Security advice with Cantina by Henry Shen

Transcript

So, uh, we're very happy to have Henry here with us. As you know, Canina is one of the most desired names in, uh, contract auditing today. And we're going to ask Henry, how did they get there? So, I see some competition joining the room. Watch out, Henry. They're coming to hear your pitch. All right, so um, let's kick it off. So, um, could you tell us a little bit about container for people that don't know you who you are? Yeah, totally. And, uh, again, nice to meet everyone here. Uh, name's Henry. Just, uh, one of the core team members at Spearit Labs Cantina. So, I'll use Spirit Labs and Cantina interchangeably.

It's honestly the same company at the end of the day. Uh, what's helpful to understand is kind of starting back in terms of how Spirit Labs started and then I think, uh, the story of Cantina and what we do will make a lot of sense. So Spirit Labs uh our core founding team actually created the solidity compiler during EF uh and quickly after creating the compiler they realized that there was an industry-wide challenge in providing highquality services uh security services at affordable rates and at scale. So what we did then was we ended up creating Cantina, an open security marketplace in which projects, protocols can request virtually uh literally any type of security service.

Anything from web two to work uh architecture reviews, cloud reviews, pen testing, key management, audits, bug bounties, and much more. So yeah, that was a little bit about cantina. I'm very tempted to ask about compiler, but I will put it aside and I will ask you what is your secret source? why everybody wants you, why everybody wants Canina now. Yeah, I think I think the the thing about cantina uh the secret sauce is there's the the web 3 industry is evolving. And so with that, a lot of web 3 services and solutions are evolving as well. And what we see right now is there's a lot of point in time solutions, meaning that there are auditors, there are bug bounty

providers, there are insurance providers, but they're all fragmented across the entire industry. Um the the secret sauce of our platform or company is that we we're we're looking at this holistically. We want to approach the entire security market and we want to bring that all with under one platform which is Cantina. So I think that's what really differs us from a lot of other companies uh and yeah other other firms today uh is that we can we can have we have web two researchers we have web 3 researchers we also have uh yeah researchers that come from yeah government entities as well. Impressive, very interesting approach. So, um I wanted to ask you about this optimization. I was looking up, you

know, what you guys doing and I saw on several websites that uh optimization approach comes up and I suspect it has to do something with this compiler of yours. Oh, sorry. The optimiz uh optimization optimization that you have developed some kind of optimization of optimization optimized approach in auditing versus others. Gotcha. Yeah. So that's kind of talking about the end to end aspect. So really when people ask me what cantina is um it's really when you think about developing a product or protocol it's really the same development life cycle whether you're building a SAS building a protocol it's a development life cycle at the end of the day. Now, if you think about where

protocols are within the software development life cycle, let's say they're building the MVP, they're getting ready for mainnet or they're post mainet. Uh in cant you can you can uh get any security service regardless of where you are within that software development life cycle. So if you're in the early stages of building a MVP, we have things like code advisory. uh we have things like architecture reviews to help you build if you don't have a security team or security point of contact. uh if you are preparing for mainet that's usually when a lot of projects and protocols need audits and then you know competitive audits as well which is a hot topic and then post mainet right so in web 2 we call it po post production but here you can do bug

bounties insurance multi-IG and then incremental audits for new features and additions so I I I believe when you say optimize the auditing you know experience or approach that's kind of what we're referring to is bringing it all under one platform got Well, it's a lot of added value. Um, I'll take you back to the compiler again because uh we see the trend in uh security audits today and your colleagues are here might confirm that we see that um lots of AI tools are being used and that's where I'm thinking about the compiler and then you somehow create um a combo of u manual auditing or manual QA with AI tools. So, how does it work for you?

Yeah. So specifically just for the AI part um so I I know crypto AI is a is a massive topic and like AI agents uh there are some AI solutions when it comes to auditing today and some of them are decent at finding really low-level bugs but in all honesty a lot of them still need human in the loop uh interaction. So, I think we're a lot closer than we think, but it's it's definitely not capable for like if if you're building a D5 protocol, like you you need to get manual audits. I would not just rely on AI tools right now. Um, they're great to test out and play with, but in all honesty, uh, yeah, manual audits are still the way to go as of now. Is there any kind of percentage you

could share like how much is audited by AI and how much is still human? No. Yeah, I I actually cannot, but that's uh that's pretty interesting. I'm curious to understand just to see uh percentage of code audited by AI and then the differences as well. Patrick, we have to invite Haken next time because they claim that they have very advanced AI audit. Who is that? Haken. Oh, okay. Yeah, the good old Haken. Um all right, so um what we really would like uh to offer to the startups in audience and those that will uh listen to the recording is some advice. you you're getting a lot of um lines of codes and you looking into different protocols.

What advice can you give to founders um you know so which will enable them to have a quicker and more efficient audits or maybe have less audits altogether? Yeah, that's a great question. Um like I know audits are very expensive at the end of the day. Uh so a lot of firms try to reduce costs wherever but in all honesty if you're a founder and you're building a D5 protocol collaborate and work with your auditing firm like very seriously. So uh we work with a lot of top EVM uh new protocols that launched mainet uh this year you know few that everyone would recognize the names of and every single protocol I meet with

they're like we need to hit mainet right because some people are bashing them on crypto Twitter so they need to hit mainet um in all honesty if you're working closely with your auditing firm uh view them as a strategic partner and vendor right uh there are a lot of things and tools and tricks that we can utilize to help you ship to mainet faster without making trade-offs on security. So whenever I meet with projects and they're like look we need to hit mainet in like four weeks but you know uh we don't uh we're and they're trying to make trade-offs on security that's when you should be working collaborating speaking and meeting with your auditing firms and vendors like we're here to support you at the end of the day because we want you to be successful. So view them as a strategic

vendor uh not someone that's you know trying to extract or be malicious whatsoever. That's a good advice. Another thing comes to mind uh you know people uh most of the protocols you know they create something they send it it to audit and then when it comes back they upgrade the application they upgrade dub they upgrade the protocol continuously. What happens to all this you know ongoing edits? How often do they need to come into audit again? Yeah. So, uh, in terms of how many times they need to come back to audit is very subjective depending on how fast they're developing. But this is literally the case that I'm speaking about is when protocols when protocols release incremental features and new

additions, use your strate, you know, use your vendor. Maybe you want to use a new vendor for whatever reason, but if you're working very closely with the vendor, they're going to be familiar with your protocol. They're going to be familiar with your code. they're most likely going to have the resources that have the ability to look at that code. So utilize them, right? So this is exactly what I'm speaking about is when you build a strategic relationship like this, uh yeah, those incremental additions and features will become just so much easier and you don't have to fight for resources or look for resources. Makes sense. So I have one last question because we're mindful of time. You need to go and we need to wrap it up. So um we have noticed that you're doing a lot of uh bounties. You're doing a lot of community engagement like I

heard from uh Phil from um Phil Fogle from Core Protocol who's going to speak here tomorrow that you're doing a bounty for them. So how did they you come to this uh bounty hunting thing and how it works right now? Yeah. So uh before not too long ago I mean still now uh traditional reviews and audits they're still very much effective uh but the auditing industry started experimenting uh they basically wanted to gamify the whole experience for auditors. So then they basically opened up these. So when you have a smart contracts that are open sourced, you basically host them uh and you basically have a prize pool and you say, "Hey uh

researchers and hackers, go into the my code and find bugs for a payout." So I think um the driver was uh really gamifying the experience as well as uh just make just making the audit experience a lot more effective. In all honesty, before I joined the auditing industry, I I think audit competitions really got hot probably when I when I was here, but at first I was a bit hesitant because I was like, okay, how effective are these really, right? Like you can't really guarantee participation. Um there's a lot of participation as well. And then like what what's the what's the most effective prize pool? But in all honesty, after looking at the data, it

is absolutely insane at how effective these audit competitions are. Um like uh we ran an audit competition for you know 60K and when we compared that to a traditional audit for 60K it the number of severities and vulnerabilities that we found through the audit competition was just significantly different. Now when you're reaching the 1 million plus amounts obviously there's an aspect of that which is you know marketing and awareness but uh yeah I would I would say like audit competitions are very much effective I like it I think it's very unusual it's true innovation here uh driven by container because we know that this kind of competitions took place uh initiated by the protocols themselves but this is like a gamecher where the auditor is driving it. Yep.

Exactly. Yeah. So I think the key advice that we can take from uh our discussion with Henry today is um auditor is not one time stop. You want to make auditing firm your partners, your strategic partners and this what will get your project to market on time and will support you and protect you from all the crazy things out there. Thank you so much Henry for making time. Thank you so much. Good advice. Thank you.