Auditing, Security and Safety Inside the EVM w/ 0xTaiga (Consensys Diligence)

Transcript

[Music] thank you hello and welcome back to another episode of the strangewater podcast I'm so happy you're joining us for another great conversation thank you for tuning in smart contract auditing is one of those background topics that very few people really think about the basics are straightforward developers will hire specialized auditing firms to painstakingly look through their code looking for errors bugs and other vulnerabilities the Auditors work with the developers to harden their protocol hopefully making it safe and ready for production

and then when devs are ready to ship they make sure to loudly and repeatedly tell everyone that their code is audited now the final part is only implied but most of us just do the work for them because their code is audited we assume that the protocol is safe but just like all things in this world things are much less simple when you look under the hood it's one thing to say an auditor is going to look at your code but what is the auditor actually going to do are they going to read it line by line throw a bunch of test cases try to hack the pre-built binaries today's guest is Xerox tiger an auditor

and a security engineer at consensus diligence which is consensus's auditing firm during the next hour you're going to hear Ty walk us through the ins and outs of smart contract auditing including the basics of how an audit works how smart contract programming differs from a more traditional programming and even some valuable Alpha on how to keep your auditor happy when you finish this conversation I hope you walk away with two main points first if you are developing on chain the standard that you need to be working towards is absolutely perfect bug free code this is just not a place where you

can cut corners second you are rarely going to hear about audit companies or audits unless something catastrophic happens but the hard work of auditing happens every single day for a job that we all implicitly and often explicitly trust with our digital net worth we don't give it nearly as much attention as it deserves one more thing before we begin please do not take Financial advice from this or any podcast ethereum will change the world one day but you can easily lose all of your money between now and then

all right let's get started foreign thank you so much for joining us on the strangewater podcast well thank you for inviting me thank you Rex no man awesome I'm super excited to have this conversation but before we kind of get into uh like the more interesting things that are happening in today's crypto and today's defy can we just hear a little bit about your background and like what I what I love to hear is like who were you before you like had heard of crypto or understood the power of crypto and like what was your moment where you realized like oh my God I need to be involved right yeah that's um a good question so basically before crypto I was a software engineer at a major game engine company that

um most of you most most likely know um unreals but uh the other one that most of you must like uh it was Unity so uh it's uh more like less less AAA but still a rather popular gaming engine and what I was doing there is I was uh in their EI department so we were basically working on uh reinforcement learning being added to different in-game objects for for developers basically breathe in some life into their game objects or industrial applications right so that was it was it was a Hot Topic at the time it was really cool and for me it was a Hot Topic up until I learned about crypto

um so then uh the first day I learned about Flash loans and the arbitrages and basically any sort of like one chain activity where you can make money without a risk of losing money was fascinating right so I feel like a lot of people are actually going um into crypto that route and for me it was the same I start writing Bots some Bots that were just centralized exchange Bots uh like on finance and things like that but um after that I just wanted to learn a little better what the smart contracts are about and I felt like whatever I'm just watching on YouTube and whichever whatever I'm trying to do myself is just very basic so I started seeing if I can contribute to other

protocols or anything like that so it did contribute to protocols right so smart contracts and eventually I just wanted to convert to crypto full-time so I just went and started working four metamask um so I did work at metamask for some time but unfortunately I met a mask I didn't get to write smart contracts or read smart contracts so I just went to auditing position consensus diligence later um and yeah that that's uh where I'm at full time currently I can sense of diligence I'm also contributing to vendor Finance but uh um the the diligence part is also extremely entertaining and I know we did spoke we did speak about vendors so we

can uh talk a little bit more about auditing as well today but yeah but this is like in a nutshell how I ended up in crypto yeah so let's just unpack that a little bit more because like especially like now in 2023 you know the only thing like kind of like at the more bleeding edge of Technology of than crypto is AI and so like it sounds like you were like playing with those Concepts before um and and like more so than just like creating research projects or like chat Bots and throwing them out there like you were using this technology to build real products and so can you just like talk a little bit about like like that is like kind of the wet dream of a of a builder or technology person and like what why was this opportunity

just how did it speak more to your soul right I mean AI is fun right like what technology to me always was an opportunity to just create something right it's like magic you don't you don't need anything except for your computer and then you create stuff right and um that in itself is Art and um past that point AI is like a magic Art right where you just do something and then it does something that completely blows people away right and it's uh relatively accessible to developers right like there's a subset of people who actually writes those different models trains them and uh or not necessarily training them but design for the models right but then training and actually deploying a model is not that

difficult so this magic is becoming more and more accessible and I felt like there's just too much attention around it I I didn't feel like I'm still early you know um and it was just before those like um I guess not just but like a year before the um Transformers were introduced so it was um commonly introduced I should say but essentially I felt like there's a lot of competition and there's a lot less room to kind of impress someone or do something that's going to be novel or you have to be at the very very Cutting Edge of that and uh have a completely different kind of level of math than computer knowledge that I might visit or would like to possess right and then uh

the crypto kind of scene comes along and then you see that you can uh basically take advantage of all your data structure algorithm knowledge right a rather short program that has to be the Perfection right and then have it hold a lot of money and not a lot of people know about that just yet and that's a whole nother level of thrill and adrenaline and like it's unbelievable that you can get adrenaline writing code that was weird to me you know um but that is what happens when you add the money in an equation and that's what you get as an auditor you get a thrill of actually finding a way to take the money and as a developer you're just constantly scared

that somebody will find them so I've been on both sides and it's interesting I kind of understand both sides at this point so yeah well it's not just as a developer you're constantly worried about something going wrong like as a user as a researcher like as a participant in this ecosystem I think I'm just as afraid of uh as the developers but um I do like it really resonates with so I studied computer science and then never did programming professionally but I just like so vividly remember like the first time I got a computer science homework assignment it was like I ran home and I did it it was the first time I was excited about like work you know and I think um that same feeling what you know for every intro uh like

program they they make you write your own um I think it's a c compiler right like anyway like these like kind of like complex things especially for students and like I do remember getting that adrenaline like when all your pieces kind of click together but man I can't even imagine like the rush when you put Financial Stakes to it you're right you're right because um and that's one of the things about uh working as an auditor that's a little bit different from regular software developer role uh when you are a software developer you're given a task and you kind of do small little steps towards that task and you get those dopamine boosts all the time right so like every time something just slightly Works to get a dopamine boost and and it's good that that what keeps

you going but for auditing it's different you can go without a dopamine boost for like a week for two weeks and then you find one thing right so you have to kind of find a way to keep yourself excited because it's it's different from just regular software engineering uh position it's uh has some Unique Kind of aspects to it but yeah you're totally right it's uh when something works it's a great feeling yeah and so just before we move on from this like you said that you you started in crypto by just writing bots on centralized exchanges I think for all the non-programmers out there like the reason Ty started on centralized exchanges is because you can like write in like with modern computers as opposed to like the janky evm but what when you

started was this really about like the financial and the games and that piece of it and then you kind of backed your way into understanding like the purpose of crypto and ethereum or did you come to this from a first principles oh I had no idea like what crypto can do and uh what like what is possible and how much useful it can be I was just I'll be honest it was purely Financial um and uh I'm not I'm embarrassed to kind of what kind of bots I was writing so it was like it was very Financial driven I was not there for the tech but now it's it's shifted though yeah man I I totally understand and look like at the

end of the day it doesn't really matter how you get to the technology like it matters if you stay and why you stay you know so who cares like I uh I think you found like centralized trading Bots because it was fun and like you could maybe make some money maybe lose some money but um you're here now because like you hear the call of ethereum right and and you see the vision and you want to push it Forward yeah definitely just see the perspective and what can be accomplished for sure yeah for sure so let's um before we get to like audit world like let's talk about your time at metamask so you said you weren't writing smart contracts what were you doing well so if you ever go on metamask and if you go into a buy button like buy crypto so there is this kind of onboarding

process that essentially just like offers you the best kind of quote and best rap to um purchase the crypto for Fiat funds so I was contributing to that routing engine that was finding out the best route uh for you to buy crypto so this was purely kind of like logical and a back-end kind of job so it was not anything to do with smart contracts because it's all like with three not like what two kind of world where you interact with the service providers that just offer you to buy crypto and you send them real money and they send you Crypt into a wallet so there's not much what three going on there

um so it was purely back-end and that wasn't necessarily what I wanted this is not what I was going into mirror mask not the intent that I was going to Mid mask with yeah well it totally makes sense but given that you had that experience do you think that like your perspective like what I love about what you just said is that like well we're all like trying to be Giga brain about like Financial um derivatives and like all this crazy stuff on chain like really what we all need to be focused on is like simple things like ux and like getting users on board and just like you know the blocking and tackling of like Building Technology and so did you find any like any interesting insights in the

you know the the ramp side of this industry um I I face some of the challenges that they encounter um and uh like the interesting aspects about how quote generation can work right so most of them are very technical um I did realize how much we need web3 and how many like because when you write this engine right you're essentially saying in your circumstances here is the best route right and there's so many age cases to match everyone's circumstances if you're from that region of the world you cannot buy crypto because some other old dude there said that they're like

now banned country or this amount of money is not allowed in this currency but this one's allowed in the other currency all of that is nonsense for crypto right like you want to buy a token just go buy token it's just that easy but here it was insane how many kind of exceptions you have to think about and it's a rather unpleasant experience you know and you can you you almost kind of end up in a situation where you can try by crypto with one combination of parameters it wouldn't let you but then you potentially can just do a different one like a different payment method I'm like what the hell like why is the payment method important uh but there there are reasons like for for the banks to prefer

one payment method or the other because they're have different trustworthiness but yeah those kind of rules they just made me appreciate with three a little bit more um and uh how accessible it it can be yeah I know it's funny I mean like I'm gonna reframe what you said and tell me if this resonates or not but it sounds like you entered crypto because you thought it was like fun and had potential but like didn't really care and at your time at metamask like while you didn't get to do the work that you actually wanted that was like the experience that taught you like well the why of the technology I think it's mostly like contributing to different crypto protocols that kind of opened my eyes to what can be built it's almost like I was too small brain to understand

like what can be ran with solidity on evm so it was just like always you open a YouTube and they show you oh here's like a multi-stick wallet that we're going to write today I'm like great what am I going to do with that well like how's that useful like what's cool about I think when I started contributing to protocols I understood the economy behind it that those smart contracts actually interact with each other that they're the money Legos that if I want to interact with a protocol in some way or another I don't even need to ask anybody's permission and um this this like kind of blew my mind uh is because usually you request the API access like keys and stuff that

was another thing like we had to um get those API Keys permissions and everything from all this um basically like little changes to kind of buy uh crypto with them but in in D5 you don't even need to ask anyone you just find a protocol you want you want to build on top of Ave you just plug into their contracts and nobody is even going to be able to tell you anything so understanding that whole economy and how things can get interconnected and you and how you can extend pretty much anything that what blew my mind that's what was unique to me and that was something that is just incredible that that what makes the growth so exponential in terms of Technology right

that pop-ups pops up on chain um so that that part I think got me into it and by the time I was writing the um that metamask uh on on ramp uh code I was already deeply in love with book three so I was just more more and more disappointed in web too yeah no I I think uh we can have like four podcasts on the disappointments of web 2 and then like another 10 podcasts on the disappointments of like the real world but for the sake of brevity um so so I think you've kind of like covered this in its entirety over the

like you're all your other answers but um I'll just ask you directly like I totally understand why you moved on from metamask and it was essentially because like you wanted to put your hands into the evm and get on chain and that just wasn't the pro like what you were doing at metamask but from from that standpoint like not a lot of people choose to be Auditors right like a lot of people choose to go be contributors or to like be Founders or to do lots of different things but how did I guess like now with with the the benefit of hindsight like what about auditing Drew you to it and like why do you find yourself just so passionate about it well well first of all I really appreciate smart contracts to me they're

like art they're short and they're capable and they are they must be perfect it's kind of a standard in the industry that a lot of people say oh you cannot write bug-free code and good luck releasing a non-buck free smart contract right this is just blows in a lot of developers Minds that you you cannot allow a single bug in production right you know like a lot of people a lot of developers think in that way where they don't allow any bucks but for a lot of people it the risk is so miniscule they don't care you know if there's a tiny bug nobody kicked

um here even if you have a tiny bug a lot of people care that's your reputation that's uh essentially bug bounties that you're gonna have to pay out um so it has to be perfect and it has to be extremely efficient because of the gas cost so you're literally not just riding a giant kind of system that whatever like here I can cut the corner here I cut the corner as long as the giant system works you're writing something extremely efficient and you're you're spending a lot of time trying to design it right so that is just to me it's the top of the food chain for the developers I it is like some people are going to say hi developers are the top of the food chain somebody's gonna

say a backhand developer everyone has a different opinion to me writing smart contracts and auditing smart contracts is the top of the food chain because you you need to carve that perfect piece of code it has to be perfect you know yeah yeah and that's essentially just the the thrill of money being in the contracts and the fact that it has to be that perfect one thing that I think that has a lot of beauty to me and um that's that's why I want to do it yeah that makes a lot of sense and I mean I think like it sounds to me like you get all of the like benefits of being like a a developer but like with this also like sense of like responsibility and this sense of like

last line of defense between you know like uh testing and production and like in production there's like real sharks out there that will like rip your face off definitely definitely and there's also like a consensus diligence that is writing a lot of products as well um a lot of them are very famous like Visual Studio developer like if somebody ever wrote a smart contract they'd probably know about that vs code extension that just does all the highlighting for them um they're supposing that we're developing which is pretty interesting too it's rather performant um so if you if you do want to write like a regular product code you can do that at diligence um but the

most of the time we audit obviously yeah so um let's like zoom in a little bit and like can you add a super super high level like especially for uh all of us that are not actually smart contract devs but even for smart contract devs can you talk us through like what what is the process of auditing even look like like if I like if I send you a thousand lines of code right now where do you start oh well it's rather straightforward it's like it's a simple approach but it's not easy you know um so when I was just starting somebody told me that by the time the engagement ends you have to be able to close the code that you

are given and reproduce it pretty much line by line right so you need to know exactly what's going on so for me what works is basically um either printing it out or putting it on an iPad I prefer I just put the code in iPad function by function um and that's a that's not how I start but that's how I it essentially like more closer to the middle of the audit um and I just uh go with a pen and pencil and basically look at each function individually eliminating all the assumptions of the surrounding code and kind of a look at specifically what each function does and what each function I believe should do sort of um and compare my beliefs to what's

happening and then once you kind of look at them in isolation you don't have any um kind of uh yeah any assumptions about what the code should do you don't share them with the original developers then you start seeing those misalignments of where like your beliefs go apart with like what the code does but um and yeah you just go line by line and kind of look at each of them and try to understand each of them and in the very beginning you just basically start with the docs and then you start with like General architecture what the files are what the function that's going to be triggered and by whom right if I'm a user which functions are going to interact with okay so that's the entry point and then everything just starts from there you know you just

follow which function calls which function uh but the definitely starting with the dogs then looking over the generally the scope scope is the list of files that are in in question and then once you understand the general architecture it's just like you you really dive in into each line each variable and like even something is super straightforward during the audit you actually need to look at it like force yourself to look at it because you might feel like it's straightforward and then actually make sure that it's doing what it's supposed to do because the bugs are usually very frequently are in the places that people think are very straightforward because they don't think twice about them and then there's like some weird

kind of edge case in there that those are nicest to catch because you because usually you would miss them and uh they're usually like on they're usually like one liner uh things but they're really hard to catch and you're like damn I wonder how many people looked right at it and didn't see it yeah I don't know if this is like directly relevant in the solidity case but like again going back to my computer science education like it's like floating point mismatches would like are literally invisible on the human code side but like will destroy the application right so speaking to that um like how much of your process relies

on like your human brain and eyes reading lines of code and how much relies on automated tools that like help um just like blast the code with as many different variables as possible and so that you can kind of like see the outputs and then ladder backwards it depends on the engagement time right so usually it's it's sometimes easy to just run some tools that um give you some kind of you throw a coated them doesn't matter if you compiles or anything they do static analysis they just look at what's written and give you some insight into it and give you some kind of risky places right so sometimes we do that but

most of my times actually manual review so I don't necessarily do fuzzing for example on every single engagement because then it's so much time trying to figure out how to deploy the client's code right and a lot of sometimes it doesn't compile which uh happens rather rarely now but um so trying to actually like set up the whole environment is usually complex and the diligence that the code bases we look at are usually complex um so setting them up will take time and it's always a risk whether you have the time to actually dedicate to setting up the environment and then like run a fuzzing campaign for example um so usually a fuzzing would be done not in the audit but or as a part of a

separate engagement or just by the developers themselves because they have a limited amount of time and they can then rewrite the campaign each time they make any changes right but I prefer just manual um kind of line by line approach because then I feel comfortable that I looked at everything I covered everything myself and then I know where everything is and how everything works just for like if unless I do that I wouldn't be comfortable delivering because then I'd be nervous yeah I mean that that's like genuinely surprising for me to hear but amazing like totally amazing because I as a non-auditor I would just like imagine that even like let's imagine

someone wrote a like a function that rounds down like you know just as floor like I I know how to read code you know I know the division and then like and edge cases around certain divisions based on like data types and stuff but um I don't know I guess like the way I don't have the confidence like I would need to have like machines like just throw everything at it in order to feel confident in myself and so I don't know if that's the difference between you and me or experience or what but it's just super cool it's a different approach it's a different approach right um if you took if you look at the rounding function right there's uh several ways you can go about it right if we look at this simple example right you can look at it line by line and try to convince

yourself that it's secure you can um throw a lot of numbers at it and see if anything violates your assumptions or you can try to mathematically prove it right and say that just write a mathematical proof where you say that there's under no circumstances this can generate an answer and I feel like for something that does rounding I might be wrong but like the mathematical approach will be the ultimate one right because it's like a rather I don't want to say simple but it's it's most likely fits the mathematical kind of Direction very well but for something that is a more complex complex protocol it becomes more and more difficult to kind of do an exhaustive mathematical proof you're more like uh maybe proving

a financial model at that point but uh you might want to talk about that with people who actually like concentrate on mathematical proving but uh yeah no I you like you just opened up like a whole can of orbs that will just uh just like we'll we'll step past but it's super interesting to think about like the different types of certainty tools that Auditors use and like when they're applicable um but we'll keep walking something super interesting that you mentioned was that like sometimes you'll get code and it may be more rare now but like it might not compile or it's super hard to compile or it's just super hard to get it like in a like kind of up and going State like how much of your job as an

auditor is to check to see like if the code even works the way that the developers want like if it works at all versus just like reading it and looking for bugs and edge cases and that kind of stuff so over time you can get a feel for whether the code's going to be good or bad and one of the red flags is when the happy path does not work right and uh by happy path I mean if you're a yield farm right like let's consider something really simple I should be able to deposit like LP tokens and get rewards right if every time I try to deposit LP tokens the contract gonna

revert that I know that this has not been tested at all right like at all and even if that path was not tested what's going to happen when I think about the edge cases right what's going to happen when I try to actually break it well usually things go really bad in those kind of um the cases where people didn't even test their main functionality um and um at diligence we usually just say that sometimes we'd have to say that this code we don't recommend for production is just not ready and um so we we don't post reports too frequently we don't publicize them

because we give people an option to publicize the report or keep it private so a lot of reports just like don't ever see the light of day because you don't still want to publish them uh but yeah it it's usually like you can tell rather quickly um like in the first few days where whether this like whether you would put your money in it or not and whether it should others um but uh a lot of times there this little box in a happy path um much less common uh that the code doesn't compile that's something that's I think um kind of thing over the past at least for the clients that we work with

um very common thing is people submitting one code for Price estimation and that's giving us the other code to audit that's like majority of the clients like um when I see a team that gives uh a commit hash or like the version of the code for Price estimation it gives the same version of the code for auditing I'm like I Like These Guys these they have their [ __ ] together they they're good well but let that be known listeners there's some uh auditor Alpha for you like it is not worth like trying to shave off the extra few percent to like

have your auditor not be like on board with you yeah it's like give it a little bit of time like finish your code right make sure it's done I understand people have um time constraints and everything but um it is frustrating you know you get one code and it's never less code it's always more code and that is this um a little Annoying a little frustrating but we understand we usually unless it's like obnoxious we kind of try to work with the client and try not to um like try to accommodate but it's just like annoying it's a little Annoying and

I personally do do very much like teams who can give themselves some time to actually finish the code and just give the uh code that they wanted to price to the Auditors to audit it means that they have some process in place that works for them that is not rushed that is uh more mature and more serious so that that is a nice thing to see um but yeah also what else we we do uh during the audit we we communicate to the client a lot so by the time we generate the report for example we the the bugs in the report are not a surprise as soon as we find them we we

tell them and then reports just like an official thing that they can publish or share but uh yeah so so in that vein um without like I am not asking you for any specific stories to be clear but like do you ever have situations where you are finding what either bugs or like things that need to be addressed and like getting really strong pushback from the client teams yes definitely what what are the types of scenarios in which like that happens um just protocols trying to downplay their issues and I feel like at diligence we are not putting major on minor bugs like we we're really trying to be rather

strict ourselves in what we find so we never change that we already kind of side with the client in internally like we want to make sure that we don't like blow out dishes that we find to something disproportionate where it's like a non-issue becomes media more like a medium becomes critical um and for that philosophy kind of not that difficult to say guys We believe We believe what we wrote if we're not going to chase that um some people don't like it some people just accept it um but the it happens happens frequently uh but

um we just have one policy for that we just don't change yeah again without asking any specific questions or examples like have you ever had a time when because the way that um that consensus works is that they offer the um the audit report privately and then it's up to the protocol to disclose it or not have there ever been situations where you know that there is something that needed to be addressed and wasn't sure if it was addressed and never saw the client report away and you just kind of had to like sit with that uncomfortable knowledge so this is an interesting one because it never happened to me but I wonder if that happened to my colleagues so we're lucky where we work with mostly

serious protocols so like they have to uh either fix their issues to show like the report to investors even if they don't publish it they have to show it to someone um so most of the time people just fix them uh but I haven't yet worked with a protocol where you essentially see a major bug and they refuse to fix it and they refuse to publish the report because when then what's the purpose of the audit right they still want to get their code better what they want usually is to just downplay like they fix it but they want the report to look better you know so they're not

opposed to fixing issues uh they're opposed to seeing that they had an issue um so I haven't been in a situation where like the bug that is extremely critical went unfixed but I wonder if my colleagues were I should actually ask that well and and I'm not if it didn't happen to your colleagues I consent at diligence if it didn't happen to diligence it definitely happened at some uh audit audit a firm somewhere and so which which uh makes me want to talk to you about just like the state of auditing in general like how do you feel about where auditing is like as an industry do you think that the way

that like crypto Twitter and like the people that are relying on these audits like are appropriately understand like what the audit is telling you to safe and what's not or do you think like we still have a lot of work to do in just like developing this safety layer that you contribute to uh let's let's unpack that question so first of all I don't think people I think often people misunderstand what the role of an auditor is and like in general they put to too much uh weight on an audit well audit is just one kind of piece of a puzzle uh protocol security you can have all the audits in the world and still get hacked

um so I I don't think it's um right to kind of expect a stamp of an audit and just expect that it's safe um but uh also then yeah sorry I did ask two dense of a question but just picking off what you said there I think like the exact exact right a perfect example for this is the uh not the curve hack but the Viper hack right whereas like we can talk like we can say that curve had enough audits they needed more audits like it doesn't matter it does not matter how many people looked at that code because like the issue was in somewhere lower in the stock and so I think like that might be what you're referring to that like

auditing is not this like stamp of approval of security it's actually like this very specific thing yeah and in general like um that can happen right but even then we we kind of try to look at what like solidity version or Viper version the protocol uses so it's usually still considered but like I think Euler I forgot what exactly the the issue there was but like they were a serious team that kind of took security seriously right um and they had good Auditors and uh several audits I believe but uh it happens and there's like so many little things that people just might oversee once twice three times it's just natural and especially if the

system is very complex there's so many things that can go wrong and the more you work towards security the more of those you eliminate right and eventually you can eliminate them all but it takes time and it takes many many steps not just one step right so that is something that needs to be understood and I think um the the kind of problem people have with auditing is the fact that was in high demand and the market kind of dictated the prices to be rather high at least in the beginning of uh the D5 so that kind of misalignment with uh of how much people think they should pay for an audit and what they should get

um is kind of what makes people think this way I believe personally but um right the market dictates what it is basically so um but people have a little bit of a High expectation I guess from what an audit report offers them in terms of security well that was a super interesting Insight that you just dropped that like it that at least from your perspective which I am like fully agreeing with that it seems like the market started expecting that these audit reports represented a lot more and that might have been a result of the like Supply demand which resulted in a pricing problem that may still be going on or may be relieved in

the in every Bowl sorry in every bear and come back in every Bowl but um man it's just like another incredible example of how like everything really does boil down to economics yeah so because I've been on both sides right I've been hiring Auditors and I've been doing audits um and it is incredible how I can change sides depending on what I need to do right because um I do understand that for Developers um it's rather nice to be able to iterate quickly right as a startup you want to iterate fast you want to learn fail build again and get feedback fail again get feedback and then succeed

right like you want to iterate as much as you can but in in D5 each iteration is extremely pricey each iteration you do is an additional audit and that is frustrating right um but then as an auditor on the auditor side you know that there's a backlog of protocols that need to be audited is a very short list of people who can do the job especially if it's a D5 related where you actually need to understand the like a D5 Legos and like those financial pieces so there's a very few people that do it relatively few uh at least they're looking at the demand and then um also you have to look at what happens

if you make a mistake and your reputation gets bashed and you go for a really hard time and people start asking you to pay off their bug bounties and everything so people want you to share their downside but they never want to share your their upside with you right so it's a very ungrateful kind of position because you're gonna it's like I don't want to compare it to like a hockey golly because hockey goalies do get credit when they like um when they do good saves but it's basically like you don't get praised for doing a good job but you do get a bath really hard for missing something it's like you're

expected to do a good job but if you didn't you're gonna get like destroyed so nobody shares the upside only the downside so I also understand the Auditors here um it's it's around it's going to be balanced and just like you said is going to be like an economical kind of situation of who is ready to pay what and who's ready to do this job for how much now you're totally right to um like point that out and like I sympathy from the community to you like you're totally right like you will only ever eat [ __ ] if something happens and if nothing happens like people will forget you exist and like yeah depending on whatever your job is you you have the same joke but for your job it's like you don't know what a bad actually you don't

know what a good it person looks like you only know if they were dead once they leave right and like that's that's uh auditing World exactly it is like that and there's certain things that you can do right to kind of stay relevant as an auditing firm and like you can release products educational content and like be praised or contributing to the environment in different ways but you're not necessarily being loved for just doing your job which is kind of weird right you're you said you're are going to audit the audit but that's not necessarily enough all the time and you know honestly it makes me think of like a Trad fire accounting firms which do audit right like Enron like what we think of like Arthur Anderson and Enron like evil they like the the accounting

firm like really [ __ ] up and but like who's ever been like KPMG they did it you know yeah it's only when they [ __ ] it up yeah so um queuing into something you said about how it's it it not only is being a um let's say evm auditor A specialized skill but even more specialized than that is being a defy auditor like can you just like I I am sure what you're referring to is that like when you start building with composability and with money Legos like not only are you having to um audit your specific protocol and the lines of code that you wrote but you as an auditor now also need to like if not do full audits

like really understand the dependencies of all the other protocols and so can you just talk through a little bit like how how far out from the protocol that you're auditing do you need to look in order to feel comfortable um calling something safe or not yeah so a decent amount right so first of all you need to understand what um specific uh dangers are there on a particular chain that you're deployed to right so for example like on ethereum you can get front run sandwich or things like that right so that's one thing to consider immediately so you can't just look at the code and just try to find what logical issues are there you also need to like kind of look into what

environment it runs in then you need to understand what kind of um uh assets can be deployed in there right because some tokens are evasing some have re-entrate so you need to understand like what are actual like risks based on what assets are going to be held there then you see like what kind of information the protocol gives out to other protocols right if there's some price view functions those can be manipulated potentially and if they can get manipulated who is going to be reading those price seats and who can get hurt by that so and then another thing that's really important um is that you usually have a limited amount of time to to audit a project and um what helps is knowing the common D5

Primitives right like you need to know uh for example how staking usually works how liquid staking derivatives work you need to know like what a typical amm looks like or a typical Farm looks like you know how some options work if you don't you can still audit right but you're going to spend much more time trying to figure out what they do instead of actually how they do it and what could go wrong so this knowledge definitely helps so it helps keeping up with different protocols and like what kind of uh novel models they're introducing because it just saves you time during the audit significantly uh but yeah you do need to think like what are different protocols that can interact with with the code

that you're looking at what assets are stored there where it's deployed so you you go a decent amount um so let let's just uh like without like pick an example and one that I'm pretty sure you're familiar with which is Umami Finance right their their vault product let's say that they came to you and were like Ty we need an audit so for those for those that aren't aware Umami has a vault product that is essentially providing liquidity to GMX and then it's using so it's doing proprietary stuff in its own protocol while providing liquidity to GMX and then also has a side protocol that's external but it's

providing Insurance in case of like a deepeg or that kind of thing and then on top of that this whole structure is on arbitrum which is a roll-up on ethereum like with all those like different like are you looking into the code of GMX oh absolutely yeah you you definitely have to um at that point when it's so deeply integrated like they might be utilizing like a function ABC or GMX right but what if there's function like f that once you trigger it something messes up in the functions that Umami would be using so at this point you like you kind of have to look at GMX um very deeply actually do you need to

look at the like let's say an insurance protocol everything whatever they put in a scope you must look at what about arbitrum arbitrim probably not you need to know like how arbitrum operates what kind of interesting things can be done on arbitrary and which ones cannot but you don't need to look at arbitrum code specifically um but the GMX for sure like usually it's just everything that the protocol wants you to look at the files and anything that they're touching uh to a certain extent you have to look at so if they're touching GMX then and this this much you kind of have to very well understand what happens uh behind the scenes where when Umami interacts with GMX got it yeah that makes sense and

yeah it sounds like you basically need to go as you need to touch you need to look at everything within the evm that you're audited the company or sorry the protocol that you're auditing is touching you need to look at everything and then you might but probably don't need to look at the infrastructure that it is built on top of right and the usually you still don't look at GMX the same depth you're going to be looking at on model code obviously you're just like in certain isolated things that are um that Umami would be interacting with for example yeah I've got it um so a super interesting thing you said was in reference to like when you're working on ethereum mainnet like you need to worry about front running

sandwich attacks like that kind of stuff and so like it didn't even really occur to me that um not on like auditing is of course about like finding vulnerabilities but it's not in like the static world that most computer science in it's in this like very alive Dynamic and like this Mev World um and so I guess my question to you is like how much do you think about um like the the true like Mev research and the block building and like what's going on in there to inform like the behaviors that are going to appear um for the protocols that you care about so it's interesting that you bring it up

because on chain there's much less kind of activity where it's uh like typically called race conditions or something like that so I feel like fine like uh it's actually counter-intuitive but I feel like in a traditional hacking there's way more of those kind of situations where what if I call this function while I calling this function and then I just this one finishes a millisecond faster and there's so much more you can do but on ethereum no matter what everything is executed sequentially there's no multi-threads you know so it kind of eliminates us so much complexity like so much complexity so when you think about it this way as a single thread like front running and

just like sandwiching is this like kind of not that difficult kind of race conditions that you can exploit so you do think about it a lot but once you think about it um for some time it kind of comes naturally you kind of start thinking about like every function you look at it you're like what if I quote something else before that or like what if uh what if I can call function in different order than they were um like designed to be called so typically on on chain thinking about those kind of scenarios is not too difficult because you don't need to worry about like having multiple instances of something running or having like

um two functions called somehow in the same at the same time and trying to see which one executes first like it's it's kind of similar but it's usually like much more simple on chain so um which which I love the fact the fact that it runs kind of on a single thread it just makes my life so much easier and I think everyone's lives well for I mean threading is like oh obvious and now that you say it but the other one too is that in traditional hacking like you can lit like a DDOS attack is like literally free if you own the computers right whereas everything within the evm cost the attacker money and so like you oh you you'd be surprised the Dos attacks on Smart

contracts are not always that difficult so what does it go on there's often times like people just don't think that you can call a function with a certain parameters and then you call it like five times and then you break access to someone accessing that contract it's often where like uh one user can do something on behalf of the other user where the other user is just gonna break their funds or something so those kind of bugs we don't talk about them too much because it's like hackers don't necessarily incentivize to do those because they don't get any benefit but they can just ruin somebody else's life right and those bugs happen more often than not because people just don't

and developers don't think about them and it's like oh you call this function with this address but with that value and that user just loses access to a protocol or some [ __ ] um so those happen a lot actually so and it's kind of denial of surface it's just not distributed denial of service but kind of denial of service that is not distributed is actually very common like happens a lot yeah well honestly that makes me pretty nervous just because like I we're so I I do believe we're so early and like I think that like right now we can't think of reasons that people would be incentive incentivized just to come to cause that kind of chaos but like holy [ __ ] uh our world is like just people like setting fires for the fun of

it all over the place like that makes me nervous to know that that's a lurking problem here yeah I forgot what it was but that was like one of the I think it's one of the most famous bugs that every every kind of auditor gets introduced to auditing with it's like that I forgot what it was but it was a multi-sig wallet where somebody just posted like oh I accidentally killed it like um a lot of money was lost and I forgot the name it literally flew out of my uh my head let's just Google it it's so famous wait is this the parody yeah yeah exactly yeah like the guy clearly knew what he was doing like it's not simple experiment that you're in yeah he's like oops I accidentally killed it I don't

care thank you like he destroyed the implementation of the proxy and then it's like nobody could use their walls anymore and all the funds got stuck right he didn't profit from it at all but he just decided to run it and I'm like I don't buy that you accidentally killed it I feel like you just couldn't could control your genuine interest it's like the Adam and Eve and that Apple but there at least there was an apple and this guy just like uh it's just to mess mess with something yeah yeah I yeah I mean the only reason I even know about that story is because I read I entered it through the drama of

like hearing about people trying to push through ethereum like level consensus like a change to the parody wallet like contract specifically to get the eth out and like I um yeah that's a wild story I uh it is one day we just got to do like actually you know what Ty like I will like we'll uh coordinate but like it would be really fun to just do like a history of like the most crazy ridiculous things um that are like hacks or just like crazy stories like this um but yeah that would be cool I think that one is one of the most famous one uh it's because this is hilarious the guy just like breaked a lot of money and just like oops I accidentally killed it

up I'm like it's hilarious it was sad too but yeah definitely sad because like a lot of like real people like that was their money they got bricked but um I don't know I guess it's just more burned so yay like I don't know all right well anyway um that like I I don't want to take up your whole day here so Ty I just like really appreciate um your your thoughts and like I just learned so much about like what auditing actually is and how it works and um man you just you have so much to teach us and to teach me about um like the actual last step before deploying things to ethereum you know it's so easy to talk about like big

visions and like to actually just like hack things together but um like what you guys do and what you do is just like make sure that we're actually building infrastructure and not just building like a carnival that's gonna like fall apart and kill a bunch of people yeah definitely and it's a pleasure to talk to your ex all the time you ask very wonderful questions and you keep it going very smoothly so I appreciate that a lot wow thank you well before I let you go uh any like and work first of all where can the people find you and then anything you wanted to shout out or um let the people know like how do how do they get more involved yeah so essentially uh they they can always reach out to me on Twitter um if uh there's any anyone who's trying

to get an audit from consensus diligence you can also reach out to me on Twitter and then I'll forward you to uh the people who do the scheduling so that shouldn't be a problem uh but yeah just uh I hope people treat their smart contracts seriously and also believe that it has to be a Perfection that is completely bug free and then our lives are going to be a little easier a little more stress-free yeah for sure no and yeah stay tuned like make sure you subscribe to this podcast because like coming shortly I hope it will be that our next episode where not only will we do like hilarious or sad War Stories but we will do tips and tricks to uh make your auditor like you yeah that's actually there are quite a

few of them yeah or hate you depending on what you want yeah all right man again this is such a pleasure and I really appreciate it and uh I'll talk to you soon yep thanks Rex bye bye foreign