Fixing Smart Contract Vulnerabilities with QuillShield by Akshat

Transcript

hey guys good afternoon uh thank you all for Gathering here for our Workshop we are from quill audits we have a smart contract security product called Quil Shield we will be giving you a live Workshop about how to fix smart contracts while notabilities with quill Shield the presentation is done by me uh joose Paul I'm the product manager heading quill shield and akit Mishra he is taking care of the AI stuff inside quill Shield so you'll get to see some cool stuff happening um if you have a laptop you can follow through about what is going to happen so before we get to the demo and the workshop let's just first look at

why are we doing this right like what is the issue that we are trying to solve with cool Shield So currently if you look at how smart contract develop ment is being done security is currently an afterthought something that the Auditors are supposed to take care of not something that is taken care of while the development is happening you put a buck Bounty you give some money to the auditing company then the problems are resolved but what we would like to do is to bring the developer closer to the security staff without having to take away a lot of their time now one of the main challenges that we do see is that developers don't like to write unit test cases that's just something not just in web3 that you can see in web 2

as well so unit test cases test the basic function of the business logic or the smart contract of the logic sorry smart contract so that is something that takes a little bit of time to write so you don't want developers generally don't tend to write these things because it takes away precious development time right and fast testing is something that only the SEC researchers today are doing the regular everyday solidity devs are not tackling this it's almost always absent and since it's not part of a core part of the development now what we are trying to do is to bring all these aspects to the security uh to improve

the security of a project and give those tools in the hands of the developer now if we look at why what are the challenges that we have in the existing security tools one of the biggest problems is all of bunch of these are open- Source done by different people sitting in different places might not have a great UI the experience is horrible produces a lot of false positives which tends to you know take away more from your time than to give you time right and it requires a lot of manual steps to contact a static analysis or a dynamic analysis you need to set up your environment you need need to set up uh get your dependencies in

place this fundamentally takes away time from the users from from the developers and that is the reason why one of the key reasons why it is not part of the core development flow or cicd pipelines of today so this is what we intent on changing with Co Shield so you can set up a project very easily you can ex upload an existing verified contract or upload it from your device or just connect directly to your GitHub and import your project you get security reports you get an ID like view so that you're in familiar territory for the developers you can edit your code uh once you run an audit it'll show you all

the vulnerabilities that we have found you get a description you get a remediation and we even give a neat oneclick autofix all of these will be showed to you guys in a little bit so if any of you are Dev here please follow through with the steps that we are going to go ahead with yeah and if you get an audit done you get a sharable audit report as well which you can share with anybody we will soon get an onchain verifiable version of this audit report as well now with that uh I'll hand over the mic to akit so that he can walk you through the workshop okay thank you Joe uh my name is akit and I'm I'm a technical product

manager at quill audits I'm taking care of all the security related stuff here so to begin the workshop I'd like everyone to scan this QR code if you have a laptop with you uh all you need to do is scan this QR code it's going to lead you to the address of a repository um and from there we can do okay yeah so once you've scanned the QR code you're going to be led to a repo so

I'm directly going to get to the repo here because I have it stored on my device uh exiting the slideshow um so this is the repo that you should be led to for the purpose of this demonstration it's a very simple taking protocol just to demonstrate the capabilities of a product and how you can use it so once you're here all you need to do is copy the link and head over to our smart contract auditing platform so once you open it so I have already logged in here's what you're going to see you're going to be on a landing page from here you can go to the

dashboard and I'm logged in already so I'll log out so there are three ways you can log into our platform you can either use your Google account you if you have a wallet you can use that or your GitHub ID so I have my GitHub account connected so I'll just click on that okay so I'm in for you guys You' probably have to um accept the O um permissions and then you should be in so I have two projects all already I'm going to quickly copy this repos link again and I'll click on add new project so you have three options we're

going to use the third one because we have a GitHub repper let's call it staking protocol and the branch is main um okay so it's going to take a couple of seconds to set up the environment it's going to import all of the dependencies that are required to run this project and perform an audit yeah so in case it does not updated for you you can just hit a

Refresh on a browser uh the projects are sometimes done sooner than expected Ed so for us it's ready all we need to do is click on audit project now let me make this full screen so you can see the full interface in its Glory so if you're a Dev you'll find this experience quite um similar to what you see in Biz code you've got an editor you've got the file directory tree these are the dependencies and here are our smart contracts taking in lending borrowing so it's pretty similar to what BS Cod offers to audit you're going to click on audit now now once you sign up all of you are going to get 2,000 credits for

free if you need any more then head over to our booth and we are more than happy to share some the coupons which will give you extra thousand credits okay so once you click on audit now it takes a couple of seconds to calculate how many credits are going to be used so um so each project has different requirements in terms of credits so we do a dynamic analysis of the cost so you know what you're getting into now you can either choose to audit the current file that you've selected or the full project since it's costing me the same I'm going to go for the full project audits so let's hit audit in 5 to 10 seconds we should have an audit report ready and we should probably see some

vulnerabilities okay looks like we have something let's find out so uh on the right side I feel most of the people are going to find it really easy to navigate uh it gives you the total vulnerabilities and they sorted from their criticality levels so you click on total issues found it's going to lead you to where the vulnerabilities are on your smart contract so you can see what exactly is wrong here so let's take a moment to read the description or maybe not read it you can skim through it uh so the AI here is going through your

contract and uh it's able to find what's wrong in your code what is the uh what is the exact vulnerability and uh if you scroll down you'll see how it can be fixed so it's a reentrance a pretty common vulnerability which has led to some of the greatest smart contract hacks so um if you know how to fix this it's pretty very easy you just have to reorder some of the variables here so that the trans so the state variables are updated before it's actually sent over to the user but we have got something for you okay uh let me just scroll back

up yeah so um so this is called autofix one of our latest features uh it's available only for a select few vulnerabilities we uh we are using our own AI models to fix your smart contracts for you so if you don't want to do the work all you have to do is click on autofix and uh it's going to take a while to um make it to correct the vulnerabilities and let's click on order now we should probably not have any errors so let's see if it worked and I guess it did zero total issues found so that was a very simple

demonstration of what Quil Shield can do it's actually a lot more powerful what I'd suggest is you guys play around with it it's completely free to use as of now you can get a lot of credits if you need more credits head over to our booth and we're quite excited to launch it okay now I'll move from here back to our presentation because there are a few more things to discuss now if you followed through so far here's what you can do you can be a part of a beta program you can as part of the beta program you're going to get a lot of extra credits we launching a lot of new features so you'll get exclusive

access um and you can also get to shape our road map and uh we are an auditing company in case you don't know and this is a flagship product so if you're an early adopter and if you get into our auditing pipeline through this you're going to be eligible for waxi Grands so waxi is our take on wag we're all going to secure it that's what we like to call it uh so you're going to get up to 10% off on manual audits if that's something you're interested in uh so what's next for qu Shield we're going to have a dedicated testing Suite so earlier we discussed how writing unit test cases and first test cases is a

pain now with this dedicated testing Suite the AI is going to do that for you so you have to focus on what's important you can ship your products faster to the market uh and yes we also going to launch apis and vs code extensions so for you developers you don't have to leave the comfort of your terminal and uh your vs code window you're going to get the entire Quil Shield experience in your vs code and coming later would be monitoring an incident response let's say you audit some smart contracts through our platform and uh because we are using AI models to audit you can never be too sure whether the vulnerabilities really

have been solved and if the smart contract is totally Buck free so for you guys who want to be extra safe before you deploy a smart contracts there's going to be monitoring and incident response so all this smart contracts that are deployed through our platform are um are going to be checked for any attacks that could potentially happen on them any malicious contracts or Bad actors who are trying to steal your funds and our AI models are going to come in and they're going to prevent those attacks from happening and that's post deployment security so you're completely shielded whether it's predeployment or post deployment and with that that's the end of the presentation so so thank you

we're all going to secure it