#DappCon22 :Day 1 - Battling Anxiety: How To Make PPL Feel More Comfortable Using Web3, Bogdan Habic

Transcript

I cannot actually see you from the light so it's much much less anxious for me so uh wasn't part of the talk I just want to Echo what Martin said that the social part of all of this is extremely important I think us as Engineers really think that we can fix everything with tech that unfortunately isn't true so everything that he says 100 agree so it's a strange start to a Monday morning basically uh we need to get little flipsy and not be not be anxious about all of these things but the mental health talk is definitely a good start so other than uh battling anxiety it's generally how to make people less anxious when using web3 and this will actually be a technological talk even though it maybe doesn't sound like it but before we start as this is the first

slash second talk uh of this morning I want to stand up when I say something for people to stand up so if you're a multi-signer so if you have a seat on a multi-sig please stand up foreign good okay no no keep standing up sorry sorry yeah you're gonna stand up for the longest okay second group of people you did the swap on any aggregator whatever and the price was widely different from what you wanted to do please stand up great okay a failed transaction that costed you more than like 50 or 60 bucks in Eve please stand up are we feeling anxious yet

okay everyone can sit down and you're gonna see why we did this other than my speaking coach telling me I need to get people get people active before we all start so the agenda for today is we're going to talk about four topics they're uh By Design ambiguous like this but we're going to talk about the couple of problems that we see before even sending a transaction the second one being is trying to tackle one of these and we're going to talk about how you can do this yourself or by using different tools and services the third one we're actually going to look at the very very good real world case that tackle this problem and see how it is performing and then finally under the hood type of thing how this actually all works in the background so let's start so a lot of people when we're talking

about blockchain development or how we tackle things we talk about what happens after we send something Unchained so is there going an exploit going to happen uh how do we listen for events and a bunch of these different things but there's actually a lot of things that need to happen before we even send the transaction I'm not talking about the user signing a transaction I'm not talking about for example I don't know uh connecting multiple wallets I'm talking what a developer team can basically do to alleviate future anxiousness of their users so we can look at three distinct categories there's actually much more but the projector is just as big so we we're going to talk about three only so the first one is generally trying to make smart contract development easier more accessible and more secure so here come

your audits here come your educational material for developers here come foundry's car kids truffles of the world uh here comes all of the formal verification things that you can use to to make things safer it's also very important I think to lower the barrier of entry for this particular thing because I think blockchain still perceived as a very very complex topic the second thing is and I think this is being tackled the most out of these three is educating users about this Brave New World so what's a mnemonic what how to send transactions how can you lose funds and all of these different things and then the third one that we will do which I'll read very quickly to make you more anxious is helping the world developers as well as retail users know what will happen before writing something into a ledger

that will there and be until the end of time I didn't practice well this well but but yeah but let's remember when you send something on chain it's there forever so the third one is actually simulations and we're going to talk about that a bit more but let's start with the story why web 2 is crap and a real world thing that happened like six days ago so uh I'm from Serbia we have a currency called the Serbian dinar which wasn't the most stable thing in its history one of the sponsored packages actually at Thief Berlin is called the Serbian dinar for example a beer during the 90s costed like five six million or even more sure million dollars so anyway six days ago I was trying to make a purchase of around fourteen hundred dollars I went to my bank's app to see

the currency exchange ratio and in general one dollar is 160 Dinars so we are packed to the Euros so the dollar is kind of doing this but anywho so I thought okay sure I can do this over my credit card expense it I'm not going to exchange the money the money will be exchanged by itself so I swipe my credit card and the bill should have been 162k Dinars more or less but when the statement came in it was 106 70k Serbian Dinars so if you look at it the the slippage I got from my bank was around 70 dollars lost so what happened here is the bank is a very good friend of mine where when I was signing the terms of services if I by hand exchange money

then I will get the better currency ratio but what actually happened here because the money was converted automatically I just didn't click a button in the app I basically lost 70 bucks because instead of 160 Dinars the currency exchange ratio for some reason was 120 20. 122 dollars and the worst thing is I accepted this like six six years ago when I was opening the account of course I didn't read the papers there was like dozens and dozens of them so how can web3 actually be better in this situation than web 2. so again what can happen before the transaction happen so again same inflationary currency we're talking about same purchase same currency exchange ratio only now when

I'm submitting the transaction my wallet should tell me hey just so you know this will cost 170k Serbian Dinars so what can we imagine here that in web 3 in general this would I don't know go through uni swap call swap or whatever and I would know hey this is actually 70 dollars more than what I actually expected it to be and basically the profit is me not doing the purchase doing the currency exchange and then doing the purchase anywho the consequences of not doing things before checking things before the transaction even happens are manifold one example is the 1.7 million open sea fishing scam where people thought they were buying nfts they were actually sending their nfts there's a bunch of DNS hijacking so basically people uh

people going opening a UI and the smart contract addresses are actually different so people sign something to a malicious contract uh blind multi signing we're going to talk about this a bit more and then maybe something just like Martin mentioned the social aspect of how we don't talk about all of these things there's actually an implicit consequence with this current situation where basically people from outside of the space and I especially see this while what we're doing hiring for for web 2 developers to come into web3 they see crypto they see the scams they think crypto is crap that everything is Ponzi scheme then they even don't even look at the tech which will actually get them excited they don't get into the space and we're having problems getting people into the space so hi everyone my name is

DMC mentioned I come from tenderly which is a company that makes a developer platform with a bunch of different tools and services I'm not going to bore you to death with that particular thing we have a booth and we can bore you to death over there and now let's talk about to the solution of one of the problems so the goal of this presentation and then if we extrapolate it like 15 years into the future is to have have safe and transparent transacting be a basic human right so just like the access to the internet access to monetary things should be a basic human right it's very important to know as with the amount of transactions that we're doing what's happening so this goal is much larger than a single company much larger than a single product and in general I think democratizing this data is why a lot of

people actually came into this space three years ago something like that ondap underneath Berlin one or four years ago time doesn't make sense anymore but we actually came to the hackathon complete newcomers to the web 3 space the first tenderly feature actually started on East Berlin one there was two additional features built out in need Berlin 2 and we came into the space due to this fact and we should really really propagate this in more good people will come so the goal is again in general given a transaction it input tell me what will happen so which events will be emitted how will the state change and which functions will be called so everything before the transactions and to achieve this we need a couple of things we're going to break this down a bit more so

we would need a full archival node custom State Management and custom execution so let's look first at the case study in the real world so a lot of you stood up when they said are you a signer on a multi-sick so in general but for people who maybe might not know what's a multi-sig it's basically a smart contract abstraction for a wallet and multiple people need to say I'm okay with this thing for it to actually be sent on chain extremely high level so there's a lot of moving parts and a lot of things that can go wrong here multiple people need to sign the transaction for it to actually happen so human error they usually do more than one thing in a single transaction for example avidao or uni swap Dao when they're changing things they use it around like I think 2

million gas or something like that have hundreds of contract interactions for the whole thing to actually work there's usually a lot of funds being locked in these in these accounts so again a lot of money can be lost and the last thing is if the developer team needs to react react to an exploit or something similar it's usually time sensitive you don't have enough time and you basically need to react instantly and then again human mistakes are made so let's actually look at the use case so it knows it's safe so I think it would be very strange to pitch Nazi safe in dapcon and I would do a much worse job than Martin and his team but in general the most used multi-sig in the world definitely suggest trying it out so they have something called the transaction Builder so if we go back to

the multi-sig thing that I mentioned you can do multiple things in a single transaction because these interactions are complex so what I can do here is I can say okay let's do a new transaction I can input the smart contract address and then the uh the function that I want to get called on that particular smart contract the thing here is that I can chain multiples of these together so instead of I don't know just doing a uni swap swap or cow swap swap I think I can do is I don't know do the swap send the money to people in my company then put some money into the git coin grants program and pay out I don't know a contractor so I can do six seven things that can touch dozens and dozens or even hundreds of smart contracts just by

using the UI and everything else so the problem here was that people were blindly signing transactions so what does this actually mean I run a developer team we need to push something out into production quickly it's like 2 A.M I wake up my team I make the transaction do the fix and I tell the team hey guys we need at least five people to okay this for me to publish it to to to the chain I wake up the team they look at it uh I eyes all grumpy they they cannot even look at the screen and they have no apparent way to actually check what will this this transaction do so what they do is they blindly sign and trust me that it will do what is it what it is actually supposed to do

so what notices safe they actually came up with the idea it wasn't ours was to add the simulate button in the UI so when I click simulate we can actually see that this particular transaction would fail now this isn't rinky by but when I was calculating the gas costs if I was going to send this to the ethereum mainnet it was going to be around 80 bucks to execute this particular transaction so it says the transaction will probably fail are you sure you want to actually send it and then the next step is I can actually go into tenderly here and see where it actually failed so what to expect basically from a developer tool in 2004 but the thing here is that I can see what will happen and what would have gone wrong an additional thing if everything was going to get right a thing I can do is

basically see all of the things how the state of the change chain will change what events will be emitted and we're going to see a bit of that afterwards again if I'm a developer need to debug some of these things even though something didn't happen on chain with all of the unchain data basically we have access to all of the tools to get this right so the benefits here diagnosis safe not knows to save diagnosis safe users got was that every signer what knows what they're signing it's just a click of a button you instantly see what uh what will actually happen don't spend money on failed transactions you can see it's a pet peeve of mine I I went to a website that checks how much how much the field transaction costed you it was abysmal cfd complex smart contract interactions

do what they're actually supposed to do so again a failed transaction is actually much better than a successful transaction screwing things up because again we have written something to The Ledger forever and we need to then somehow fix it usually it cannot be done and then finally because these multi-stick transactions usually lay low in the multi-segg until everyone signs them it can sometimes take a couple of days to get all of designers together you can know that the transaction five six days out will actually do the same thing because the last signer before signing off the final the final part of the transaction can actually check and see what will happen so how was this actually achieved so what we needed what was needed to be done basically to to do this particular thing so if you remember in our inner

use case of me waking up developers we needed five out of let's say for example eight people to sign the transaction for it to be sent on chain now the thing there is if we want to simulate something do I need to simulate all five uh signers signing the transaction and all of these things we could have actually done it much smarter and this is how diagnosis safe team did it so the first thing is we can impersonate the signers so we actually don't have to check the signature when they're signing something we just need to know who the signer is uh we need to we need to provide of course the transaction input data so what we're sending on chain we need to lower the number of signatures needed so again in our case five out of eight signers were needed to actually send out

the transaction well the gnosis safe team did basically was lower that number to one so when they're simulating the transaction we know that the transaction will instantly be sent on chain and then finally we combine all of this data with the current state state of the chain to actually see what will happen if we send this transaction out right now so how does this work actually under the hood so this is the tenderly simulator at this point I am chilling a bit but we're going to talk about how you can build this yourself but basically here here is a simple dye transfer I wanted to do so up top you can you can see the smart contract you can see my address cut a bit so I don't docs myself although I'm doxed at this point I'm

quite sure and then finally the amount of dye I want to send and then who is sending the transaction now this particular address has no die at all but I want to simulate what would happen if I had enough dye so again the same feature that was used by diagnosis save team to lower the number of signers basically we're doing using it here so we can say hey on the dice Mark contract do a storage override so in the balance is off mapping I can actually say hey my particular account has this amount of amount of dye so at this point we're lying to the ethereum virtual machine that something is true even though it's not this will make more sense at the later slide and here we actually see a successful transaction with the actual

asset transfer happening over there so if the multisig transaction that they showed you which failed would have succeeded we would have seen all of the asset transfers all of these swaps and everything else over there in place and we could reason about what will happen so what is needed actually for for you to build this yourself it's a lot to work but it can be done so the first thing is is you would need a Custom EDM so you basically need an implementation of the ethereum virtual machine that you can instrument yourself tenderly actually four years ago started as a guest Fork on this very on East Berlin hackathon or three years ago again I I didn't remember correctly but what we started doing back then is just committing code directly into the guest

node into the Gaff node I mean our own version of it and changing things and emitting data from the virtual machine so we can hook into it and see see how it works now it works quite differently four years is a very long time in this space you need custom State Management so what does this actually mean so the first thing is you need the full archival node because you need access to all of the data on chain for you to switch it all of the balances or whatever other crazy thing you want to do with storage that's the first one and then also you need the way to basically do a state override so why do you need the custom State Management solution other than pulling the data data for from the node you somehow need to lie to your own custom virtual machine

something is true on chain even if it's not the third part over here is basically custom execution so a user provides the ud input you take the state from the chain you take the change state that that the user basically told you or you want to change you need to merge those two run it through your virtual machine and then if you remember adding a lot of emits and everything else in the virtual machine itself we need to return the data and the data that we saw people find very useful is events that are emitted all of the state changes that happen because sometimes events aren't enough to reason about all of the function calls contract calls there's actually a very nice project being made right now which before you sign a

transaction in metamask it pops up a pop-up simulates the transaction and tells you all of the asset transfers that are going to happen so hey did you know that in this transaction you're actually selling your NFD you're not buying a new one hey did you know that in this transaction the swap will actually have a very very bad exchange ratio because you set your slippage to like 45 for some reason and then finally the gas information because again sometimes some multi-sect transactions or other transactions use up a lot of gas sometimes even more than a full block that's one setting the correct gas limit and knowing how much the thing will cost in advance and you can basically do much more when you do simulations this is what we have it tenderly when it comes to simulations

so the first thing is it has API access you can Hammer the API with any amount of simulations that you want to do a lot of teams actually use it as a staging or a forking environment because when you then chain multiple simulations together you basically get something like a cloud Fork so for example if I'm a UI engineer I can just run a fork of mainnet at the particular block transact over there I know it sounds like a local node but it's different because there's a bunch of ergonomics around it that's one part and the second part if my transaction fails for some reason I can send my fork in the cloud that lives in the cloud I can send it to a back-end engineer or a smart contract engineer to help me debug the actual issue integration testing isn't another one

that's very very interesting use case basically run all of your tests with production data so it's like Andre was was talking about testing in production this is testing in production without with without making a lot of mess on Twitter basically and then you can also if you make your evm custom enough you can do historical bug fixes so let's say for example I found a bug I needed one month to develop the fix the thing I can do is I can actually go one month back in time change the source code of that particular smart contract and see if my bug fix would have prevented the bug happening in the first place anywho as I'm running out of time I want to invite you on the day of the merge to a war room it's a CTF Knives Out thing that we're building it's gonna there's

gonna be a bunch of smart contracts that people are gonna try to exploit for money you can learn more about it at their Booth we actually didn't initially plan it to happen during the merge but again as the as the chaos there's a bunch of random events happening during the War Room I think a bunch of things breaking as well because the merge is happening it's just going to add to the stress and and to the whole simulation of how a warrant scenario looks and thank you so much [Applause]