Exploring Blockchain Security with Cyfrin

Transcript

GMGM. Welcome to what's going to be another fantastic episode of Devantel. So, if you didn't know, Devantel is a 30-minute podcast held every week, allowing founders, hackers, and anyone in between to come on the podcast and showcase their product. And today, I'm ecstatic to welcome the one of the true OGs in the blockchain space and Patrick Collins, who's the co-founder of Cifren. So, if you didn't know, Cifren helps secure the blockchain and its users through institutional level smart contract audits, tools, and education. So, if you stick around for today's episode, you'll see Patrick give us an overview of the Sifin platform, its origin story, and how you can start get started with it today. All right, let's get into it. But first, a word from our sponsor. Today's episode of Devantel is

brought to you by our friends at Arbitum. Arbitrum is a technology suite designed to scale Ethereum. You can use arbitum chains to do all the things you do on Ethereum, but your transactions will be cheaper and faster. With over 3.8 million ETH saved, 1.69 million active wallets, and over 1.7 billion total transactions, why would you want to settle for any less? Get started today by exploring Arbitum's comprehensive docs and tutorials linked in the description below to help you get started launching your next DAP today. Now, on to today's show.

[Music] GMGM. Uh, welcome to the show, Patrick. Ecstatic to have you on today, man. GMGM. Yeah. Thanks so much for having me. I just had to uh to share the tweet of this on Twitter. Oh, yes. Ah, yes. Awesome. Awesome. Yes. Uh, yeah, we had uh quite a bit of interest uh for this one, so I'm glad uh we could get this um get this organized for folks. Um, absolutely. I know you have quite Yeah, I was just going to say I can't see the chat, so uh whenever comments come in, I guess you'll just have to let me know.

Uh sure. Uh there should be a uh comments tab on your Okay, if that one works for me, great. Yeah. Uh we will post a GM for the gang here. Uh got it. I can see jam jam. Excellent. Uh yeah. Uh I mean you uh for the web 3 uh enthusiast um you need no introduction but for folks who might be new to the space um would you like to give a brief introduction about yourself? Yeah sure. Uh so my name is Patrick Collins. I am the co-founder of the siphon team where we do security and education as Narb pointed out in the beginning and uh absolutely love this space. Love everything about crypto.

love everything about web 3 and yeah, security and education is kind of the main um main business of Siphon, but we really do anything and everything possible to make this space successful because we yeah, we love what this space has to offer and we're really excited for the inevitability of the entire world to go web 3. So, yeah, as am I. As am I. And um I guess just curious like how did you find yourself in uh technology like how did you get interested in tech itself and and eventually found yourself in web 3?

Yeah. So tech itself was uh basically like I went to college um as many people you know 10 years ago did uh when they were like I don't really know what the hell to do with my life next. They just went to college and I didn't really know what I wanted to do. I took a computer science class. I was like, I'm pretty good at this. Let's keep going. Uh I didn't have a whole lot of direction. Um when I got out of college, I started to be like, no, let's like like let's actually do something like let's push, let's try to learn, let's try to grow. Um and I ended up kind of really luckily getting a job at like a uh an asset manager or hedge fund as like a as like the lowest bottom barrel, you know, Uh can I can I swear on this or

are there children listening? Okay, cool. uh lowest bottom barrel like software engineer you could like basically like my role was like um it was like alpha support or like production support. I called myself a software uh support engineer. Um and I really wanted to get into finance and use my like tech background because I I I was fascinated by finance. I was like I you know I was like how do these giant hedge funds work? How does money work? you know, um I just didn't know and I wanted to learn as much as possible. So, I I got to work at this hedge fund and I got to see exactly how it was like a $ 35 billion hedge fund. Um I got to see how like one of these hedge funds work like end to end. So, I was in charge of

what's called alpha production, which every all these hedge funds, they're always looking for this thing called alpha. So, a little bit of a a finance learning for people watching. Alpha is basically the uh amount gained like above some benchmark. The benchmark is often called like the beta. So you want to like outperform other benchmarks, right? So like um the S&P or like index funds. Indexes are often like the benchmark. So how much better is your hedge fund performing than you know uh an index fund. In this way you can go to clients, you can go to um you know enterprise people and say hey look here's how much more money you would have made with us than if you had just invested in the S&P 500. Right? So

they're always looking for alpha. So, alpha production is the I might maybe I'm being too laborious with this intro here. Alpha production is the um is the is the process of them, you know, running all these models, these simulations, collecting data, and just running all their algorithms for like what stocks are we going to trade today, what are we going to buy, what are we going to sell, that's it, right? So, I got to see this whole thing and I was absolutely blown away and I was so excited that I got to learn all this stuff. Um, but I also got to see where a lot of the issues were. um where are the slowdowns? Where is it not fair? Where where are the information asymmetries?

And um uh after I left there, I worked for a uh uh a data a data provider for a little bit. They sold like basically stock data like data that these hedge funds would ingest to, you know, put into their alpha production cycles. And when I was there was when I started to learn about smart contracts. Historically, crypto to me was just like a thing you buy and sell. um a as with most people. And I learned about smart contracts. I learned you could put data on those smart contracts. And I kind of was like super nerd sniped by that by itself.

Really, really interesting. But then as I kind of like started going deeper into it, I I was just kind of blown away by oh my god, how much of a crazy, you know, equalizer this could be. how much ba basically like from my perspective I was like why like does the stock market even exist when we have this objectively better system? Um and so to me I was like holy this is inevitable. I want to work on this right this sounds really cool. Um, and and even more than that, like one of one of one of the my favorite kind of examples that I give now is, you know, a lot of people meme on stable coins, but stable coins are this amazing product um that we've never seen before in history. This is the

first time in history in the in the in the world's history where you have a chance to be financially free being born anywhere in the world. Historically, if you're born in a country where the government is doesn't have their together, your financial freedom is bastardized because you rolled, you know, you you you lost the the being born lottery. You were born in the wrong country and now you're financially, you know, screwed for forever. That's insane to me. This is the first time in history where everyone on the planet can have access to the same financial products and have access to financial freedom no matter where you're born. And so, to me, that's wildly insane. And I don't know why that isn't like the most exciting, the most

cool industry on the planet um to work on. Um so yeah, I'm giving the the really long- winded answer here. Um yeah, so I was like, "All right, this is amazing. Let's go deep into this." And uh I started working at Chainlink Labs uh for a few years. Absolutely loved working there. Fantastic, fantastic place. I still love the product, still love the technology. But towards the end of my time there, um, I was getting more and more frustrated with people getting hacked. Um, because, uh, what we do is a double-edged sword, right? On the plus side, it's this amazing equalizer.

Anybody on the planet can have access to this this credibly neutral financial system, this credibly neutral technology. But the downside is something breaks, you have no one to go to, you just lose all your money. Um, and so yeah, at kind of towards the end of uh my time at chain the collabs, I was like, why the is everyone getting hacked and it's the same stupid hack and oh my god, blah blah blah, why won't anyone do something? Why won't anyone fix this? Blah blah blah. And um yeah, basically me and a few other kind of web three web 3 natives. I actually hate that term, but yeah, web three natives, if you will. We were like, "Okay, we're going to start a company. We are going to fix this. we are going to be the ones

to to jump in because we're we're not happy with the state of things and we wanted to do things differently and I'm very h so so siphon we've been around for around two and a half years now I'm very proud of the work that we've done and I'm really excited for the work that we're going to do so we we approach this problem of security very differently than a lot of the other security firms um yes you know we work with some of the largest you know smart contract clients in the industry you know we work with MetaMask uh Lineia ZK sync you know, the um the the new MetaMask update with 7702, like EIP702, you know, we did the the audit for the um the delegation of that. So, if you use MetaMask as of today, you're probably working with, you know, cipher

audited code. Um so, we work with some of the best people in the industry and we work oneonone and we help oneonone, we help, you know, as many big projects as possible, but we also think that that's not enough. if we go around one at a time, um you know, we'll help one project at a time when it's the whole industry we need to level up. And that's why we pour so much energy into education, making sure people know themselves how to like level up as auditors, how to level up as developers. Um because we think that's the only way to bring this whole space uh to fruition. Um, and from a business perspective, it's actually quite stupid that we do this because we will get into bidding wars with siphon updraft graduates who like

learned, you know, security from us. And um, uh, yeah, from a business perspective, it's kind of really stupid to bring to literally be like, hey, come to our industry and come learn this stuff. But we think it's so important that we still do it. And um yeah like at the end of the day we are going to do whatever whatever it takes to make this industry safer and uh we have a lot of issues in this industry and uh we're fighting really really hard to to fix it either through education you know directly working with clients uh building open source tooling we build a ton of open source tooling and just everything. Um so that that's my super long- winded intro. Sorry that was you know a long that no that was amaz that was wonderful and thank you for getting into so much

detail. I mean, I was going to ask you some some of those questions you already touched on. Great. Um, but like, yeah, um, myself, um, I got introduced to yourself when you were at Chain Link. I actually, uh, learned my first smart smart contract coding, um, from some of your videos when you were doing the Chain Link demos. Yeah. And I've taken some some of your course content from Updraft as well. So, uh, yeah, uh, you guys are doing wonderful work, um, saints work. Uh, so definitely keep it up. And I mean um we need we need more people being security conscious around smart contract development. So I know you're like oh it's kind of like uh cannibalizing your own uh your your own uh market share but

like um I think it's for the better. Like as long as people are making people know how to properly code smart contracts I think it's worthwhile. Yeah 100%. And uh you're also quite the avid lifter. Uh from some some videos I'm a lifter myself. So just curious like how did you get into lifting? Um so I'm uh I call myself like a a backyard athlete. I'm like a a very I consider myself like a very true crossfitter in the sense that um I will never be the strongest lifter. I will never have the highest endurance. Um but I will be pretty good at both. Like I can rock up to a weightlifting

competition, hold my own. I could go, you know, run a marathon. It would be a terrible marathon, but like I could do it. Like I like being able to uh um just just be fit, you know, and and that's kind of what I wanted to that's how I got into it. So uh when I graduated school, like I did kind of the whole like, you know, classic bodybuilder split. You go to the gym, you do like push pull legs or whatever. And I would be super active for like two months. And then I I I hated it. I hated being in the gym for like 90 minutes and just being like, "All right, now I got to do my curls and now I got to do my whatever the hell you do in like at the gym for a class." I hated it. I I hated

it. I hated like being alone and putting my headphones on. And I was like, "Okay, like sports. I like sports. Like I want to go like let me go play a sport." Um but I wanted to play a sport where I would get like in better shape and be more fit. And I felt like none of the sports like I wouldn't be as fit as I would want to be like cuz I could go like play basketball and then like still feel like I would need to go to the gym. And then I felt crossfit which is like the sport of fitness which is like kind of silly and I remember being like thinking it was so stupid and the pulps are so dumb and but then I started doing it. I had a really good time. you know, there's uh it's got an amazing community

and uh I'd never done like Olympic lifting before and Olympic lifting is like the most fun thing ever. Um do you do Olympic lifting or is it more powerlifting? Uh it's more of like a hybrid between like bodybuilding and powerlifting. Hell yeah. Okay, cool. Yeah. Yeah. Cool. So, if you ever get a chance, you got to try Olympic lifting. A lifting. So, it's it's really hard and it takes like it takes like six months to even feel competent with what you're doing because it's so technical, but oh man, like hitting hitting like a like a heavy clean Oh, you feel like you're the just like such a badass. Like badass. Yeah.

Yeah. Like hitting like a heavy bench, you're like, "Yeah, like I'm sick." Or like a heavy squat, but like hitting a heavy clean. Oh, man. Like there's there's it's just so explosive. Like I nar I highly recommend if you're ever in Boston, man, I'm I'm being dead serious. I've actually brought clients to CrossFit. Oh really? Yeah. I brought I brought I brought audit clients to to CrossFit. I'm like, "Yo, you got to work out with me." Blah blah blah blah. Um Yeah. If seriously, if you're ever in in Boston, I would I would love to lift with you, dude. I think that'd be so fun. Hell yeah, man. Yeah. Yeah. If I'm ever in town, I'll hit you up.

Yeah. What What What about you? What What got you in lifting? Yeah. Uh for me uh personally like uh when I was a bit younger um I was a bit overweight so I kind of just started lifting and lost a bunch of weight and it kind of just stuck on uh to me as like a a habit that I can't and won't ever get rid of. So hell yeah. Oh yeah. It's just like a it's just like a magic pill, right? It's like brushing your teeth or Yeah. brushing your teeth. Yeah. You just like up and at him just an hour in heavy lift. Yeah, dude. It's nothing better than that. It's it's such a mood a mood like uh uplifter. You you like frustrated with work or something goes bad. You go to the gym and you just get your ass kicked for an hour and uh

Yeah. Yeah. It's it's actually surprisingly like a pretty big thing in the security community. Like a lot of like um a lot of the security people like they are all like avid lifters. Um, yeah, which I think is awesome because it's also like promoting, you know, more healthy habits, getting out the door, like you know, uh, like I consider myself a hardcore like nerd, like you know, um, like if if I if I didn't have the gym, I wouldn't leave my apartment. Like I'm, you know, like I would go hang out with my girl, you know, and that's like it. Other than that, I would just stay in, you know, these four wall, you know what I mean? So, yeah, get out the door, get healthy, you know? It's good. It's good for your brain. It's good for your brain.

100%, man. Yeah. I I can't agree more. Um, but yeah, that that's that's awesome. Uh, I mean, yeah, if if you're watching this today, maybe maybe go to the maybe go hit the gym for the first time. You you won't regret it. Or hit hit us up on Twitter, ask for uh we we'll give you the bro tips because uh cuz neither one of us are actual fitness like instructors. We'll just be like, "Yeah, just like push pull legs, baby." Like hit hit a hit a sick clean, dog. Yeah. That's right. That's right. Hell yeah. Um but yeah, I I I guess uh without further ado, um I will bring up the stuff you have prepared for us. Um yeah, the stage is yours, my man.

Great. One second here. And uh folks, um as Patrick is going through his content, if you have any questions, uh please post them in the chat and we will get those questions answered for you. It's a little warm here in Boston. Not quite as warm as it was in France, but uh Oh, yeah. Little warm here. Uh yeah. So, so today we're going to do a little um brief rundown of just introduction to security and auditing basically, you know.

So, a lot of people who have gone through the security curriculum on cipher updraft, this will be a refresher for you. But if you've never done anything in security, this is perfect for you. If you have done something in security and you want to learn more, if you want to kind of be informed about what this process looks like so that when you build a protocol, you can know um you know exactly what your auditors are doing, uh this is for you. Or if you want to be a developer and you want to have your code actually be good, like this is important to to know. So, one of the things um that we've seen kind of in in this industry, especially with the rise of AI, getting writing code is becoming easier and easier to do, which is good. You know, we want it to be

cheap to write code. Uh because AI can help you a lot of times with writing code. However, writing good code is still pretty much just as hard, right? So, um, you know, you can you can write a protocol where an AI can help you write most of it, but you still need a human being to go through your code to make sure it's secure because, um, there's been a lot of advances with AI's, you know, finding bugs, but that it's still not good enough to rely on, not even close to good enough to rely on. So, no matter what, at the moment, like, um, this is still important. And one of the main differences between um web 2 and web 3 security I shouldn't I should stop using those terms about traditional engineering and um

blockchain engineering is in traditional engineering if you build a website and your website is like oh look save pictures of your cat you know if that website gets hacked oh no like all the pictures of my cat have been you know out on the internet for free. Wo was me. Um you know uh or my data has been released. Although data being released is actually quite bad um for other reasons. Um but usually kind of the the damage can be kind of like a little bit abstract. Whereas in blockchain world the damage is immediate and it's financial. Uh we've seen the largest hack of all time happened uh a

few months ago in the Bybit hack. $1.4 4 billion stolen in an instant. $1.4 billion. That's bigger than I'm pretty sure that's bigger than any bank heist that's ever happened. And it was instant, right? So the the risks of getting something wrong in this industry are quite high. So you really really really really want to make sure you have this down. And we're basically we're moving to a um a meta where the best developers are security researchers themselves because of how high the risks are. So basically if you want to be a good developer you need to know everything we're going to be

talking about here. So with that being said let's go in. Um just kind of a quick refresher once again I'm CEO and co-founder of Siphon. Uh yeah we work with like I said MetaMask consensus chain link CK sync circle uh I'm a developer security researcher I've been in this industry for you know five or six years now um and also the lead instructor on cipher updraft which is our education platform um you can go get certified in different skills like smart contract development wallet signatures and you can learn everything for absolute free because we believe that knowledge wants to be free and that's something we hold very very strongly.

So here's kind of the agenda of what we're going to go through. You know, why security, what is web3 security, you know, what's the opportunity, some prerequisites, talk about the audit process, and go through some tools. Um, and then these are kind of some of the tools that we're going to go through. So this is going to be a just kind of a primer on security, what is security, uh, smart content security, how does it work, and then um, uh, any questions that you guys have like as we go through, please feel free to ask. Um, and then questions at the end as well. So, a bit of a quick primer, although I pretty much already talked about this is, uh, you know, why is web3 security so important? Uh, and, uh, this is why.

So, this is a list of this website, WCT News wct.news. Um, the eco-friendly rugpole. Uh, so this is a website. Absolutely love WC News. um they very humorously kind of go over uh different attacks that happen in the industry. Uh and if you'll notice um July 3rd, July 2nd, June 22nd, June 24th, this is like about a week and this is four high-profile hacks that made the news. Um usually kind of in the first blob you can see how much. Okay. 12 million 10 million uh 200k. Oh, this was this was actually

much bigger. Uh because the tokens dumped to 99. The token value went to zero in an instant. Uh so you can see this happen quite often which this is basically what I was reading when I worked at Chainlink Labs and I was quite frustrated that this happened. So uh these hacks happen quite often unfortunately and for a lot of money. Um, like I said, by bit, $1.4 billion. It's the largest hack of all time, not just web 3. That is $1.4 billion that was stolen in an instant. Uh, it's the largest heist of all time.

Um, so why is security so important? Well, uh, spending $2 million on security, uh, versus getting hacked for $200 million is a 99% reduction in costs. So, it maths out quite well. Um, now this is kind of like a humorous way to put this, but usually in most protocols, this $200 million is not your money. This is $200 million of somebody else's money, of your client's money. Uh, it is quite unacceptable to lose somebody else's money. Um, so yeah, if you're going to build a protocol where other people's money is going to be on chain, you damn well sure better take the time to make sure it's secure.

This chart is a little bit outdated um but yearly total value stolen in crypto hacks and the number of hacks kind of across the years. We can see 2021 2022 have the biggest numbers but you can actually see the total number of hacks kind of still has this upward trend. 2021 2022 the um the amount of money in the industry was was a lot higher uh and people were a lot less secure. We're getting more secure, but attackers are also getting more aggressive. Um, and especially with stable coins kind of having this dominant play, we are about to see a lot more money enter the industry. You know, Robin Hood just launched uh an announcement with uh Arbitum, sponsor of this uh of this uh of this show here.

Thank you, Arbitum. Um, so we're expecting to see, you know, more money coming into the industry and therefore we're probably going to see this number go up and up and up. Um, how much time do I have left, by the I'm already like going taking too much time. Uh do your thing. Don't worry about it. Okay. Uh I'll try to hit the beyond the hour here. Uh so what is web3 security involved? Well, it involves a lot of things. Some of the most common ones are going to be the audit, uh a bug bounty, uh and sleuththing. And these are kind of what what I consider kind of the three, you know, uh big parts kind of like of postdevelopment security. Now this is kind of um kind of not totally true because security starts from when you write the first line of code. You

know if you architect a protocol poorly you could start have to start over right. So you really want to be thinking about security from day one. And this is why you know cipher updraft and and us so importantly are like hey we want to shift security left onto the developers. So that's kind of the narrative. Shift left, make developers more aware of security. Um, and again, that's one of these things that other audit firms might not do because they want to shift everything right because that's how they get paid. Uh, we think that's net bad for the industry. We want developers to be smarter, to be more informed, um to write code better and and then actually we think that will be better for us in

the long run because then you know when the code gets to us it will actually be high quality and we don't have to spend a lot of time like on really silly lowhanging fruits or or silly bugs um that you know somebody else could have found and we can focus all of our time of finding those really tough to find ones, right? So uh the audit is going to be kind of this basically a security review of what is this code? Um is it secure? Basically you have you know one or several security researchers who literally go line by line reading every single piece of code trying to find hey where does this code not do what it's supposed to do. Uh bug bounties are this really important narrative right now. Uh Amunifi is one

of the largest bug bounty platforms uh in the industry. Uh where once you deploy your code to production um you have some type of way for people who find bugs in live code to a get rewarded for finding the bugs and then b uh responsibly disclose those vulnerabilities. And that's really important this concept of responsible disclosure but uh I'm not going to spend too much time talking about that. And then sleuththing um or tracing what a lot of people call them is like you know when a hack does happen how do you find out who did it or you know follow the money um that way you know you can figure out how to go after these people who have uh conducted a hack. So like ether scan TRM chain analysis these are

some of the tools that um will do that. So a typical protocol kind of the um the endto-end kind of security flow is they're going to use these different security tools um they're going to use security tools to build um they're going to get a security review slash audit before they deploy and then after they deploy their protocol they're going to monitor the codebase they're going to post bug bounties maybe set up a security council but like kind of these are some of the main things to think about when you're building a protocol. Um, so the opportunity, why get into uh why get into security? Why is it why would it be cool for someone to become a security researcher to become a uh um uh yeah, somebody who's into, you know,

hunting for bugs. Uh, and it goes back to this. There's definitely a monetary aspect here. You know, there's a lot of money to be made in uh in the security field. Like I said, spending $2 million on security is a whole lot better than spending $200 million getting hacked, right? So, um, you can do very well in the security field if you're amongst the best. Now, that's the hard part is you do have to be kind of cream of the crop. Um, this this is one of those industries where the best people get most of the clients and rightfully so rightfully so, right? Because as a protocol, as a client, I only want to work with, you know, the people who are actually going to make sure all my all my bugs well actually going to give me a higher uh security assurance. Uh, but the beauty

is the path is the most straightforward out of any career in my opinion in the entire world. People are always asking me, Patrick, how can I get a job? How can I get an internship? How can I do this? How can I start making money? For most jobs, the path is like kind of fuzzy. It's like, oh, hey, go learn this stuff and then go apply and then try to, you know, make some projects and then hopefully somebody notices you, hopefully you get an interview. And you're kind of like there's a lot of like hopefully somebody picks you up. In the security realm there is no hopefully you will learn money if you find bugs that is that is it. Um so the path go to cipher updraft go to the uh we have a careers page actually if I go to updraft

explore all courses where is it career track if you go to the career track there is a security auditor career track take these courses um in this in the career track that's step one um then go to competitive audit platforms like code hawks go to bug bounty platforms like IMU Unify and you will make money. That's it. If you perform well, if you find bugs, you will make money right away. Uh if you find a lot of bugs, if you find a lot of issues, people will want to hire you. Um that's it. It's super straightforward.

Now, the downside of this is just because it is straightforward, it doesn't mean it is easy. Um you have to find bugs that everyone else couldn't find. So it is not easy but it is straightforward and I I want to make that that very clear. Learn, apply and earn, repeat. That's it. That's the path. So go to code hawks, go to C4, Amunify, find bugs. Um and the thing is your first couple of competitive audits, your first couple of bug hunts, you won't find anything and you will get your ass handed to you and you will perform very poorly.

But that's fine. Everyone started the first time everyone did this. They were terrible, right? You just keep trying to get better and better and better and eventually you will find stuff that nobody else can find and you will get better. So, competitive audits, if you've never seen these before, these are this uh fantastic security um uh kind of primitive that we have these days where you take a codebase uh you put basically a bounty on it. You say, "Hey, whoever finds the most bugs on this codebase in this short amount of time wins x amount of dollars." So, and you can kind of see like a leaderboard here from Code Hawks. That is one of the platforms that the Siphon team runs. Um, and this is a way to to win money, help secure the codebase. Uh, and we've seen fantastic security results from these

competitive odds for the clients as well. Um, because when you have, you know, 100 people looking at the codebase, that can often perform better than, you know, just two or three. Uh, there's a lot of distinctions between competitive and private audits. They both have advantages and disadvantages, but uh it from my perspective, competitive audits and bug bounties are still the best way to get into security. Full stop. Uh so let's talk about the audit process. Uh there's no silver bullet to the auto process. There's no silver bullet to, you know, finding bugs. Um but uh there's typically kind of a uh a process um a four-step process here uh essentially like the actual process kind

of varies but first for any audit you first want to figure out what the scope of the review is. What specific contracts are you reviewing? How many lines of code is it? What is the commit hash? What exactly are you reviewing? Right? Because if I have some code and I forgot to add a function and I add the function later but my security researchers are you know doing the code without the function you know maybe that function is super key to the security of the whole system right so what exactly are we auditing so that the auditors don't waste time on things that aren't going to be in the code or are going to be the code or etc right um so this is the scoping phase what exactly are we auditing then you get

into was what I call the recon phase. And this is where the auditors are kind of doing the the grunt of the work or the brunt of the work, excuse me. Uh they're manually reviewing the code. They're literally reading your documentation. They're reading your code. They're looking for issues. Uh they're using tools as well. Maybe they're fuzzing static analysis tools. Maybe they're using AI. Um vulnerability identification. Obviously, as they're doing this, they're looking for bugs. And then the final step is actually reporting. And this is actually a really important step. uh if you find bugs, but you can't communicate that effectively to your partner, to your client, it's worthless, right? Like you need to be able to effectively tell them, hey, here's the bugs. Here's how you fix them. Um and

there needs to be an understanding, right? And this actually can kind of go both ways because often a lot of lot of the time, junior new security researchers, they go, "Oh my god, I found a bug and I can destroy this codebase and blah blah blah." and then when they go to report it, the client will go, "Oh, no, that actually doesn't work and here's why." Um, and uh, you know, not having uh, and and having like the feedback from the client can be can be really uh, really important. Um, and that reporting phase is really important because that'll also give you feedback on did you you know, do you know what the hell you're talking about? Right?

There's a there's some pretty famous stories of like security firms reporting bugs. um the client then saying like, "Oh, those those bugs don't exist." And then the security firm, you know, looks kind of embarrassed. Um uh yeah, so a lot of this a lot of this is going to be just like reading code. So like uh this is kind of a little bit more in depth of the job like you are most of the job of security researchers is just like reading. Uh you do a lot a lot of reading. Um this this joke is kind of outdated because nobody uses Stack Overflow anymore. Everyone uses like cursor or claude or whatever. Um but uh you know there's always this kind of like joke of like trying random stuff

instead of like reading the docs. As a security researcher you are doing a lot of reading and you have to do a lot of reading uh to be good at what you do because you're the main thing that you need to do is you need to understand what the protocol should do. And what you're essentially doing is you're looking for asymmetries between what the protocol should do and what the protocol actually does. Um, and then just with this, like anything, you know, repetition is the mother skill. The more you do this, you know, the better and faster you get at it. Um, so as a really simple example here, you know, um, we have like a uh, uh, uh, a codebase here. It's called contract

caught with test, you know. um you have this set number functionality. Um if you don't know what this set number function is supposed to do, you might look at this and go, "Oh, this this looks fine. There's no issues here." But, you know, maybe you read the documentation. It says, "Oh, set number is supposed to set the number to the new number." Then you would go, "Ah, okay. Well, it's doing new number plus one. That's clearly wrong. You know, that's a that's a vulnerability here. We need to we need to fix that." But with this kind of contract as written, there's no kind of documentation here.

you know, it's really, you know, you could kind of infer that set number shouldn't be adding one. Um, but without the documentation, you can't be sure, right? So, this is why, you know, from a protocol perspective, writing documentation will actually improve your security because you can define exactly what the code should do, right? So, the manual reviewers can can get it right. Uh, now let's talk a little bit about uh tooling. So, like I said, uh or or yeah, we'll get into some specifics here. what are the tools that security researchers are using today. Uh manual reviews like I said actually going through the code reading by line by line line by line. Uh test suites are super important. So like foundry hard hat moccasin a works truffle's dead so I got to get rid of

that. Um uh security researchers they they write proof of codes which is like proof that a bug exists in these test suite. Whenever you find a bug you you really want to prove that it actually exists and that it's exploitable. Uh so these are some of the main tools people use as of today. Foundry is definitely the most popular uh by far which is why we uh teach it on siphon object as well. Although hard hat just had this amazing uh revitalization. Um so uh they're great to check out uh moccasin's one that we made for the few viper developers out there. Uh and there's some other frameworks as well like ankor for Salana um etc etc. Uh so stack analysis, this is a tool um you pretty much should

always be running as even as developers before it even gets to the security researchers. These are kind of what I call like dumb um tools where they just kind of like automatically check the code. They look for pattern matching. Uh two of the biggest ones are a Darren, that's one that uh we actually build uh and Slither that's by the Trail of Bits team. Um and yeah, essentially they're just looking for for patterns, right? like uh a common one is going to be like a re-entry vulnerability. You know, if um if you have code that can call itself back um that's like a re-entry that's pretty easy to find with one of these static analysis tools. It's called static analysis because you don't actually run any code. It's like a tool

can just like look for patterns um and just like read and can find these by by reading the code. Like um AI in a sense could also be considered like a static analysis tool. Hey, read this code and look for, you know, um look look for bugs. Uh kind of the next level up after um static analysis is going to be fuzz testing. This is another one of these tools that developers should be very good at and should be very familiar with. Uh fuzz testing, also known as fuzzing, basically involves providing ren data uh as inputs during testing.

So, kind of as an analogy, um if you're uh if you're testing the, you know, the strength of like a hat, for example, like if that's, you know, what you're doing, fuzzing would be like doing different things to the hat to try to like break it. Like maybe you karate chop it and you go, "Okay, karate chop didn't work." You throw it, okay? Be like, "All right, throwing didn't work." Maybe take some scissors and cut it and be like, "Oh, scissors. Scissors. I was able to cut it." So you're basically like doing random stuff to some smart contracts to try to break it. Um, and this is in my opinion one of the most effective techniques, especially when it comes to smart contract development. Um, however,

kind of knowing where the limitations of fuzzing are are really what makes fuzzing kind of difficult. um you know if you just say oh yeah like you can um let's fuzz this smart contract and just allow any bite code in the world to you know be sent to it well you know it's going to take a computer you know millions of years to come up with like every different scenario so you really want to scope it like okay we're going to say this subset of of random data or blah blah blah and this kind of gets into the tooling so akidna medusa foundry these are all some of the most popular fuzzers u medusa is kind of the one that's one of the front runners as of today. There's also some um paid fuzzers like get recon, consensus,

diligence fuzzing um that do really well. And uh yeah, fuzzing is really really important to uh your security uh journey. And then kind of one one of the final tools that a lot of people in the smart contract space use is thing called formal verification. And uh the the the definition here is basically just kind of converting your your code to a mathematical proof. So yeah, it's it's a generic term for applying formal methods to verify the correctness of hardware. And so in the smart contract space, we kind of consider smart contracts like hardware.

Um usually kind of people's eyes glaze over when I when I say the actual definition of form of verification. So then I usually just say um yeah take solidity math takes take a solidity function and turn it into math. Math can be solved solve for X right that's that's form of verification. So one of the most popular ways to do this form of verification is this thing called symbolic execution which is excuse me which is the actual process of like converting it to math. You basically convert your functions to a mathematical expression. Um and then you say okay can um you know can X be you know what it shouldn't be or blah blah blah. So some of the most popular form of verification tools are going to be um like Storra Halmos uh Solidity actually comes built

in with an SMT checker which is a type of uh formal verification tool. Uh and this is a much more niche tool form formal um verification because it it um most of the time fuzzing is going to do what formal verification does for like onetenth of the effort. Uh whereas uh formal verification you know it's it's going to be quite time laborious. uh it's depending on the on the methodology, right? It can be a little bit more time inensive uh for not that much more gain, right? So, this is another one of these tools that in my opinion if you know how it works, you will figure out kind of the niche scenarios to apply it to. Um it's

definitely very cool. It's definitely a fun nerd snipe. Um yeah. Uh finally, AI tools. Um AI is getting much better than uh when I made this screenshot. So this is like which is heavier 10 kilograms of iron or 10 kilograms of cotton? And it's like you know chat iron's heavier than cotton like come on they're both 10 10 kg fam. Um but they're getting much better. So uh uh Dan our uh our audit uh lead at our audit manager at the cipher team. He actually recently did some really cool stuff with kind of priming an AI. You know we're doing a whole lot of research with AI. uh they're getting much better, but they still have a lot to go. So like they're getting better to

the point where they can kind of help catch a lot of kind of lowhanging fruit. Um but like replacing auditors, they're just they're not quite there yet. So um so I went way over here. Um so happy to uh to take any questions. Oh, cool. I do see some questions in here. Yeah. Yeah, we got some questions in and no worries, man. Uh so we can bring up uh Henry's first. Um, so Henry's currently learning uh on Siphon uh content is so great. Agreed. Um, however, is the security market really expanding? I feel like there aren't as many competitive audits available.

Yeah, great question. So, the competitive audits market is is really interesting um for a lot of reasons. So, you know, uh I think so C4 basically pioneered it back in 2020, I want to say, where they kind of um took this formula uh of like, hey, let's do these open competitions, brought it to the web 3 space, and then I want to I I feel like yeah, like 2022, 2023 is when they started really like kind of being in their heyday. Um doing really really well.

there's been a lot of different approaches to competitive audits and the market is there's a lot of competitive audit platforms. Um, so we're kind of seeing a lot of the the margins on a lot of these kind of go down. So like a lot of these companies from my perspective this is just you know so I so I obviously have a platform Code Hawks and you know everyone should use Code Hawks and I I do think I I I do think Codox is the best objectively product uh out there. Um, but I also understand that like uh the the with so much competition, the margins are a little bit slimmer. It's harder to um it's harder for just anybody running one to uh want to do one. You know, we've seen a lot of the competitive audit companies

also spin up a private audits branch where the margins are a little bit better. Um so there's that. uh which to me is kind of a travesty because the competitive audits themselves I think are some of the best you know dollar for-dollar um security that you can get if your goal is to mainly squash bugs. Um they do do a great job at that. Uh whereas private audits um are a lot better uh at like having a certain expert on some type of um of some type of feature, getting kind of more tailored feedback maybe more than just like oh here are bugs. Like competitive audits are really like here are bugs. Whereas private audits can be more you know oh here's how we can

increase your testing and you didn't think about this and you know you can have a more lot more uh kind of strategic feedback to your protocol uh as well as kind of getting specific experts and then there's hybrid approaches of the two um but yeah so so we have seen less there still are a lot there still are a lot and um Uh I think the the security market is still expanding. We're seeing so much money kind of flow into the industry, especially with stable coins and stuff.

There will be continued demand for security. Um uh but yeah, like a lot of companies from my perspective are kind of pushing for their private audit products. Um but the thing is that there's still competitive audits out there. They still do really well. I think they're still some of the best money, you know, companies can spend. And they are still, even if they're super hard, they're still where security researchers should start because you will get feedback immediately on how you do. Most platforms um are pretty objective with their judging and with their scoring. Um you learn so much so quick. And then also actually um if

uh oops code hawks uh I'm going to present again in just a second or h no I won't um and then also if uh if you're getting into the industry and you want to you know get started with kind of this quick feedback this quick turnaround round on code hawks we have these things called first flights which are beginner friendly audits where we've put in kind of like dummy bugs uh in them so you can get started you can get that that turnaround you can feel confident in doing these competitive audits because you already know what they feel like um so yeah it's definitely expanding uh I think the market is going in a lot of different

directions especially when it comes to these competitive audits and I see like yeah people um having different opinions on where these should go um I think yeah but like I said uh a lot of money coming into this industry especially with stable coins and all these uh traditional finance people coming and um uh competitive audits I think are still some of the best and we will we will continue to see uh competitive audits for a long long time. So yes. Yeah. Hell yeah. Great great question. Great answer. Yeah, great question.

Uh we'll squeeze one more in before we conclude today. Uh James asks, um what's the typical time frame a developer can effectively learn about security? I mean, it's probably not one sizefits-all, but like you got it. No, no, you you got it. So it's uh it's different. Everybody's different. Um, so I've seen people go to Ciphern updraft and start making money in in security in as little as 2 months. Um, that's like some of the quickest that I've seen. And that is a crazy pace. That is like them, you know, waking up living on cipher updraft and then hammering the competitive audits scene. That is like that is like you are

living in web 3. Okay. Uh I've also seen people uh in my opinion have a more realistic timeline of of like uh a year and a half, two years, right? Um they spend, you know, 3 to 6 months on cipher updraft. They start doing some competitive audits kind of gaining, growing, getting better and better. And yeah, like a lot of Cipher Updraft graduates work in some of the best places in the industry, right? We've we've got people who work at um uh Trail of Bits, Open Zeppelin, you know, MetaMask, Chain Link, you know, you name it, right? like there's cipher updraft graduates all over the place.

So, uh yeah, a more realistic timeline is like um you know like a like a year or two. Uh but if you're super motivated, if that is if you're like I'm hellbent on making money as soon as possible, you can do it in as quickly as two months. I will say it is very difficult to do that. Um don't have that be your expectation. There's very very few people who have done that. But if you have a realistic expectation of like a year or two, absolutely you can absolutely make money uh and get a job in in two years. If you uh yeah, if you perform really well, uh you make sure you just every time you don't do well, you say, "How can I be better? How can I improve?" You know, what what bugs did I miss? What do I

need to learn? What do I need to know? Uh you will get there 100%. The path, like I said, the path is the most clear to success for security researchers. But just because it's clear doesn't mean it's easy. So, but it is the most clear. Great question. Just like just like heavy lifting, right? It's like that same mentality. It's like actually spot on. Like if you want to lift a ton of weight, the path is super clear. Go to the gym five times a week and lift heavy weight. Doesn't mean But that's not easy. You got because you got to do that for months and months, right? So, it's exactly the same thing. Yep.

Yeah. It it's interesting how many parallels you can make to like real life from just like the things you do at the gym. But uh anyhow, uh yeah, Patrick, uh thank you so much uh again for taking the time out of your day uh to come on the show. Um it was wonderful. I know I learned a lot. I'm sure folks learned a lot. Um final uh uh closing thoughts uh just if people join late uh what's the best way for people to get started with friend today? Yeah. So, um, if you want to get started with Siphon and you want to learn, head over to updraft.siphon.io or just go to siphon.io. Uh, you'll see all the links there and you can start learning, like I said, for free. Start with blockchain basics and, uh, go as

far as you want. If you want to just get jumped jumping right into security, head over to Code Hawks. Um, do some of our competitive audits, do some of our first flights if you want to go there. Uh if you're a protocol looking to get secured, go to our website uh and hit request a quote. We would love to speak with you. Um and uh yeah, if you're a developer and you want to help contribute to a lot of the open source initiatives that we're working on, feel free to make a poll request, make an issue, or just jump into our Discord and say hi. So, lots lots of ways to engage uh and reach out. Boom. There you go. And uh with that, just want to wish everybody a very happy start to their week. Uh and uh we will catch you back here on Friday actually

for another episode of Dev and Tell. All right, with that catch you next time. Thanks all. Cheers.