White Hat Hacking Discussion

Transcript

guys do you want to pop up for the the panel here and and Sam can you can you hear us yes all right oh we can see it yeah yeah that's it [Music] I'm sure the audience has a bunch of questions I might just kick it off with with one that actually has been top of mind for me a lot is we talk a lot about like D5 mechanism security smart contract security but if you look at a lot of the biggest hacks have been operational security misses like private Keys getting hacked like DNS getting getting hacked and and front ends being rerouted

um how do you guys think about advice for teams building here to like make sure that part of their security stack is taken care of and as is there any advice you have I'll try to start obviously as you mentioned security is a wolf thing uh we just discussed about how you uh you know approach contracts and whatever but yeah in reality we saw recently you know core when many others as he is with DNS and so on so the uh I think that there is no single solution for that uh what you have to do is you have to monitor more I think that one of the also convex if I remember correctly

with Sam we manage the the easy over there um there was a poisoning attack so tedious you should use the best practices also for protecting web 2 infrastructure especially front-end and DNS but again you have to monitor so you have to look if everything is going to change you have to apply also Security on you know all your code base checking the dependencies so there are plenty of solutions that you have to um to to do my uh my only consideration is that for all those problems there are already Solutions because our web 2 issues so you don't have to reinvent the

well you have just to check how you would protect a traditional part of the web to infrastructure but obviously uh I think that Sam uh oh no you mentioned in the in the slide uh showed there are plenty of young themes and maybe you have to deliver so so fast that you maybe forgot those things and I suggest that as soon as you launch you have to look also on those things if you cannot afford at the very first I'll take a shot because this is actually a question we thought about at a Minify from you know before day one we and we found this particular method to

be very effective which is to do threat modeling as early as you possibly can ideally from the very start so in our business we knew that there was going to be a lot of sensitivity you know we're handling very sensitive Secrets very sensitive workflows and it was going to be an important part of what we were building to do it in such a way that it maximized security and so we modeled out okay well you know what kind of operation are we creating if things go well you know what kind of infrastructure are we likely to have you know just just Loosely because you don't have time too much time to waste on that what are the likely vulnerabilities who's going to want to come after us what are they going to be trying to get how is that going to work and by doing

that exercise very early on and then repeating that exercise every few months you know where our assumptions correct we our mind was constantly pulled towards operational Security in a much more comprehensive way than strictly looking at on-chain infrastructure and that has propelled itself even to today and worked its way into our culture every single you know all hands every single Major meeting we're talking about fishing we're talking about scams we're talking about different kinds of breaches that can occur it's just kind of worked our way to be like hey let's be obsessive about this and we know any team in the space is not going to have the resources to even go after best practices so saying oh well why don't you solve this why don't you work on it it's just that's not really an option especially for a younger team but even for a larger team like there's there's

too many different workflows there's too many things you don't know you know your best option if you have infinite money is to hire a lot of people for it but then you hired a lot of people for it you know new problems uh that what we did at least for us is like we're thinking about it all the time we're thinking about what our threat model is and we start trashing it okay what's the most probable area that someone's going to come after us where's our Central vulnerability today what's Best Practices today who do we know that can answer this question today in case we don't have the expertise in-house and this allowed us to cover a lot of those operational areas and eventually help other teams with that in a way that we saw as very uncommon so culture I guess threat modeling early

culture making that a repeating and early process is the kind of the only way we think to constantly level up your operational security as you grow Sam did you did you have any thoughts on that uh could you repeat the question again sorry mostly about uh how to also beef up the operational security side of the protocols like because there's just a lot of like unglamorous attacks like you know DNS Security even just Discord hacks where the community gets gets rugged yeah well I mean I think a lot a lot of that comes down to you know just that's right like making sure you use 2fa

making sure that you know you don't you know click untrusted links you don't install it like what's that one big Discord attack that went around like you you clicked on this bookmarklet right and that like executed some JavaScript that like expelled your token and so like a lot of this like what two Optics stuff is just using or like that screensaver one right uh where it's like you get this DM and it's like oh like please test my game and it's like this archive and there's a screensaver file that like executes some code um yeah I think a lot of this is just like you know having good digital hygiene uh obviously if you get hit by some ode or if you get hit somebody like DNS cash poisoning attack like there wasn't much you could do to stop that it's like you know try your best but like don't don't sweat

over it but like yeah everything else just don't don't be silly in line great thank you great thanks um looking forward like two to three years do you guys think there's any sort of security silver bullets that you're excited about like that can redefine the space that's spicy I like to think that you know what we're building when it gets to a scale that is 10 to 100 times larger than today will be the closest thing to do that but I don't really believe in silver bullets like this my vibe about it is the same way I look at operational security like the attack surface is too vast there are too many problems there's too much value on the line their security is is a loser's game and

it's a critical one and we have to play it but there's no I don't foresee any any great solution that will you know change turn the tables in our favor in a big way other than the continuing work on a whole bunch of different layers of the stack by a bunch of brilliant people in parallel and that's that's what I'm hoping for and that's what I like to encourage yeah my hope in this sense is that security start to switch from a cost from uh any group any protocol to more an investment and becomes part of the culture of the developers as we had with the devops basically so where people don't just dabble of things but also

maintain on production and so here the idea is that if we are able to provide a way a sustainable and a cost-effective way for people to embed security at first uh that for me would be a a very good achievement so I think that with these kind of events and companies working on pushing about adopting security parties and building more effective tools embedding maybe hiding security uh is is is the best Sam any thoughts from here well I think just that I don't believe there's going to be you know one Silver

Bullet like Mitchell says you know this is definitely not like if you're in this game to sort of like get out into yours because you've like found the Holy Grail of security I think that's probably the wrong mindset um but other than that I would agree with what everyone already said great maybe one more that is uh we lost him now we're connectivity Jesus he keeps escaping from us um well I'll keep it going until he can reconnect um you know emiliana you touched on this a little bit with the big red button and the tension between having the ability to pause contracts and immutability and how do you how do you think about

that moving forward especially with maybe regulatory concerns about the ability to stop contracts is that is the goal like we don't have a big red button in in five years once your contract is fully deployed bug free hopefully let me check first if there is someone in the audience that can listen to me no um yeah I mean um that's a very hard decision for any team I talked with team that want to have some degree of control to protect their users and many others that instead want to say we cannot do anything so that's the code that's the rule so if you accept that's a risk

so uh I think that there is always a trade-off especially if you see big players like you know compound Ave but also yearn they have some degree of control I think that the challenge here is how you can get the minimum amount of control to limit the maximum loss that you may have and not having access to the user funds so in one of the examples that's why it's an example I say that the governance can access to the funds and move somewhere else obviously that will drive many regulatory concerns because you can effectively access to those funds but if you write the context in a

way that those funds maybe get moved to in a specific Vault that will be getting controlled by the token orders or whatever maybe could correct so I think that the challenge here is that how I can design the security operations in a way that I can guide the protocol in a safe way without you know Rising regulatory concerns so that's the that's the challenge and that's a good challenge honestly great yeah let's do it yeah this is a bug Bounty question and the question is do you think a bug Bounty can get so big it actually can create perverse incentives and to give a motivating example let's say I'm I'm a

protocol Dev and there's a 10 million dollar bounty on my protocol and I realize oh no oops I've accidentally uh shipped the bug but I can call up my you know my good gray hat friend to report through a back Channel he'll claim the Bounty will will split that you know down the middle or whatever we think is fair and you know run off with the money so you know just with that example do you think there's potential for that sort of person incentive then how can it be unrest absolutely there's a that's a definite risk in doing this the only way to address that is you know where effort should be going first is monitoring your developer Pipeline and you know before you go and you put a massive reward up which comes with all these potential risks right it's an incredibly

useful tool but it comes with risks all those risks can be addressed by making deeper investments into your culture into your Dev pipeline into your code review process first right into your hiring and selection process like that's where your money and energy should go before then if you don't make those those if you don't address those things then uh there are you're just blind to to what degree you have like many of us now I'm going to know we've never actually observed such a case so we've thought about it from the beginning hypothetically it's on our list of things to watch for like when will this scenario appear and what are the potential markers for it and it's never occurred in so far as we can tell

we'll be hard to see but it's never occurred but uh you know easy to easy to deal with bug Bounty is the last line of defense not the first one invest in everything else first pretty good question how how is Buck Bounty programs for web 3 world are different from web2 like I'm not sure we can do like full disclosure about the bug or something like that uh so we use the same name uh and that was like a practical business decision but in operation they are very materially different especially for the work that we do on immunify so for one thing the kind of contractual stance between the parties is completely different on traditional web 2 you know

a lawyer writes the program and then maybe a lawyer receives the report or interacts with it in some way and like they're they're set you up so that they have maximum protection but in web 3 the opposite is an inherent reality like the fact that this person has a critical vulnerability means that they already have power over you and it's not your call it's not your decision you you don't have as many options you don't get to control this situation and so that changes the entirety of how the programs are structured which is where a lot of our attention goes it's very unsexy unappreciated part of the work but we just like we hit the programs and we optimize optimize optimize them to solve certain problems and it comes down to like well if we treat these parties equal parties that each have power over

one another what does that look like that looks like clear expectation setting that looks like very clearly defined functions for dealing with common edge cases and that's that is the total opposite of how bug Bounty programs in web 2 are today where the companies will preserve the maximum flexibility to basically do whatever they want so that's a really big difference and that is felt by the way right like there's a lot more tension in these reports they are more uh and it contributes to the difficulty of running this type of operation and running these types of reports there's a lot more tension in the transaction because at any point even though the White House shown his good faith by disclosing the information right and really cutting down his leverage hypothetically until

the fix is in he can't execute that whenever he wants right and the projects feel that tension and it's like so that is a really big big difference we have some of that in the web too but in web3 it's like every every other major transaction is like that so we are constantly doing mediations to like calm people down it's a much more equal playing field and it's becoming more in favor of uh hackers over time not less right something that we have to address hey um two things one is I just wanted to make a comment about that good question about if developers could potentially exploit bug bounties and I'm curious if you agree this is true or not in a lot of other Industries they have

this problem as well that if you're in banking or other things if it's ever a point where you solely have the ability to commit a crime then it's a mistake in the system so there's this idea is just as long as there's you know sort of two or three people who are kind of checking each other once you get to a point where it forces a conspiracy of people to come together to commit a crime it's much less likely to happen because people just fundamentally have this prisoner's dilemma they don't trust each other so it's like what you're saying developers pipeline but a little differently just saying make sure that people know there's other people checking their work and once you have that it's very hard to like feel safe that you can slip something through is that a reasonable better answer than mine okay all right

um the other thing I was going to say was when it comes on the user side you guys didn't talk about a lot but it seems to me like a lot of the user side of the security threshold is really about the ux and how much safety wraps around the user in their wallet experience in their web 2 interface and some level of like either educating users if they want to kind of go off the rails and run things themselves or give them some version of safety five where they basically are kind of curated through the experience and somebody warns them like you should not be looking your private key you should not be doing this type of transaction if you know somebody got you to this point doing this you know call up customer service because something's going wrong so it just seems like that's a a very

big threshold on the security side is you know thinking about how to basically protect users who typically are just either apathetic or ignorant or some combination of them when it comes to security but that's most of them yeah I mean it's I I feel like you know I'm I hope I'm smart but when it comes to security I feel very stupid honestly so I really like the idea of this disclosure flywheel what do you think is the appropriate ratio between payouts for white hat reporting and value at risk so before I give an answer I really want to hear Sam and Emiliano's answers as

white hats who have done so much for the space and been on the receiving end of this case so stakeholders right what's your answer [Music] same first please oh God wait sorry was this the was this the last person I don't think I actually got what the question was uh uh Dan is asking a firm about uh what's the threshold between uh the uh payout for bounties and the value at freeze for a protocol basically oh yeah I mean obviously you know at if if you're like the white hat you know

never go up is better but I think like the current you know the current matter of like 10 is pretty good right it's like it seems like a pretty good compromise between not you know sniffing the the white hat hacker on you know a big payout and also not being so big guys because I I make this point A lot of times whenever this this conversation comes up it's like you know you have to keep in that keep in mind that for a lot of protocols so not a value at risk it's not like their money right it's not the protocol's money to actually go and give away and so I think like 10 seems like a pretty good balance between like a number that's big enough that it doesn't you know stiff the white hat but also it's small enough that it might not you

know like put the project into bankruptcy because they can actually afford that percent of TPL yeah yeah I agree totally with what Sam said just to add I think that the Eden uh rule uh was that you know you have to pay at least you know 10 of the video tourists that you have in general but I think that as soon as you grow becomes you know unsustainable I think that back bounties fits in one of the solutions that you may have for protecting your protocol we see the rise of insurances that can help you to multiply let's say uh the protection that you may have we start to see reinsurance programs that try to help on

on coverage uh but I I think that we we should stay on those let's say amounts so something between one and ten percent depending on the on the scale that you that you have but at some point there should be a plateau let's say at fix it absolute amount otherwise would be totally unsustainable let me give an answer there because I have an unusual perspective so I'm the guy who came up with the whole 10 model right and uh my primary thought there originally when coming up with it was not that it's correct like it's a very primitive mechanism of price Discovery uh it's just that it feels fair and that's where we should start because the

rewards are so mediocre that we had no bug Bounty expertise or Tooling in the space we just didn't reward it at all so we need to start with something that's reasonable uh which was the 10 number it feels fair and it's good and it's enough given the money at risk but as I've seen more and more cases at least for me my thinking is evolving and I'm thinking at new price Discovery mechanisms like my problem is I need the bounties to be large enough to disincentivize to provide an effective alternative to black hat Behavior but they have to be small enough that they're not going to bankrupt the projects they have to be reasonable enough the capital sources have to be right it has to feel fair for all parties around so that it's long-term sustainable so what's the price Discovery mechanism what's the

algorithm that I use to figure that out and one of the conclusions that I'm coming to is that the 10 model is a great base right it's given us lots of valuable Market data it really works but we can get a lot finer on that for solving different classes of security problems by providing different pricing mechanisms and like I want to go in that direction I'm work that's my spare time right there how do I find better ways that are more matched that make the white hat hopefully even more money but at the same time are much safer for the projects to employ whereas the current model today has some serious costs so I think in one year I'm going to have a much better answer that is going to be different than the 10 percent thank you to all the presenters uh we're gonna have a break now

um you know if you can yeah thank you