Safenet: Onchain security in the world of offensive AI

Transcript

So, on the next topic, he will talk about security on Web3. Previously, we've been We've been having attacks and previously the limit was on humans, but introduce LLM and the constraint is gone. So, we need some infrastructure that compounds as much as on the fence that it compounds on the attack vector. So, please welcome Richard from Safe. >> [applause] >> Hello everyone. I hope you enjoy the nice day at Devcon with nice weather actually.

Right, only for Devcon the sun came out. And today, yes, as mentioned, I want to talk about offensive AI especially in the context of on-chain security. And but But why are we talking about this, right? And it's I think it has been clear and I mean Frederico opened the Devcon with this change that there's a new paradigm. AI is everywhere and I can remember when 3 years ago it was not Gemini at this point, it was Bard, I think, fun name. Where they started experimenting with this personal assistant and I was really like, "Oh, finally, I don't have to scream at my Alexa anymore threatening it to throw it out of the window because it doesn't understand me."

But I finally have something that feels like I talked to something intelligent that can really react to me. And this is how it started, right? Like this is how it started out and by now it evolved and between we really started using it for code reviews. We gave it limited context of a diff from a PR to the point that now basically AI manages whole code bases in projects like our website in some cases. And this is This is a fast development. It's a new paradigm. AI is everywhere. AI is being used by everyone. It's not only developers, it is all whole family using it for day-to-day stuff.

And this um this even impacted web3 massively and it started with Safe in the beginning of last year where we really saw the first big event around this. So, Safe started organizing the Agenta Sound. It was an AI event. We had more than 30 sponsors um ranging from smaller web3 specific teams all the way to big projects like Kraken and AWS pooling a massive amount of 500,000 or more than 500,000 dollars as as rewards. And that attracted a lot of teams trying to build hey, how can we use agents to interact on chain to interact with Safe accounts?

And in this beginning, it was mostly that you had the setup where agents were controlling Safes. These are directly controlled the Safe so were set up as owners or they used a combination of different modules so like access control mechanisms to really have like scoped access to your Safe. Either time bound, session bound, or scoped to different functions or under different conditions. And this was quite often used that you can like let an AI manage your portfolio, automatically participate in a prediction market. These systems were quite complex, but they allowed really this autonomous agent automation.

Oops. All of this was really made possible because if you can see here, this was the Agenta Gone was already where models actually have large context models. But if you look back further right like this became possible because AI agents started to be able to understand a wider context. So, in the beginning, it was maybe only possible hey, you have one page of text and analyze it. We're going all the way that that they now can understand a whole market, whole code bases. And this actually allows also that we go away from hey you and an AI model just tries to analyze a single project. No, they they analyze whole flows. And this was

something that yesterday was also mentioned by Rahul from Labs. We really say when it comes to security, security is not only guaranteeing the security of a single piece of code. In Web3 in DeFi, we live or the magic happens when you compose all of these different pieces of code where you create flows. And guaranteeing the security of these flows, that is what introduces complexity. And now that AI models basically can look at the whole flow and not only at one specific code base, this would make them so powerful and potentially also so dangerous because now they can basically combine the combine the different things. They can

look at the complexity introduced by module setups and how they interact with different protocols and see exploit paths that have not been visible before. And we have seen this in recent weeks that this is an active threat. We can also see this in a more global trend when we look at the re- reported vulnerabilities in the security landscape where we really see that in 2015 we were below 10,000 CVEs per year. And we really see that it spikes over the years and that in the last 2 years it really there was a massive increase to the point that alone in the quarter of this year there have been more reports than 2017 nearly over the whole year, right? Like

we can really see that it is like an exponential curve going up. And the very interesting part here that it's not that AI finds like low-level bugs and these are just low-level CVEs with a low score. No, we also see that the number of critical and high-level vulnerabilities are going up. So it's a real threat. The statistics shows right like that now AI agents can find vulnerabilities faster. That's you can argue that's nice, right? Like we can also use this in a defensive manner. But actually now that these AI models become more um widely available and we see also that smaller models become more powerful, actually um the attacks vector goes beyond this.

After AI models discover um vulnerabilities, you can use AI to also obfuscate the code. There have been research papers where basically AI like worms generated or like empowered by AI can adapt themselves. They can obfuscate themselves. They when once they're on the machine, they use the local available models on this machine to analyze the machine, to adapt themselves, and find new vulnerabilities how they can exploit. I'm not sure if some of you have seen Stargate Atlantis. It's the fun series and there is this point they have these replicators, these nano bots. And there was a point where these nano bots were in one of the characters, one of the main characters, and she was close to

dying. And there they thought like she was dying because the nano bots they basically were wrecking havoc inside her body. But they at the same time used these nano bots to reprogram them, to convince them to help her. And we're at the same point where it's not in our bodies just yet, maybe, but where they are in our digital systems. And these AI agents, these small worms autonomously acting, they can wreck havoc inside our systems or potentially they can also help us. And to help us, we need to give them the right tools. And a lot of the smart accounts out there actually already have one very essential tool, which is a circuit breaker.

In safe, this is the guard mechanism. A guard is basically a piece of logic that is invoked every time that you want to do an interaction from your safe. And this allows you to really say, "Hey, before anything happens to my safe, before anything goes through, here is a hard cut where I can like evaluate what is being done, where I can insert additional logic." And the nice part about the guards is that it aligns with our values of self-custody because the guard can never say "Hey my funds moved without my confirmation." A guard can only prevent a move, else so they cannot have positive control over your funds.

But this alone is not enough. It's really like, "Okay, how do we allow now that AI agents and like a vast decentralized network of security checks can really interact with such a system?" And I mean, if you know the history of Gnosis, Gnosis has worked on this in the past. How can you pull information efficiently from a large crowd? And historically seen that's prediction markets. And I mean, the screenshots here are from Polymarket which are doing this right now, right? Like you pull information from a large group. The problem or the challenge with prediction market in our context is that prediction markets are normally a little bit longer running. You have clear resolutions, right? Like how do you resolve this prediction market to do the payouts?

So this is where we need to adjust, right? Like how can we shorten the time? How can we make this really short-lived markets and focus on them on a more fuzzy topic like transactional security? So in most cases, there is no clear yes or no this transaction is secure. It is there are fine nuances and really have to figure out how to handle these markets. And for us and what we are working on at Safe, the Safe research team, that's SafeNet. SafeNet being this marketplace for these short-lived markets allowing us to pull this information.

So what do we have with SafeNet, right? At the core of SafeNet, we have a consensus um mechanism. And this consen- And this consensus mechanism, we attest information. We just finalize information saying, "Hey, here this is the outcome of one of these short-lived markets." But the magic what you can do with this information is that you take these short-lived markets where we have actors which we call sentinels that together like figure out is the transaction good or not. And then we take this result being attested, and then we can put it into the on-chain enforcement into the guard that has been mentioned earlier, which is guaranteed on chain, which is guaranteed by the smart contract logic that this will hold.

All of this allows us to have the flexibility, this pooling of knowledge, while it's still giving strong guarantees on chain. So where where are we right now? In the beginning of this year, we started working on this consensus mechanism. We started saying, "How can we bootstrap the economic security?" where we said we introduce safe staking, and we wanted to bootstrap this consensus layer where we really said, "Okay, how does this consensus, how does the finalization of the information work out?"

And for the last 3 months, this has been running, and over the time, we had more than 400 people staking safe. Um we are at close to 40 54 million safe tokens being staked, and it has been paid out. We do every 2 weeks there's a reward payout where we have paid out more than 1 million safe tokens so far. In this consensus algorithm, as I mentioned before, right, like we have different validators running. In our initial in the beta running, we have six parties, six different validators that together run this consensus. In this consensus algorithm, because we in this beta

didn't have this short-lived market, we perform some basic checks, and we have performed these checks on all transac- safe transactions that have been executed on base and Ethereum mainnet. These in total have been over I mean these stats are from last week so by now it should have been over 200,000 transactions that we have checked and in the average the participation rate of all of these validators is above 99%. This really showcases that since in our consensus algorithm we actually don't need all validators to be online all the time. We only need four validators at the same time to really move forward our checks.

This gives us a high confidence that we can move ahead and say, "Okay, let's research how can we bring this really to the end user? How can we integrate this into SafePal wallet and make this accessible?" In the last 3 months our focus here was really okay, what is the best way of on-chain enforcement? What do we need in a guard? Because obviously when you can block transactions, this can result in funds getting stuck. So what are escape hatches that we want to have here? We also thought about what are meaningful checks? What are the advanced checks that these short-lived markets want to check? While in the long term in the far future, we would like that you just post your intent in our and the sentinel's check does the transaction fit your

intent? There's a long way to get there. We first have to start with more focused problems. And our goal is that by Q3 also that in Q3 we start working on integrating this, making this accessible to the SafePal wallet users before we then start opening and working on further decentralization, accountability and also privacy in the context. So what exactly do we want to integrate into SafePal wallet? And for us the first part is that we want something that is available to all SafePal wallet users.

So far a lot of the technical safeguards that exist are either very expensive or they are not available with strong on-chain guarantees. If you want to set up something like policies, you normally need a full team just analyzing your setup, making sure that it's optimized towards your use cases. And not every team has this um such a security team or security council. And we already see this in smaller teams on our side. We recently wanted to or not we only wanted to but recently put some funds into Guava. And when we looked at this transaction, it was very hard for us to fully verify it. And what

I mean with fully verify is like obviously we knew, "Hey, this is the address that we interacting with." We could decode the um call data. But after we start looking deeper, we saw that the pool that we interacting with, it's actually a proxy. So, the proxy is pointing to an address. This implementation address was updated 4 days before we did our um um transaction. We had to figure out why was it updated? Is it a valid update? Was it a compromise? All of this is way too complex for the average team. And this is really where we want to make this available to the vast audience. As you have seen in my my example, often even the verification of an address becomes really hard. And that's also why we said our first scope that we want to focus on is really this, "How do we make

sure that these addresses are valid? That they're not malicious? That there has been no address poisoning? That there's no compromise related to this address?" Solving this will bring a big value to most of the safe wallet users. And additionally, we also want to avoid that you have unintended configuration changes, which in most cases the users of a safe don't constantly change their safe configuration. It's a event where it's well planned, where you can um expose um time locks. So, what do we need to do is that we need help for this, right? Like as we said, it's a network of protocols. We have sentinels, we have validators, and all of these need to come together. And

the hard work of figuring out what it is this a valid address or not, this is really where we need people that support this, where we need teams, where we need AI agents really working together with us. We are in a world where AI is everywhere, where AI can be used for attacking scenarios, for analyzing vast information, user flows, big combinations of contract setups. But it's not all bad by no means. AI also gives us a lot of opportunities. It allows us to be like use it for defensive purposes and to really move forward faster.

And that's where really we invite everyone to really build together with us a new on-chain like security or the future of on-chain security. We invite you to join our Telegram group for updates, reach out to us by a email or via contact form listed on here, or find us um on the venue um to collaborate with us. Yes, I managed to keep in time. Awesome. >> [applause] >> I am uh sorry, we will unfortunately won't be able to take questions um yet.