DAPPCON 2024: dApp Security: Creating A Trusted Web3 Space - Mike Krupin

Transcript

today we will talk about uh the most uh I think one of the most important uh problem uh and topic uh in the web3 area at all it's about security security and Trust especially with decentralized steps but before we starting I will introduce a bit uh the project that I'm working with my team uh on so it's block Scout it's it's a open- source Explorer uh many of different chains can use it uh uh like any times for their own chains uh as well we uh help them uh to host their in uh infrastructure uh and if they don't want to like do any uh like work uh on Explorer on their their

own we can help them with this one and in addition to uh open source Explorer we have different vectors like directions of development like we are working on uh marketplaces we are trying to uh like simplify the um like interaction with transactions of U um uh on blockchain trying to just entrepreneur them uh and many other stuff uh so let's back to our topic and uh uh this the first question is like what is the biggest uh problem in web 3 right now and uh it's uh to be true like it's not so simple question but I think it's obvious uh it's uh because like many of users uh can be hacked and scummed every day by anyone

by projects by nft collections by anyone so this is the one of the biggest problem that we have right now uh and we can see like many different examples uh how it happened like one two three four many of them uh and uh people lose their money uh because of hacks especially because of uh hacks on uh in exploits on Smart contracts and if we can check uh the tendency uh then we can see that uh the the tendency of Hax is pretty the same uh but uh of course like there is a decreasing decreasing of the number of losses that uh user that was that were stolen uh it's something good but as I said the tendency is pretty the same um

and if you go deeper inside uh um inside all the hacks uh and what happened uh we can see that uh most of uh uh assets were stolen uh by from def platform so 63% and many of hacks also happened uh uh on Def platform so it's 50% and all this data from crime report by chain link um if we go one more time deeper uh we can see that uh most of uh like hacks and primary target of attackers is smart are smart contracts uh almost like 30% of all attacks uh happened uh with smart contracts uh there are like different categories of attacks uh like

vulnerabilities directly on Smart uh smart contracts of a specific protocol or if uh attacker trying to find the vulnerability of another protocol to hack another protocol so yeah um if we can see like like we we can see here that around $2 million were stolen uh on chain because of different vectors of dech on Smart contracts uh and this is a big problem um and uh yeah for now I just want like quickly uh go to Wormhole hack just to understand like more deeply what happened uh with uh this kind of uh attacks and hacks so uh yeah Wormhole is a uh like brid protocol that helps like

to breach their assets um users assets and uh there was a hack um like there was a hack that uh where users um lose their like a lot of money and uh what happened is that like the one of the uh key um key thing in Wormhole protocol uh was like a bridge smart contract uh and uh this smart contract has uh um their own like uh Guardian uh like a guardian cryptographic that uh uh checking cryptographic signatures and the main uh attack was exactly on this smart contract uh what they did they uh created a fake cryptographic uh security uh cre um fake cry cryptographic

signature and uh uh used it for this Guardians and uh uh this Guardians like uh check uh like false check security uh bypassing check security uh of this uh signature and because of this uh they could meant like w and then Bridge it to uh mayet and then like um withdraw uh their East um east east product uh East tokens um this happened like uh in a couple of I don't remember like this year or maybe one year ago and uh because of this uh users uh lost like around two uh $200 million it's pretty big uh big amount uh especially for users who are just like uh like IR

regular users um and uh like as I said uh the main focus like one of the main focus for Block Scout was uh to create a trusted and secure space for regular users who are just like they can just open uh like one place get like information about Market about D apps and other stuff so it's and they will trust this space that's why we're starting to work uh that's why starting started to work on the app Scout uh so it's uh uh the place uh where we try to aggregate as more as possible different information onchain and offchain and give a user uh a really simple uh like

report uh or a score uh about the security of a specific protocol um so uh the IDE is like pretty simple aggregate information and show something simple to a user and uh uh when a user try to find uh an app for a specific use case for example for a swap to make a swap of uh token on one chain they can go uh to our Marketplace they can uh click on a swap category and get the list of all uh all apps and sort them by uh security score uh this security score is uh uh we are getting it by checking all contracts uh all smart contracts of a specific protocol and checking them through a solidity scan so solidity scan uh has

different validators of like divided by different categories so they're just checking different uh different aspects of every smart contracts and just uh uh show a security uh level of uh uh the specific smart contracts and we are just like uh aggregating this information and showing it as a simple report here uh in addition to all this information we also showing uh like the list of total number of smart contracts as well as number of verified contracts um yeah so it's pretty uh useful information and it's uh something that can help users to understand what they can use um uh and in addition to all of this uh users also can interact with this specific uh uh

like with specific uh D app uh directly on our platform and in addition to all of this they also can uh forget about the reconnecting wallet every time uh because they need to connect it just once to block Scout and then it will be automatically connect every time to all apps uh also user can get uh quick access to uh all information about the protocol like social uh Social Links description uh security information smart contracts and also uh a bit later there will be information about uh like um like a social input from uh other users about this specific app um and as I said uh previously um the uh like one of our hypothesis

that if we are uh collecting uh as more as possible different information about D app uh onchain offchain data then we can create a more uh trusted and secure space for daab so it's some kind of uh profile of D app um yeah and uh as I uh also mentioned uh couple of minutes ago that we're also working on a social input for our Marketplace so the idea is here that we want to um aggregate information like um feedbacks ratings reviews from users but not from all users we want to uh add only users uh only reviews and ratings from users who interacted with smart at least one smart contracts of a specific

app uh so this can help uh to uh filter some boats or uh just a fake review use um and also uh in addition to this one we uh we are working uh uh closely with open rank just to try to uh use their graphs and uh get information about reputable users to uh show them uh at the top of this ratings and reviews uh so users can uh like see uh like a familiar faces from warcast for example from lens uh and like get information and reviews from them exactly um and also uh like in addition to ratings and reviews we also want to show some basic uh analytics uh for specific apps

because it's also one of the important um piece of information that shows a user the popularity of the protocol and he also can understand like should I use it or not so um that is what we are doing uh right now uh we are uh as I said we are collecting all uh possible information uh to give a user uh like a uh App Store uh in web3 so they can just go in it discover different apps for their use cases and uh just get as more information as possible and solve and decide for themselves like if if they want to use this specific app or not yeah so thank you very much uh yeah if you want uh to yes if you have any ideas

regarding uh how we can improve our services if you have any questions feel free to contact me here and also subscribe uh follow us on Twitter and and get information or website super thank you Mike uh now if you any of you have any questions we have five minutes for some Q&A oh just one minute that we get the mic hi and I'm a a sponsor of um BL GitHub by the way I've been a big fan of

the product what's the demand you're seeing for the DB Marketplace so far are you observing the dabs buying Into The Narrative of decentralized front ends uh yeah uh it was one of the hypothesis that we are uh try to focus a couple months ago uh to offer them decentralized frontend hosting but uh we faced many different issues uh with settings because like every project had their own uh settings environment variables and other stuff so we are just uh uh launched a couple of uh um such uh cases uh with such uh uh with several uh apps uh the most demand for now that like we got from uh service with our um

with our users that the top three um important stuff when they're interacting with the apps is like uh security uh so to get information what like is it secured app or not like it's just some abstract but we are experiment ING with this information and also uh the the second uh thing is to get uh as more uh information like from real users it's like reviews ratings and maybe not ratings but mostly reviews just to understand like what users think about other uh D apps that they interacted with so that's why we are creating uh Marketplace like uh for this case uh for example and also it's also useful um Place uh for small chains especially

like when we help uh when block Scout helps to uh deploy small uh chains uh this Marketplace is the place where users of these chains can go and find like what uh what apps are available here on these chains so it's uh some kind of defy Lama 4 or the operator for small chains something useful in this case as well thank you uh any other questions oh sorry vishka a minute thank you how are the applications included in your D Scout yeah uh we have uh um I think uh three or two main uh

like inputs uh how we can include uh these D apps to our Marketplace the first one we're just uh discovering and trying to find something uh interesting some new apps that we can include uh manually also uh any of projects can go to to uh our Marketplace and just like submit information about their uh about their app and we review it and include to our Marketplace as well and sometimes uh our partners or chains they're also contacting us so we can add uh this information to uh to our Marketplace yeah and also like uh we have uh uh is the first place how users can add their project it's we have uh uh a submit idea button so everyone can also um like offer their ideas regarding what they

want to see in our Marketplace yeah so these things super any other questions we still have some time okay here in the front curious about the uh process of leaving reviews um you could theoretically still spin up Bots that do at least one interactions on each smart contracts and then they just leave reviews how are you planning to solve that uh yeah it's a good question uh yeah so I think like uh in the first version we are just uh launching this uh

reviews as I said like just if a user interacted with like an address interacted with this specific uh like one of the contracts then he can leave a reviews but then we'll just need to check the tendency uh if uh there will be like such cases that you describe um and then I don't know like we can uh uh introduce some kind of timeout for uh such review so uh only like users one one address per day can leave their uh like reviews but I understand yeah that could be like many of different addresses yeah it's it's a good question I will write it down yeah yeah it's a good good uh good point um yeah interesting because like uh the

only thing that we we saw the user flow that they need to connect a wallet uh and when they publish uh their reviews they need to see sign the message so yeah this uh kind of things and the cre criteria that they need to interact with a smart contract but yeah uh also like we can use some uh that you offered like GitHub passport but it shouldn't be uh something crazy like just to read their reviews so it should be something simple but at the same time it should be useful so just to filter out some boats and spams yeah agree well thank you guys uh we're going to take a little break and we're going to start over at 5: so I'll see you guys in a bit thank you thank you