The White Hat Safe Harbor: A deep dive in protecting white hat rescue ops

Transcript

All right. Hello, everyone. Welcome to the last uh little Seal presentation here. Um as you just heard, this is about white hat safe harbor. Um two of us are actually last-minute replacements, so that should make this a bit more interesting. And we're just going to go ahead and do a quick round of introductions. Um I'll break the ice. Um I'm Kurt Berry, he/him. Um my few I have a few affiliations. I'm with Seal. I'm a Spearbit lead security researcher. Um and I spent 4 years with MakerDAO as a protocol dev, uh where I was involved in some of the early safe harbor discussions, in fact.

Robert? So, I'm Robert. Um I'm co-leading Safe Harbor initiative at Seal, and then I'm co-founding Scytalk, which is another security startup that operates under the Safe Harbor agreement. Hey, I'm Charm. I do legal and operations in the crypto space. I helped get Seal and the Safe Harbor off the ground. And I currently work with a Maker ecosystem actor. Hey, everybody. Uh my name is Kurt Opsahl. I am a associate general counsel for cybersecurity and civil liberties policy with the Filecoin Foundation. I'm also uh on the board of the Security Researchers Legal Defense Fund. And uh prior to Filecoin, I was working at the Electronic Frontier Foundation,

uh where I was there for uh close to 20 years, uh working on the Coder's Rights Project, uh trying to uh help defend uh security researchers when they got into trouble for their good faith security research. All right. Oh yeah. So, let's kick things off. Um Charm, uh what is white hat safe harbor? Yeah, uh so the white hat safe harbor is a legal framework that can be deployed for protocols that might come under hacks, what we call exploits. And if during an exploit uh white hats swoops in uh acts in line with the ethics and terms that are stipulated within that legal

framework then uh we essentially provide a best efforts like to the max uh legal protection uh excuse me, liability protection and uh probability of reward for their their awesome work in saving funds. And that's exactly what we're trying to encourage with it. All right. Yeah, next question for all the panelists. Um what brought you into helping with this and what interests or background made you uniquely qualified to give that help?

I mean Hudson, who isn't here right now but is originally a panelist, is who brought me into this. Um I was working on on Skynet, which is my startup originally, and we were trying to find a way where we could if we detected a vulnerability that was in the mempool, we could reverse engineer that vulnerability execute it ourselves front running the hacker and then save the protocol funds. And we wanted to try and craft a legal document that would actually let us do that without it being theft. And Hudson gave me access to one of the very early versions of Safe Harbor, I think 3.01, although I might be wrong about that.

Um and then I've been helping out on and off ever since. Uh yeah. Uh 3.01, we're on like seven now. That's impressive. The versions have ballooned. I imagine that Gabe is not happy about that. Um so I came in actually under Gabe Shapiro, who is co-founder and most prominent architect of the Safe Harbor framework. Uh Uh, at the time I I was working with this other entity, Lex Punq. Uh, and uh, Seal saw what I was doing and was like, "Can you Can you help carry this?" And it was absolutely my pleasure. And uh, yeah,

that's that's what I've been doing with it, just helping flesh it out and get it ready to present to you all. These guys have been incredible. They've donated hundreds, perhaps thousands of hours just to fixing the legal agreement and to building it and to creating all of the things that need to be done in order for it to work and to protect white hats. It's It's a community effort. It's incredible. Yeah, so I got into this space uh, defending defending hackers, defending security researchers. Uh, and this is about a commitment that finding vulnerabilities, fixing those vulnerabilities requires having good security research and requires a legal environment in which someone can conduct that research, find the vulnerabilities, talk about the vulnerabilities

to get the problem solved. And we don't want to have legal constraints, whether it be civil lawsuits or criminal charges, to get in the way of making a more secure world. And unfortunately, there's a lot of times where either uh, you know, they the companies uh, involved, a vendor doesn't want their vulnerabilities to be exposed and they threaten or even uh, go after a security researcher for what they have found. There are times when prosecutors want to make a name for themselves and show how tough they are on hackers, but instead of going after bad faith actors, they find uh, a good faith actor cuz they're easier to find and uh, can try to cause trouble, trying to cause interpretations of the law even when they're going after

a bad hackers that will have uh, ramifications for a good faith actor. So, trying to ensure the space so we can have stronger security, find, fix vulnerabilities. Yeah, and I'll add that I was brought into the early safe harbor discussions to represent the sort of DeFi protocol side of things um, because you know, ultimately uh we want to make DeFi and other crypto protocols safer, um but you know, protocol's not going to add something that they worry could have potential negative edge case impacts.

And so, you know, I was I came on and, you know, made sure that it was something that protocols would be happy to adopt. And kind of on that note, um I'll I'll open this kind of up to all the panelists um to explain, you know, how does White Hat Safe Harbor work at a high level? Um why do we need it? Um and who is it protecting? Um so, I don't know to say why we need it. Um maybe maybe Kurt, you want to take that aspect. Why Why do we need it? Well, uh like at one level, a key aspect of any sort of anti-uh hacking law is access without authorization.

And so, one of the things that is trying to be solved with the White Hat Safe Harbor agreement is authorization, having authorization ahead of time. These are the rules of the program. You abide by these rules. You go into there and you are authorized to do so, taking away a key element of a claim against the the security researcher. And by doing that ahead of time, it makes it harder for an upset person, uh a prosecutor to bring charges, bring a lawsuit against the security researcher. And so, we're doing it to create the space in which this can happen. And one of the biggest challenges, one of the things that makes this like very interesting, is that for a lot of security research, like it's done

maybe uh on the side or, you know, not not in a uh very public way. But when there is an active attack going on in a DeFi protocol, it's pretty public. Like something is going on right now, and the time is super sensitive. It is needs to be taken care of right now cuz if if you wait to go through process and get authorization and so on, the wallets may all be drained by the time you sort of get through that process and do a good spot to try and do something about it. And so, getting it in at a time, getting it signed up, getting the the DAO or the the governance body to adopt it beforehand protects you later.

I think that's beautifully put. Uh to to kind of jump off of that as well, the way that it works is uh for a given protocol or for a given instance, we go around to all of the people who might Again, as Kurt mentioned, uh under current hacking laws, under computer security laws that exist as they are, there's no sophistication. Uh like the the ones in the United States were created in under the Reagan administration and and they're like, "If you access a computer, then you're hacking it." Uh which it especially when somebody is is like having funds drained or exposed, they're not going to care who comes in and saves

them. They just want that help. It's like you're asking for an ambulance. Um but as we have, you know, these good Samaritan laws that somebody can come and help you and if you end up like giving them a boo-boo, they can't sue you for the boo-boo while you were saving their life. In the same way, we say in this instance, "Hey, we've gone around ahead of time, made sure that all parties who could possibly act in that not-so-great-faith way, aren't going to have claims against you if you a white hat step in and actually save the day. Best efforts.

Like like do your thing here. We'll give you the information you need to execute. We'll let you know what to do with the funds, where to place them once you've recovered them, and we'll reassure you that if you do this, you'll you'll probably get like a a substantial reward. And having this all clarified ahead of time would release from doubt those who might hesitate. And as Kurt said, really the 11th hour when if if somebody's showing any sort of like bent towards an action, it could cost potentially millions.

Yeah, I mean, building on your terms point, like for the white hat perspective, the most important part about Safe Harbor in my mind is just how it's all standardized and how you can be confident in it. Once you understand how white hat works, we're being very pedantic, very like certain that all of the different protocols that adopt Safe Harbor are going to adopt it in the exact same way. That all of the protections extended to the white hats are going to be the same protections, no matter which protocol is adopted it. And that the information that the protocols have to provide, the asset recovery address, the bounty terms, um any of the diligence requirements, like KYC requirements, and all of the assets under scope, all of that is provided for the white hat, and it's provided for the white hat in the same way for every single protocol. So,

you as a white hat don't need to really care what the protocol that you're interacting with is. Mhm. You mostly just need to care that they've adopted Safe Harbor, and that there's an active exploit and that you can save them. And and I just one more comment there. That's that's the real beauty in and Gabe's work here is is that uh this is a legal instrument. It's flexible in all the right ways, and it's standardized in all the right ways. And in terms of adoption, there's many different ways. We understand that, like not every crypto protocol out there is is going to be the most prestige like perfectly organized entity lined up, blah blah blah blah blah.

Whoever you are in the crypto space, you can use the white harbor framework, and that's what makes it incredible because on the one hand in terms of adoption we have and with this this has been so extremely vetted uh so much flexibility and on the other hand we have standardization so that when it's go time you can go into go mode and that's it it's I I just admire it as as kind of an object like that like it's an almost an object art like damn.

Yeah, I like to think of safe harbor as kind of like an extension of the bug bounty program for a project where you know if it's not under attack and nothing's going wrong you know bug bounty is how you would report things um but if something is going wrong and there's not time to report and be like hey you might want to fix that and you have to act immediately white hat safe harbor you know creates this umbrella of protection for white hats to to step in and take action and save funds which you know there that is an action that is not without risk right it's not like just sending an email with a POC right your transaction could get front run and the generalized front running bot could end up with the funds that you were trying to white hat and so you can never guarantee that

everything's going to go perfectly you know obviously you should have the best of intentions um but with white hat safe harbor you know it's a scenario where something's gone wrong anyway and you're at least going to try to help and you can have a little bit of confidence hopefully a lot of confidence um that you know you'll be protected for trying to do the right thing. That's that's a really important thing to stress like safe harbor does not apply universally. It doesn't just mean that white hats can now suddenly hack your protocol if they've discovered a vulnerability. It only applies in the event of an active exploit if the hacker has moved first.

In basically all other cases contact your 911 contact the bug bounty provider contact the protocol directly disclose the vulnerability responsibly. Safe harbor is not the best approach in all circumstances it's the best approach when you have no alternatives. Right and it's it's seriously an emergency measure It is It is highly compatible with all bug bounties. Like like Generally we recommend for incentive compatibility that, you know, the reward for a safe harbor white hat not be greater than, you know, the reward for an equivalent bug reported through the bug bounty. So that you avoid an incentive for people to go and try to plausibly in a plausibly deniable fashion, you know, create an incident that then they can white hat. So that that's been thought about carefully.

It's been contentious. But, you know, so So there are great limitations on when you can use it as a white hat. But then on a legal level though why should you trust it? Cuz I've just highlighted that, you know, things can go wrong and you can get blamed for them. So This is a good one for charm. You know, why why can we trust it? Who looked it over? And and who is it protecting exactly? And who's it protecting them from exactly as well? So I'll start from the bottom on that. Who's it protecting us from? It's It's a The meta is is that it's protecting us from black hats. It's protecting us from losing

funds and and ultimately the reputation of this industry. I within the context of the safe harbor itself, it's protecting us from each other. A protocol can include bad actors in the legal context who you know, a lot of people here just after their bags. No hate to that, but if you're driven by greed and you recently suffered loss, you're going to go to any measure to to make a recovery.

And for some it might seem ethical to them to target a person who was trying to help them. And it's it's even happened in the past. Like like there's precedent for this as awful as it sounds, and uh safe harbor kind of removes that from from from the landscape. It's it it it was a not so great feature, and again it it switch to real hesitancy in in situations of emergency.

So I yeah, protects us from from each other. And then in terms of like who's been on this, who's helped develop this, it's Oh my god, it's it's more like who hasn't. I I mean, we've had eyes from Australia. We've had eyes from your favorite VC. We've had eyes from the Department of Defense. I and it's it's like or excuse me, not DOJ. I can't confirm. I don't know about the other. I but it's it's like I I can name a score of lawyers. Like I I the list would be like Santa's rolling off the stage here.

I it's it's been vetted. It's been battle tested. We have faced criticism. We have like put this through the paces, and I'm I'm I I'm shocked that so many lawyers came together from every corner of the world and said yeah, looks good to me. No comments, which if you've ever been doing legal work, no comments. That's the holy grail, and we it's I I've can't I I've lost count of the holy grails. So, that's that's my word on that.

Remarkable. Yeah exactly. But let's entertain the scenario that something goes wrong, a protocol adopted safe harbor, but then after a white hat, you know, acted, the protocol decided, "You know what? We feel like prosecuting them anyway." Or maybe there was some user of the protocol that, you know, felt that something wasn't done quite correctly and they bring suit. Um you know, or who knows, maybe maybe a government just decides that uh it looks like a law was broken here and so we're just going to prosecute everyone who participated in the hack even if, you know, they weren't you know, even if they returned the funds, you know, which governments do things like that sometimes. So, um Kurt, what what exists to help out in this case? And

Yeah, yeah, absolutely. So, well, just starting like yeah, obviously with with the the agreement has been uh you know, uh vetted, put out there. We believe that it is really good. But I you know, when you work work in the area of security, one of the things is you have to make sure that even if you think everything is fine, you got to also prepare in case it's not. Uh and so, one aspect of that uh as I said, I'm on the board of the Security Researchers Legal Defense Fund, uh and we worked with uh Seal on this too make sure that there are funds available to provide uh legal help if somebody gets in trouble for using this, for doing some good faith white

hat work on a protocol and nevertheless something comes up. Could that happen? Well, you know, it's a tough thing when when somebody loses a lot of money on to to a hack and there are some bad faith actors that they can't find, they there's no way of tracking them down. And then there are some good faith white hats who are presenting themselves to the world as having done this. Well, you got you got one target for your your uh frustration and anger over what happened. And one of the things that that unfortunately can happen is when people are frustrated, angry, and they've lost a lot of money is they will lash out.

Uh and uh you know, a challenge is often where it is not a legal action that um would have a very high chance of of success. You know, we have where we eliminated the access without authorization. But, that does not stop someone from being able to threaten or even sue. You know, that there often times where people are trying to do that as a way of intimidation, as a way of trying to uh uh put pressure on the other side in hopes that uh maybe that's a better bargaining position. They can do some some compromising and such.

Uh and part of having the legal defense fund as a resource is to help give confidence to people who want to do this. Uh that uh you know, while it has been reviewed and vetted by a wide variety of people, um so far it has not been challenged uh in in a court and it'd be good to have some lawyers. If it ever was challenged to to help with those arguments to say why it is it is very good. And some of the scenarios that we're just talking about. So, uh you know, a a protocol uh denying you know, saying that they repudiate the the agreement seems unlikely. And that would be a particularly uh uh tough one to say, "Well, we we agreed to this thing, but we no longer agree to it."

But, perhaps a uh a member or someone a user of that protocol says, "Well, I didn't agree to this. This was done by some governance thing. I don't, you know, agree with what the governance thing has done. You can't hold me to it." And then that would put to the test whether the governance mechanism was functional. Be good to have some legal help in that scenario. And uh also for for criminal charges, uh the the victim does not have to agree. Uh the governments can press charges for alleged crimes even if the victim uh is like, "No, I don't want you to press charges." Usually they don't.

Uh usually it is a victim who is is cheerleading and pushing pressure to do it, but it doesn't it doesn't always have to be that way. So, it is good to have this in case of emergency break glass. Uh and uh if it happens, you know, uh, reach out to the Security Researcher Legal Defense Fund. Um, and for that matter, uh, the Security Researcher Legal Defense Fund, uh, works for all sorts of uh, security. So, if you're doing something, uh, independent of the white hat, uh, safe harbor, but are doing some good faith uh, security research and and get in trouble for it, also feel free to reach out to the Security Researcher Legal Defense Fund.

I could riff on one thing that Kurt said there. Um, the safe harbor might seem it operates as kind of from a place of cynicality about the people involved. Uh, what it's it's really doing is is it's we're we're Excuse me, not about the people's involved so much as like the the courts that you might face afterward. Like, am I really going to end up being indicted and then found in the wrong for trying to help somebody? Is that where our legal system is at?

No, but even being yanked into the civil system, like even being hit with a lawsuit from one of these people who Yeah, those are the people we're getting a little cynical about. Cuz again, you find this greed drive sometimes in crypto. We all know it. Uh, we're taking away their ability to even harass you, the white hat, so that you can go forward, do your thing, use that talent that we know you have to actually get something done here that's that's going to save a lot of a lot of people.

Yeah. I mean, fundamentally the way I see it, the SLDRF exists because the white hats are the ones that are taking on the risk in safe harbor. For a protocol, if you adopt safe harbor, worst case scenario, nothing really changes. You get hacked. Like, a black hat's not going to operate under safe harbor, and if they do, then it's not going to apply. Um, but for the white hats, if like Kurt and Charm said, if a bad protocol or if a bad protocol to user comes after you, you are taking on a lot of risk there. And as an R&D app, at least makes me a lot more confident that I would not face that alone, that I would not go bankrupt or I would not be ruined just by a single mad actor after I tried to help

them. Yep. Now, on that note, um say if Harbor doesn't get used, if projects don't adopt it, uh which is its own battle. Now, Robert, you've been a huge help um with driving adoption and, you know, getting projects to to get on board. Um what are the non-legal, technical, and on-chain components of of doing this? I mean, the on-chain components are really the on-chain registry and then all of the corresponding protocol adoptions. So, the protocol adoptions are basically just on-chain records of the details that the protocols used to adopt Safe Harbor. So, that's the stuff that I mentioned before, the stuff that's standardized. It's the asset under scope, it's the KYC terms, it's the bounty terms, and it's the asset

recovery address, the place where you return funds if you've recovered any. Um and protocols deploy this on-chain, and then white hats can see or any white hat can see it just by querying the chain. And then, the second part is the on-chain registry, which basically just it's a smart contract factory for the different adoption details. It just keeps track of all of the different protocols that have adopted Safe Harbor and has a mapping of the protocol addresses of the protocols' adoption addresses to the actual adoption details. Yeah. So, that's kind of technically what happens. Um uh Charm is there anything else the protocol needs beyond these technical components?

Uh you know, like how does a DAO that doesn't have a legal entity adopt an agreement? Oh, all right. Uh yeah, so what we do here is we essentially have a process for the DAO to implement a a governance vote. And we say and this is this is one of the the like striking parts of the safe harbor is we say if if this governance vote passes then the the DAO and everybody who's part of a you know that amorphous group that has given legal mind so many so much trouble we say whatever you end up being if you're classified as purple, green, or

or whatever color and under the legal rainbow it doesn't matter you can sign to this agreement because it passed under your governance system. Uh therefore the white hat is protected when they swoop in and save the day. Uh there's different configurations again this the the flexibility that the the white hat safe harbor framework has in terms of adoption is is really remarkable. Uh so I I can assure virtually any configuration that you're bringing to to the adoption process is going to be compatible with minimal imagination.

It's we we have templates and and guidelines for whatever you are and it's it's fairly easy to follow them. If there are actually legal persons who are coming to the table you can just have them sign on the dotted line. Otherwise if you're providing a product or service to other people added to your terms of service so that users are made aware that as they're engaging with your product or service they're also agreeing to allow these white hats to do their jazz.

We we've been very thorough we've accounted for for most everything. Is it fair to say that we've we've done everything we could to to it easy to adopt? Absolutely. Absolutely. And and and we're eyeing things here. Um I I I always love highlighting that this is a community effort, and it is to the very last. Um I that's it that really shows in the mindfulness of the document. One fun thing that I forgot to mention, but it's kind of an intersection between the legal aspects and the on-chain aspects.

Um and correct me if I'm wrong, but for the DAOs, the actual on-chain transaction to the smart contract registry is legally binding action that they take to adopt Um and I know that Gabe, who is I think he's the one who came up with this. Yeah. He is very interested in this idea, and he's like working on it a lot that the on-chain transaction that you execute can be a legally binding action. Um and I imagine there's going to be a lot of other stuff that comes out in the next couple of years that uses this same legal principle to like start to combine the traditional legal agreements with more on-chain registry stuff.

A lot of theory behind that. Yeah. Notarization. Yep. Great answers. Um question for Kurt. Um you've been in this security researcher protection business for a long time. I'm wonder I'm wondering if you have some examples from your past experience to just highlight, you know, why this matters, why it's important, and you know, how how it helps. Yeah, sure. I mean, like I've been in this a long time. I have seen things. Uh it is, you know, it's actually improved quite a bit over the time. Uh there was a lot of misunderstanding. You were saying like the Computer Fraud and Abuse Act, which is the US anti-hacking law, came from the the Reagan era. And just a little side

story on that. Uh as the story goes, Reagan watched the movie WarGames, uh which involved the hacking into the uh nuclear defense system, uh and that inspired the uh M2 promote and and eventually sign the Computer Fraud and Abuse Act. Uh so, I going at it with a understanding, uh a movie level understanding of what uh what it could be. But uh uh you know, over the years, like in in the early days, there was just a lot of uh challenges when industries were being confronted with with security research that made them look bad. You know, they got they got popped. Uh they didn't like Did you see that? And

wanted to take it out on on the researcher and doing things suing them, threatening uh suit at least at a minimum, trying to silence the effort. Uh and there have also been some prosecutors who uh took things that I, you know, shouldn't have been uh cases and brought them anyway for their own political careers. A lot of, you know, the the um uh prosecutors in places are often elected officials and such. Uh so, one one prominent uh example is uh Aaron Aaron Swartz who uh went into MIT uh as I I was lawfully entitled to download some uh academic articles, uh you know, under the under as a, you know, student there.

Uh went into a uh networking closet, attached his laptop with with a cable to do it, you know, faster than they were anticipating. Uh and and perhaps more than they were anticipating, but I don't think that should have been a crime cuz he was authorized to get the those articles and they hadn't anticipated that uh it would be done so fast. But nevertheless, a prosecutor went after him uh and Aaron was facing uh up to 35 years in in prison for for having done so. Uh the the organization that uh uh had these academic journals, uh after a lot of public pressure, said uh you know, this is this is fine. We don't we don't have a complaint with this, but nevertheless, the prosecution continued.

Unfortunately, uh this this led to uh Aaron taking his own life. So, we never found out how that that case would have ended up and we lost one of the one of the greats in in both the open source movement and and doing security research. Uh and so, like the this is this is sort of a bad place where where things started out. For a long time, the DOJ was also taking some very tough interpretations of terms of service so that with the assumption that if a term of service said, you know, you are not authorized to access our site under these conditions, then that was access without authorization and thus it was it was criminal. And just to give you a notion of how ridiculous that is at at the time that we were doing some litigation around

this, put an anecdote before the court that 17 Magazine, which is a magazine that was only read mostly by people under 17, uh had a term of service saying you must be 18 or older to access this website. So, basically their entire audience under the DOJ's interpretation were felons accessing without authorization, hacking it by typing in, you know, 17magazine.com into a browser pushing return. Uh and so, this is some of the bad places where it's gone. But I think it has gotten better.

Uh most technically sophisticated companies are open to security research now. Bug bounty programs have become commonplace. Uh and you know, essentially what the the way that safe harbor is an extension of the idea of a bug bounty program to a high tempo uh uh you know, immediate action scenario versus a slower one, but it is an extension of that idea and so, this is moving it forward. But you know, still we have uh so, we have some problems. Just this uh this summer, I was at the Def Con security conference and then ended up getting pulled into representing a a speaker there who got a cease and desist the night before a talk was scheduled to stop by the by the manufacturer. So, he was done some research and discovered

flaws in these electronic locks. Uh and had done the testing on locks that he, you know, lawfully bought and own own the lock themselves. So, if anyone was to authorize any hacking on those computers, and the definition of computers is broad enough to encompass basically anything that might be considered a computer except pocket calculators. And that's longer story on that. But in any event, he owned the locks, he was authorizing to do it, and but they nevertheless they brought suit. They brought a whole bunch of ridiculous claims that would have basically totally lost in court.

But there you are, the night before your talk, getting this letter. Uh anyway, so it did work out. Uh we responded to them, uh ended up delaying the talk to give some time to have the conversations, and they eventually withdrew their threats, uh and uh you know, uh the thing was resolved peacefully, the talk went went forward with the security research. But like I said, the fact that it was still happening. Yep. And so, it's a lot of good examples of how, you know, security researchers have gotten in trouble for a lot less than, you know, maybe uh moving a few uh million dollars on chain. Um and Just a few million.

accepted fashion. Um all right, we I want to be mindful of the time cuz we're getting close to the end here. Um Robert, um to date, how many projects have signed up for White Hat Safe Harbor? Um and where should teams go to get started on implementing it? I mean, we've got five protocols so far. Um Balancer, I think, being the most recent one. Um and if you want to Oh, thank you. And if you want to adopt it, then contact myself, contact Stigson, who's in the audience. He is the one who is the real wizard behind all of the protocol adoptions. And um yeah, like like we've said before, it's it's pretty easy for protocols to adopt Safe Harbor. If you're a DAO, it goes through the DAO process. If you have Immunify, um you can adopt using Immunify. If you are a regular protocol,

then like Cham said, it's it's easy as just signing a legal agreement. And when you do that, you are giving white hats the opportunity to protect you if everything else goes wrong. Um if the there's a vulnerability in your code that wasn't caught by the auditors, that wasn't reported to a bug bounty, and that is discovered by a black hat if you've got some zero day, then we're not saying that it's going to stop the zero day, but we're saying that there is a much better chance that you're going to get your money back and that your users are going to stay protected. The a frequent criticism white hat safe harbor is that the the scope is so narrow, you know, only attacks that are in progress and you know, most attacks are one transaction, all the funds are stolen. Um so there So how would you answer um

to that criticism of like, well, you know, maybe the set of times that this actually gets invoked is is close to zero. There's a thing to be said for how safe harbor could be expanded where if a white hat finds a vulnerability and can't contact the protocol or can't responsibly disclose it, then they might want to be able to exfiltrate the funds and return them to users. And there's definitely I think a path where safe harbor could grow to encompass that sort of stuff. But right now we wanted to start off with what is most explicitly something that white hats should be able to do.

Um like safe harbor exists like Kurt said, it exists kind of as an offshoot of bug bounties and it only really exists because in crypto we have the opportunity where we can see what the hackers are going to do um or what they already have done and we have time to react to it. On Ethereum you've got what, 12 seconds in the block time? If a transaction shows up in the mempool, you've got maybe 6 seconds to respond to it. Um or if the hack occurs, it's not behind some closed doors inside of a bank system, it's on chain for everybody to see. And and some attacks do fall into this category of there are multiple actions they can repeatedly the the classic example of this is actually the Nomad attack, which was one of the sort of main motivating things behind yes, uh safe harbor could definitely be useful

even in this initial form, which was where, you know, basically there was a way to steal money from this bridge and, you know, there was an initial transaction that then started being copied and replicated all over the place and, you know, some white hats participated, but there were also many other white hats who were sitting there watching it happen and saying, "Well, I could save some funds, but I might also put myself at risk. And if I don't take any action, I'm not in any risk, so I'll just sit it out." Exactly. The it you know, it's maybe not all maybe not all hacks and vulnerabilities are like that, but there are definitely ones that exist of that nature. And so if you I think if you can add this and get, you know, marginally more protection at basically no downside risk, still still valuable.

You might have feeding frenzies like exactly as you described. You might have an instance where a mempool bot detects that a transaction is in the mempool and then front runs it. You might have an instance where like someone deploys a smart contract and you can tell that that smart contract is going to be used in a malicious way. I know that there's a few people here actually who are working on that sort of tech. Um Like there's a bunch of different applications. About 50% of exploits as of 2023 were code-related exploits and most of those would be applicable for safe harbor. I just wanted to add like it is part of a sort of suite of best practices.

Yeah. So like you also want to have a bug bounty program so you find the vulnerability before anyone's actively using it. You want to have audits so you find the vulnerability before anybody in a bug bounty finds it. You want to do, you know, secure by design coding so that the audit doesn't catch it and so on. So go all the way back the chain, but you also need that thing at the end of the chain if the other checks haven't worked so far and somebody has them in their sights but it's very short decision time period. And if they don't have confidence that like they're they're not going to, you know, go to jail or get sued to oblivion for taking an action, then they might not take it and then the money is gone and when we, you know, and we have yet another horrible story

and a lot of people are upset. So, giving people some confidence when they have to make a very tight time period decision, good or bad, should I do this? Will it work out? You want them to have the confidence to go for it, save as much money as can be saved. And that that is the purpose of the safe harbor. Music, as I said. I thought and I think we're slightly over time, so I want to be respectful of all the speakers later in the day and want to mention all of that. So, if you have any questions about safe harbor, um come find any of us panelists or other SEAL people afterwards and yeah, we'll be happy to talk to you about it.

We've all got these lovely blue shirts.