those of you at uh chain patrol at failsafe, like what are some of the ways that you help try to prove value? Because at the end of the day, uh

you're a line item and maybe things are going well, there's no bugs detected. Uh is that a is that just because the team's doing really well? Are they getting value out of your product? So I'm just curious how you approach that same uh you know budgetary question when you're talking to teams and saying like this is why the tool is valuable even if maybe there's not an incident that proves it. >> Yeah, I think um a a lot of cases for us we come to projects uh you know as soon as they have sort of a name in the in in the space like uh or a social media account or whatever it might be like just for context like um chain patrol we're focused on mostly brand protection and off-chain monitoring. What that what I mean by that is like everyone on your team your your social accounts your uh

your website is a target from the social layer to be attacked. People are going to create fake websites, fake social social media profiles, fake support pages to try to convince people like, "Hey, we launched, you know, like here's the you missed the first airdrop. Here's the second one." You know, like get get on board. Here's your chance. And uh, you know, these are all using drainer kits and all sorts of things to steal people's funds. But you know going back to your question I think uh when we talked to a lot of uh companies in the space a lot of uh chains and D5 protocols you know maybe 2 3 years ago when we started the company there was not a lot of we got a lot of like

question marks and quizzical looks when we said hey we're doing security in the space you know it was like oh are you doing audits no are you doing you know smart contract security are you doing bug bounty programs no like are you guys security or what are you guys doing here? So that has changed in the last 2 or 3 years. Now when we go and talk to people, they already have confronted this problem. Uh and it's often not who you think that that's seeing this. It's it's the heads of marketing, not necessarily just the heads of security. >> Okay. So it's it's something that maybe have you ever been paid from a marketing budget?

>> Yes. >> Okay. Then you go after other budgets is maybe one of the answers. >> We go after you know people who are feeling the problem the most. people understand who it's affecting, who's stands to lose. uh that's kind of who we talk to and you know oftentimes in organizations that's founders like every time I talk to someone if I can talk to a founder this is something that they care about and I think that's kind of what uh we should ask is like who is in the organization is the one who uh stands the most to lose from that and that's how you can talk to about okay what is the right price to pay for this service or what is the right uh time to initiate this >> and so all right Neville from a like security monitoring perspective curious

Yeah, I mean our experience has been that uh just in terms of budgets uh folks are much more willing to spend money on on audits uh than monitoring. It's just that's just the truth. Uh and we do we do we focused a lot on audits uh and been quite successful at that. Um it's just like any other like if you forget about web three just I mean I spent like my entire majority of my of my uh working life uh in in uh at Microsoft at Google uh Grab other big companies and selling security infrastructure is always hard um and uh you know uh especially with something like I mean I think monitoring uh is one of the least friction uh kind of a

product that you can possibly have um but you know you have monitoring and then what so you you basically okay so a transaction happened uh and then the next step is like true integration where uh you detected anomalous behavior and then you trigger an automatic pause that I mean that's an investment it's it's a great defense and depth mechanism u but uh you know the same sort of friction that I have seen throughout you know throughout my career in web two in terms of spending Uh even you know I I see to even to a greater extent here that that's Yeah.

>> All right. Uh well I know we're near the end of time. Do we have any rollover time? We're the last event. >> I'm looking at you. >> Are we Are we the last? >> We are the last. >> Oh yeah. Okay. Perfect. Okay. Yeah. Sweet. All right. Neville, do you have anything? >> Oh yeah. They until they kick us out, we can keep going. Okay. Neville, do you have anything to add? >> Sure. Yeah. So, uh, you know, this this discussion about, you know, white hats becoming blackheads, something like that, it's it's not as clear-cut as that. Um, really what's going to happen is is more white heads become disincentivized.

And actually, the white hats and blackheads, you know, they can be white hats on one day and blackheads on another day. And you know, occasionally I come to conferences like this, like DSS, and I might meet some guy who tells me, "Hey, I use your decompiler to hack an MVOT." And I'm like, I didn't need to know. [laughter] Like, I I don't want to know. So, you know, the the the blackheads are actually coming to security conferences, too, right? I mean, that's why they're they're good at it. And I know of um cases in which like people at security companies have been caught hacking um projects as well. So this is real

unfortunately. >> Anything adm? >> Yeah, I feel like with the white hats and black hats, it really comes down to the ethics of an individual, right? So um sometimes black hats are not really caring about money. They just want street credit, right? They just want to feel like they they're the best, right? So um and then on the other side as you said white hats um obviously they want to do the best for the greater good for the protocol also you know try to make some money if they if they can be incentivized by it um but there's always both sides right so it all comes down to I feel like it comes up to an individual but also I guess the situation like >> I can give a spicy take >> one more spicy take to finish us off.

>> Okay well don't we have questions? No no question >> we can take questions. Yeah we probably have time for that. Let me go. >> We are absolutely creating more black hats these days than we used to. No question. Now, it's not entirely our fault. Yes, these like underhanded, you know, short-termist greedy little things I see from some players in the industry, which really annoy me. Uh I have no respect for it whatsoever, I think are really creating problems and creating more black hats out of some of my peers. But a lot of it, the one big challenge is we face this downward pressure that comes from the financialization of crypto. The reality is the more we win, the more we're going to become Wall Street 2.0. And the more that happens,

the more we adopt financial culture. So crypto itself is becoming a more PvP, a more predatory environment, a more extractive environment. Now historically security has been really one of the safe havens where I feel like along with like underlying protocol development we attract the greatest people you know some of the most brilliant some of the most beautiful some of the most noble people in the space who really want to contribute to something larger and are not not not strictly here for for the commercial returns. But as the space becomes more and more financialized, and as the money gets bigger and bigger, and as you look around and you see those some some suspicious people doing suspicious things, getting suspiciously rich, you can't help but be bothered by

that, right? Meanwhile, you're like, you know, you're hauling ass to protect the industry and get access to that line item in the security budget, and you're like, okay, this is this is an interesting thing. I'm not sure I like it. And this is happening more and more and more and more and more and it's creating more and more and more black hats is people like well where's my my cut of that pie? I created value too. The only protection against this is the security community really coming together and pushing a very specific value set along with the incentives and economic support that make this fall into gray hat and black hat behavior not necessary. And to be fair, over the last five or six years, we've done a great job. We've been winning that war. We've

created amazing opportunities across the security stack. But I think over the last 1 to two years, that's been beginning to slip. Okay? Now, it's trending in the opposite direction. Now, we don't just have to worry about APS and and and North Koreans and like weird hacker gangs from Eastern Europe or increasingly other countries. I've seen records of a number of other countries, you know, getting in on the game. Now, we also have to worry about people just getting so jaded by the financialization of crypto, which is inevitable. It cannot be stopped, right? That's the price of victory. We're going to win, but that means we're going to become financialized in the process. You know, can we can we push back on that enough?

If we don't, the pace of black hatification, so to speak, which is really just everybody becoming gray hats and prioritizing their commercial self-interest, right? It's not, you know, being evil or anything. It's just like, well, I want to make money, too, and why should I make some sus, you know, protocol run by suspicious people? Why why let them make all the money? They're going to screw me anyways. I'll make some money, too, and I'll send whatever amount of money I want back if I feel like it, right? That's how people are going to think about it. The only way to deal with that is to push back at this level at places like this and to create these meaningful incentives and and good and safe ways to contribute and be rewarded for doing good. If that keeps slipping, we're going to keep slipping on this question.

>> All right, with that, do we have time for one or two questions? Nope. All right. Okay, we'll do one. Thank you. Thank you. I love the passion that Mitchell speaks about this subject. Um, can you perhaps tell us a bit more about safe harbor and how it can directly incentivize white hats to essentially do the right thing? And back to your point of socializing the uh bounty payout through TVL. Is that perhaps the best solution that we have today? And how can we maybe drive more adoption?

>> Sure. So for those of you guys who don't know, safe harbor is this wonderful legal instrument that we use. It was created by Seal and an alliance of security firms uh with its first successful application during the balancer hack which is a big moment the validation of this technology to protect millions upon millions of dollars in people around the world. Now the challenge so so there is real innovation that has been going on over the last few years to improve onchain defense via bug bounty like mechanisms. Safe Harbor is one of those and it's exactly the kind of thing right the Immunifi the original kind of bug bounties that we designed were it's a social legal standard because this is the kind of thing that

works at the incentive layer right social legal conventions not necessarily code right not necessarily tech social technology is what you could call it but not that much more than that and what Safe Harbor allows you to do is if there's live funds at risk if you can know validate that funds are being stolen from a protocol right now, then that protocol has preemptively given every one of you in the crowd here permission to hack them in order to save those funds and return them within 24 hours to a safe address. Okay? And that is a really that is a a a new layer of the stack, right? A new last line of defense that we just didn't have before and now we see it working with the

balancer case right now. So that's that's a really big deal. Like just because we're under some pressures with the financialization of crypto, just because these difficult incentives are kind of squeezing us a little bit doesn't mean we're not continuing to innovate as an industry and create more and more ways to do good. This provides every monitoring player, for example, a chance to jump in if they see a vulnerability like this, steal the money to save it, and ultimately be comped for it. Because in many of these cases, the safe harbor is comping at a the same rate as the bug bounty on a scaling basis, which could be well well be 10%.

>> Sometimes with the 1 million, >> that's definitely not true because I run safe harbors with bigger rewards than that. >> There are more, but different philosophies in different places. Whatever, we're innovating on it and it's really working. Safe Harbor is amazing. >> Cool. Thanks, guys. Um, so an inherent characteristic of decentralization in a world where you can hard be at a computer is you're going to have black hats, right, that are going to want to steal money. Um, do you not think we should be putting a lot more focus on stopping or incentivizing white hats?

Because the more you incentivize white hats to do what they do best, naturally there's going to be less for black hats to steal. Um, so that's a really good point. The safe harbor thing is really great. I'd love to hear from your guys' minds. What are other ways other than money that we can incentivize? Because a lot of people are doing it for reputation as well, white hats as well. We we glamorize black hats, but we don't seem to do the same thing for for white hats. Um, so I'd love to hear your guys thoughts on other ways we can incentivize white hats. So one way to incentivize white hats which is quite simple really is you know if there's a bug that is found and it's fixed you know they should also publish it you

know and say you know this is the bug that this guy has found you know this is why it worked um basically a postmortem without an actual you know the the vulnerability being triggered and that you know is to the satisfaction of probably most of these white hats because they want to promote, you know, their own personal um, you know, technical capabilities with with the rest of the world as well. >> Thank you. >> Do is that it guys? I mean, I got stuff.

I do all sorts of stuff like this already, but you guys, come on. We He's offering you a chance. What do you want? What do you want for doing more good things? >> The EF leader board is good. >> The EF leaderboard. Okay, that's not bad. Do you have a thought, Omar? Yeah, I think like I think there's a social going back to like the social layer a little bit. I think there is some more that could be done in the community about highlighting sort of white hats work. Um I think a lot of the kind of we have these protocols with huge you know followings and communities discords you know exclusive kind of perks and accesses. I haven't really heard of anything for white hats in that regard, like nothing other than, you know,

conferences like this where we all come to come together and talk about the work that's been done. I don't really see any incentivization at the social layer for them. I' I'd like to see some something happen there. I can make a comment there. So, at at Immunifi, we've been doing this since the beginning. You know, my pitch to the security researcher community to white hats ever, well, pre-white hats, I should say, right? you know, cuz we have to see if they're going to do the deed. Uh has always been let me, you know, make you get I let me get you paid real money, nice money, but also I'll make you famous. I'll create a career path for you for you to do good. And if you look at security researchers, if you look at Immunifi's leaderboard, tons of

these guys have launched full-on security careers, okay, on the back of their Immunifi bug hunting activity. And we try as much as we can to support that. We built more and more career tracks. So, not only are we trying to glorify people, I mean, we every single week we are tweeting about it. We are posting about it. We are showing the wins of the community. We're trying to draw attention to their good deeds. We write bug fix reviews on why people's uh acts ended up being impactful to the community in addition to the technical write-ups because people always want to see both. Uh, and we try to help them however we can. And more and more now that we have a broader product stack, things like PR reviews and auto competitions and the like, we also try to provide more stability because that is an an inquantifiable

value prop to them to be able to just like trust that tomorrow is going to be okay because otherwise bug bounty stuff is really volatile. Now these are all well and good but they they the challenge is they stop at the limit of immunifi, right? So our ability to to interact and engage on the social layer is limited by the borders of our domain. We try to engage with other people to do that. But of course all the the platforms are in competition with each other, right? it doesn't it's doesn't make that much sense for us to cooperate and uh at the level of the kind of L1 L2 layer you know at the level of kind of the ecosystem layer generally they haven't really some of them are are proactive about building security communities but most of them not so much

you know the market kind of takes it for granted and makes a a cold commercial decision so we haven't received the kind of higher level support I mean most of my customers which are you know forward-thinking projects in my view amongst the best in the industry, all the best ones will use Immunifi, shamelessly. But, uh, what can I say, guys? It is what it is. But, you know, they're they're coming at us saying like, "Look, Mitchell, why don't you deal with this? We want you to deal with this. We specifically don't want to deal with this ourselves. We're busy growing our business. We only have so much effort and resources we can push around." So, it's not really that easy to do, you know? And I can't also just say like, "Oh, well, why don't why don't all of Ethereum cooperate?" Well, we have lots

of non-thereum customers too, right? And they'll be like, well, do we want to glorify those white hats, too? So there's no easy kumbaya solution in this environment of market economies. Our best luck for coordinating that is oddly enough with institutions like SEAL or the security alliance because that proves us even though we're all kind of co-op editors in so many ways that gives us a a space to bring around and unite in a common set of values which includes glorifying one another and giving each other access to new opportunities. That's how that's how we met for example. Would you consider extending credit line? [laughter] >> All right.

>> I'm sorry to interrupt you. >> Yeah, it's okay. They're gonna kick us out soon. So, all right. Thank you everyone for sticking around. The lights are turning on. DSS is over. Thank you everyone. [applause]