Getting Started in Smart Contract Security

Transcript

good afternoon so hopefully everyone had a good lunch and uh we'll make sure you won't fall asleep because we have a fantastic session planned for this afternoon starting with uh tincho from the red Guild who's going to be talking about getting started in smart contact security so please give tin show a very big hand so nice to be here hi everyone um I'm tincho I'm a security researcher um I've been working here in this place for quite some years already I used to be a smart contract auditor I also created the mulnerable if I perhaps some of you played it if you haven't please play it and now I'm working on the red Guild which is a

collective of security researchers that it's emerging that we are trying to create public goods for the security community and we do application security research and educational advocacy so this part is like educating and sharing what we know right um the talk is it says how to get a start in smart contract security um I will derail a lot and please bear with me um I didn't want the the title of the talk to limit me too much um but hopefully you will get some ideas on how to get started and Jonah was talking earlier in the previous talk and he probably gave some more specific advice on how to get started I wanted to compliment his talk in in another way

try to share um more about value some purpose and and why I think this is this is important and hopefully this advice will help you get started and also get started but keep going okay it's not only important for you to be here today learning about all of this cool stuff but I so wish that next year you will also be here as well you will there or you will be speaking here right we really want you to contribute to the space and we want you to to be part of it right so John showing the security Community we are trying to make things uh better and we really need you this talk is about that get started but please also please keep going on it um my secret sauce for keep going is

with purpose okay um there's a real thing to contribute here in web3 security I really think that the technology can have an impact in the world I might be too optimistic about it I don't care um but I really think that this is the main thing that has uh kept me in the space through all of these years and hopefully I can share some of that with you okay so this a real sense of belonging that's a real sense that you can help shape the industry um that you can have purpose in working in web 3 security and you can keep going at it right so you can keep continuing with three security it's quite different

some of you that I've been talking to you already at lunch um you come from web 2 security perhaps and you will find out that if you want to get started well you will find that there are many different things in web 3 security of course there are similar things but in what free security there might be other things that are not quite similar okay for example I personally really believe in the technology and that's for me why I really joined the space to try to protect that right um you will find a lot of these the systems that you that you're about to start reviewing the channel to start learning from our public are open source that's not as common in in our parts of the industry right um You can get really deep into many

parts of the system because lots of it is probably lots of it is open source you the the code is there for you to explore right um and anybody anybody can join right it's you from home that you can actually see these systems deployed you can see smart contracts on the blockchain for example nobody who you are nobody where you come from nobody no like you don't care about your actual background anybody can actually come and contribute and try to make this ecosystem more secure right and there is a double-edged sword because if anybody can join the good people can join and the bad people look at you right so there are lots of people with um not that many good intentions in the ecosystem

um that can really hack smart contracts right so anybody can join that's good but that also means that lots of factors are getting into a scene and of course there's billions of TVs at risk right and you can actually look at the blockchain and see how much money is stored in there this is very uncommon in other places you in other parts of I know web to security you might not know exactly how much money you are actually protecting and investor security you might realize that well it's quite clear how much value you are protecting right if you only want to speak about value in financial terms it's so good purpose is fine whatever by why should you care right um we all come from different

backgrounds we will have like different histories I personally I come from Latin America and I think that the technology has a way to propose a different approach to things to create more fair social coordination mechanisms uh to create more transparent mechanisms to give access to financial um systems that in the traditional World many people don't have access to um I've seen cases where crypto is really a saving line for many families for many friends and I really believe that I wanted to protect that technology okay hopefully the stock also gets you

started in in the same line right not only care about like the stars and the followers and engagements and whatever but there's really something meaningful that you can contribute back um and hopefully in the next year you will be here and you will continue contributing to this ecosystem in such a way um purpose is obviously not enough okay so that's why many people are tackling this problem of Smart Control security line web free security in general from many places there are many actors who are involved um all of these are ways in which people are organizing themselves to contribute you have people working alone you have consulting firms whatever like such as

the traditional auditing shops you have people doing crowdsource security you have doubts you have um hacker collectives you have internal security teams you have locators you have Advocates there's lots of people really contributing to ecosystem in really meaningful ways right you can be one of those you can really participate in one of these um organizations or even create your own whatever but we really want you to to be with us all of these organizations have created a lot of these resources that we see today right in the early days if you were part of the ecosystem you may have realized that we didn't have many things well today we do have lots of learning resources that you will find online and in crypto Twitter everybody's sharing uh

challenges and uh spoke debug stuff and newsletter and conferences like today roadmaps there are lots of resources that you can learn from okay it's everything out there and you can actually learn from that and also contribute back a lot of it uh everything is cool everything is fine but there is something going on right so all of these these resources seems like they work to some extent but why is it that hacks keep happening right there's something missing that we need to continue working in all of this right so we haven't won yet we want we will never win but we really need you to continue with us right so you can have an impact you can contribute lots of other stuff

and I want want you to have that mindset when you are getting started right you shouldn't be just a passive consumer of all these things and all all of the information that these actors are providing to ecosystem you can really brace your voice and lift your hand and contribute something meaningful knowing always that we won't secure it all okay now we know is that we can miss vulnerabilities hacks we continue happening but if you at least know that we can make the application layer for example uh a little bit more resilient so that even if hacks keep happening we can actually recover from vulnerabilities we can actually um have

these applications not always be like having this application not always be damaging the legitimacy of the space right I don't I really don't want the next D5 hack to be heard in the whole legitimacy of the world 3 space right so we as a as a community need to continue working on making all these processes far more resilient so that we can always grow Stronger by everything that happens um it's not only smart contracts right so what is actually the application layer money this I know this is a 101 so many of you might not be familiar with what do I mean by the application layer well it's these things like sitting on top of the base like right sitting on top for instance on top of the ethereum blockchain and if you want to dive

deeper into it you might say that and well there's this front-end stuff and then you have the smart contracts and you might consider that the application layer um so in this case would be anything sitting on top of the ethereum virtual machine and the blockchain and the consensus mechanism and that kind of things to some extent I would agree but that would be kind of oversimplifying it because I think the application layer is growing more and more and more complex um not only you will be seeing smart contract stuff right so it's not only about like securing a single smart contract or paying attention to one line of solid article yeah that's fine but there's all of these components surrounding smart contract these days

that are actually really really important as well uh I could just name providers I could name indexers Oracle soft change services signers like many components around the smart contracts and it's also keeping in mind that what you do in smart contract is fine but yeah there's lots of things in which you can actually contribute to the whole application layer right application here actually looks like this these days um it's not too much like this but actually it looks like so you have like these deleted components here on top of each other and stable many of them vulnerable if one gets attacked then many are hurt as well um so it does feel far more fragile fragile than the base layer right um

so that's that's the thing that I think that we need to solve somehow um in particular with smart contracts for you for those of you that are not that familiar with what does it mean for a smart contractor we will know well you will see that there are attackers actually not going through the whole flow of the application layer but sometimes they can actually just exploit directly and the smart contract code that is deployed on the blockchain that you can do that as an attacker with one or more transactions right sorry about that um what I wanted to just to mention a few keywords for you to take home on on what you will be dealing with when we are discussing smart contract security for example so in this case you will be

dealing with denial of service Theta funds price manipulations integration issues business logic Fields step corruption so there's lots of things to learn from right and you won't be learning everything in this Summit you really need to do your homework you really need to start step by step as Joanna said in the in the last talk um really getting deep into many of this kind of attacks or vulnerabilities of threats that we have in the ecosystem and little by little you will be gaining experience and you will become more familiar with a all of the things that you as a security researcher perhaps need to be aware of okay and this is what you will look like in Namaz more or less

um perhaps another month but on day one you will be looking at growth in day 35 you will be far crazy um it's weird that this thing of actually looking at codes on a screen has become so popular these days it's rather I don't know how but it has somehow is fancy to be looking at color and trying to find vulnerabilities which is called kind of nerdy but it's cool um but please don't go too crazy on it right so stay healthy um yes you will have older energy all the momentum after their Summit but take it slowly have patience has lots of things to to start with lots of things to learn from um so take care okay we really want you to be here with us next year

um so yeah go slowly please if you don't like smart contracts you can do many other things okay so yes you can get it started with smart contract security and that would be awesome but if you want to keep going there are other things with that you can do um and Jonah and the last talk also mentioned similar things at some point you might get bored our smart contract security and you want to do something else does that mean that you need to leave the ecosystem and not do anything else no I don't think so okay many of us that have some experience um of little by little been looking at other things beyond smart contracts

so I why am I telling you this because you will get started but if you want to continue working in the ecosystem just know that there are many open opportunities for you okay it's not only about solidity stuff there are many things in one ways in which you can contribute just a very limited list of things that you can do and I won't mention them all but we are maturing as a community as a security community in web 3 and I believe that um if you don't do a smart contact security you can check out many of the things and throughout the summit you will see many many talks related to security and with free security that are not strictly related to Smart contract security okay so you will see many

experts and know about all of the things and you can reach out to them and you can talk to them and you can actually push them to share their experience with you okay so use this Summit also for that take advantage of this guiding that we are having in the next few days I think it's quite important to to also open your minds knowing that you are contributing to a little thing and there are many other Professionals in the space also working to secure stuff and perhaps it's not just a smart contracts right many of the I don't know bounties that you see and contests that you see on Twitter and what's hitting the headline the headlines it's just about vaccine smart contracts but know that there are many professionals that you

might not know of but that you should respect but because they are actually contributing to many of these things behind the scenes okay so please reach out to them say thanks and uh and get in touch and try to learn a lot from them as much as you can probably just wrapping up I think this is a real offered on the table and that you have here on the summit and as you get started is more contract security as I said at the beginning you might just focus on the on the followers that you have on the legs that your latest posts got in Twitter you might just focus on where you make it to the to the top of the leaderboard and that is run by money that you want or whatever

you can take that offer if you want to everybody has their own history some background and interests and that's totally respectable I think that's another offer on the table and that you can also take which is like meaningfully contribute to ecosystem knowing that they are professionals working at this that we really care for the technology and the possibilities that are coming to the world and you can also contribute in that way and hopefully that that's the offer on the table that you take and that's what keeps you going that purpose is what's what is keeping you going throughout the days and throughout the years while you contribute to two or three security you can actually help save the industry

we're in a nation industry um we haven't had the final word on it I think lots of people in this room will have different opinions and and we try to do things in many different ways and that's so very valuable as long as we are really meaningfully contributing back to the ecosystem trying to make lasting contributions that we can all learn from and that we can assure that will last for many years not forever but for many years and we can actually all together hopefully in this room make a space a little bit safer that's the offer on the table I want you to really contribute back I want you to not only be a passive consumer everything that you see or

Empower yourself to know that with what you're learning this Summit you can take all of that digest that and create your own things and meaningfully contribute back with things that are lasting for the ecosystem I think that's the way to get started in smart contract security I didn't want to share about road maps or specific links or whatever you will find lots of lots about that and indeed have an interior and whatever I just wanted to share um a more broader perspective on why I think that you should get a start in smart contract security and get going at it I'm tincho I work at direct deal thank you very much [Applause] thank you tinko now we have a couple of

minutes for questions and answers you can make comments feedback say that I'm wrong you can also reach out to me like later and yes yes please yes sure so um team of uh yeah I would say a security Collective we are three people right now we don't mainly application security research which means essentially back hunting for example so we go after projects that we think matter in this

case for the ethereum ecosystem that really are a language ethereum's vision and that contribute meaningfully to to ethereum's long-term game so we try to protect those by doing back hunting and what we learned from that we know we don't keep it to ourselves we try to share all of that with the community um with educational articles with videos and participating in events with workshops creating them will now identify and contributing challenges to that so that's our way to contributing back to ecosystem right I think that many in the lots of people in like there's lots of people with that are very technical and highly skilled in ecosystem but as a

community we are missing this bridge with the with the beginners or with the with the real users another guild we try to produce uh valuable educational content that can be seen as a public good so hopefully one day the security research work that we do can be seen as a public good contribution to ecosystem right now we are funded by the ethereum foundation but hopefully in the future many others in the space will see value in what we do and can also fund us there he's my partnering crime other questions comments okay cool people thank you very much for

listening see you later [Applause]