How to Secure Smart Contracts from AI Attacks

Transcript

attackers will always have like a structural edge because they need to find that one missing or one exploit or one particular endpoint to attack. We have lost over $27 billion since 2011 and that is a huge amount. The risk and the attack surfaces are going to increase as we go forward. AI and the intelligent models that we have at our current date, they can run 24/7 on [music] our digital or hardware infrastructure. Not knowing what the AI is coding [music] and pushing that to production, that is where the risk lies.

5 years, our tool has been able to detect hacks worth 200 million If you have ever shipped a smart contract [music] or have interacted with one of those, does it immediately [music] come to your mind that it may hurt your assets? It is a scary situation, [music] but you know it is not always scary if we take the right measures. Welcome back to Ecosystem Project [music] Demo. This is episode 33. I'm your host Puja Ranjan and this episode is brought to you by EC Institute. Today we are diving into something [music] that I think is very

important for every developer as well as users. We are using AIS. [music] We are using smart contracts. So we have to become smarter to protect [music] our project. Today's guest is Indranil Roy, co-founder of Credi and the brain behind the solidity [music] scan. a guy who has been hunting vulnerabilities since before most of us was even writing the solidity code. Indranil, welcome to the show. >> Thank you Puja for the introduction and thank you team for inviting me to this.

>> Before we get into the project I understand that is an interesting one and we are so looking forward to it. I would love to hear who you are as a person. I did some research and I found out that you started with bug bounties went to bug crowd delight and then a co-founder of this great project which is going to help this is not something that people learn in colleges. So please walk us through how does someone go from hunting bugs on buck crowd to building one of the web three most active security firm. I'm Indrail co-founder of Gretchials and I also lead the business side of things. Gretchials in a nutshell is established back in 2021 by both me

and my co-founder Shashank. It's a primarily blockchain security company with two verticals where we are building automated security solutions for developers, smart contract engineers, project managers who are building smart contracts. And apart from that like apart from the automated solution we also provide uh hands-on manual audit service that goes more in depth understands your business logic finds more edge case vulnerabilities. Uh so that's how we work hand inhand product automation plus manual audit service and it's been 5 years you know we have served across 450 clients in the space ranging from names like research herb hemi quick swap poly trade and also on the financial side fintech side clients

like taza pay hero etc. Yeah, now as more ecosystems are coming into the space, we are having to look into different kind of languages. We initially started off with ZT scan back in 2021. I was the CTO and I built the initial set of smart contract detectors and now basically we have a full-fledged team. We have a set of unique vulnerability detectors more than 700 and now we implementing AI into our auditing workflows. That's pretty good introduction of the project. I want to hear was there a moment that you know this is what you want to build.

>> During my university years early days it was more of discovery what I wanted to do. So I got my hands dirty on tech pro code but then security kind of started to pick my interest. I used to find exploits, write exploits, start looking into fishing attacks, how to clone a website, basic stuff. Going more in depth like when I got access to, you know, our college labs and our college professors, they they also educated me more about what things to look at, what things to contribute at. So, Metas-Plot and NMAP are two popular opensource security frameworks that I initially contributed to which are being used widely in the world. these two open

source security tools and that's what got me into security and once I learned about bug bounty actually it was Kashangi in college we are from the same college we became friends in our second year in college and he gave me books to read and told through bug bounties we can earn by deporting diligently so until then I was more about learning for my own skill upgrade but then I got like a motive to keep continue doing it spend nights finding bugs until I get like a valid vulnerable Y still remember my first bug that I that I found at Samsung. I had reported it. They hadn't seen it. They got back to me after 3 months saying it's valid. Thank you. And that's what got me into the push. After

that I went into it more depth spent more time got into hall of fames of organizations like Tesla, Nokia, Philips, Samsung itself, Cisco and that's how all came up and we got into security and uh in 2021 what we saw was no one was building a decent enterprise security tool in the market and we lost over 27 billion late in web 3. that time it was it was way less but still it was a huge amount and that's what got us like both me and my co-founder Shashank that's what got us drive to solve this particular gap in this industry >> so basically some of the interest some uh experience and opportunity in the web

3 space that it is exploding and you also carried some of your experience from web 2's place finding that nobody's building nobody's addressing those problem that inspired you to become a developer and perhaps provide us a tool that can help us prevent some accidents. Very well. Let's talk a little bit more about the problem before we get into the solution. We noticed that there are frequent hacks especially uh I'm talking about the web 3 ecosystem. The other day we were having a conversation with the project one claw which is also kind of helping out with AI technology how we can find it and stop it from happening.

I want to understand from you does it surprise you that these hacks are still there despite the fact there are so many prevention tool or processes which are around. Does it ever feel like that you are just playing guacamole and everywhere you're finding some bugs and and that's kind of creating problem. Like when you talk about attackers versus defenders, attackers will always have like a structural edge I think because like they need to find that one missing or one exploit or one particular endpoint to attack and through that they can get into the system while we defenders we have to be very careful about all the endpoints that can be attacked right but that said with

nowadays with AI coming into the picture there are these intelligent models in the space that are able to fast pace what an attacker does. Before it if it took days into exploit development, attack surface mapping, testing issues. Now that is all automated, right? And the attackers just have to check what issues have been found and you know just validate and execute and chain the attack using his human experience and knowledge. So yeah, attackers are moving fast. If you see in April, we lost over $600 million in the space. Kelp, DAO, and a drift protocol. Two of the issues.

And what we are seeing is web 3 security is no more web 3 security. Now attackers if their smart contracts are secured are targeting their web 2 infrastructure, their AIM infrastructure, etc. Right? So, so yeah, it's always like a cat and mouse game. Very interesting. Yes, of course. Like exploiter just need one loophole or one endpoint which is vulnerable and as a defender as a a tech protector people have to take care of all the APIs or the end points that we want to make it a secure. So it's yeah a game that we are playing but hopefully the good people are winning here. Well let's get into

credial how credial work. So if I am a protocol founder and I come to you and I say that I need an audit what actually happens walk me through the process from the day one to the final report that I would receive in my inbox. >> So initial you know the first part of audit is scoping. So that depends on the client depending on which particular code base is going onchain live or which particular codebase will have you know live users uh depositing funds etc. So we get on a scoping call we understand what needs to be audited we ask questions to the potential client even

like people don't understand that they also need to secure this segment only thing they need to secure their smart contracts. So we explain it you know in detail what are the attack surfaces what we can cover and post that once the scoping is done we basically sign an NDA with the client post that which they can share the code base with us after sharing the code base it takes us you know hardly a day to go through the code and out the effort estimation how much time it will take for auditors to basically complete the audit once the scope is finalized we take the payment we get the process started the first round of checks are usually automated tools is scanning for issues while the auditors are going through the

documentation. Now with AI, we are able to automate that even more in depth the initial stages. So we are able to save time while our auditors focus on the important elements, the business logic, the edge cases, reading the documentation and giving AI more context to to go through the issues. Once that is done the back and forth it goes on until we are confident that the scope that is given to us there are no issues in it and we provide with a developer report which is like a draft report to the client. Then we give them like a 3 month period to fix the issues that is free of cost. Within 3 months they can fix them their issues any time. As soon as they fix the issues within 3 to 4 days we like one to two days to test

retest the issues and then we give the final report and post that it's marketing activities. is we kept like an audit batch to for certification which you can like the users of that project can verify on our website etc. So that's how like an end to end audit processor >> that sounds pretty interesting and I understand you have some presentation and if you would like to walk us through the website or or some slides to explain a little bit more about credit shield project. Yeah. So the burning problem in this space is like we have lost over $27 billion since 2011 and that is a huge amount and 3.6 billion was lost in 2025

itself. Now protocols get more mature. There's more liquidity coming into the market. We are seeing traditional finance come into the space. the need for security increases and traditional manual audit cannot scale with the pace at which hackers are moving. So yeah, what we when we come came into the space what we noticed was like an audit happen an audit is basically a check against a certain set of standards but the industry was pretty new and there was no set of security standards established.

So we started building the product. We started gathering data. You can go to our web3 hack hub. You'll see our past hacks that we have decoded and explained in terms that developers understand before building their their protocols or their smart contracts. So that is how we collect data. We have been collecting since the past four to five years. We have completed across 7 million plus scans on our tools. Solidity scan framework that we are building which I'll get to it later is what solidity scan now aligns to. So we have like a framework in space. What is solidity scan? It is an automated smart contract security analysis and vulnerability management solution built for smart

contract developers, security auditors, project managers, product managers, etc. What you have to do it's simply DIY tool. If you're writing code in solidity, just upload your smart contract on solidity scan and within a few minutes it passes through 700 of our detectors and gives you a report and also how to fix it, remediation steps and other functionalities. Basically, if your code is on GitLab, Bitbucket, which I'll show in the demo, you can easily pull it as well. And at the end of the day you can invite your team work together in in the same platform and generate your audit report within minutes. Now coming to the OASP smart

contract security standards that we advocated which has been backed by the Ethereum foundation as well. So before coming to that OASP is a foundation which establishes smart contract security standards even before web 3 existed. It has been creating standards for mobile application security testing, web application security testing, cloud security testing, ailm security testing and this segment was missing in the web3 space which we partnered up with was gave them our research discussed with them and came up with a framework which now the industry can follow for their security analysis. So yeah, the solution is it's uh what we've been doing for the

past 5 years. Our tool has been able to detect hacks worth 200 million. Some of them are mentioned over here uh like the safe moon, Deceity scan, you'll be able to find the exact issue that was the root cause of the hack. Before traditional institutions were not coming in but now after we see we can see regulations in place across Europe, UAE and we are seeing more inflow of capital in the market. We are seeing more crossber payments happening.

We are seeing more asset tokenization and now we seeing infrastructure not only focused on like built on solidity but in newer languages like rust dam which is a new language for the canton foundation. So what we realize is you know where money flows the risk increases and the risk and the attack surfaces are going to increase as we go as we go forward. So now we have started in exploring and dam we have a partnership with canton foundation we have audited projects in daml rust golang etc.

So at the end of the day, security is not about just running an automated scan or just going through a manual audit or just launching a bug bounty program on the web. It is about all these three which which creates a complete ecosystem. You run automated tools to weed out 70 80% of your issues during the development stage. Continuous security tool keeps monitoring for whatever changes you push or you add to the repo. And once that is done, you consult a third party for a manual review which they go in depth, understand the business logic, talk to your developers, understand why this is needed, why that's not and give a third

party review on it. And at the end of the day for that 1% edge case vulnerability is what you launch your bug bounty platform for where you leave it out to the open for smart or smart security hackers to find it out for you and get paid. So that completes the entire ecosystem and that is what we we are trying to build. And now we realize that as I was mentioning earlier that web three hacks are not related to web 3. it is expanding into your mobile in your cloud in your API configuration in your AILM infrastructure. So what we realized is people will need security not only for their smart contracts but

also for their other infrastructure. So this is something that we are launching in a couple of weeks in beta which will cover your end to end security of your web 2 infrastructure as well. So yeah >> that's pretty interesting. Thank you for sharing it. Definitely gives confidence that we have the tooling that we require in order to prevent some mish happenings because not only web 3 but web two as well. When we are looking into finances and we have billions of dollars on stake we should get the right precautions to prevent anything going wrong. Well, I have one question. You mentioned in the presentation that there is a mix of both

AI and human work. So what the AI can catch that human team may have missed it and way around as well. What human can catch that AI just can't do it now. >> So an AI and the intelligent models that we have at our current date they can run 24/7 on a digital or hardware infrastructure. You can feed it data. it you it can do the initial 60 70% of your work before security pentesters or auditors had to go in depth understand each issue go line by line of code and automation tools came in it it was able

to help now AI is able to ingest databases that have been there for years while human attackers try if a human pentester tries to go through 10 thousands of past vulnerabilities. It is not possible for them to understand and he or she may also ignore an issue or hit a 404 and and stop retrying. While an AI is relentless, it keeps doing your work. It keeps finding what coverage we can do, what pattern recognition can happen and eventually provide the auditor with the most concise data that he needs to look at. Now the auditor has

years of experience. He has seen things differently. Before when I used to hunt for vulnerabilities, if I hit a road blocker with my known knowledge, I used to try this and that. While AI knows how to if I've told it to do this, it knows how to do this. It doesn't has its own thinking that it might try something else. So that is where the human intervention takes place. A human understands the logic of the contract, the economics of the contract. Like something might make sense to an AI just by simply looking at code. But when you talk to the person who is involved in this project, you understand the priority of that person. You understand what is more risky. You understand why this logic was implemented in a

particular way and not the other way. Right? So that level of human intervention is required to basically make a conclusive review of the engagement >> right. So AI is kind of um really fast and tireless junior analyst that is working in the background and human are partners who make these decision who make the judgment call. >> Yeah. >> Very well. I think this is a very good point to maybe see what you are explaining it to us. So if you would like to provide us a short demo of how things work.

>> Sure thing. So yeah this is what our website looks like. It's smart contract security scanner like I mentioned even without login you can explore our resources. Web3 hackhub which I mentioned has hacks hack data of the past. You can go to each hack understand what happened and prevent yourself from it. [gasps] Once you log in, this is what our dashboard looks like. Like I mentioned before, we have various methods of code injection from GitHub application. Like if your repo is on GitHub, if it's private, you can integrate GitHub and give solidity scan access to that particular repo and when your scan is done, you can remove access. So we have maintained that level of security and

access control while building the tool itself. Apart from that, GitLab, Bitbucket, Azure Repose, these are more platforms that enterprises use and verified contracts is something that we've built specifically for this space where what we see in this industry is is for transparency projects make their source code public. So what we did was we partnered up with block scout. We partnered up with Etherscan, Subscan, XTC network and multiple other players in the space and wherever the contracts are basically deployed like Bass is one of our partners through block scout. You can find in any verified contracts you'll find our our security score over

here. So once you have the smart contract what you can do I'll just take an example. You just copy the contract you select where it is verified on. You select the chain. I picked it up from base mainet. So I'll select block scout mainet block the contract address and proceed. So yeah, while the scan runs an example of a typical scan is like this where you get the overview of how many issues have been found. When you go to the vulnerability scan tab, you get issue by issue what the issue has been found. general remediation and this is something that we have implemented where it generates an AI fix for you which

gives an exact fix for your code. So once you're done you have additional functionalities like it's an automated tool. So there will be false positives here and there is what you can or it might be an issue that you don't need to fix. It might not be like a security issue. Generally critical high medium are security risks while lowformational and gas are code enhancement methods. Gas is something that we have added for developers to be able to optimize their code to consume less gas when they're running on onchain functions. Once it's done, what you can do is you can basically publish a report right off from the dashboard itself. A typical

report looks like this where we have the table of content, the project names, the classification of vulnerabilities, an executive summary, threat summary, finding summary, line by line like details where it has been found for the developers kind of like this. The description etc. If you have added any comments previously on your portal, those will also reflect on your report. And the thing that was as mentioning organization you can invite your team member add permissions they will be able to work together with you if you're building you know if you're using the terminal since we we have also integrated with developer platforms like VS code remix what you can do is you can generate an API key from the platform

itself and we have our SDK documentations which you'll find on our websites which you can easily configure the API key and and get all the results in JSON format in case you want to show the results in another report or in your own dashboard or for your internal security. So that's what solidity scan is and this part what I was showing was more for people who are sound or who understand solity who understand what the risks are etc. For the rest of the people what we we also built which is a free functionality which is solidity scan quick scan. The same process. You basically add your smart contract code.

You select the the blockchain etc. and you run a scan. But this is more for people who are looking to interact with a particular project and wants to check whether this might be a duck pull or a scam or not. It's not like code risks but it is you know subjective risks that a developer might intentionally add a burn function in a fixed supply token project. uh add a mint function in a fixed supply token project or you know the contract is or the project is not truly decentralized people hold you know more than 50% or 51% of the tokens and have control rights checking for self-destruct function etc. So basically

these issues are not vulnerabilities in it itself but it can be used to trick others scam others. So this is something that we have provided for free to the ecosystem to to do a quick check before interacting with any contract and what you see on top is basically a sneak peek of what I showed just inside. So yeah, that is pretty much it on solid scam >> and pretty fascinating as well. Like it is really good to see how detailed the report is and like the auditor is doing a great job here trying to explain the finest detail and putting it into good graphical format to like give a good feeling of how and where we are right

now. I want to understand the positioning of this tool like the target users just to provide some context. Recently we had a conversation with a project called sourceify. So I understand sourcifi is another a project which helps us review the smart contract code right. So how do you see sourceify being different from solidity scan that is being provided by crime. >> So what we do is more on contract security level like we ingest smart contracts. We are not on transaction level or or transaction analysis is not something we do. It's more on the deployment.

>> Once you have deployed your contracts and smart contracts are you know immutable. You cannot change them after after they get deployed. Our tool won't work on them because the contract is already live. So anything you do before going live is where solidity scan positions itself. Early stage developer teams that might not have budget for a fullblown manual audit but want to launch like a beta version of their product. It's a good layer one of security for them. Yeah. Like it's an end to-end solution for your reporting, for your scanning, for your management and it's like a solution that sits on your pipeline and keeps checking for issues as soon as you start coding.

>> You answered two of my questions. So I was wondering like at which development stage or cycle we should uh consider having solidity scan and who are the right people. Yeah, like during during your pre-eployment stage, of course, you use it. And another differentiating fact once it it continuously runs on your pipeline, if you go for a manual audit engagement, you go in for let's say a week or two or 3 weeks, the manual auditors work with your project and once they are done, they are done. They are not looking at your old code on on a daily basis. Now zero day attacks are something in the space that no one is aware of like it comes it is called in that fashion as well. Any attack factor that is popular across that affects a

lot larger crowd comes up it's called a zero day. So for zero days like for example when we're starting out open zeppelin libraries are used by widely a lot of projects they basically import open zeppelin libraries and and build on top of it. But in the time lock library of open zip plane we found an issue. So that is something that as a manual audit engagement we won't go back and remember that this client had this right but when an automated tool sits on your pipeline even post deployment it it keeps identifying security risks.

>> These are all interesting facts that's coming out and I'm getting hooked up here. There is a statement on the website that is interesting to me. 72-hour promise. Could you maybe explain a little bit more about that? What is it and how does it work? >> 72-hour promise, it's basically for depends on scope to scope again for an application. What we're able to do is now with fast-paced AI models, we have been able to build like an agentic workflow with AI. It's not like AI running automatically or we are just dumping our stuff on cloud and asking it to find vulnerabilities but it's a guided AI approach which again reduces the time that each auditor is spending

manually. So an auditor can at the same time focus more on edge cases, business logic, documentation and nitty-g gritties in inside the documentation that the AI may need context of while the AI keeps running and doing its job at every stage. basically a human uh security researcher gets the inputs from the AI puts his own human intelligence and based on his experience he knows like in the next stage what I need to basically communicate with the AI to make it perform better. So when you do it at at each stage the results in your next stage gets more purified more direct more more to the point what it

has to look and AI is more deducted so that is how it's not that audits won't go beyond 72 hours but but yeah like it depends from application to application we have done audits that have gone on for 3 weeks as well but now we are assuming that the audits that previously took 3 weeks would be done under one week So that is the messaging >> AI has provided us so many tools it's mind-blowing like they can do a lot of grunt work and then human intelligence can make it even more powerful at the same time we are seeing that there are increased usage of AI in terms of writing smart contract codes in your mind what are the new attack surfaces that will be there in future if these AI

agents continue to write codes would you be terrified or you would be excited about it. How does it look like? >> I mean a lot of companies are now promoting gentic development. We don't need developers eter crowd are basically wife coding and creating applications, right? So one thing I'm majorly concerned about is how AI has access to your API keys because even to connect to let's say Google sheets or connect to your Slack, connect to Telegram, connect to notion, you need to have those API keys in the AI right now. It depends how restricted you keep the AI. The more unrestricted you make the AI, the attack

surface increases. If the AI is able to talk to external people, it can be manipulated into a prompt injection where we basically brainwash the AI into into spitting out the credentials. So this is one and apart from that VIP coding is a big problem like productivity wise it's really great like even not wipe coding but we use AI for coding as well but then not knowing what the AI is coding and pushing that to production that is where the risk lies you need to know what code AI has written how it has written it its approach to understand the code so that you also understand when talking to the

auditors you also understand what to tell them what is the attack surfaces etc and so yeah like before which took two two weeks to go to production now it's going to production in 2 days right so and attackers with AI tools you can see popular supply chain attacks happening in node modules npm postgress versel got hacked compromised so these are tools that are being widely used for and if the main application gets hacked then it's It affects everyone and even the application that you are coding yourself if you're deploying without any expert review that increases the risk.

>> I mean centralization is always risky right so whenever we are using something which is there controlling so many users data it is always risky to have but the other concern that you mentioned about the usage of API keys. So I would like to share it with our listeners. We had this uh conversation with one claw team and that project basically talks about how you can share your API keys securely with AI tools that you're using. So I will highly recommend people to check out our episode. We'll provide the link here in description. Well, next topic that I would like to talk about is the usage of project credit shield for community and ecosystem. As I understand

like this is a web 3 world people have a lot of projects ongoing and the most popular concept is like the DAO and there are small protocol teams there are communityrun projects what does a minimum viable security practice looks like when people don't have big budgets and how cred shield can help there >> so like when you're working with a small budget you need to first prioritize what you want to push to mainet first like rather than going all in when like even I'm a founder when we start building things like we think about this that and we want to build everything right but once your priorities are straight you basically focus on the part that you're building and now if you don't have no

budget for an audit what you do is you run open source tools like slither for the methics you get those outputs you run solidity scan as well the base plan is just $30 for like 2,000 lines also it doesn't cost much. You won't get the reporting etc and additional functionality. But that's fine as long as you get the issues that have been found. Next step like for new age founders in this AI world, I would say feed the AI the context of your project as well as you can explain it and read about hacks that have happened similar to your projects or similar to your protocols. Feed AI that context as well so it understands. Then what you can do

is like you can check out our OAS repository where we have detailed each attack categories. It's called SWE and we have like around 100 plus attack categories documented every year on year. We publish the top 10 attack vectors for that particular year based on the hacks that have happened. So you can learn from that. You can understand the attack vectors or you can make your agent understand the attack vectors. get all these information from different tools, from different sources, feed it and then ask you know the AI to do your security if you want it. Once you have more budget, if your application is going live, you have users, then you have funding, then then it is recommended you, you know, call in the

expert to do their job. >> That's right. And we are talking about minimum viable uh security measures that can be taken in order to just kick it off. >> Yeah, >> very well. A slightly related question here but honestly I would love to hear from you. What is the state of web3 security culture right now? Are we getting better and um when according to you we will be way more confident in shipping thing we'll ship and just relax >> like when we started off in 2021 there were a lot of general bugs like re-entry access control etc. They still exist today. But nowadays when you see hacks like kelp exploit that happened recently

282 million or something like that. You see you know there were multiple attacks that have been chained to it. Right? So yeah like attackers are getting more smarter. They are now looking for more complicated attacks. Right? So in a way the older things people have learned but now newer attack vectors are coming into the space. So we have to keep up to date with what's happening in the industry keep up to date with whether your web 2 infrastructure there's a public compromise or not in that if you're using any kind of modules in your backend infrastructure you need to update it or as soon as you get to know about a kind of supply chain hack you either need to shut shut it down etc. It has happened year on year. People have got hacked. People have got scammed. But

after so many years, you get the knowledge of what to do, what not to do, what to interact, what not interact with. Yeah. So the industry have come a long way, but I think there's still a long way to go. >> Indeed. Yes. Everything is evolving and we have to keep it up with that in order to stay safe. Well, I hope that the information that we are sharing through this program becomes helpful to people. It's always an eyeopener when we learn about something new that is happening in the space as well as when we learn about that there is a way to prevent any mis happening. So that's really good to learn about these projects and tooling.

All right. Uh now let's move on to our next section which is called rapid fire round. [music] Here we would love to hear your thoughts or something that comes to your mind first and try to respond to the questions. >> Ready? >> Best smart contract audit you have ever read and what made it exceptional. >> I think the best smart contract audit are not the ones which they don't you don't find issues. It's more where you understand like the D5 specialist auditor has explained the issue in certain way or that defines the business logic or the economics of that particular project while writing that

report. So yeah, best would be you know unis swap v3 audits. A is pretty particular about their security. So those reports I I would you know give it a read. AI auditor versus human auditor. Who will win in 2030? >> I think it will be a combination of both unless something unbelievable comes up in the space. But I think the best output that you get is when you put human intelligence with AI after all AI has been built by human itself, right? So I don't think neither will win. I think the combined model will will perform better than both of them individually.

>> Yeah, that makes sense. uh one D5 protocol doing security really right right now. >> So you have like the previous question like same D5 protocols like a are particular on their security non-defy institutional companies like Coinbase you can check they are pretty particular about their security. So yeah, >> so mostly all D5 protocols are >> larger D5 protocols that have been you know that that have gone through a lot of phases over the years >> right if you would have to point that out what would you say as the weirdest vulnerability solid scan ever caught >> I wouldn't say weirdest but earlier which I mentioned the open zeppelin time

log issue that had happened that was more of a supply chain attack and it was weird because it was a repo used by a lot of individuals and that time information was also not there and available for people to know. We didn't have automation built. So we basically manually emailed all our customers that were using that particular you know issue and very early early days of scratch shields like my co-founder had found a bug which halted the avalanche test net that was pretty weird early days of avalanche as well. Yeah, we have written a blog around it >> right because the project has audited so many chain. I have this question for you. If you had to guess which chain will be more susceptible towards attack

in the upcoming years. I'm not going to take any names in this but you know the newer L1 L2s that are being built I think those will be most susceptible to hacks because now new chains are again the rapid development fast deployment and yeah those would be primary attack attack targets >> free scanner or paid manual review uh what would you suggest for a solar dev start >> obviously you start with a free scanner like some security is better than no security but then when you have $1 million interval that is not when you rely on free scanner itself.

>> So even if um the project is initiated by a solo developer if it contains a large value going by free tools may or may not be okay. >> It is not okay. >> All right. The one thing a founder should absolutely check before it goes on the mainet. basically who owns the you know multisc wallet obviously who owns the liquidity then ownership of the contract how it's coded when you renounce the contract stuff like this that deals with directly or what of the project the functions that the after all your tokens are again a piece of code right uh so anything around that that hack that or make it exploitable that that is something that

founders should focus on >> the last question in This round is biggest security lesson from the past two years that nobody listened to. >> I think the by bit hack of last year 1.5 billion when you understand the hack it is not a web3 hack. was more of a JavaScript attack, right? And that tells you more about why you need security on your entire digital infrastructure, not just your smart contracts, right? Because now attackers are not just looking into your smart contracts, they're looking into your different infrastructures. And uh even if you read about drift protocol hack, it was not the code that was kind of compromised, but it was the people of the

organization that were compromised. So being aware, knowing who is bad or who are the bad actors, knowing what to execute or not to execute, I think would be that. >> Very interesting. Well, you responded to all the questions of this section very well. Just final one, where do people find you? >> You can find me on Telegram in996. My Telegram ID, I'm active on LinkedIn. My email is there. my name at the rate.com and you can find me in upcoming conferences and events.

>> Well, I said it twice and that was my last question, but I guess I have one more for you. So, if you have to say credial in one sentence, what that would be? >> I would say the security umbrella for your next generation agent infrastructure would be our new tagline. Before it was building nextgen security tools for web 3, but now times are changing. Awesome. Hundreds of protocols secured, zero post audit exploits and multi-million in value protected. This team is clearly doing something right. Indra Jani, thank you so much for taking out time and talking to us about this project. This is the kind of the work that makes the

whole ecosystem safer for everyone building in it. >> Thank you Puja for those kind words and thank you for having me in this session. It was really great session. I hope it is useful to the viewers and looking forward to do this again sometime. >> Sure, we would love to have you again. Definitely would love to chat about it when there is something new coming up with the project. >> Thank you for your time. >> Thank you. Thank you team. Bye-bye. >> For people listening to this podcast, links are available in the show notes. Run a free quick [music] scan or solidity scan. It takes 2 minutes, no account needed. And if [music] you are about to launch anything, talk to these people first. Get your project audited

or do self audit. Until [music] next time, keep building, keep shipping and I will see you in the next episode of ecosystem project demo. Cheers everyone. [music]