Kanav My Money Back? On Counter-Exploits

Transcript

foreign thank you for being here I realize I do have something of a captive audience one talk before the uh the closing ceremony so thank you for being here I suppose uh we can turn our brains off a little bit for this one I will not be talking of anything much technical you will not be hearing the phrase ZK you will not be hearing anything L2 related with the confidence that comes from a man who has been at law school for exactly one year I will be talking to you about a topic

that has been popping up in some precedence recently which is the notion of contracts getting exploited and then counter exploited um I'd like to thank shizzy for the picture she did ask if I wanted any more I think this is probably one's enough so yeah um in short I'll be talking about contract upgrade ability and kind of like the vector that it presents in terms of like um it's it's both a weapon for rugability and it's a counter-offensive weapon in terms of recovering things how should we react to these things when they happen uh how should we react uh there are two examples that happened in the last couple of months that are really important uh well important one more than the other one was platypus which is on Avalanche and the other one

was the big one uh the Wormhole recovery I'll be talking a little bit about um how this stuff is kind of being handled in the real world outside of these little bubbles um and like I said not much technical I'll have one thing about how Diamond proxy patterns work but we're not doing code we're very tired if you're like me I've been it's I've been going to bed at 3am every night for the last four nights I'm exhausted so uh the difference between the eoa wallets that we all use uh to get our Apes drained and a smart contract where we put our money to get rugged is that a smart contract does uh have bytecode it's that's the logic where things are contained an eoa is controlled private Key by you smart contract doesn't have

one um as we know like as developers will know this is like the technical bit I'll do you've got some techniques for like metamorphic contracts you can use Diamond proxy patterns and so on and so forth there are some implications about what you do it states for that but it's It's tricky to easily upgrade the logic of a contract however sometimes that's exactly what you need to do and so normally when we see this it's uh We've spotted a bug and nothing's acted been acted on and so we just make a change or um we're doing an upgrade you know like a V2 or something and react to that I want to talk a little bit more about when normally when an exploit happens contracts normally stay dead like like

if they can't be recovered that's it end of um if they can be recovered if funds can be recovered somehow how and what happens if a court gets gets involved um and yeah the impetus Behind These is different right sometimes we'll be the ones that want to act and sometimes we're forced to and this is starting to happen a little bit more and it's going to accelerate as the years go on so platypus Finance you guys might recognize this name from about a week ago because it was attacked a second time um I I finished writing these slides and I'm pretty sure on my Google Slides template is a Death Note because as soon as I finished it happened again a different Vector but again so they're an amm on Avalanche

they are Stables oriented they do single-sided liquidity they had something that was a pretty cool idea which was that if you had like a MasterChef contract and you deposited LPS of stables then you could like use that as collateral for an over collateralized stable coin called USP you could deposit things in pull out like up to however much it was LTV um and then use that as kind of your intermediary currency um except it's a bugging it and you could not um you could easily like pull out your LP and not repay the debt so you just got a bunch of bad debt sitting in your MasterChef contract um 9.1 million stolen in total over I think two attacks but that didn't all go to the attacker

because uh here's for those of you who are devs there's a little bit of a rundown it was flashlight oriented like all of these things are nowadays flashlight on some Stables deposit them max out alone um withdraw your LP swap your now bad debt into like actual stables and off you go this was done really badly um if you know who did this you should probably boo them so executed an attack couldn't get the funds out they're stuck uh try to again accidentally send 380k to Ave because that was their like their provided for their flash loan um The Flash loan didn't have any access control so anyone could ping it and it

automatically approved usdc to the proxy that proxy is controlled by the Platypus team so uh anyone here who knows how proxies work kind of tells you what like the way this goes only technical slide only one I promise if you're interacting with a proxy there's a slot in there that points out an address it's called implementation and that is an address that says where the logic is so what you'll do is you'll ding the proxy here and it'll point at the implementation go this is how I need to react that's upgradable normally that's controlled by a multi-sig um I'm I don't know why I included a bit about maintaining State through delegate caller it's not necessarily relevant to our purposes but I just wanted to show that I do know how delegate call works

counterex quite simple if you're automatically hard coding approval to a proxy just change the proxy and if the function that calls the flash loan doesn't have like automatically forces it cool I'll have that back thank you very much there was about like a 20 recovery which is not bad um oh button's not working so yeah this was partial and it was really slick I think block SEC helped out with it really cool but the consequences right um I think everyone who works as a developer knows that if you maintain a proxy you've always had the ability to do these kind of changes and you just take it on faith that they won't mainly because like maybe they won't know how to or because of reputational risks or

they just don't want their like hands forced but obviously if things have been stolen you're going to react what I'm more interested in um as a mini law student is now what happens when a court of law demands that you actually act on doing something like this if you're told with an injunction you need to you need to upgrade your proxy you need to change your logic in X and Y away um I'm going to take this opportunity to uh I have a bunch of merch left here from my overlords um I as you guys might know I work at Euler nowadays I also have some stuff from wintermute funded the Wildcat protocol the shirt that I'm wearing and I'm not carrying this back to the UK so please

accept free tokens free hats and shirts uh if you weren't oh trust me you're doing me a favor because I the tax I'll have to pay to get this back I'm very grateful about it I'll give that 30 seconds if you have an Euler card already and double redeem I will find you foreign I literally just brought my suitcase and packed it full of stuff I don't want to

bring home so thank you again everyone um I wanted the mega hats to be read but I don't get what I want so so moving on the more interesting example of this that happened recently was Wormhole um or rather wormhole's recovery um we all remember that last year in February was one of the big ones there were three massive hacks that were all over half a uh well all over like a quarter of a billion dollars was the second one of them I think between Polly and Ronin uh 120 000 eighth worth of collateral so 320 million at the time Jump uh stepped in within a day

and they plugged it and everyone was pretty baffled about that no I mean it's in their purposes they're an investment in uh in wormhole um chain Checkers will have noticed that they moved These funds around for about a year I can't actually remember where they went right now but they ended up settling in Oasis which um was I think a lot of people thought at the time was the same thing as maker but it's leverage in powered bolts and so they sat in there for a little while uh the automation's important here for obvious reasons or perhaps not if you if you want automation on these things you're going to want to introduce like a stop loss trigger and to do that that it allows you to like um to uh by collateral take on debt and

to do that you need to give an approval for the contents of your wallet to a proxy or a contract in this case it was a proxy so um yeah the same pattern as with platypus right you're like oh you've like given you've opened the door up to a proxy address here and a white hat group I it might have been block sick again don't judge me if I'm wrong notice this reached out to Oasis with a proof of concept and said like we can get this back now this is the stuff I've been really fascinating I think uh the Oasis team didn't necessarily just want to jump right into it and say this is like you know it's going to take it end off I think they might have been a bit concerned like there are like always a Labs as a UK company they didn't want to

just like jump in and like break the law so what they did was for the best of my reading they reached out to the UK high court and basically asked them to force an injunction on them to act which is a weird implication because they're like hey can we get permission to exploit our own protocol like exploits in a bit of like a quote here um because it was taken from Wormhole it's being recovered from Oasis but like I think in the UK law you might want to use the term replenish remedy but maybe not I don't know look I did go to law school um the consequence of how this actually like once they got the injunction a wallet which I think we believe is now jump was added to the Oasis multi-sig they executed all of the transactions that gave complete control of vaults

over to um to them it was like five transactions and all of them were co-signed by Oasis multi-sig holders and this I think is the interesting thing because I think that they wanted the cover of the injunction to say we were we were compelled to do this so yeah all of the debts and the collateral from the two volts um owned by the Wormhole attacker got moved away jump shifted over 80 million and die and they walked away with 4 000 more youth than was taken I'm pretty sure that's offset by the 80 million but fine well done jump and Well Done Oasis it was actually really slick um as I said this was this was great for them like you know this this made the news for like a good couple of days but it wouldn't have been possible without

jump or whoever was actually adding it like actively being added to the multi-sec and people are oasis cosigning so like yeah it's the seeking of a legal mandate that I'm interested in and perhaps the Contra although this might be a little bit of mental masturbation is what if jump had forced it in court and what if Oasis had looked at this and said I don't want to comply um I think we cover the range of ideologies here right from utilitarian D5 people like myself to fairly militant crypto bunks who believe that like yeah we should not be bending our knee to a court um if you're a like a docs entity or like say like the court of your

jurisdiction insists on doing something your options there are quite limited like you you be anonymous you make sure you can't do upgrades you can't um like you relinquish all control um that's pretty limiting right because it does leave you in kind of a pure um like it is what it is since and that's there are lots of people who say that that's how D5 should be um it's not my place to tell them they're right or wrong so yeah if you're dogs like if it's easy to work out and by the way fed's a much better chain Checkers than you think that they know who you are and they tell you to comply you're probably going to comply you're not going to get an injunction and get told now I'm burning my access that's going you're just going to get contempt of court and off you go

um this assumes that like the law that you are being asked to play with is reasonable and in a way since this case it was weird like there was a very specific set of circumstances for this they were like we need to like we're telling you what we want you to ask us to do but the law is a little bit wavy around how like taught works and possession and assets and like indeed these things aren't even really classified like properly yet in the UK we've got some stuff now that falls under like our financial conduct Authority but the rest of the world not so much as we've seen with Gary so you don't need to read this I promise you don't but there is a bill that's currently sitting in the Illinois Senate um called sb1887 I seriously don't read it

um but the gist of it is and like this will never become law but it's probably indicative of the kind of thinking that we're facing right now in the US if any blockchain processes a transaction in Illinois and something goes wrong like they have a claim for it they can go to a court a judge a lawyer get an injunction and demand that ethereum hard Fork or Bitcoin hard folk or anything of the sort um and yeah there's a five to ten thousand dollar a bill uh a day bill for like every day it doesn't comply this is on the face of it absolutely insane like so yeah like this was hard enough to do after the Dow you man like I remember reading about it this is going to haunt slept Terrace for

the rest of his life this was hard enough to do like with pretty widespread consensus from the like 96 consensus from the small amount of ether that voted like and that was just native tokens right that was like Dow tokens nice if you're telling someone to like unwind a CDP because someone like objects to like the way that something's gone wrong determining the state route alone is going to yeah like no survivors it would take forever like you get no no by him Nokia just it's not it's not happening so other questions yeah they go okay cool you haven't done this for for a couple of years here's your million dollar phone who's liable for that is it everyone in Illinois that's a validator if it's a proof of work chain is it the minus if it's ethereum is it the

ethereum foundation like it's not clear and it's weird that this is being posed as like law that should be taken in fun fact I'm also geo-blocked by the um Senator that presented this so like I I haven't got the measure of the man at all I think I wanted to kind of leave it at this as like law is like the laws that we're dealing with are bad and we need to like perhaps more buy-in from our side to kind of teach people like what is possible and what isn't I started thinking a little bit about yeah like if the Illinois bill passed and it was accepted Nationwide and somehow but you know by some Stroke of Luck they managed to convince everyone in America to Fork off like every like validator to to implement a change that's not enough right it's it's over a

third but it's not half so all you'd have is like there'd be no finality like and the inactivity leak would kick in and eventually sort it out like great you've passed the notion of the law but you're not you're still not obeying so it's just like another side point I wanted to think about a little bit was okay uh let's say then the things right let's say that you're forced to and uh we saw this when um the pow Fork of ethereum happened um you know at the merge people are going okay cool who are the stable coins like supporters going to like display like tether is probably going to do the you know that Meme of please maintain the peg no matter how illegal it may be thank you sir um what about Circle they're American if

they get compelled to like you know cleave to an American chain like what happens there and there are some interesting things I'm thinking about about do we really need to like start at scale having um Euro dollars produced on Chain by like a UK company somewhere outside of the Eurozone do we need to like win the three pool perhaps not with a UST this time we do have better options in crypto for dealing with this kind of thing um we've got koala we've got Lex Punk we've got Lex Dell like kind of working out what the obligations are and like our duties in terms of you know if you if you are the owner of a contract does it look like a real contract what does modification look like for there

what are your duties it's I have no answers here because it's still really like kind of in the wind and I find it really fascinating I didn't find I didn't think a few months ago that I'd find myself reading Stanford journals when I went to bed but here I am so I'm closing pretty early like this has only been about 15 minutes I've been reading a bunch of Scott Patterson's books uh really including the quants and uh yeah John manner Kings quote from 93 years ago uh history rhymes blundering in the control of a machine that we do not fully understand we'll get there eventually but uh yeah a lot of weird questions about kind of what contracts mean legally what they don't how we upgrade them

I'm ending on that ask your questions or let's wait for the closing ceremony I'd like to apologize to the cameraman as well for having to follow me do that little autistic walk up and down the entire time I am so sorry yes what protocol are you writing about in your next presentation I really thought that my bit at ECC would be every year I would do a presentation on like the contracts like the protocols that got wrecked because like that's my thing now I'm the guy who like turns up like the Grim Reaper and like mocks things that like got done and then yeah like the one whole thing

happened I was like oh this is fascinating and I've spent a bunch of time reading about contract levels so like I guess this is my thing now next year I don't know I I don't know if any other mic's been passed around or if I should just get off the stage oh I promised someone I dab so [Applause] for that she's Don't Clap for that can I ask you a question where am I looking I uh so do you think there is any way around proxies I mean in in the current state I don't see any way to build a sensible Project without using the proxy

pattern but at the same time of course you have to to trust the team that's building that what do you see like a way around it so I think there's like a there's a um I've completely blanked now because I've spent my energy but there's a proposal for like a create three that's coming out now that like you could theoretically replace the diamond proxy pattern with because like create if you do like a self-destruct and create two now you you can replace the by code but you remove the state there's some EOP that's now that goes actually you could just kill it and restart the whole thing while leaving state in touch that just kind of moves the goal post a little bit you're like well we've got rid of diamond proxy patterns but we've still got to create that has the same kind of

like trust implications I don't know um I I genuinely think it's either like you nuke it all and you completely sever the link or you accept that at some point like if you are a doc's entity you do have legal obligations towards things like and I think like we're it's not been long enough to kind of fully realize the ramifications of that yeah like these are happening in the UK it's we joke in America that like it's in the states that like the UK stuff doesn't matter but it might do sorry no solid answer if this comes from Tina no it's actually comes from Hudson

Hudson Jameson yeah Yeah so basically he asks what is the worst and best case scenarios for law around this topic it's a good question Hudson I wish you're in the audience so I could shout out to you for it I think worst case would be something like sb1187 where we are told that um you know like it's not even down to ownership of contracts um and it does literally have to be like at the validator or the the Staker level of control I think you could also do things like I think like Mica in the in the EU has some things that go like oh you can launch a coin but if you have a white paper and there are some kind of like natural implications like you have to be on a registry

um like docs to do that and so that you know you can be found if something needs to happen best case I kind of want to leave it to koala and like Lex Punk and leg style to work out um I there's probably a joke here to be made about using like Clara's court for working things but I I truly don't know and like it's a bit frustrating for me to be standing up here going oh these are cool questions and I I don't know what like the Utopia GIF looks like for this sorry Hudson by proxy I have three minutes left not everything's a Down Neck hey Lawrence

so uh which protocol are you going to hack next I did wonder if like there was going to be a weird PR from like Euler for like going you know the bits like should you be working for them the answer is are they and it's coming in uh six days so if this actually happens I'm genuinely moving out of the country oh Nick uh yes I am going to mention Downs um no so it's it's obviously kind of insane right to expect ethereum to fork and this is one of those things where you know they can try and force compliance

and then fail and then that's so they won't attempt because it's not there's no way to comply to it but what are your thoughts on uh the likelihood that they're going to start compelling Dows with like centralized token supplies so like um it is feasible to say like say compound you know 20 200 000 token holders but quorums met by 12 people um what's the likelihood they're going to start trying Force like ofak compliance on things like compound or anyone with doubt I do wish I had the djen Spartan one that uh Denison used is now the what color do you want your Lambo to be uh I don't know I'm sorry Mark that did that in his um I think like there's been some weird precedent

with like Uki but that wasn't like about forcing them to do things that was just about like the obligations that they held as as owners of the token um ofax stuff like I mean well we we don't have we don't have an ofic sdn in like the UK and like that's kind of where I'm focusing on right now I I think we've I I've stared down a threat before um where we were told you you need to pass a certain vote um and the response to that was just pretty much like deafening silence but like it didn't seem like there was really a path to um to like enact that like well okay what are you gonna do you don't know who like half the controllers are um again like it's nice to think about that and I think koala are probably like the right people to do that they did the

model down law and like they're trying to working on like kind of legal personality and obligations and they would be curious to see like if their follow-on is like okay cool what does that mean now if you like oh the legal Steward of a contract but beyond Uki like I don't think I've seen anything else recently at least not that I can remember I've got a minute left so I'm going away what's my favorite vegan food they won't trap me [Applause]