Josef Gattermayer / DCxPrague

Transcript

okay thank you uh so hello everyone uh I'm Joseph and uh uh I'm from Aki blockchain uh we are cyber security company Auditors and uh we are mainly known for auditing smart contracts on Solana in ethereum but we are also uh developing uh some open source and uh teaching blockchain and uh we had this problem that I'll talk about today which came up to a solution uh we are quite working with high-profile protocols and one of them uh is safe and safe is very active in drafting new uh proposals and protocols

and this uh ercm going to talk about was drafted by safe and we are co-authors of the ERC uh but before I jump into the problem I must give you some kind of like introduction so uh what is is the auditing process as seen by the Auditors the second sentence is quite important uh in our view like the whole quality assurance uh is based on some assumptions which are built from top to down so of course the developers need to have some kind of tool link like good framework uh on that they are building

by their best practices uh which means uh for example correct git flow uh regular pre reviews or uh using uh Vari design patterns and on top of that we are adding tests uh which means of course the developers should be writing their tests and uh that's another layer of security but they are just like unit tests there are integration tests but uh some special category of tests are fastest that we have like separated here and if this all is completed then there is the audit so uh without the

underlying layers the audit basically cannot much help or can basically tell that uh there's some problem but uh the process looks like this and of course this is the impact on cost so uh the uh things that have the biggest impact are the cheapest one and audit of course is the most expensive one and um this is how Auditors see the audit uh regarding the process uh security is a process it's not like one hop on H hope of thing and uh the good projects should be audited continuously which means every release and um also the Auditors always tell

that hey please guys get another auditor so it's good to have everything reviewed by at least two teams and of course the audits should be public so this is how we as Auditors see the process the problem is that users see the process a little bit differently and at least from my understanding the user perspective on audits is this uh which of course doesn't much help uh it can bring some problems and uh one of the problems actually happened to us and uh you can imagine that there's a protocol who was audited sometime in the

past and the protocol of course wants to demonstrate that it was audited so they put the logo on the website and the user he sees this but what does the user doesn't see is uh the comment here which is not of course on the website uh which tells yes this company has audited the protocol but it was 2 years ago it was 30,000 revisions ago uh the smart contract now looks completely different and uh even the audit report three years ago has raised some issues that were uh some of them just acknowledged and not not really fixed so this is what the what the user doesn't see and of course

this doesn't work for the users and it also doesn't work for the Auditors because from the auditor's perspective when something happens for example the protocol gets hacked uh so uh who is here to blame of course the guys that have logo on the website you know even if the audit actually happened two years ago and there's like completely different protocol right now uh the funny story is that this protocol got got hacked and uh we were having a lot of issues by communicating that uh the hack happened in smart contract that even didn't exist in our audit so uh this kind of make me very uncomfortable and we wanted to find a solution for

this problem for the users and for the Auditors and then I reminded myself that uh save guys were speaking about some standard uh which they already named and the standard is ERC 7512 and so we jumped into the conversation with them and uh basically were a little bit uh trying to uh move the disc discussion technical towards the direction that we wanted to and uh uh with them we drafted uh this ERC and what was the motivation so we are from the blockchain space right so our problem with with was with the logo on the website but what if there is a

distributed storage that cannot be manipulated and provides cryptographically proof Pro proven data that's blockchain right and uh so let's start just using that uh so the idea is to store on chain the metadata from the audit which then of course would work better than a logo on the website and we just identified like for the first version for the draft the very minimalistic uh set of data that basically help to solve this problem so the important information is like who audited that that's the name of the

company we also have their field to include names because skin in the game you know so it's good to uh see who was the auditor uh what was audited so uh the scope which means uh the contract or the GitHub comit anything that helps to identify what was the scope of the audit this also answers the question if the audit is still valid if there's like new newer comit or a newer version then of course the wallet the audit is not wallet uh then important question is when was it audited so this also helps to answer the question if the audit is still wallet or not and also a question if the fixes that the Auditors recommended were actually followed so

this I would say is like the minimal set of data that we need to store on chain and uh so we did this is the ERC and and the structure is very easy so we are defining basically the Auditors we are linking the report the PDF of the report uh to be sure it cannot be manipulated we are also including hash of the report uh we are including list of Auditors who work on the report and uh we are linking there uh in this draft the uh actual deployed address on the chain which means if it was on I know Avalanche then we uh include chain ID of

avalanche and uh the address that it was deployed to and uh then the things I discussed which means when was it audited and uh that's basically it so this kind of structure is created by the protocol and once it's created the auditor just signs that and by the signature is there's like approval that uh yes this information is solid and we have our SK game which means that we are also confirming that uh this is how we perform the audit and it's kind of like bigger space there in the in the standard could have been included like the issues and we discuss this all but

in the end we just agree that let's keep it very simple and basically when the auditor signs that it means he he's happy with the outcome of the fixes so we don't need to include like every uh issue and the status of the issue but just like by the signature the auditor approves that okay we are happy and now it can be signed so is it the easy solution and uh what does it cover the use cases so it's a proof of the audit uh which means there's a cleer that uh it happened it happened at some time and happened on some scope it's also kind of like the other Edge case uh for example the auditing company could modify the PDF the report if they would oversee

some issue they could edit there you know and be doing like kind of this practices that shouldn't be done so also as we have onchain the hash of the audit it can be manipulated so it's working on both sides and another like huge Advantage is that by having this uh kind of uh onchain structure on ethereum uh we can uh query that programmatically uh by uh simple RPC call uh which means it can be implemented for example by wck news uh so so far when something is wrecked there are just like following the tweets and trying to uh find from the tweets who was the auditor so here

it would be like very hard proof and it can be checked by uh an easy algorithm and also my initial goal was that this should replace the logos on the website uh which uh of course is not defined yet in the standard but we can imagine that there's for example some kind of like uh interactive dashboard that will show that it's audited and the audit is still bid and this dashboard could be used then by the protocols on the websites so uh it will also work for the end user and that was the second part of the motivation so this is the ERC nutshell if You' be interested uh here is the uh proposal uh as it's drafted uh the QR

code leads to the uh ethereum website uh if you would like to add anything ask anything or help with anything we have a telegram Group which is now quite small but there there are all the ERS with the of the CRC and now the goal is to basically uh have the draft finished and push it to towards the production so every protocol could be using this and uh it will help us to create a safer space for the users in the end uh these are the uh companies that stay behind the CRC so we can see that uh they are quite high profile Auditors open zalin AAC uh to BU Bounty platforms safe they diving that most uh chain

security so it's kind of like good names and we are happy we are part of this uh initiative so thank you and maybe you have any questions hi thanks um this is awesome um have you I have a couple questions so first one is um I think there already exists like a document management standard which was related to Securities have you considered something like aligning with that no okay this was quick reaction um basically like the motivation was to keep it as much as lightweight as we could but of course even in this very

small group there are like very different opinions because for example like The Bu Bounty platforms they wanted to look look a little bit different we want to look a little bit bit different but like the very core that needs to be settled is like who audited it when was it and what was the scope and that that that's here okay and second question is um I can often see that that there are like updates on audits right that there is the audit and there is some you know following works by the project and then there is like the AUD uh updated document reflecting the the the outcome comes of the you know whatever project uh has um responded to to to the audit and those are literally not considered like a sometimes like not secondary audits it's more like this is updated

document you know sometimes we can see visin the projects that you cannot see both of them the both versions the previous one and and the new one you only see like the new the new one so do do you guys somehow discuss this because the versioning is not here but uh do you guys somehow discuss it uh how this would be handled the versioning of the of the audits yeah uh it's there actually and you you're right uh it's the best practice that the audit is constantly being updated so uh the good audit uh has like seven revisions you know and you you can see even like the history how the protocol was evolving you know these are really the best audits we are for example doing this

with axlr we just submitted a revision number seven so this is the good the best best practice how to how to work with audits uh of course the auditing company shouldn't should never like modify the previous versions We have like rule happent only so whatever happens happent only and exactly like here it works that way that uh this structure is emitted for each revision so basically because like when when you have a revision number two then the scope is not wed so basically if there would be I know dashboard this would be then flashing CED you know it's outdated uh but you will just uh as a protocol emit the new um version of the of the contract vs auditor sign it and there's

like new entity which is green so uh yeah it's it's built in and we wanted to keep it simple so there's no versioning but every uh version should have its own representation so do do you plan to have like a like a secondary standard which would say this is a collection which reflects those all those revisions uh we are not there yet quite like from my side I'm happy even with this because it's doing the job and we just didn't want to complicate it okay and potentially last question because there might be a few more from the audience and that is uh reading the the ERC number uh do you guys consider this that this could be like a little bit more adjusted that it would become the nft um I know that for example on if I can tell the word on on Solana they are

having discussions of having uh uh audit proofs as nfts here in e space I think uh it wouldn't be accepted that happily if I say polite yeah I think nfts is kind of the way because otherwise you lose the link from the contract to audit so me as like user of the contract I cannot see like if the contract was audited or not because there is there is link from the from this audit contract to audited contract but there is no backlink so you I think uh you need some kind of nft or something like this to to create this

link and uh but the question is what stops audit company or developers themselves from uh spamming like hundreds of different of those uh audit contracts to their for their Contra for their own contracts that they want be audited or they they want to look like audited and just like you know just show show whatever is convenient yeah it's not here in the snippet but they are uh the disc in the in the ERC proposal is something like that that every auditing company will have its own like verified address that will sign this so basically

I know there will be a list of companies that you know uh have these kind of accounts for signing the structure here and by that you can identify who signed that if this answers the question who will do this qya no your your auditor like decentralized community no one yeah but of course like idea is everyone can sign anything of course but I know for my side for example I will have like on our website that this is our account that's used for signing of our audits so something like this yeah but this is not trustless propose something yeah no no no I'm just saying yeah yeah there's no

like mechanism to make it trustless not yet so would you use it or not not sure like like like the motivation was like better than nothing you know it's it's the first step you know we want to replace the logo and and that that's that's this you know Des um we must think about the fact that um such a structure and when when when we have this in in in in the space that it can be used not only for the audits related to the smart contracts on evm right this is this is General approach which I can

see here that it says there is the auditor there is the document and here's basically encryption of what what uh what he signed at that is's saying this is document from me regarding the audit so it could be for any other chain or whatever you know uh so that gives a little bit more opportunities to uh to the auditing companies I would say yeah I think this is like the very basic use case of uh blockchain you know to have uh some kind of hash start on chain so you can verify the document you know that's that's it yeah sry question um I'm just curious if you're seeing some um resistance or hesitance

from Auditors um around the fact that I mean they spend a lot of time and money and resources in protecting their reputation um and it's very tricky because you can never have like a foolproof audit and you know no matter how good you are something can always happen but if it's like onchain forever and something happened everyone can very easily go back see that you audited it and that hurts your like is this something that you see resistance about yeah like first of all of course like in every disclaimer or sales call of a reputable company is like it's a process we are trying to do our best of course we can make mistake that's it you know all of

the top auditing companies such as trof bits neodyme opens a plan all of them are on R news sometimes they missed up you know that's that's the fact you know uh so that's like the answer to the first part of the question regarding the names it differs like some some auditing companies are just using the some kind of pelo random names whatsoever nicknames my view is that we are confident and we must put our skin in the game so we have real names there and of course when someone messes up he mess it up you know it doesn't mean that he his job as auditor is over uh but building a reputable history is some

kind of value as well so we are working with real names but but the standard doesn't tell you know if you if you actually have to submit there uh the real name of the auditor of if it's like 0x hacker one doesn't tell you know so it's on the auditing company or auditing team in our case we will have their real names okay thank you [Applause]