Security Hub - How Do We Coordinate Ethereum Security?

Transcript

session, but we have the QR code as well. >> Yes. And I we're going to pass out another QR code. We actually have uh a a really interesting talk. We're going to Anna Maria is going to introduce the security hub and what we're doing uh right over there uh near the entrance. And then Sema is going to talk well I'm going to talk a little bit about the DAO and the DAO security fund and our mission. Se is going to explain this crazy voty thing, voting thing that we're going to do called Blossom Budgeting and how we're going to distribute a million dollars to security initiatives and then I'm going to engage with you guys about the different initiatives that we have out there and the different ways that we can actually coordinate to secure Ethereum together.

Uh but let's start with Anna Maria. Take it away. >> Thank you, Grief. So, first of all, welcome to Devcon and welcome to Security Hub. In case you didn't miss it, in case you didn't went to the security hub yet, just go straight from here to the other side pretty much of this uh whole big space. So, yeah, what is a security hub? Uh, basically, it's a place for people working to make Ethereum safer or for people who are curious about learning more about Ethereum security in general. And for the next four days, we're going to bring together all of the security related people. So think researchers, auditors, builders, protocol teams, incident responsors, security curious

contributors, pretty much anyone who is interesting in uh hearing about security, sharing their opinion or just learning from the people who are at the hub at the moment. So why the hub exists? Basically, we have this big pool of talent of security people, but we need to do better things to help us coordinate everything together. So we always like keep things inside separate themes around separate initiatives, share separate priorities without having like a shared discussions between us all. So yeah, the hub exists basically to try to close that gap in the next four days here at DevCon and hopefully to continue way after Devcon.

What's happening at the hub? We have a full full 4day agenda right now at the hub. We have seal about to finish their session and then zero shed is going to join us to share what should you do in the first 16 minutes of being hacked and what should be your like kind of like incident to respond to a hack. Tomorrow we're going to explore AI agents a lot in a formal verification. We going to talk about prior runs on EVM a lot of different things. Sam is going to have a talk also tomorrow. So join for that.

Don't forget it's going to be a one-hour workshop I think. So it's going to be a pretty intense session. Uh we have uh on November 5th how to defend your defend your protocol in the AI era and we have chain security coming for a one-hour workshop session on the breaking changes in Glamsterdam. So yeah jump in for that one. It's going to be a pretty intense sessions and a very important one for all of us. And we're gonna finish everything together on a Friday. We have clothing. going to going to have a pretty interesting panel on the that of a bug bounty. So in if someone has something to share for that panel, feel free to jump in. That's going to be like

a very I think good one where we can like share their uh opinions what we want to achieve at the hub. We want to pretty much get a clear sense of Ethereum security priorities, better visibility, who is doing which work, and how we can help connect the teams and the domains they're working on and basically get a stronger support for important security work and our main goal is to continue all this conversation after DevCon. So like Armen call to action is you the hub join the session share what you're working on meet the people who are tackling the similar problems or if you have a problem share with the people at the hub discover initiatives that need support and also help shape the whole

conversation about Ethereum security. So if you care for Ethereum security this space is basically for you and you are free to come and join us anytime at the hub. If you want to interrupt a session, you can do that and share your opinion. Everything is allowed. The hub is like pretty laid-back space, so feel free to jump in and share uh whatever you have to say. And now I'm going to pass it over to Griff to kind of like get more in depth on how we are trying to achieve this Ethereum security coordination as the Dallas security fund.

>> Thank you, Anamaria. Yeah, definitely check out the hub. It's going to be a lot of fun. But I I'm going to give a little intro on how we're actually hoping to coordinate security and and coordinate the Ethereum security space with the DAO security fund. So quickly, uh many of you probably weren't around in 2016, but the DAO, which was my project back in the day, we raised $150 million, which at the time was the largest crowdund that had ever happened, and it really showed the possibilities of using Ethereum for uh capital formation. But uh you know it was famously hacked and we had a hard fork that created Ether Classic and that hard fork rescued all the money from the

Dows. Uh the DAO was like uh this Genesis Dow and there were hundreds of Dows that had money in it. The hard fork took all the money from all the Dows and put in a contract where Dowo token holders could get their money back. Uh but there was a lot of edge cases actually and I let the return the recovery effort from most angles uh including these edge case funds because the hard fork only solved the problem for about 97% of the ether and it was a lot of ether. It was actually 14% of the entire market cap of ether. 14% of the supply was in the DAO. So, uh, this 3% was a lot of ether, but we put it in a bunch of random contracts with tokens to

make sure that everyone who put money in, even the small edge cases, could get their money back. Fast forward to 2026, 99% of the funds have been claimed. So, there's only 300 million left uh, still to be claimed. I don't know, the math is crazy, right? Math is crazy sometimes. Maybe AI can figure this out. Uh basically about half of the money that hasn't been claimed was still in these edge case contracts, but we didn't feel that they were very safe given the AI risk. Uh these are contracts written in 2016 and there was no such thing as a smart contract audit.

It's just really sketchy. So we actually had to move the money out of those contracts. Uh and we're staking it. We're keeping claims open so everyone can still claim the money. In fact, more money has been claimed this year than the last 5 years combined. So, uh, funds are still being claimed by the original owners, but we're using the staking rewards to actually support Ethereum security. So far, we've, uh, distributed around 100 around a,000 Ether, a little over a,000 Ether to 135 projects. But we actually didn't h that thousand Ether isn't all ours. We actually are working with the community to figure out which projects need funding and and engage the

community to support them with us. Uh you can see every project all 135 projects that we supported at the df fundtransparency. The problem that we're trying to solve is a lack of coordination. You know, if you think of Ethereum is like an apartment building, every project is securing their own apartment and they're spending a lot of money to do it. But the problem is that no one is securing the lobby or the stairs or the air vents, right? And so actually we're paying a lot of money for security, but there's still a lot of attack surface.

Uh this is where we come in to try to coordinate the community to secure the lobby. And you see in this in this picture versus the last picture here, there's nine cameras, right? Here there's only seven cameras. And these seven cameras are uh you know that the only the three projects are actually paying for security. And it kind of sucks because there's a free writer problem. All these other projects they kind of get decent security for free. But that's okay because actually it's cheaper for those three projects to coordinate and secure the entire building rather than uh you know everybody secure it themselves. So we can overcome this freewriter problem and the tragedy of the commons by just

sucking it up and and appreciating that if we want to secure a if we want to secure our projects, we need to secure Ethereum. And we can coordinate. We've had a lot of success in coordinating. I I think Seal 911 especially is incredible at coordinating the community after an incident. and Defi United was able to raise $300 million to uh rescue after the layer zero hack. Um we want to coordinate before the attacks. And guess what? An ounce of prevention is worth a pound of cure. We don't need so much money. We we're actually distributing about a million dollars to a bunch of Ethereum security initiatives. Many of them people in this audience have

proposed. And uh the the rule is that for an initiative to be funded by us, we have to raise 25% of the ask from the community and then once once they qualify for the ballot uh by getting co-unding from the from external sources, then we have a vote and I'm very excited to have invite Sam to come and explain how the vote will work. Hello everyone. Yeah, give it up.

Thank Thank you. Thank you very much. Uh, so the DAO is for security, but it's still a DAO. So it requires in some way some coordination among people. During the third round of the DAO, we used quadratic funding, which is a very well-known um funding mechanism so people can f co-und with um the with the DAO. Uh in this second round we are going to use a novel model. Um we have been doing some investigation on different voting mechanisms and we have found some that are interesting for proportionality and the usual problem of 51% attack. Uh

let me see. So basically with the DAO majority rule um if the 55% of the people who is voting is an auditor most of the money is going to be to audit projects uh it does not save the man the minorities with uh this mechanism that we call blossom bud budgeting uh it's somehow more proportional so a a minority that cares about wallets will uh receive more or less uh uh the amount that they represent for wallets.

So the we researched in the literature scientific literature and we found an algorithm that is uh pretty novel uh from 2021 uh which is uh the expanding approval rule made by by these uh two researchers. they we contacted them and they will of they offered us to do some interviews with them. So if you follow the DAO fund at X uh we probably will have some X space with them in case you are interested and the the promise is that groups that agree on the top choices get the funding

in line with their size. We added a few things on top of that. Basically, uh we want people to to go. So if they ask um 100K and people fund uh 20K, actually what they are asking for is 80K, right? Speed up. >> Yeah. So uh grief uh has shared with you uh a qu a link uh in which you will be able to be a batch a batch holder for a day.

Basically uh we have this demo in which you will be able to uh ballot uh well create a ballot with the initiatives that are right now in the in the DAO uh in which you will be able to tier the the initiatives. So if you search for formal verification, you will see the different projects that are around formal verification and then say, okay, I like this one. It goes to the S tier. I I think that that is a nice idea. I think that this goes to the B tier like in YouTube. I don't know if you have seen any of these videos. Uh so you can uh try it out. Meanwhile, I I finish the the explanation.

Uh so the ballots look like that and sorry let's say that we have a a 50% of people who is an auditor and they do a lot of allocate a lot of a lot of the ballots uh into auditing projects but the rest of the of the teams are still or or the batch holders in that case of the voters h have the rest of the of of their projects um allocated in in their in their ballot. Right?

So the first thing that it's going to be funded it's the this project was in hardness but the people who voted for for it they lost uh the the position they lost some money in order to fund it. uh this is how it gets proportional. The rest of the projects of these people will have less money to be to fund. So the next project will be fishing blog list. So the wallet teams do not have any money to spend.

Uh in that moment we have the S tier settled. The next thing will be um funding the legal retainer uh audit fun um the there is another project that is findings database that is uh funded. So people uh as the projects are allocated people is losing their voting capacity because they won. And at the very end we have a list of projects in which uh that are tired and it's the official uh result of the DAO

and part of the of the money is unspent because it will not fund any project entirely. Basically uh 3K in that case will go back to the DAO. So instead of auditors being able to vote 90 97k uh for the for their projects in that case they only can uh vote 57 uh which is way more proportional.

If you are interested in in knowing more about the algorithm you can find it in this website. There are three other interesting properties uh that you can find uh withholding, slow quiet ending and tierby tier settlement that you will find and the vote uh for this second round of the DAO will start on November uh 17. Great job, Sam. Thank you so much. So, yeah, the voting algorithm is super cool. It's the first time we've done a participatory budgeting that I know of at least in in crypto. Uh it's a very cool voting algorithm. But now what are

we voting on? Uh it's it's really cool. Like like I said before, Defi United was able to raise $300 million and rescue A and layer zero and kelp and all the users associated with it. What if we could just fund a in this case I have 17 awesome initiatives that I pulled out for uh out of the 80 initiatives that we have on the board and if these initiatives were able to get 965K from the community then the DAO could actually help complete the rest of the funding and pass all these initiatives.

So that's the mission. We need to actually support find people who benefit from some of these initiatives. And there's so many that we that would benefit from it. So many uh interesting initiatives that could actually support the the whole community uh that I want to go through some of them. And I want to hear from you guys if there's any specific like sectors of security that are interesting to you. Uh what do you guys want to hear about? Let's like opse formal verification. Uh is there any or or um fuzzing or is there anything that you guys are interested in specifically from the security space? Shout it out.

>> UI. >> Local what? >> UI. >> Oh, >> local. >> Local thrust UI. Oh, the local first UI like the safe one because yes, there is uh actually there's one thing that's really interesting in uh in in this ecosystem right now is that safe has safe pro and there's actually uh you know if you want really good security on safe right now you're going to have to pay for it which is good. I mean it's good to support safe but there's an initiative here that is actually allowing uh trying to create a local first safe UI so you can run safe even offline on an airgapped computer and and double check that what you see is what

is happening. So you could double check the safe UI to make sure it works just by running this yourself. This would have stopped the a lot of attacks, the bybit hacks, so many hacks that uh a lot of hacks that have happened uh if you could just double check what's going on locally. So that's one local u uh UI uh example. Are there any other initiatives or even sectors or pieces that you guys are interested in? Uh one one that uh is especially prevalent nice is the assertions for safe. Who has heard of assertions? Has anyone even heard of this term? It's basically like something that you could add to your uh transaction that says if this is true, if this is not true, then

the transaction doesn't go through. So, for instance, you could add uh hey, if this you know, if the balance of this uh of this address doesn't go to uh to ether, then the transaction doesn't happen, right? And so, this is assertions. What's really cool about uh this assertions project that Sam actually made is uh you can add it straight into the safe. So you could add a daily limit like hey if this if a transaction is sending more than 10 ether it it's no longer void or if it's sending more than half of the wallet balance out then it doesn't count right and you could add that straight into the safe so that even if you do sign a bad transaction it would fail because the safe would have an assertion added to

it. Uh there's so many really awesome initiatives. Uh does anyone have any more inputs or things that they want to hear about? >> Yeah. What you got? >> Which one? >> Oh yes. Northcan. Uh DPR. Uh so this is a really really interesting initiative. It's asking for 50K and um Northscan is an incredible company. They have somehow hacked North Korea and gotten a lot of good intel to figure out who is a fake uh IT worker that's actually working for North Korea. A lot of people in this industry, a lot of companies in this

industry are hiring North Koreans and they don't know it. It happens all the time. Uh large companies that we all know probably have North Koreans working for them right now. And right now, NorthScan generally goes out and talks to the companies, says, "Hey, we'll screen your your uh employees to see if they're working for North Korea and you know, if you're going to hire someone like talk to us." But this initiative actually wants to make it uh scale it so that a service so it's not just them talking to the large companies, but actually allowing small companies to come inbound and say, "Hey, I want to hire this guy. Can you just make sure he's not from North Korea?" And then they can send in the resume. And actually it's going to have a premium

service. Uh one thing I love about a lot of our initiatives, these are not necessarily grants. Some of them are grants, but a lot of them are actually more like equityfree um investment that is an initializing a company. Northscan is trying to make this a profitable business. This could be a beautiful service that would help this industry stop hiring North Koreans. and it but right now the DAO will not fund it. It needs $12.5,000 to be put on the ballot. So we need some company or multiple companies to pledge a little bit of money to help make this a reality. And if it gets 12 a.5K then

it'll go on the ballot and then if it works through the voting algorithm that Sem has created then it will be funded by the DAO >> and pay grief. Yes. Uh this time it included the >> Oh, I thought it reset to add us more time. >> Yes. So uh like for them uh you saw the care code over there. Uh you can ask some questions and I know that you give it to everyone the that other care code as well. So you have two minutes to finish.

>> Okay. Great with this. >> So if if you you have that QR code, right? So check it out, scan it, and you can actually vote for initiatives. You can be a badge holder for a day and you can vote for initiatives and try out the algorithm. What's really fun when we do this live, we're going to have real-time results the whole time. And our goal in as the DAO security fund, our goal is not just to fund uh initiatives, but it's actually to work with the community to figure out what do what should we fund? What is the what is the most impactful initiative out there? is north scan and you know scanning for IT workers more important than you know uh assertions like I mean we could just decide but we don't want to we actually

want to hear feedback from the community we want to see what what initiatives does the community want to put into and what's really cool about the voting al algorithm that we're doing is that you will see the real-time results and you'll see oh man if this project was asking for uh just $3,000 less it would actually pass. Well, what that means is as a community, someone could actually send $3,000 to that initiative and it would actually make it pass. So, it's going to be a really fun game. This is happening throughout the end of November. You can try it out now. The QR codes that I passed out, uh, they let you vote. It's one person, one vote. If, uh, if you didn't get a QR code from me,

I saw a whole fleet of people come in at the end. Feel free to ask me for one at the end of the talk. I'll give you a QR code. You can scan it and you'll be voting just like the badge holders will be voting uh starting in mid- November. Uh so, yep, keep an eye out for it. And thank you so much for listening to talk. There's so many great initiatives. I really encourage you to check it out initiatives. Dow fund. Uh if if you want to see if any of those initiatives really call out to you, help us fund raise for them. We're only going to fund the ones that people are willing to put their their assets.