How to Launch Your Project without Getting Hacked

Transcript

H Round of Applause for your first Speaker of the day Oliver her how to launch your project without getting hacked very important guys give a huge round of applause for Oliver we're not going to talk about the shadowy super coders unon hackers so much we we try to take the the other perspective today like how can you navigate web 3 security because I think it's like super hard especially for new projects entering the space and the the first problem is the auditor market and I I hope the next s will resonate with some people so if you're a new project coming into the space you're doing smart contract you kind of know like okay I need to get audits right but then you have this big challenge like okay which

auditor do I choose um and most of the time people know like these tier one Auditors like trail of bits open zeppin dep org and you write them an email and they come back like yeah you can come back in 6 months and it will cost you like $200,000 and and uh then many projects like well okay I I cannot pay $200,000 three times a year as a bootstrap project it's it's impossible and and then you dive dive into like okay what other Auditors are in the market but it's nearly impossible to to like check the track record of an auditor and to um see if the auditor is good or not you basically would need to re audit your own code and then compare it to what the

auditor did and that's not feasible either so you have basically two options one is like you invest a lot of time into research and then you in the end gamble on on any auditor that you find and hope that he's good and that you get like good value for your money or you're somehow lucky and you know someone who's like really familiar with security is following all the hacks is following all the Auditors and can recommend you a good choice and we believe that this is actually a incentive problem that can be solved and I want to present two solutions um how how we could solve this issue so first why is it so hard to select an auditor like what are the

incentive problems one is there's no risk sharing so if an auditor is like reviewing all your code and you're getting hacked the next day the the auditor will say like oh I'm sorry for your loss um sorry that happened to you but by the way my payment is due anyways uh so it's you know like you you have all the risk all the damages and the order has literally on and what we have well have seen is that there's little to no reputational damage like there's like one big auditor people still coming up to me and and tell me like proudly that they will get an audit from them their name is CTIC I I'm now in the camp of shaming people sorry um and you know like like so many times you like see on

my feet popped up like this project is gotting hacked who got it audited from CTIC and so I don't know why but there's like no reputational damages for like really bad auditors um so that doesn't work either and um yeah as said it's nearly impossible to verify the track record well you can look at the list of projects that had been hacked and you can look who are the Auditors that had audited them but just because an auditor is not on this list doesn't mean it's a good auditor so yeah it's a really hard problem um so what we want to do is we want to change um these uh um these um incentive problems and the first solution we see is um we call it skin in the game auditor so the auditor offers their clients hey I take part of my

payment and put it into a buck Bounty so a buck Bounty for those who don't know um is after you launch if a hacker finds a way to steal your money hack your code whatever he can tell you and you give him a reward for that so basically you give the hacker a way out uh and monetizes know how without harming your project and your community and so if the um if the auditor offers to put part of his payment into your back bound that means he's a very confident in his code in his review and B if something goes wrong and someone finds an issue he missed he will lose part of his payment so suddenly he shares the risk with you and this allows um projects to select as well tier two and tier three Auditors

which have like good price value because if someone offers this to them it will give them trust like okay this guy is actually going to review my code otherwise he going to lose his his payment and um additionally depending on how long the auditor will share the risk with you he as well has an incentive to stay engaged so um if you agree on a period of 6 month he will have an Financial incentive to keep reviewing your code and make sure that if something externally changes he will let you know about it and we think that this aligning of incentives is really beautiful and the second solution that we propose is um audit challenges or audit competitions uh especially what we call the the Cutthroat model um so the best practice that we recommend is first

you you do an audit with a legacy firm so you have a trusted design partner you do multiple iterations they they tell you like okay I would do the architecture in a different way and after you have completed this process you run one of those the audit competitions it's an open invitation to anyone come and audit and we do that on chain so it can even be anons and we have like a huge community in South America in India um the guys that don't want to go through kyc in the US um they can come and they get purely uh rewarded based on results so anyone can submit vulnerabilities and only the um valid ones will get paid which is as well amazing for projects because we tell them like okay you did three audits do this audit competition now either you

code is safe it's for free you don't pay a sent no fees no nothing to security researchers or we find more vulnerabilities and afterwards you're really really happy that those vulnerabilities still have been found before you launched and uh recently we had like two projects got audited by like best audit Us in the space and we found three critical issues and two critical issues respectively so um I I think this is definitely going to be um the new standard and the security researcher Community as well loves it they love this gamified aspect of like you have 14 days 100 bucks and they like talk to each other in Discord and like um how can you correct the code and um it so it's actually a win-win for the project and and for the security researcher and um the the sole fact that

you have in said in the Legacy AUD usually have like three to five people looking at your code depending on which auditor you go to in this competition model we have seen 300 1,000 people looking at your code so um in in auditing it's more quality over quantity but still if you have thousand people looking at your code the chances that everything is getting found is is getting way higher and uh what I think person is really cool um is that um depending on how you structure the model the good Auditors that earn a lot of money and the bad Auditors that are good good at making fancy PDFs but miss every vulnerability in your code they walk away empty-handed and uh actually down here you can see what uh mid Journey's interpretation of this was like up here

are the the Auditors earning a lot and down there the poor Auditors that have to work home without any payment so but there's another um very big problem in security and um that is it's super hard to be ethical as a hacker and I think this is pretty fitting topic for the Luna stage um because um I don't know if you have heard about it but in Europe it's a very um dangerous to be a ethical hacker in Italy recently three students they found um a vulnerability in an app they reported it to um the the developer of this app and their response was that they get arrested sorry for the old number we had $3.4 billion hacked

and stolen and only $10 million in Buck bounties paid out so there's like a really big discrepancy between the numbers and one reason of that is how the process works so the web two disclosure process is like this I'm a whacker and I found uh vulnerability so I have the information on it and I request The Bu Bounty from the Builder um but for the Builder to evaluate if this vulnerability is real or not you have to show him what you found right otherwise how would he know that it's real so you show your information and suddenly the Builder realiz wait a minute I still have all my money and I have all the information I need so what happens often Chia the go he goes to the hacker because the hacker has no tools to enforce getting paid uh he has no

like proof or evidence or something like that he can bring to a court so um this is actually a situation that um gets reported to us on like a weekly basis from like many security researchers and uh now we in web 3 and this sounds like a super solvable solution problem right so all you have to do is you have to put the buck bounty into a vault and only then this the White techer shows the information to to the Builder so the money is already in the world and now the Builder realizes okay um this is the information on on the vulnerability I try to ghost you now but what happens is we give the white attacker a new tool to his hand which is

a decentral court so we are building something ourself there but we as well work with claros so there will be like an expert committee um which try make Fair decisions so it's always important to balance the interest between the project and the hacker there's like no solution where you just say the hackers right every time like this is not I think a desired State either but um so he can request the ruling the court will look at all of the evidence that's presented so in our case that's what was the definition of the b Bounty and what is the cryptographic proof of the vulnerability with the time stamp and everything and they will make the ruling and if the court then decides okay the hacker actually did like just save like this ecosystem save the users money and so on the wher will get

paid so the question now is like why why is this even uh important um when I'm a project why would I give up control over my back bount like many like if you talk to the big projects they get like really antsy about it because they don't want to pay if they don't completely agree but actually you you want to increase the efficiency of your buck Bounty so you want to have more people looking through your code and disclosing and as well make the option to disclose way more attractive than stealing the money so I mean a stolen dollar is not really worth $1 because you have to wash it so um and depending on how big the size is like if you steal $100 millionar it's rather hard to get that onto your bank

account because any like agency in the world will be on your tracks um all the exchanges will monitor all your wallets and so on um but still we need to make it um way easier choice to go down on the ethical route and what is maybe surprising to many but these um really really good hackers they are actually from top universities in the world uh so you have maybe some guy from MIT who's like this super computer nerd who just found the vulnerability this guy he actually wants an ethical career yeah he doesn't want to live in the shadows and do criminal stuff so I I think the meme about these like 14year olds living in the basement of their mom and hacking all the the projects there are some people like that but like the majority

is actually like people that went through University and like want to do like a good ethical career yeah so that's my talk uh we still have eight minutes for questions so I love to have a discussion or like hear your like experiences with like working security launching a project and uh yeah if you want to um check out how we solve these issues you you can scan a QR code or visit our website thank you any questions or ideas you can tell me as well if my talk sucked uh so just tell me in my face no

problem okay seems like we have no questions no hi uh what is the amount of bounties you have because I mean there's platforms like code Arena and Sherlock defi which also have these kind of competitions so are you competitive in terms of the bounty you can get out of it mhm so um depends on the project so we have bounties that are um like $500,000 big we have as well bounties that are like $20,000 it depends as well like how much attack service you have if you close sourced and don't have Smart

contracts then the bount is smaller and we have seen that as of now the onchain Bounty is usually um smaller than the the bounties that are just hosted on websites um but the question um I have and we had some um some instances where white attackers they claim bounties on like immuni or like one of these like um centralized back Bounty platforms and the project told them like listen we don't have the money anymore uh especially now in the bare market so the bounties are smaller but I what I would question is like how big are the bounties really on those websites do they really can pay this 2 million that they claim they will pay you or or not um so yeah Does this answer the question okay

oh and for the audit competitions we have like a price pool of round about 100K most of the time and this 100K is getting paid out on average to 80% in these audit competitions in like 10 to 14 days so um actually quite interesting we have like a few guys that come over and over and they're getting like paid for single submissions $199,000 for like if you find this critical vulnerabilities in the audit competitions and in our model you don't need to share your money with latecomers so in in code forina you have like everyone who finds the same issue is sharing the reward uh for us it's only the first one and then it gets flaged in GitHub so all the other security researchers they don't need to waste

time finding the same issue over and over which is as well super annoying for the project because they get like 50 reports for the same vulnerability and uh this made it's very attractive for experts to come because they know if they come in and find this critical issue first they they can get like 15K 18K for like this this issue alone and we have a few guys that are coming over and over again and finding these big issues that the Auditors have missed which is like blew our mind yeah so um ref Finance has been audited by trail of bits probably the best Auditor in the space and uh the last project we as well was um audited by y Academy as well amazing auditor and we as well found two critical issues so so that that has been really good for us

cool hi hello so um you were suggesting before one of the of the ways of attracting more Auditors and making the space more um yeah like uh equal or Fair um is to only pay it for valid findings yeah but then it raises the concern from me about yeah if I see a project and I don't yeah I feel it's quite good I may not even go and look at it because you know I'm not going to get paid so have you thought about that uh we thought about it uh but the situation never really came so we have projects that have been going through three Audits and we still had like uh paid out 30k out of 100K of price pool um so um I think Auditors are just humans and we need to

accept that and even the best Auditors will miss something and um but and we believe like the the competition model works really well if there's only a few vulnerabilities left because if you have like a price pool of $100,000 and there is 60 uh findings that 60 people share this $100,000 if there's three findings then it's really getting really really attractive so what we actually um proposing or what we recommend to project is first doing an audit with the firm to have this like trusted design partner and only then run the competition model and then depending on how we structure the rules of this model it's still attractive even if the code is more mature so as of now um actually believe the competition model is better

for more mature code than for like really shitty code um I have a question related to your model since um you are paying out just for the uh first auditor that finds given vulnerability that means you need to like confirm this vulnerability very quickly uh so you you know that it's a valid one and another thing related to that is that does that have like bad impact on the quality of reports because if I find something interesting I want to you know submit it as soon as possible instead of like spending time writing proof of concept and like making sure the qualities of report and you

know the the content is very very well written and so on because there might be someone else working on the same stuff that might just you know submit it quicker with the lower quality so where where you put that you know barrier um so for the first question um well the issue is public after it's submitted right so it doesn't matter if it's valid or not uh I mean people would then not report a invalid submission again either which is I think positive for the project so uh I think this doesn't really matter for the second one it's a really interesting question and we are like like tuning the model there as well uh actually we like have a very active Community because um we are not building something like a central company like we

just building this protocol where projects self host their back bounties or audit competition and so we have the opportunity because the ownership of this protocol will go to the the projects to the Auditors to the ones that are in the community either way so they know they can shape the rules together with us and one thing we exploring right now is that for finding a vulnerability you get 0.6 points for the PC you get 0.2 points and for the test as well 0.2 points that means if you find something and write a shitty puc someone can bring a better PC and can like steal your 0.2 points so there's like a a second market for like writing good PCS and writing tests which as well for us um is a good way to get

like new talent in that maybe not so professional yet than these audit firms um but this is an experiment we want to run so I cannot tell you yet if this will solve all the problems but um I think being able to like shape these rules is like so interesting like we have so many discussions as well like should it be time based like one auditor come in and said like okay if a vulnerability is found very early in the competition maybe it's just a super random standard one everyone can find it should get less money than something really late and then we had this discussion okay doesn't this create a new incentive to gamble on like should I report something or should I wait until I report it so there's like all these different parameters we can tweak and

we're like trying and discussing and innovating on this is constantly I think the the competition model is still something where we can do a lot of cool stuff and it's not completely explored yet thank you okay I think my time is up thank [Applause] you