Bolstering Web3 Security Across Smart Contract LifeCycle by Jose Paul

Transcript

let's talk about ball string vet 3 security um I don't know how many of you guys are devs here but I'm sure all of you guys are building in web 3 so the way we look at web 3 is that it is money Legos right we have figured out D5 where you know each piece adds to a new piece um we figured out reaking now reaking has given birth to a bunch of different protocols so what keeps this as money Legos is the security part that comes in between if there is no security this just becomes Jenga it just becomes money Jenga you pull out one piece the whole thing comes crashing down so which is why we3

security is something that is to be taken very seriously in today's environment now that we are running into trillions of dollars of market cap so today I thought because of that we will have a small discussion about how how to stay safe within V3 and how to ensure that your smart contracts are safe from day one till whenever you're upgrading it if we take a look at the yearly smart contract deployments we can see that we are on a rocket ship to the Moon right so in 2020 we were at 16 million and today we are at 1 billion plus smart contracts and this is a bunch of smart contract data that I could pull from Dune

I'm sure across all the other chains there are way more smart contracts deployed today but if we also take a look at what has been happening the growth in the space hasn't really correlated with the security in 2020 we lost 500 million in 2022 that went up eight times right so when you involve large amount of money and the money is in the code and if the code is hackable there will always be incentive to hack the code so if we take a look at why these things are happening what we can see is that out of the 1 billion smart contracts that has been deployed I can tell you we did thousand

plus maybe the bunch of other security companies out there they've done maybe 10,000 20,000 in total or maybe let's say even 100,000 95% of the smart contracts are not audited and almost all smart contracts are not monitored now why is this bottleneck present why is that things are not getting audited right the number of security researchers available that is less the scalability of it that is questionable there is high cost associated with things because of the lack of skilled uh security researchers and the scalability issues and tool set barriers we don't have

enough number of tools which helps the scalability issue with within the security and training and awareness it's again one of issue that we have we don't have enough new people coming into web 3 security to match the demand that is there today so if we look at take a look at how smart contracts or when in a web3 business how things goes first somebody comes up with an idea that idea becomes a business logic and from that business logic you move it into smart contract code so this is the first stage this is the development phase now how to stay safe while you are building your smart contract unless you are building

something groundbreaking always use community wetted libraries unless most of the applications that we see across new l2s new l1s that are launching is the same amm the same lending and borrowing protocols so you don't have to reinvent the wheel but you need to use Community wed libraries and try using as much AI gener Creed prev vetted code as possible while you're writing converting your business logic into smart contract code now you written some code what happens after that this code might have some basic vulnerabilities that uh AI based audits will be able to catch there's some static analysis Dynamic analysis

that you could do on it after which you are kind of assured that there are no basic vulnerabilities present in your smart contract code things that we all already know of right your re-entrancy attacks your arithmetic underflow overflows these kind of attacks will no longer be present if you clear all your smart contract code with uh AI based audits now in your predeployment phase you might have some crazy business logic inside your uh application for it to function the way it should function so get manual audits that is I can't stress on this enough AI based audits at today's capabilities do not cover business logic or or certain hidden vulnerabilities that might be present so

during the predeployment phase always ensure that you're doing manual audits so that you from move from Smart contract code which has no basic vulnerabilities to basically smart contract code that has no vulnerabilities and always get multiple audits done because one set of Auditors might not have seen something that others said more eyes on the table are always better for things now we are you have launched to the main net then what right this is where most of the projects lack today everybody since it's a practice for your projects tokens to get listed on an exchange everybody ensures that you're getting one manual audit these days but post

deployment nobody is really monitoring what is going on now how to do that right there are applications which allows you to monitor your smart contracts which will ensure that some State variables which are present inside your contract some functions that are present inside your contract these thing there is always a onchain monitoring happening and when it falls below a certain threshold certain values you can set it up in a way that let's say if it's a staking contract and it's your most important variable is your balance if the balance is falling below a certain threshold in a certain time stamp in a certain time period Then There are two things that that you could

do set up alerts so that your devs go into a war room and figure out what is going on and set up incident response which is circuit breakers if you set up circuit breakers what happens is uh after that point all the transactions will stop and you can go figure out what is happening and only after that once you figure out what is the issue you can get another audit done on the fixes maybe inform your community about what is going on and then then reestablish connection with an up upgrade your contract and get it live up and running again so smart contract monitoring smart contracts also will allow you to

um stop your contract from interacting with sanctioned addresses if they are required so all kinds of suspicious transactions will be monitored and will be alerted so a bunch of times what we have observed is that a lot of the sanctioned it is from the sanctioned wallets where these attacks come from or gets funded from if you take a look at the 4 and six of the attacks so our suggestion is set up monitoring for all your major smart contracts where all your balances are being held at least now how do you do all this right we have a solution of course uh so during the development

phase you can utilize our a driven recommendation with the static analysis and dynamic analysis to prevent common vulnerabilities using Quil Shield so once your development phase is completed you can reach out to quill audits our mother brand who will do the manual audits for you and post deployment phase you have to enable onchain monitoring and set up incidence response both of which are coming up soon in coil shield and there are other people in the market providing the same Services you guys should check it out if you can't wait till then uh um by Q Q4 of 2024 we will be ready with quill Shields post deployment Security Solutions as well so I hope you all

learned something about how to stay safe with your smart contracts across its life cycle thank you