Security at Scale, NFTs & DeFi

Transcript

hey everyone salic i work at fireblocks and i had the web3 group there so first to those of you don't know fireblocks is a custodian technology provider and for businesses and institutions we basically provide a very secure infrastructure for custodians to handle all of their digital assets from treasury management compliance aml that's okay um transfers exchanges and so on and on top of that we're building additional uh ecosystems so one of the emerging ecosystems in this world is the wet tree and

i'm actually from a technical background and what i want to do today is focus on the security aspects and issues that we have in this field so as victor mentioned there were quite a few hacks in basically in the recent uh two years since defy came to life and so he mentioned the big phishing attack on openc but that's actually a small one so the bigger ones are hacks that are happening on protocols on d5 smart contracts on bridges we had the huge 2u jacks that happened in the last half a year that each one of them stole over 600 million dollars

only in this queue in 2022 1.3 billions worth of tokens were stolen from protocols or private wallets and we can see that we are in good pace to break last year's record so i think we'll make it um and if we look at this 1.3 billion we can actually see that now the vast majority of the funds that are being stolen are actually coming from defy so if in recent years hackers targeted private wallets and private exchanges now they are targeting the default world and that makes sense

because a lot of money is flowing to the d5 protocols and hackers want the money so they they're just following the money and the second reason is this is kind of a new environment so the best practices are not known yet or uh used by everyone so it makes a lot of these protocols susceptible to to hex so from a very high level perspective of how the web3 airflow works you could sum it up in this slide so you have on the left the web application

whether it's a dab a mobile device a developer calling an api he basically wants to send a transaction to the blockchain okay now in the blockchain world you need to sign the transaction for this you have different types of wallets you have your wallet connect metamask or fireblocks or any other custodian solution and once you sign the transaction it goes to the blockchain the blockchain is completely public right you can see the smart contract you can see the code there something happens the smart contract receives the transaction writes the data to do the blockchain everybody could see what it did what was the outcome and

because this is now public it's also a new attack vector so if i'm a hacker i can go i can read the codes of the smart contract and i can try to find the exploits there so don you'll probably be a bit overwhelmed from the next slide but keep it together so what i want to uh try to suggest here is this is uh obviously not readable for humans by the way computers also don't need can't really read this they need to decode it but this is actually the way a smart contract call looks like in the raw data that is being passed to

the blockchain and the reason i'm showing this is what i want to argue and what uh i think if there's one idea that you should live with today is that the lack of contextualization that we have in this world today is actually a security problem okay so we here as some kind of wallet metamask wallet connect ledger or something okay quite a few so i'm assuming some of you have interacted with adapt with a decentralized exchange swap tokens did anything and you're probably aware of this screen so this is a screenshot of metamask but it appears in other wallets in

different forms and it basically you go to adapt right you do a request and then something pops up in your wallet and it says hey are you do you confirm and you're okay what am i confirming usually this is what you are confirming so if i'm looking at this you see this there are three tabs the details the data and the ax so if i press the data it will actually say hey i can decode this um and if you press on the hex you will see this again not something you can do something actionable about it and this is the key for

i think 100 percent of the fishing attacks that we're getting because people are basically signing something that they have no clue what they're signing so it's like i give you a contract it's in a language that you don't understand just sign here please thank you i got your all of your nfts so this is a major issue that we have today and what i want to do now is think about what kind of model a security model and actually a technical model we can offer so we can provide security in all the layers of the interaction with the blockchain whether if you're a wallet or you're a smart contract or a protocol

so the first aspect and the most important one is the private keys right wallets are basically containers for private keys they're a synonym it's a nice word a wallet but it's actually a private key if somebody steals your private key if you lose your private key you lost all access to your funds if somebody took your private key he has access to all your funds so private key is really the the key aspect here so the most basic uh form of security for private keys is what we use and became an industry standard it's called mpc multi-party computation and the idea behind it is

this if i can uh take the private key and break it down to different parts so the client has part of the private key and fireblocks has the two other shares i get into a situation where at any point in time if an attacker hacks into the customer's mobile or steals his private key it can't do anything without it why because it's just a part of the key if somebody for some unknown reason managed to break into fire blocks again it can do anything because it has only part of the private key and only when you get all the private keys and you sign them

together only then you can actually sign the transaction and send it to the blockchain so this is the first concept protect the private keys and eliminate this attack vector the other layer on top of it is what we call the policy the workflows so imagine that you are [Music] a trading firm or a bank and you have a lot of people in uh interacting with the blockchain you have traders who are working on ethereum you have traders working on with bitcoins you want to change the way some department can work

with this asset class the other department can work with this asset class uh i'm allowing this trader to trade up to 10 million dollars a day uh but this trader if it trades over 100 million i want to him to get two types of different approvals and i want to block these traders from working with this protocol and so on and so on so you can basically build a policy that gives your operational uh rules and guidance that will enforce the way your traders work or anyone working inside your organization so even if you have a raw employee an inside attack or even if somebody is making a mistake

he's is putting another zero in the transfer and you now wants to transfer 100 million instead of 10 million dollars you will catch that in the in an automatic way so that's the second crucial part here in the security model and the next one is what we call the web3 engine so on top of that we can address the thing that i discussed so if i'm able to contextualize the actual smart contract calls so i can say something like hey you are trying to swap 1000 ethereum tokens to gazillion usd right i can manage to say

that and if i can say that first of all if you are the person signing the transaction or need to approve the transaction you understand what you're approving so that's the first aspect but the second i can also build a defy policy on top of that because i can say okay i'm not allowing people to swap more than x amount or y amount in t period of time right i can make it more flexible i'm not allowing anyone to borrow more than one one million dollars worth of assets in a day or i'm not allowing them to to land them in a specific period of time um and what's also nice about it is i can do something even smarter i can say

okay i want to lock this asset class in my wallet so nobody can interact with it okay i want to lock all of my nfts or better yet i want to log the really prime collection of nfts that i have so even if somebody does a mistake nobody will able to transfer them if i want the uh if i want to now send them or sell them to someone i will change the policy so it will make me uh able to do that but for the rest of the time these assets are completely locked so this is the third layer and the fourth one which is an extended uh

thought about this is we can do even cooler things so we can if we have a history of a lot of transactions or if we are keeping track of what's happening on the blockchain and what kind of attacks are happening i can actually do a lot of heuristics that can detect anomalies okay so i can for example see with a lot of the phishing attacks that happen on decentralized exchanges that suddenly a lot of the swaps are sending the money to a wallet address which belongs to the attacker but it's not the original address that i see in all other transactions in history so i

can maybe put up a red flag and ask for a special approval if i see such cases i can also try to evaluate the risk of smart contracts so i can send smart contracts for evaluation in audit companies and give them like a risk score okay this is a low-risk smart contract this is a high-risk smart contract i can also manage all the approvals that i gave for other prop protocols to play with my tokens so for example this is a true case a protocol has been hacked a month ago so we because we know who approved what to which protocol we can

warn our customers to close all of their approvals to that protocol to protect them from additional uh stealing of funds and this makes uh gives us the ability to be not only passive to protect you when you're actually doing something but actually be proactive and manage the risk before it actually happens and this is the model we're employing today and we believe it gives the best protection for your digital asset whether from a wall standpoint or protocol standpoint thank you [Applause] yeah if we have one minute so if anyone

has a question don't be shy or be shy thank you