Secure your Dapp or join the REKT database

Transcript

cool thank you all for joining last session of the day hopefully for all of you guys my name is Christopher I work for polygon Labs I lead the application security team over there and I'm going to give you a couple of pointers if you're building apps in this space on what you can do in order to make sure that you don't end up in this list and just to be clear I know the title says joining it's not about if you're going to join it's about when you're going to join and the way that you're going to join and hopefully after the session you're going to join over there at the bottom right and not over there on the top left okay because it's just like death you're you know having a a hack a bug a manipulation in your smart contracts your application

it's going to happen so make sure you're prepared for it um just very quick I know you've seen this hundreds of times especially in this uh in this event there were a lot of a lot of use cases regarding this and showing it but you know just a couple of examples you know running hack very common one hacked private Keys yeah that that led to a huge huge huge huge exploit on a bridge the badger hack they've had nothing nothing to do with smart contracts really there was an injection in a JavaScript code that made people interact with a different smart contract so actually the problem was on the front end was on the app on the upside uh coin check um in this case you know bad bad opsec

bad just security practices in general and strategies they connected a hot wallet directly to the internet like come on you're you know you're like hack me please um next one Nomad um this is a very very very good one and that shows that it's very very important to be methodic on when you do changes not on your smart contracts but on anything you do from a technology perspective now in this case there was a poorly managed change they did an upgrade to a Smart contract that introduced a bug and basically the rest is history you know for them 140 90 million and I've not heard about them anymore and the last over here the cream.f finance attack this is very specific obviously to Smart contracts it was a

flash loan attack but it was an easy one it was an easy to detect one like if you would have hired just a very simple auditor potentially even one from Fiverr he would have found and told you like hey this doesn't look great so um you can categorize a lot of these hacks and almost every hack every bug and every issue in three categories the problem resides with people the problem resides with technology or the problem reside with processes I assume everybody recognizes one and two but number three is probably only for the old people over here like me that is home alone's plan for when the you know Intruders were trying to get into home

and it's really good because it explains security at its you know completeness and the fact that it's defense in depth you have to have multiple layers and that's what the kid from Home Alone actually did he implemented a lot of security measures in order to avoid to fatigue to slow down the the hackers in this case we're not hackers no but basically to steal the house so this is a slide this is basically uh where I think you know if you're interested you can take a picture this is a kind of a checklist most of this is all free tooling that you can Implement you do not have to be a security guy you do not have to have a 10 person security team in order to do any of these things

you don't have to hire a very very very expensive tier one auditing company to at least have the basic security measures in your smart in your applications in general so first of all if you're a development team if you're small if you don't have a security team just choose somebody somebody smart somebody that cares somebody that you know and and just tell them dude you're gonna spend half a day or a day every week just thinking about how can we make our application more secure um next make sure that you're training to a certain degree your teams around phishing passwords uses of MSA MFA I know that you've been hammered with this you know all day in all your lives I

hope so um but still very important very easy to get and last but not least if you're a developer if you work in devops or anything like that understand the basics about security and how do you protect yourself so OAS top 10 a really good one a couple of free resources on the bottom you know that you can get over there this is mainly training stuff second over here test and secure your stuff now testing obviously can have a lot of lot of lot of different measures a lot of different layers but start by aiming for 100 test coverage now test coverage is not perfect but I saw so many different hacks so many things that come through different bug Bounty

platforms that just very simple unit testing would have found it so aim for 100 test coverage I know it's kind of impossible but aim for it and don't assign just one person have multiple people trying to do to build those test cases because it's all about imagination um now screen saver uh Second Use security scanners there are hundreds of security scanners specifically for app layer so for web 2 for web3 there are not too many a couple of them sonar cubes later obviously for web3 sonar cube is free sonar cube is amazing for the app layer and it's free you can use their obviously hosted version or you can host your own it's

really really good security scanner sorry I'm losing my voice a little bit it's been a tough couple of days with definitely security Summit so bear with me um GitHub obviously provides things like the penderbots they also have their own code ql stuff you can also use sneak for free so um those are all three tools you should be using keys I'm very tired of seeing dot Ms in GitHub repositories and I'm very tired of seeing just keys in general in GitHub repositories so I know it's convenient it's easy you didn't notice you didn't have a git ignore or something like that but please please stop doing it and the best way to prevent it is just Implement GitHub security scanning get guardian or

truffle hog they all have free versions very easy to detect the basic AWS key that is going to wreck your whole infrastructure uh penetration testing and security audits that's uh you know tough topic obviously it costs money but it doesn't have to cost money like you can you know if you don't have money at least at least higher and auditor from Fiverr it's better than nothing you know have other people look at your stuff um if you only have 100K don't hire the top one trail of bits you know 100K audit get three medium tier two of it that will be much better than one big one to be honest in personal opinion huh um and that's on the other side follow

best practices and standards um for those that are new in the engineering World those that are new on the crypto scene and all those type of things all of this has already been created there is no reason that you need to recreate incident response processes there's no reason why you need to recreate CI CDs best practices there's no reason why you need to recreate bug Bounty and responsible exposure programs it's exactly the same it's just another language another technology but the processes the standards the best practices they're all there he knows it all um really not just how do I do an incident response plan how do I manage change management Char TBD they will

it's good enough it's really good so a couple of recommendations over there these are all clickable you'll you'll get linked to the slide afterwards how to set Branch protection rules in your GitHub oh yes Cloud Fair please Moody talked about it already a couple of hours ago stop using namecheap sorry if there are any name cheap fans over here stop using namecheap please use something better even GoDaddy is better than namecheap but if you're using namecheap at least make sure that you're protecting your domain that nobody can change it cloudfare offers the same and offers a lot of great tools like DDOS protection WAFF and many other things for free for your domain so look into that a couple of extra info that I really

like from people that are actually here in this conference some guides to security from Emiliano bossy that's really really good it's all about personal security and also about just General application upstick and all those type of things web application security checklist checklist if you know for your front end um some opsec stuff this Twitter Thread about low budget of it is really good it really explains very well depending on your budget how can you get a good value for your money in and of it and yeah other stuff traffic hack Labs if you want to retry some of the old hacks and some other tour guides over there so I made it with my boys basically so thank you very much hopefully you all enjoy

the event and uh yeah if you have any questions feel free to reach out thank you we have one question thank you quick question on the the last stage let's say you deployed a dab and what do you what we always found challenging is kind of the end-to-end test and or QA at the very end seeing it all play together even maybe testing with real funds on a layer two what's kind of the latest and greatest there what would you recommend how far should you go can you go with automation of maybe even deploying the

dab automatically testing with some yeah definitely cicd is is if you're good at it if you're good at setting up you test cases and then making sure that they run automatically every time you push code every time you know some new commit comes into it that's gonna solve a lot of the basic stuff but it depends on how good your unit tests are for smart contracts what is really good is that you can directly in your CI CD actually Fort Fork the network and test things like with you know thousands of ethereum or thousands of uscc to make sure that your app is actually behaving however you expect especially when you have an inflow of a lot a lot a lot of funds so um yeah but it all depends on how good your test cases are no you still do

manual QA at the end yeah yeah the teams do a lot of manual query to be honest especially for smart contracts I would say for uh for normal appsec web 2 applications you have a lot of tooling that already do all of that but for smart contracts in general there is very little so there's a lot of manual work that needs to be done and that's why it's important to have multiple eyes on it and that's why I say like yeah one big audit will be very good but it would be better if you can have multiple because then they can see all the different test cases you will have different perspective and the same from your team don't have one person build those test cases have many people at least brainstorm what those test cases should be thank you good thank you thank you