Security Panel with Sarang Parikh

Transcript

uh hey everyone so yeah uh we're going to talk about D5 security uh and stuff hope during the panel nothing gets hacked or we might have to stop and get into a war room uh so yeah let's start with some introduction hi I'm sarin I used to read engineering at Sushi saw before now I just help and advise other apps hey folks I'm mod Gupta I lead security and smart contracts at polygon I'm Omar G I am CEO and co-founder of deur hello okay uh I'm PR I'm co-founder at Quil audits my bad hey I'm pram I'm co-founder at Quil audits we also a blockchain security

company and I'm Valentine I'm a researcher I consensus diligence and core member of creed Dow yeah awesome so let's let's get started with some questions so one of the questions that I had like there are a lot of attacks which happened in last year like with Oiler and you know like with Nomad uh which happened after the audit right so they had a very well audited code six seven times audited flaunting on Twitter always and they changed some code which they deployed which got hacked right so uh what do you guys think about it like should Auditors have some kind of you know like dashboard or something which says that no now this uh you know like this code base is not audited by anymore because for a user what we see is we can't always like no user can just

directly go and check the uh commit hash right because there might be some other changes as well so how would you guys as a auditor like you know in or in the space of security would like to address this problem where you know uh protocols after they they they gone through the audit they need like some kind of checks to make sure it's the same code yeah I have something to say I think well uh there is one obvious problem that we don't have a common standard for sharing the audit results so there is there are PDFs there are some portals there are markdown files but there is no really a standard where

we could share that these particular lines of code have been audited so that's a very big problem but I think there is another problem because sometimes uh the code has been audited and it still has been exploited for example in the Hiers swap case there there was a bug Bounty report before that which was uh a similar bug bug similar to what to the one that has been exploited so I think that whenever the some new information has been gained about the security of uh smart contract this changes the assumptions like there were like maybe 50 audits but then there was a bug report I think this bug report invalidates the assumptions about the

security and safety of this protocol and now we have to do another round of uh audit uh considering this new information so this has I I don't I'm not sure if this has been done in that case and I think it has to be done so this is another problem with we have I think yeah I agree so funny enough before working in blockchain I've worked for some time in the banking industry and I think this problem of like information sharing within cyber secur security is actually not something that's that only exist in blockchain so it's also a problem in other Industries um and I feel may I think that like in blockchain we're already like better

than like in many other Industries uh I think there is an open an open proposal um about um uh registering like aits on chain like having some kind of unchain representation of aits I don't know where exactly this property is standing right now um I've looked at it like a few months ago and I think like it was really interesting and I think it could be like one of the way to actually solve the problem like like you were um talking about right I mean it won't solve the problem of like bugs that still exist in the code after an audits uh but uh actually it can at least address

protocols that are updated F stance after an audit and users not knowing about it right um yeah yeah I have a a bit of contrary view that I I believe audits should not be used as marketing material so at the end of the day it shouldn't matter if this has been audited or not because no audit can guarantee 100% security um so I would rather just have um like users need to trust the team to properly manage risk anyway and if we can educate users to do that then it's fine AUD it become just one part of due diligence uh 99% of the code you guys or anyone is auditing is rug by bad parameters or governance or any other way anyway um so

like the whole idea of audits being used as a uh like a security certificate is just not good uh interesting uh for me I think uh we have worked with so many clients and I have seen so many cases like you know after the like hack anything uh these protocols like always blame you know you as auditor you guys missed it right and while doing the in investigation we have so many cases you know after the delivery of the report these guys did some changes and going into some hack on right and the this is the also one main thing and the second that we have seen is that currently there is no proper incident response team if any hack is going on and if you feel you know there like just assume there was some hack was

going on in some wiper language or anything right but there is again so much protocols using that like justum the open japanes library or any library and and that and these developers also like facing that heck but currently they are not getting any notification uh like in web2 well the GB is sending notification upate your smart contract stop your smart contract right so these two systems are not currently in touch the monitoring part and your code is not touch like like just any heck happened in D5 protocol but there other D5 protocol they should get any notification upgrade POS any smart contracts and I think we need to work on this thing yeah I mean that that was my second question like what does the state of monitoring looks like and why it sucks so much because as a Dev for me it's it's very difficult and some most

of the times I have to write my custom code to see uh you know like like how how my contracts and everything is doing uh there's some people in the space who have done some good work like lezero had like pre- crime which lets you test invariant if you know after the bridge if that matches you know if it doesn't you can just stop it but like that's just like top 0.1% like what about the rest 99.9% has most of the funds right okay okay I think uh uh so what do you see like you know I was reading or was listening to One podcast last year um I think last last year around 99% of the projects is not using monitoring system right or even like if some 1 person is using uh or they are getting the notification or they are thinking to

take any accident after like 1 2 hours right so currently these kind of systems are missing and I was in like talk with you know the quick swep guys and they are saying you know we are integrating one you know monitoring stuff you know uh but we're not really happy with the like monitoring stuff I was like why you guys are not happy you know we are just doing it for the marketing purpose right like just assume you know we guys had any bug in the monitoring system how we are going to take action there is currently no process like they have proper Dow everything right like just assume the monitoring system identified any hack in the process what's going to be like how the Dow is going to approve what the things are going to do the hacker can you know do any suspicious

thing right I think these kind of things are missing and that's why these Protocols are not using but I think monitoring is so much important your like now your money is low smart contct right and we need it yeah I I think it's really hard to sell a monitoring to a project because we we have a monitoring project and we talk to the projects and they always have concerns about the false positives and the reaction it's very hard for them because it's uh their whole basically their whole business can be halted by uh an alert and they don't they're not sure if that alert will be really useful so it's I we can see that uh the um Asset Management funds the hedge funds and the Traders see much more value in

monitoring than the projects and it's obvious because they allocate Assets in multiple defi protocols like 20 or 30 or 50 and so there is a very big chance that at least one of them will get hacked and so it can bring value to them I I mean like my question is also directed towards let's say PC sheet alerts right they have been hacks so pexi tweets something and the hack is still ongoing right and the team has no clue there have been multiple examples of that like I think one was ax I think they knew after a few days right so I I do realize like false positive might be like one concerns for people but it's still uh an agreeable risk in my opinion than like having a true positive in that case and not being able to do anything

right yeah honestly I'll add there I think the problem is like the teams in defi are still or in crypto in general are still very immature the mature teams have monitoring set up already like for example most of these exchanges coinbase has like 200 people in their security and compliance team um and if you come on the other side even the big D5 protocols have nobody like arbitrum as far as I know has nobody leading security like it's one of the biggest projects out there um polygon we have around 10 people now um I set up the team um optimism has one I think um so it's it's it's still very immature and these are like the infrastructure teams if you go to D5 protocols like even the

biggest ones have nobody um lier for example probably the biggest by tvl was hiring for one I don't know if they ever closed that hire but nobody has the right person who can make these calls um it's it's not that these defi teams don't want security and monitoring and something they just don't have the right person who knows the value behind monitoring and so on um so I think we need to solve that first like if they can get the right people in um then all of this would automatically get set up right now honestly like the biggest consumer and the most advanced monitoring stack I've seen is uh with a like a group of Dent Traders and all they do is like they they monitor a protocol as soon as they say see

something they shot it for just a few minutes and then they close it and they have been successful for it and they have direct like monetary reason to advance their monitoring so they are doing great like they have probably the best monitoring stack I've seen even better than our own stack um and they are gray hats in the sense like if the token doesn't drop in 5 minutes then they let the team know hey something is wrong can you spread the news something is wrong so uh to just close the position so it's it's it's a very weird interaction but people the teams themselves need to see the value for monitoring and then they will implement it yeah I I fully agree I think it's not an easy problem uh but I

think to be let's say take the op istic side um it took years in web 2 also companies for like for web two companies to understand the value of security like if you think about fing for instance now like every Big company is actually using it but it took them years to actually use it right uh because the products were not good enough you had to build them so I think right now like I mean we we're not there yet as you as you mentioned uh but I feel that people are already are kind of starting to understand the importance of like Security in in in depth uh basically as as we call it um and so I feel it's it's

going to take some times but like as the the products just mature um I'm thinking right now about like tenderly for instance or like those kind of products that really have like are some kind of like security products but have like great ux too so it makes them like really easy to use and I feel this products are really going to help I hope at least to uh yeah so that like defi protocol slowly adopt them and kind of start to implement those system in production and as you mentioned like having a monitoring system with like like a proper incident response like process is not really useful so it has to go like hand in hand but I'm sure we're going to get

there at some point yeah that makes sense and uh what do you guys think about how much of the Horizon of auditing has been expanded because back then you had one solidity code base on ethereum and that's it right or probably like one other two other chains and you just have to audit that but now people just want thousands of millions of chains right and probably even devs want to go there with the same code base but they all have some something different right uh they might have some other feature that might break into the code right and not just that now you have multiple languages where people code in right like uh you have like solidity wiper F and know like a bunch of them right and that might lead to more compiler bugs right so how do you guys look at this uh when you kind

of audit you know uh do you guys have like a checklist which says okay this would work in this because in most of the audit reports I don't see them saying that you know like it works for what do you like because if it works for General evm and the team deploys it on some other evm most people even though we don't have to look at audits as like the fin thing but most people do right like including us half of the time so um like how how do we do it like should should Auditors also include for the chains that they might have audited and the versions that they have you know used in this yeah I think I have a quite practical Point here uh the recurring problem that we have seen in the evm forks that or not even Forks but I

implementations that have some features different from the n AVM is that uh the testing toolkits don't necessarily support those features and people have to mock them in the test code and then uh over time those mocks get different from the actual implementation and when you run run tests you see that the tests are passing but in reality the mocks are passing and the real code that will be deployed is different and there are errors in that code so this is a really PR practical thing that I will would advise looking into when you're reviewing the codebase on such chain you have to diff the mocks with the actual implementation and look carefully at the

mocked uh pre compiles in the test code this is why like staying like straying away from actual evm implementation is very dangerous for these chains um some of the features are very innocent and can be added but some are just like not worth the risk uh example would be um xd/ nosis chain used to have call back in their transfer functions so if you were creating default tokens on um like uh the XD chain it will have a call back function that allows for uh reeny bugs and it went unnoticed uh for like 3 years or something and then someone started exploiting literally everything on noses chain um so like in nosis Chains defense

they they saw an opportunity to add a feature and they added it but they didn't think about the like security uh complications it might cause and the developers never knew it it might be an issue and that caused a bunch of problems similarly in the early days of Z casing it didn't support the native transfer function so lot lots of protocol that just fol de code from ethereum deployed there uh lost money or had their fund stuck and something like that so if anyone is diverging from evm in a way that might have security implications please don't or at least make it super clear to all of the developers that are building on it that hey be careful of this foot gun you might shoot

yourself um um okay so like talking about the same thing you know like now that like what's hold currently like everyone is building new chains I'm talk to everyone they're just building the new chain may this forking the evm and the same scene I think we have seen back in 20221 like everyone was foring the project from ethereum to the binance and there was so many heck during the 2021 period right and even binance BNB chain did the Tweet you know please you know don't just copy paste the code and just change some variables like and and those all projects D projects was you know getting hacked right I think same thing is is um not happening but you know uh every like as a developer as a aitor we need to understand like how these chains are working the architecture the

consensus the compilers everything we need to understand even I used to be like auditor but I'm not a auditor currently like personally but I can see you know my Auditors is you know the code is working fine on one chain and deploying on other chain and they keep getting the code is not working right we need to understand the I think the architecture and comp compilers how things are working and now the chain are interconnected as you told right one is on running on maybe you know appt one is running on evm need to have deep understanding of all the the language that we're building on again like we don't need audit on the I think appt U uh Mo language still need to understand how these things are working yeah yeah um I feel again

that's a difficult problem to address um and that's like a core problem of Open Source software I would say so as you mentioned uh it's very easy to for code uh without precisely understanding what it is doing and it already caused actually many hacks uh because you can change a single line a single line but if you precisely if you don't precisely understand what um this line is actually doing then of course it might create like side effects that can have like critical consequences so I think it's that's precisely what I was saying before like when you interacting with the protocol like reusing code you have

to make sure I mean developers have to make sure that they precisely understand um like the intention of the system the specifications the design everything and of course there are always going to be some people that just go for an audit Deploy on another chain and they think it's fine but it's not again we we're in the same Loop of like yeah it's partly responsibility I feel of the user to check that like proper audits have been done Etc but yeah um I don't have like a miracle solution for that for now cool so I has a couple more questions but I think we've run out of time so I'm just going going to ask one

last uh like in the last year or like in the current year or like whatever like previous years we have had what was your favorite smart contract uh you know exploit which happened which you think like you know if it would you would be proud if you would have done it probably as a white hat I hope you know so what was what was your favorite like bug that that you discovered or probably like somebody in your team or somebody that you know of discovered and you thought like oh this this this guy might be a genius to discover that I okay I think we discovered very interesting uh was not a bug but but again as we keep saying don't trust anyone in web 3 even your developer right so we was working with the one company and initially during 20178 there was no import open japine

they were just copy pasting the open jaine code and you this one thing what this developer was doing you know after the audit report he was just checking you know changing the code in the open CH the transfer function right like uh the logic there and and with the client just deployed the code he some money and then able to figure out there was some hack around it the AL developer going with the money then we did the some analysis and then we able to figure out like around 15 20 projects same so guy was a freelancer and he did the scams with around 15 20 projects right so the developers is also doing these kind of AC scams it's so very interesting like he going with so much money out of it it's interesting what about you one super interesting one was I think last

year or last last year um A's mango Market hack because that was not just an onchain hack he manipulated the price on FTX if I remember correctly and then use that to exploit onchain so all of these audits that we had wouldn't have caught that bug like there was nothing wrong with the code per se it was just the configuration and risk management that went wrong uh which basically shows like you need a lot more than just code audits I think I'd speak for many uh that one of the most beautiful hacks was fers swap hack which was a beautifully designed arithmetic manipulation and it was in the code which was Buck hunted it was audited and still someone managed to

do this yeah I actually wanted to mention the same AR uh but maybe to mention something different I've uh recently worked on a lot of like offchain stuff and I um an interesting I mean it wasn't act because we C the bag but like um you could connect the wallet basically uh to any website and you would actually sign a transaction without actually prompting the user to sign it uh and I feel that's that was like kind of interesting uh because yeah the they didn't think about that HK is fun enough but yeah yeah that's really

good so uh does anybody from the audience have any specific questions um no then I think that's it uh thanks for the panel guys thank you thank you