From Chaos to Confidence: Understanding and Predicting Transactions - Etienne Waldron

Transcript

[Music] Hello everyone, my name is Eten Waldron. I'm a developer advocate at Ledger and today we will see a little bit about how we can better understand and predict transactions. Uh we are going to compare blind signing with clear signing. We will see a few examples of recent scams and we will talk a little bit about how we can predict transactions as well. Um little bit this is not the next slide. Um so Ledger is a French company.

It was created in France in 2014. Um we make hardware devices that help you secure your cryptocurrencies. Uh we have sold over 7 million of these devices so far and uh today we secure over 20% of the world's crypto assets. Um our devices are secure by design and this is done through the combination of a secure element which is the chip inside the device as well as the secure display which is immediately on top of this chip. Um what this means is uh it guarantees that what you see on your device what you see on your ledger is what you are about to sign. Um our mission is to secure web 3.

I'm sure you're familiar with our devices. Uh, show of hands here. Who has had a Ledger Nano in? Okay, most people, which is very good. Um, and more recently, we announced the Ledger Stacks and Flex, which are new devices. They have a bigger screen. It's an e- in screen, and it's very practical for the use cases we will see today. Okay. Who here can tell me what this transaction does? Anyone? And uh if you're having a hard time, you are correct because this screen only shows a message hash and the hash is not understandable by a human.

It's very hard to know what we're about to sign here. Um and this is typically what we call blind signing. In blind signing, it's very hard to understand if it's a legit transaction, if it's even the right contract or function. Um maybe the payload is malicious or we're authorizing something we don't mean to. Uh blind signing is a lot like signing a blank check. You would not sign a blank check. Yet sometimes you blind sign transactions. Um the general rule is if it's unreadable, it's also unpredictable. And if it's unpredictable, it's not safe to sign. Uh getting scammed is not fun. I think we can all agree on this. Uh I've

shown a few examples here. Uh, we can see the Werx hack where $230 million was stolen. So, I want you to really take a moment here and understand how big of a number this is. Um, and if you're a bit far in the room, I'm I'm going to read to you the sentence from the Cointelegraph article which says that one major cause of the hack was the necessary practice of blind signing token transactions from hardware wallets. And because the destination address was not shown on the screen, it's very hard to know where we are sending our tokens. Um, and what's interesting here is you might think you're safe because you have a hardware wallet, but the reality is you are only safe as long as you understand what you are signing. Um, on the right, again,

really big numbers. Over nearly 300 million was stolen in 2023 with the Inferno attack alone having 150,000 victims and $108 million stolen. Uh you may be familiar with the recent bybit loss where $1.4 billion was stolen. Uh this is just another example of why it's important to understand what you're signing and being able to predict the the result of that transaction and uh clear signing actually fixes this as we will see very soon. Um so yeah these attacks are not theoretical uh unfortunately uh we've been signing transactions on ETH for a decade and uh we are facing this

reality. So yeah something needs to be done about it and that something is clear signing. So in clear signing for example we can see here the same device ledger stacks uh we have three screens on the first screen we really put into context we are about to swap tokens if this is what we want we continue and the second screen here is the main screen where we can see exactly what we are about to sign. So we can see we're interacting with the contract from 1 in we are about to send 1,00 wrapped matic and receive 554.91 USDT. We can check if the receiver is correct. does this match my address? And if everything is correct and we're happy with it, we continue by

holding and signing the transaction. So, this process is transparent. Everything is right there. Uh, it's human friendly because it's written in English. It's very understandable and it's empowering because we feel in control. We know what we're signing and we're comfortable signing it. Here's another side-by-side comparison where we can really see in one image how clear signing is much clearer than line signing. Um yeah, so how does it work? Um first a little bit of context. So on the top here we have everything Ethereum related and the bottom part here is is how Ledger reacted to all of these changes. So we have the first ETH transaction in July 2015. Um a year later we had basic

message signing through EIP191. Uh in 2017 we had typed data structures which was an improvement on the previous EIP. Um and on the Ledger side we have the ETH app since 2016 October 2016. Uh but the key message of this slide is that at least clear signable as much as possible but it wasn't really standardized until 2024 with the clear signing initiative. So it's actually an ERC ERC 7730. Uh and the purpose of this ERC is to make transactions human readable. Uh you might think okay but we have the AI why don't we use that? Um and actually AI don't really get you far

enough. Uh we can see here immediately that the the intent is not very clear exact input single. Um we can see a row token address. So if you compare with the previous screen where we had wrapped matic or USDT here it's not very friendly. and uh as well as the amount in base unit which is not very understandable for for humans and sometimes you may have unnecessary parameters because it's not very flexible in what you want to display on the on the device. Um so I tried to synthesize clear signing into different components.

So we have three phases really the creation validation and integration phases. So what's really behind clear signing is a JSON file. So we ask DAP developers to create a JSON file related to their smart contracts which will essentially describe the functions of the smart contract and translate them into human understandable terms. Uh and to create these JSON files we have at least edition tools which makes it very simple to create JSON files without any code. Um it's really simple. It takes roughly 10 minutes to do which is very nice. Uh once these JSON files are done, we are sent we send them to a public registry. So it's open and transparent.

Um you can also check other JSON files on the on the registry. Um and uh the endorsement right now is done by Ledger. So a security team at Ledger is is endorsing these JSON files, making sure that they match the smart contract and that no function or variable is left behind. Um but really the magic happens in the integration phase where all of this data from the JSON file will be parsed, filtered and formatted uh to be prepared to be displayed on the device. And finally on the bottom right if you have a ledger device you can be sure that what you see on the screen in the final flow is what you are about to sign JSON file. I'm sure you're all familiar with uh what a JSON file is.

I've given a a QR code here if you want to check out an example of a clear signing JSON file. But yeah, JSON files are human readable. It's understandable by machines, by humans. It's very practical, uh, lightweight and efficient. It's very easy to nest data to add new fields. Um and on the left here on the top part we can see that uh the amount in uh was renamed through the label variable uh amount to send which is more friendly and the format is token amount which is exactly what we want. Uh on the bottom part here we have a required field and this will essentially this is where we choose what fields we want to be displayed on the device when signing happens.

Uh implementing clear signing is very simple but it depends if you're a DAP or a wallet. Uh as I mentioned if you're a DAP we have JSON creation tools. Uh there's a few slides at the end of this deck that that shows these tools. Uh and then you just submit the files and you're you're done. Uh for wallets it might be even simpler. Um if you use the new Ledger device management kit which is a set of tools to manage the connection to devices to wallets um then you're actually good to go. uh clear signing is embedded in the new device signer kit. So as I mentioned the new device management kit is a better way to interact with ledger devices very practical for wallets. Maybe some of you know the legacy Ledger JS set of libraries. Uh this aims to replace that.

Uh so it's very easy to manage devices exchange data you have state management where you can see if the device is on offd um you can call OS commands directly which is very nice and practical. So yeah, it's a replacement of Ledger JS. It's very new and very practical. Little bit about last year. Um so actually clear signing the white paper came out roughly around the time of East Denver last year in Q1. Um we then held a request for comment webinar where we invited key opinion leaders and partners to comment on uh on this white paper following which we made a few technical refinements. Um but yeah, it's not just a ledger initiative. It's collaborative.

Um and uh the standard was published in Q2. So ERC7730 as I mentioned. Um in Q3 we held a demo on stage with Rabby where we did a 1- in um transaction. Um and we were also able to clear sign permits uh around the time of ETH Brussels. And and lastly in Q4 is where all the tooling came out. So we have the new device management kit as I previously mentioned as well as the public registry and the JSON creation tools. So we will now see an example of how A might clear sign their smart contract using the JSON creation tool. So the first step is to enter the

contract address. So here we took AB's contract address. Then we have a bunch of metadata to fill. So typically the context information, we have the owner here, the legal name as well as the URL. So pretty straightforward and simple things. Um and then we craft the screens. So we can see a pre preview on the right on Ledger STAX devices of what the transaction will look like in the end. We have chosen to clear sign the borrow operation from the A smart contract which we renamed borrow tokens. Um we can also choose to dismiss fields to hide them uh every unnecessary field and yeah so we've renamed amount which is not very you know which amount are we

talking about and we renamed it to amount to borrow which is more friendly as well as the interest rate mode. So yeah just a form very simple uh with a nice preview on the device and finally you just download the resulting JSON file and you submit it to the same registry I mentioned before. So again, you have a QR code of the registry if you want to see examples of other uh smart contracts on there of the main DAPs and how they might have done their JSON files for clear signing. And yeah, then a transactions are ready to be clear signed. Then you have an example on the right here of what it will look like on actual devices. Uh so what's next? Uh right now we're really in the phase of education.

We're doing many workshops um on boarding many dabs trying to get as many JSON files uh on the registry and we're also looking into clear signing account abstraction and externally owned accounts. Uh but really uh although it's very nice to clear sign Ethereum, it's not the only chain out there. So we're also working on other chains making sure clear signing is not just an Ethereum thing but a global ecosystem uh initiative. However, uh understanding transaction is is nice, but it may not be enough. Uh humans are not perfect.

It's possible we make a mistake. And uh for this reason, we also recently announced transaction checks, which is an optional feature that will simulate the transaction before it actually happens to understand if you're about to interact with a malicious DAP or contract or address. Um it's very complimentary to clear signing because clear signing is the human element of it. It's your assessment as a human and this is the machine part with um you know the transaction checks. We can see on the right here an example of a threat being detected. So we can see the name of the provider here. We can choose to accept the threat and continue which is obviously not always recommended. Um yeah uh how it works is pretty simple.

So the transaction is first trusted in the wallet and then it's sent to trusted third parties who are going to simulate the transaction conduct a risk analysis return that risk analysis so the flow the clear signing flow can be displayed with the risks on the device. We can see here examples. So on the on the left is a transaction which had no warnings. Everything is fine and we can continue to clear sign it as we always have. And on the right here is where it's interesting, where a threat has been detected. And um what's interesting here as well is that you can choose to view the details of why this transaction was flagged as malicious.

And uh it's yeah, it's very nice to have more information and not just a warning. There's a few useful links you can check out. Um the developer portal is the Ledger official documentation. There's a full team working on the documentation, making sure it's thorough and accurate. So we have a whole section on tier signing on there. We have a homepage as well about tier signing with um more general information as well as the repo I mentioned and the blog posts if you want to keep updated with the recent changes not only for ledger but for the overall ecosystem as well. Thank you very much.

[Applause] [Music]