How Lossless Is Creating A Safer DeFi Ecosystem for All Users

Transcript

welcome to D5 by Design where we talk all things blockchain and cryptocurrency while striving to educate Empower and enrich it's your boy Andy and welcome back to the D5 site YouTube Channel smash the like button on this video that really helps us out and sit back and enjoy the content thank you very much what's going on guys welcome back to the D5 by Design podcast episode 94 here today talking about a lot of important things that you guys need to know about staying safe as a user of some of these protocols for protocols and teams as well it's been a lot of interesting kind of happenings going on recently in the nft space actually yesterday um some of the pudgy penguin community

and a couple others were airdropped these fake soul-bound tokens which then LED them to a fishing link which then drained their wallet um so obviously you know Hardware wallets are going to help you guys a lot with those types of things but just kind of staying in the know for how we can prevent some of these hacks exploits that have really done a lot of damage to the ecosystem in 2022 I mean we've seen it firsthand on some of our accounts some some of our close friends um and then everything else so excited to dive into how we can keep you guys safe uh we're here with Dom from lossless and of course Rob so good morning Rob morning morning yeah such an important topic today like Andy said you know this is kind of up close and personal

um and I I actually saw an infographic um I think it was yesterday I put out by defy yield in their newsletter and um it kind of just described the the I think it was over nine figures of losses across several categories um phishing links um like stablecoin d pegs tons of hacks exploits all over the place um it was an interesting infographic maybe we'll link it in the description and it just highlights you know the the course of uh over the last six months or so the uh the you know just over and over again The Dominoes uh that have fallen both on centralized uh Financial companies as well as decentralized smart contracts that have been drained or

exploited in you know some some way or fashion so I'm I'm super stoked to talk to Dom to see how we can uh maybe prevent this all together or mitigate it um and uh hear about what what lossless is doing to uh improve the cause so good morning Doms good to see you yeah so uh good evening from where I am uh hi Rob and hayandi uh and thank you for inviting me here uh to the spot to this podcast uh well just to Simply introduce myself uh on the cbdo at lossless and lossless is a security focused company providing uh all different kind of security tools for the entire infrastructure on blockchain in order to prevent uh

different type of hacks and to provide services even for the project Founders and also for the small for the small Traders investors and asset managers awesome so can you kind of describe how lossless Works maybe in a few sentences and then we can dive deep in you know some some of the numerous applications that there are to apply what lossless is building sure uh so lossless production differs mainly into a two separate products the first one uh uh was our first product that we developed in early 21. uh it's aimed to protect um individual tokens that project

Founders create for themselves to back up their business uh so what lossless protocol does it's it works like uh last line of defense uh say that your tokens get stolen and they are in the Hacker's wallet what lossless protocol gives is the ability to recover those tokens back to the rightful owner um and for that for that to happen you have to have a snippet of code integrated into your token smart contract so this was our first product that we developed there are more than 30 projects currently active in the market that are utilizing

this business and uh close to uh eight or nine projects uh waiting on the line to deploy their newly created tokens that will also utilize this tool and the second product that we have developed is called Aegis it's also our most recently created tool and actually our most uh well uh demanded product in the industry at the moment Aegis is an intelligence security and monitoring tool uh how would the first from the first product is that it is very easy to adapt and utilize it uh you don't have to integrate it into any code levels

uh and you can use it even if you are a project owner even if you are a Trader investor and what it does is that this tool you can connect numerous smart contracts to it and set up custom uh notifications and alerts and it will notify you about suspicious activity which is happening around your monitored smart contract and uh it is able to identify a hacker on chain even before it manages to uh steal those funds from the smart contract which you are monitoring yeah cool yeah that that's a very interesting application specifically on

the token side we'll kind of dive into that one first because I think the smart contract has tons of open-ended questions that that are there but specifically on the token one so um are you are you guys able to um recoup tokens that are only um that only have the snippet of code for that individual protocol so in and let's say an example um let's say uh users are depositing like um let's say like Ave tokens on Ave they have that exhibit of code somehow there's a run on the on the Ave tokens or some sort of exploit right only those Ave tokens would be able to get pulled back not the other tokens in the money market as part of

this example exploit um I guess could you kind of elaborate specifically on an example that has already happened in the past um and then kind of how you guys worked through that I know I'm on a bridge hack you guys were able to kind of um you know help a protocol out so yeah I'm curious exactly kind of how you guys commit could mitigate it on a token by token basis on a on a given protocol of course um so it's also one of the bottlenecks that we had at the beginning is the adoption for the lossless protocol uh in order to adopt this technology for your projects tokens you have to implement the snippet of code before deploying the

smart contract on uh to the mainnet but in some cases if you have an upgradable smart contract you can upgrade your smart contract with lossless protocol technology at any point in time um so yeah majority of the projects that have adopted this technology were very early stage that have not created their their token at first and just deployed it after talking to us uh so for that reason we had in our timeline another product to be developed which will come live in about a month or two it's called The Token wrapping tool which will allow for any existing token uh in the industry to use lossless technology so

if you have for for example a usdc token uh you can wrap it with lots of technology and if your usdc gets stolen you will be able to recover it um and I and as Andy mentioned one of the examples with the bridge uh this has happened last year uh on one of Harmony's Bridges Harmony Bridge was hacked and that bridge uh during that hack the hacker stole numerous uh different type of tokens from different projects and uh well lucky for us one of what one of those tokens uh already had lossless protocol integrated into their

smart contracts and we thought that those those tokens were stolen we reported the hackers wallet on lossless protocol website and those particular tokens that were connected to the loss of protocol they were frozen all the other tokens that were stolen they were not affected they were then laundered and and exchanged to um to a stable coin or to ethereum or to bitcoin and they were lost but the loss of protected tokens once they were frozen they were reviewed by the security committee which works with lossless and they identified that this was really a hack and they

voted on chain saying that those tokens were stolen and we allowed for those tokens to be sent back to the rightful owner yeah and what are the it sounds like the decision to to freeze the tokens and return them to the rightful owners made by a committee at lossless um maybe we could take some time to kind of like talk about how that committee is formed who makes up that committee um and then I'm also curious and I think you mentioned earlier the implementation of the code snippet is made on a token by token level so it's so so I guess who is the one to implement that

that code snippet is it the deployer of the smart contract yeah okay and why is it that some of the harmony tokens were um why was it that some of the tokens on Harmony had this code snippet but others did not my understanding is though it came from the same smart contract but some of them had the code snippet and some of them did it so all of those tokens that were stolen they belong to different projects and uh only one of those projects uh decided to integrate lossless protocol have this extra layer of security for their tokens the others did not think about it because that is a big issue currently in

the industry uh a lot of crypto players uh founders of projects they forget about security they think it's a mess it's unnecessary because it's a an a new technology it's much more developed than the old Fiat ecosystem they think uh there will be no such issues as stolen assets but actually this is like a totally new playground there are a lot of loopholes and problems left out on the code level and uh we we will see a lot more hacks coming uh to this industry in 2023 and I I believe projects really do have to start

thinking about security because we talked uh well I'm going up the topic here uh but we spoke to a lot of investors over the past month and they said well one of their requirements is that we invest in projects uh which focus a lot on security because those investors they do not want to be you know the uh they do not want to be affected uh by all those hacks which are happening in the industry yeah that makes sense um it's kind of something that's plagued you know both the decentralized and the centralized ecosystem um and we see it particularly so kind of at the at the peak and the trough of some of these markets when there's so

much money locked in these in these you know Wild West playgrounds it is very desirable uh to these hackers and these exploiters there's no big prize on the other side and then we see kind of similarly in Bear markets uh these hackers again kind of like you know uh kind of Rise From the Ashes once again because um well it's there's not a whole lot of other opportunities uh where everything is going up so some you know somewhat neutral actors in the past May resort to those bad actions uh going forward and um if you could kind of describe how that committee uh decides you know what you know what what is what constitutes a hack maybe like

how how this committee is formed and uh if you can a few examples of individuals who who are on the committee of course yeah uh so that is a very good question and an important part of the lossless protocol it's the decision making of whether to send those tokens back to to the owner or not because uh loss of protocol is quite decentralized which allows uh for anyone to report and freeze those tokens on chain they they just need to stick quite a significant amount of LSS tokens in order to freeze uh those particular tokens that were reported

um so for that reason uh we have created this more of a decentralized mechanism to decide whether that report was legit or no uh so we created three different parties and each of those parties they have one individual vote one of those parties is the lossless company the second party is the company behind the token whose token was stolen and the third party is I'm associated with the rest of the parties is called the security committee the security committee consists of nine individual experts from different fields within the blockchain industry uh we

have members in that committee such as founder of tornado cash legal council Global legal council from maker dollar uh co-founder and CTO of polka starter um and uh founder of device safety those are just a few names that I have mentioned but all of those members they have a lot of experience in Whitehead hacking in Reading transactions on chain and identifying if actions function are malicious or not gotcha that's uh yeah I mean that's the that's the kind of decentralized way of

going about it effectively and um I think a lot of that security stuff got lost in the sauce if you will in the in the hype of the of the bull run I mean I just remember that Robbie and I would always kind of preach the not your keys not your coins and kind of Ledger and treasure and you know using revoke cash and I mean it even got to the point in defy somewhere was like let's let a coder guy check the contract and post it on Twitter before going in stuff like that and now it's gotten so much it's gotten so much more um complicated where um you know I guess we've started to realize the risk of these kind of

contracts and the term smart contract is has been all but all but created but the the reality is it's it's a dumb contract it's the person who created it doesn't really know what they're doing um and so I mean you kind of got to take that with a grain of salt and go about that so I'm curious kind of from a user perspective as well as a protocol perspective what are some things that you've seen that users can do to protect themselves but also the protocols and developers can do to protect their users well if talking about the primary products the lossless protocol for the tokens uh for the developers and project Founders

it's just to you know think about utilizing lossless technology to integrate it into their token um we even have left uh this this kind of a well input in the code which gives the option for the project Founders to turn off or to turn on lossless technology within your smart contract so if you do not want to have this kind of additional security layer for your smart contract for your tokens smart contract you can turn it off at any point in time so we made it a very friendly kind of a technology for the project Founders and

for the users well you just have to follow the projects that have utilized and integrated lossless technology into their token or you have to wait just a couple more months while we release the token wrapping tool where you will be able to Simply adopt lossless security to your tokens individually because you will not need to be the owner of the token smart contract in order to adopt local the technology if you have your tokens in your wallet you can simply wrap it with lossless technology and your tokens will be protected meaning that if they are stolen you will be able to report it on walls of unlawful

platform and recover them and is yes that's so powerful for oops sorry the uh as far as the wrapping tool is concerned is that something that is still implemented at the protocol level or is that something that users can wrap on their own without uh any communication between developers uh and between the user and the protocol yeah so they can just wrap it on their own you don't have to have a lot of technical experience in order to wrap your own tokens with lossless technology it will all be done on the smart contract level but that smart contract

will be connected to have to to a friendly website where you will be able to wrap those tokens very easily nice okay cool yeah because that that is super powerful as it gives all of the users the ability to to kind of lossify like their own tokens rather than uh you know making that decision up to the protocol um now the users can do that on their own independent of whether or not the protocol chooses to implement lossless's technology and I think you know the evolution of lossless technology is certainly uh moving in the right direction from uh you know just kind of like ability to implement this this code

snippet before the smart contract is deployed and now you guys are are giving uh you know upgradable contracts the ability to uh implement the code snippet as well and soon uh you'll give that ability to the users to wrap their tokens and and actually Implement lossless technology without the protocol at all so even you know if uh let's say like the composability of some of these rap tokens um aren't composable with some smart contracts where uh they are fully uh integratable with defy I imagine we'll get to a place where some of these smart contracts can recognize certain types of tokens as the same like a wrapped uh usdc that has lossless wrapped

technology um we can we can get to a place where uh that type of token is uh composable with a a native usdc token and they can exist in the same liquidity pool for example yeah uh well that is a good point that you made here Rob uh it's uh well all the tokens which will be wrapped or currently have the lossless adoption implemented in them they were previously an e and erc20 based token and uh a wrapped erc20 token will be simply named L erc20 A lossless trc20 token and it doesn't change the fact uh that it's a

different token standard it is still uh supported by all the platforms that have supported e or C20 they will automatically support l erc20 so if you were able to you know deposit your erc20 token in your wallet before you will be able to uh deposit your L your C20 token in your wallet as well the compatibility is there got it awesome and that that's super important for any any protocols and develop developers that are listening you know there's not a whole lot of downside to implement this type of Technology especially for a new project who's building from the onset and hasn't

deployed the smart contracts and the token contract just yet um the time is really now to implement that type of technology and not after the the token is deployed leaving it up to the users or you know giving giving some vulnerability to an exploit um and then having to backtrack and try to implement the technology afterwards of course uh yeah that is a good point you know uh we also spoke to a lot of big projects in the industry that were hacked for huge amounts of money something like five million dollars 10 million dollars 20 or 50 or 100 million dollars were stolen from them and they were contacting us saying that can you

help us uh we will do anything in our power uh to get those funds back or to adopt your technology and most of the time we just said you know you work too late at this point because you did not integrate lossless technology in that point um but in one case um it was last year when we worked with the cream Finance cream Finance was hacked for about 80 million dollars uh we as well are able you know to uh track and identify hackers on chain um we decided to uh to review this incident on off screen final attack uh we followed the steps of the hacker

which uh stole money from Korean Finance uh we got a lot of information about that person individually who stole that money we we managed to contact him and convince him to send those that money back or we would give him over to the police so uh thanks uh to him he was uh quite friendly at that point he said I don't want to have problems with the police he just gave all that money back and then we gave it back to a queen Finance yeah that damn that is I mean that's amazing to to kind of like go through the level of like forensics

um on chain you know it's not it's not very often that that happens especially crossing the bridge between uh you know the off chain the on-chain world to both highlight those transactions find the individual and then call up the individual and say you know you have the information regarding his identity and uh it's in his best interest to return that that money yeah yeah and it's actually very hard to uh to attract those hackers on chain and it's becoming more hard every day because hackers are you know they are improving they they know better how to hide their steps how to launder that money faster uh so you know

this this manual recovery of funds uh it's a very low chance and as time goes by it will almost be impossible in the future I believe oh not impossible but close to Impossible so for that reason you know you always have to uh have an extra layer of security when you are working in finance because well it's important yeah and I've kind of got some ideas off that topic as well um a lot of these hackers and exploiters kind of have gone Rogue and nobody knows who they are right they're just addresses on chain through centralized exchanges through tornado cash through

here through there so my two questions for you along that line are first are exploiters and people who um you know attack the protocol in some way are they bad actors legally and liable for that or are they participating in a system that has an option that they were smart enough to find out to then um abuse the the system for a financial gain so is that are they committing illegal crimes in or is that kind of like a a part of the system that is available to them obviously no legal advice Financial advice there for me but I'm just generally curious what your

mental model is on those exploiters and then also tornado cash like do you believe that we should have a privacy tool like tornado cash for the blockchain do you think that tornado cash obviously it's not around anymore but do you think it was a net positive or a net negative for the ecosystem right obviously it can be used by hackers but also can be used by just the average folk um so I'm curious your thoughts on those two things so regarding your first question um could you repeat that any place the first question yeah um basically the premise of it was are

exploiters of smart contracts acting in an illegal bad actor fashion or are they just playing the game as it is allowed to be played yeah so it's mostly Case by case and scenario it uh depends on the hack company where it is registered if it falls under some kind of uh legal position uh but majority of blockchain is developed and I believe all developers can agree that code is law meaning that if there's kind of a loophole left in a contract and if a person exploits that will pull he just

uses that loophole to uh you know gain value for himself he didn't steal uh physically from them he just uh played by the rules and and the rules here is the code written so since there is not a lot of still well legal inputs into the blockchain space you have to be very careful uh still this is the Wild Wild West and we have to be very careful and for your second question about tornado cash that tool can be used for good causes but sadly it was used a lot for bad causes for laundering money

and should it be in this industry or not I believe it should but and there's some some type of uh supervision and would extra rules implemented uh but to have privacy and security I believe is important and it's the right for every uh person in this planet and as we develop and grow uh privacy will be the most expensive thing that we will come around interesting that again not Financial advice but that makes an interesting case from an era and some of these other privacy coins if uh privacy is the most

expensive thing you know in the future but um yeah I think I think your point um of uh kind of Regulation and and probably some supervision over those privacy privacy coins privacy smart contracts is is you know probably practical um if not you know already already in motion um by some of the regulatory agencies that um are in the regime um you know it seems like that that was always kind of on the radar that there was going to be regular regulatory enforcement on some of these privacy aspects we've already seen that on tornado cash um so we'll we'll kind of see if those uh regulations are enforced against some privacy tokens before they're enforced

on like the General market and those that you know may be considered Securities um there's you know kind of interesting interesting takes on uh on the Privacy coins versus some of the other types of tokens stable tokens we're all we're just seeing like a bunch of like sub categories of cryptocurrencies start to evolve and I think you know your point of case-by-case basis kind of applies to that as well where you know they're almost used for an entirely different purpose even though kind of all of these tokens are considered cryptocurrencies stable coins are more of a of a currency uh Monero and maybe wrap Bitcoin or more of a commodity um and then you know there's probably

some Securities in there as well so we'll we'll kind of see how all of that all of that shakes out in terms of classifications and then as well as as well as legally um you know the the Bad actors that play you know we tend to I think the intuition is to call them Bad actors um because they're not really playing the game fairly although although it does seem like it is it is within the extent of the rules um and they're they're almost just seeing the rules a little bit more differently or at least at least what's available to them uh to play maybe you know it is not really illegal by any legal standards but is it moral or philosophy you know philosophically kind of correct

I'm not so sure so again I I think you're totally right it is a case-by-case basis on each of these each of these exploits um and then how that evolves with respect to each of these um token categories and how those are viewed uh by Regulatory Agencies by the law and then by uh users of the protocols as well yeah correct yeah um so as far as what lossless is building you know you guys are implementing uh the wrap token feature is there any one particular sector of the market you know maybe it's privacy coins or maybe it's uh you know stable coins what what is what is the kind of the approach going

um you know going forward for lossless um I think you know you mentioned it's erc20s and those um across uh kind of like the evm um is there one particular category of of tokens or users that lossless is is targeting as um you know really receptive of the technology yeah so lossless is not targeting a particular category of businesses in this space uh Lotus is working towards General Security and safety of the entirety of the blockchain space uh but you know as we are developing something new as security is new in blockchain uh

our steps are slower they are smaller so it takes a longer type to develop something and to create you know a working product we are not you know just developing another exchange we are not developing on another staking platform or another OTC pool we are creating something that was not there before so we have to work from the you know very ground definitely yeah it is a Blue Ocean strategy in a field that I mean there's tons of demand like just over the last six to eight months I think the amount of time tax is probably more than you know we've ever seen in cryptocurrency and

blockchain um FTX alone was like you know one of the biggest Financial um meltdowns of all time so if you couple the centralized exchange losses with the decentralized exchange and smart contract vulnerabilities I think we get you know into the magnitudes of um Financial losses that are uh unseen in previous times so a security company um to try to secure uh each of those smart contracts and and secure those losses uh there is massive demand and I'm really excited to see how lossless uh fits into the uh crypto Universe going forward yeah thank you very much

Rob is there anything um else you know that that we didn't cover that is you know particularly on the agenda for lossless well uh the other product that I mentioned ages uh it's another layer of security that we are currently providing for the industry uh if we have time for that I can give a quick introduction yeah please sure so as I mentioned before lossless protocol is sort of the last line of defense which gives the ability to recover stolen funds uh we we were thinking uh for a very long time for a solution that would work more of a first line of defense which is like

preventing incidents preventing hacks um so us as a company and our team we are quite experienced in forensics and uh identifying and reading data on chain so we have analyzed and read more than 100 different type of hacks we had we have gathered that information in to a single place and we have built it built on it this new tool aidas Aegis as I mentioned before is a intelligence security tool which reads on-chain data and it is able to identify the intentions of a user by its actions if his intentions are positive or

negative if he wants to exploit your smart contract or not uh the current success rate of identifying the intentions of a user are about 60 percent but we are still in version one and this percentage will be increasing so what this means that this tool is working on a machine learning module uh which helps to you know prevent incoming exploits and block them out very cool very cool yeah um I mean that that's now taking into effect kind of like the machine learning and AI uh that advances in technology that you know are starting to arise and couple that with uh cryptocurrency and

blockchain and uh there's a really interesting formula there for Innovation so when you're when you're going through this this learning process to identify the a hacker's intentions you said you have about a set of about 100 hacks um is there maybe maybe I'm just going to take a stab at how this works and then maybe you can correct and kind of tweak my understanding there's you know the criteria of bad intentions and then there's the criteria of of Good Intentions and you're you're kind of you're taking those criteria and then you're running the uh the hacks through that model to identify whether they were good or bad and then based on the output you're you're then back testing those

hacks again to see how you can improve those criteria and get a higher success rate yeah uh that is uh correct so and those more than 100 hacks it's not just any random hack it's different types of hacks so uh by reading them uh we gathered the information which is the patterns and algorithms that hackers usually take in order to exploit a smart contract and most of the time it's quite a similar pattern and algorithm just uh through a it happens through different uh parties in the industry they move

money through different companies but the steps uh patterns and algorithms they are quite similar so uh thanks to that we are able you know to identify what they are doing on train and of course with this info information we have set a lot of different rules and he just runs on those rules it checks all my transactions on chain and that notifies you if those transactions are associated with your monitored smart contracts and if they should be looked at or they are good to go and then they can go through the radar with no problem yeah yeah it's uh you know it's bittersweet right every time there's a

hack obviously there's a negative impact on the industry but it means Hiatus is getting better at uh identifying the hack so uh there's some Solace there um and we could have an entirely we have an entire other conversation on the intersection of AI and blockchain so maybe maybe next time we can talk more about that um of course but I think security is a great place to start of course yeah so thank you for that definitely uh how can our community find you you know we we have lots of protocols and developers that do listen um and and some of them are in the early stages and and I'm sure uh could benefit from this technology what it what is the best way to uh reach out to lossless and

get in contact yeah yeah so very simply uh you can go directly to our website lossless dot IO we have our email there uh if you want to have a more direct contact with uh for example me you can go to a telegram uh I am always active in the lossless General chat you can find me on Twitter as dodavana uh or you can find me on LinkedIn as dominicus one ultra low as well so I'm active on almost all on all social media and if you have any questions or want to work with us feel free to reach out to me or or to our

team members awesome that sounds great Dom thanks it was an absolute pleasure and I I feel like I learned a lot uh from uh this conversation likewise it was a real yeah thanks Tom this podcast that uh thank you very much cheers