Security Research as a Public Good for Ethereum

Transcript

so I'm going to bring on our next speaker uh who will do a talk uh called security research as a public good for ethereum so everyone give a round of applause for Martin abat Marco Okay so nice to be here hi everyone um yeah my name is Martin everybody calls me tincho you can call me tincho I speak Spanish so if after after the talk you want to speak in Spanish to me yes perfectly fine the idea for today is discussing about security research as a public good for ethereum um not a technical talk so you can stay if you don't understand solidity and that kind of little tricky things I want to share Impressions I want to share ideas I want

to share a new approach that we are tackling at this new group that is emerging which is called the red Guild where we do application security research uh pretty fun stuff uh let's see what it's that what's that about so let me show here some some quick things about what I mean by application layer security right so if you have been part of the ethereum ecosystem you probably know that very broadly we can speak about the base layer and the application layer right um on the application layer we might consider that we have whatever is on top of um the ethereum virtual machine right what is on top of the blockchain we have a smart contract but not only that but

but also we have um a front end for example right and that could be it but that's not true right so the application layer has been growing in complexity a lot over the years and perhaps that's not the case for the base layer right so the base layer has been involving by the application security the application layer has been eveling much more in my opinion and the ecosystem is just growing we have oracles we have frontend we have providers we have signers we have wallets we have indexers we have l2s like everything is lots of things are going on on the application layer so it feels like this right little blocks sit on top of each other and rather unstable I'm full of bugs sometimes right uh and these bugs can

even affect H each other and can affect protocols that you would have assumed as safe H all of a sudden are not safe anymore and while everything is going on on the application layer well on the base layer things do feel more robust right it doesn't feel like ethereum is breaking every now and then on the base layer but it does feel that the application stuff is breaking every single day um so application security um along has has evolved along the application layer right there's an article in there in that QR code hopefully you can scan it but I wrote about a little history of how I have seen application security evolved over the years I've been doing this for more than four years already I used to be an

auditor um so um there's there's many things going on right so at the beginning we used to have solo security researchers doing some freelanc stuff doing some reviews right then we have like Consulting Firs Shing the space um doing more professional stuff those are the firms that you see today that are really really contributing to the security of the ecosystem and these days we even have like crowdsource security we have Dow like organizations um organizing security researchers in new ways and we even have security people internal to the development teams if you come from Web Two that's yeah that's obvious right but in web 3 that's

only recently starting to happening uh so that's cool that's cool at the beginning we have public reports we have some Wiis we have some forums right on the early days and they say we have lots of things right we have public reports and we have ctfs and we have C the CH Capture the Flag challenges and spoke the challenges and newslet and conferences and everything so there's lots of M lotss of resources for people to learn about application security right so everything seems to be blossoming these days in application Security even on a market yeah but it doesn't feel that yeah this the whole thing is okay we are producing stuff but it does feel like we are still missing something right so we are still missing

some bits and pieces for the thing to actually feel more secure but we cannot secure everything and we should acknowledge that right H we have limited resources so we have to pick we have to pick our battles and understand what we secure how do we make applications in ethum more secure the questions that I'm asking myself and that I share with you are whether we are actually protecting the applications in ethereum that really contribute to to its long-term game or has security been evolving into a just a get rich quick scheme right um I don't have a clear answer for that yet uh and

I know that it's not black black and white um I know there are degrees in between um but I want to start considering these questions I want to start asking myself these questions and hopefully they resonate with you um on a broader term perhaps you can start thinking about application security for the long-term sustainability of ethereum and if we even think bigger what if we start considering application security for the social good of etherum right what where we have teams we have people doing application security for e theum in favor of the ecosystem thinking about long-term sustainability and not only trying to outco compete each other mindlessly H in the next contest so that

they can make a few more bus right um perhaps what we can do coming back down uh on on putting our feet on the ground a little bit is perhaps we can make the application layer a bit more resilient right so perhaps yeah thinking out for the social good is too much okay what if we at least make it more resilient what if we acknowledge that there will be vulnerabilities but we can recover faster from them we can learn from them we can educate the community about them so that the next generation of developers don't make the same mistakes as we have been over and over and over repeating right I don't think if we are solely uh thinking of profit and money uh we can actually go this way right we

should be thinking about how we approach the community how we breach our technical knowledge to the community how we reach out to them how we educate them how we set up processes for everyone to consume and to build together a little bit more specific perhaps we can have teams doing a specific efforts to protect applications that matter for ethereum for its long-term game and also provide education provide awareness provide tooling on board them with educational content share this process processes that I was talking about there might be something to be done in there instead of in instead of only um selling our our skills to the best Builders right the question is what is what

matters right each one of us will have a different perspective on which are the applications that matter for us um there's a there's an article there by vitalic that talks about what kind of applications in ethereum excites him that's his view I do share some of his views uh and you might share some of them as well um we can use them we can we can use them as influences to choose the applications that we really want to protect right instead of just uh trying to secure the next5 thingy monster you know monsters in jpex and that kind of things that perhaps for some people those are the things that matter particularly it's not that that my case um so we are willing this right so we

are we we're trying to build an MVP uh we are trying to set up this team that carries out application security research education and advocacy in favor of etherum ecosystem right we are calling it The Red Guild that's a nice logo that we put together recently and we are pretty proud of it um and where is application security research in practice right so what are we actually doing right because everything is is nice on a presentation but let's see what what kind of outcomes this kind of teams can achieve not necessarily selling audits to people right doing something different for the ecosystem approaching application Security in a different

way a critical bag on enss for example that we reported recently a couple of months ago uh is not that enss had a contest open it's not that enss reached out to us for an audit right we care about DNS because we think that it matters for ethereum we went uh to look for bus in the in the smart contract of VNS we ended up finding a critical issue on enss there's a there's an article that we published and we earned a bounty for it right so responsible disclosures of security vulnerabilities are a thing that we can do for the theum ecosystem but it's not only about finding or not a critical right I think that security goes well beyond finding

the next critical issue and hitting the headlines right there's much more work that we could do as security researchers we can be out there working for the community without nobody calling us and Reporting stuff on public issues where we report less sa BS where we report weaknesses right so these are examples for account abstraction for Lio uh for open sing contracts and so on right so we have more than this and nobody from this teams called us to do this right we are willing to help them uh nobody even pay for these kind of things right so we are doing this really in favor of the ecosystem because we care about these projects um because sometimes they are too big to fail uh

even if they are not exactly align with our values with our core values as a team but sometimes they are relevant for theum ecosystem for for the the survival of the ecosystem so we have to help them so not only reporting critical stuff but also less things that perhaps strictly profit-driven companies or teams or individuals won't take the time to do these kind of things will change everything probably not right so these are like small things that we can do I hopefully my idea is that little by little if we have more people doing this we can build the right incentives to to do more of this and what about education advocacy well we have been doing that as well

it's not only about the technical work right we could be like the best hackers ever but if we somehow don't bridge that knowledge to the community if we somehow don't don't share what we know with the rest it's useless in my view so um we do also education and advocacy we want to bridge this gap of this highest skill team that we have of this very technical knowledge that we have and and share that with people that are just starting out so for example we are building the vulnerable Lei if you have been part of the security Co system eum you have you should you should have played this theni um it's a set of challenges to learn about hacking smart contracts in

defi I think it's quite popular and uh it's been quite recognized like naturally organically in the community of being one of the best resources to learn about defi security that's free that's open nobody's paying us for that right we're doing that we are going doing this because we actually care about this stuff uh we also are hosting um live events in in Latin America all people in our team are from Latin America for that's why we speak Spanish um and hopefully we'll we not not hopefully we're actually having this event on August uh which is called years and it's a set of events that we are hosting uh and hopefully we can actually um have more people in the in the latam

community join us in this effort to secure the application later right um in terms of Education advocacy another things that we're doing is that everything that we do we publish in our blog right so we have lots of educational articles that we are pushing just to yesterday we shared a new article which is not here about a new approach to reviewing code will let us to find a bag in one of lightos Oracle for example we have if you speak Spanish there's an hour and a half video on YouTube of Mata and I Mata is my my partner in crime in this um where we go in depth into a construction and we do a work through of account attraction and and the whole code base of smart

contracts and the B of account attraction that's also free that's also open you can you can read that you can listen to that and these articles that we are every week week we are publishing two or three articles about things that we learn as we try to protect the application layer of ethereum if everything is free if everything is public if everything is open like how do we pay the bills right so how do we tackle uh long-term sustainability that's a an open question that we have um we are funded by ethereum foundation so far and they have been supporting us from day one and we really value them uh but we really want to find alternative

ways of funding ourselves so we can extend our Runway uh and hopefully do this for I know for some time um so that this is an open question right many people have told us well you should try out quity funding yeah yeah we did really well in prod funding um these are all teams from Latin America um that participated in the latest gitcoin round and we ended up top one which is really cool the only the only problem is that it's not exactly the top one the top one we wanted this is why like we are the team that spend the most in trying to apply for the latest gon round and those

are the amounts that each team received again all teams from Latin am America and we are like the people that most money lost in trying to apply for this fronts right um and this is a reality again we are just one there's lots of them and the list was even bigger so lots of teams that you're actually that you might think that are valuable for the ecosystem are doing good things for the ecosystem again everyone from Latin America in there um well and they are not done they are not doing as good as you might think right so yeah quad funding and this public grounds might be a good thing um perhaps we need more awareness in the community about them we need more contributions or perhaps we weren't good enough to communicate our

value to ecosystem and we'll continue working on that right um my impression is that there's something going on if if we were not the only ones in this but but we still have hope we still have hope because we we are having right now A a round on cl. fund that you can go there and you can start supporting us as well um and if you don't want to support exactly as well in c. fund there's lots of other public goods that are waiting for your support right we are not the only ones there's lots of people trying to uh help the theum ecosystem in a nonprofit way um without strictly being influ influenced by Financial interests

but they need your help um and you can express your support if if you don't want to do it with money well you can I know tag them on Twitter share their resources and just tell your bdes about them I don't know spread the word spread the message I think you are part of you're are part of it you're part of the solution so etherum application security as I was telling you keeps evolving right I told you about like some actors that have been for long in the in the ecosystem and we're trying to propose to propose a new approach I think we are accomplishing things as I was telling you um this is just to some extent an MVP of something

we are trying we are only three people at the red Guild right now but we have been doing like everything I have told you uh in a couple of months so we are really like committed to the things that we do and hopefully this kind of talks is to try to inspire a little bit try to to plant some seeds in some brains so that other teams can emerge doing similar things right to continue protecting the applications that matter for ethereum and hopefully we can do that for for a long time and continue on boarding these new waves of application security researchers that will continue joining and we can hopefully share with them the right

values but the right values not but some values that matter at least for us thank you very much um you can follow us on social medias the red guil I'm tincho you can follow me at tincho here's Matt my my friend and colleague matal at the red.org you have links you have everything you have our blog thank you very much [Applause] okay