Security at Scale: Solving Audit Procurement for Builders

Transcript

Awesome. Well, thanks a lot for having me. Um, especially tuning in uh Friday afternoon evening uh after a long week. So, I appreciate that. Um, Bernard, I'm co-founder of Area. We are uh um a leading investment banking firm in in the crypto space um working with many onchain organizations on on strategic topics which the the marketplace is an is an example of. um really here to basically showcase or talk about how to enable access to audits to to more builders. Um with obviously a lot of the discussions uh in the last two days being around how to optimize audits and what technology you know can be used for

to make audits more sophisticated um to to you know find more vulnerabilities. This is really an effort to take what's out there and and make it accessible for more builders and then also enable ecosystems to provide audit support for for builders on scale. Um bit of background about us. Uh as said investment bank firm in in crypto have three verticals. Um M&A support founders on the sell side. I have an active capital markets desk and then an onchain services unit where we where we work together with DeFi organizations and and onchain um organizations in the in the space. Done a bunch of deals. Uh don't want to bore you with that. Uh some some numbers and background um to start with

um obviously preaching to the choir uh security is still a key issue. one obviously on the builder side um key risk for builders that you know can result in even a a company or a or project coming to an end if you're facing a major exploit but then also for ecosystems um with you know the maturation of the space still an increasingly you know high barrier for also institutions and traditional organizations coming into the space if security remains a key threat so for us it's really an a mission to kind of reduce that barrier and and uh make the whole space more uh institutional and and easier for institutions also to build on. Um and this is really what we

what we looked at. Uh it's the procurement process if you will of of audits for builders. Um still quite I would say cumbersome and and in intransparent and and messy. If you're a builder out there, you typically uh also treat kind of audit procurement as a I would say third tier priority that is at best distraction to your your daily business. You don't really want to deal with it, but obviously um you should as it's an um you know increasingly important topic. Uh so typically you you talk to a couple of auditors that you meet at conferences um talk to befriended founders um for ask for recommendations or if you build within a larger ecosystem might even reach out to

the foundation or you know ecosystem support team or even your VC to to ask around who's you know best to to work with. um leaves you obviously with a lot of bilateral discussions um with different providers um talking about different timelines really hard to to manage and really distracting um from the daily business. So this is what we were looking at um with the builder being really the key stakeholder of of what we were trying to solve. Um secondly obviously ecosystems uh have a increasingly I would say a focused view on security.

If you look at um for example the UNISO foundation which is the case that we're talking about today uh with the launch of UNIV v4 and uh hooks becoming a you know new surface area for for unis swap um with increasingly difficult code to to audit or more complex code to audit. It's also an effort for for many ecosystems to really support builders to build uh secure um projects and and protocols. Um the third topic that we we see is also an interested uh interest from ecosystems in in capturing data to really understand what is the state of security of builders which is by now or right now really opaque um with

ecosystems not really having a a grab on this. What we um then did is basically piloting uh a simple version of the marketplace in in Q4 last year, which is pretty much uh something many of you will be familiar with from the traditional world, a web two world, a two-sided marketplace that really just connects uh the supply and demand. Um as you know, in the security space right now in crypto, both sides are pretty fragmented, right? uh the supply side of of audit firms by now um is you know to some extent even commoditized with you know close to I think 50 to 100 firms out there providing um smart contract

audits and then the builders obviously on the other side being left at the you know mercy of finding the the right auditor. So in you know simple terms how the marketplace works uh and there's really no no rocket science uh a builder when looking for an audit joins the marketplace uploads the audit request which is basically um a more extensive form asking for details about the code to be audited um and you know technical specifications of of the code and then auditors having um the opportunity on the other end of the marketplace really seeing the audit demand flow in um as a uh how we like to call it kind of a

readymade BD funnel. So the idea is really also for auditors to use the platform and see um what audit demand is um is out there and being able to serve that with the capacity they have and and the price point at at which they're willing to to engage with. How it typically goes is that the builder um when receiving quotes on the marketplace also picks up calls um with the different providers to discuss scope in in depth because there's obviously so much only so much you can you can capture within uh a marketplace or or platform format um and then really the preferred auditor is is picked by the builder um who then conducts an audit.

The additional feature which is you know becoming more and more attractive for for foundations and ecosystems is also built in subsidy or grant function uh where an ecosystem can then decide for specific builders uh that they want to subsidize to provide a grant and um cover some of the cost of of the audit which you know can go from two. Um we've seen different ecosystems try out what good subsidy amounts are from uh um you know 20 32% to even full covered audits by an ecosystem still I would say somewhat in experimentation mode of um what is the right amount because you

obviously also want to create buyin from a builder and not you know create um an environment where builders kind of learn that the ecosystem pays for for the security measures. These are some some numbers. Um, as mentioned, launched a pilot last year in in Q4. So far have 30 uh 350 audit offers processed. We've done a vetting process with providers. Um, many of them are are here today. Um, that worked. Um, and this might be interesting for for some of the parties in the room. um that the counterparties that we work with uh which is Unisful Foundation and some of

the ecosystems here on the right side um they ideally have a preferred list of auditors that they come in with um that they shoot in our direction and we provide access to our vetted pool of providers. So every ecosystem really picks and match their preferred set of providers and we are just acting as an objective party that then plugs those providers into the marketplace for each specific ecosystem. what we've seen then really play out and this is some of the you know uh data that we uh published within a report after the first six months of piloting the program is that on average we've seen 10 to 12 quotes per project that uploaded a request which is obviously a

huge unlock for for builders um that with that have a you know view on on on market price and um are offered some variation in terms of um quality and and price and then can really pick and choose their pre preferred provider. The process um is obviously significantly reduced to a couple of days because um the projects set their preferred timeline within the market place and then really only get offers from providers that also have capacity and know about the timelines. What we've seen then projects do is really schedule calls mostly on one or two days with their preferred parties. So do one after

the other um to you know reduce distraction on their on their operational business. The third thing is then a dashboard that we share with our partner ecosystems where the ecosystems get a grab on really the audit activity and um parties that their builders like to engage with. Here's just some um yeah of the companies that we we work with. We also engage a lot in in builder interviews and are uh on the ground on um demo days and and uh ecosystem events with with ecosystems that we work with to really understand how we can optimize the marketplace offering and security

support for builders. This is really what you've seen before. the the marketplace that is currently live, has some nice features, but is really right now a procurement solution that makes it easier for builders to to find auditors. Um, what's next are some topics that excites uh excite us. Some of them are more progress, some are really just early ideas, but this is really where we want to go from here. the first one new funding support model um is really a learning that we've had over the pilot and the last kind of six month of operation for other ecosystems is that we are experimenting right now with new

ways of subsidizing audits. V1 of this is really just an ecosystem stepping in and saying okay we allocate you know 500k to a million or so in a fundlike vertical uh vehicle that we then give out to builders um with an assessment being done by the ecosystem. So it much works like uh a grand funding that we've seen across the space but obviously comes also with drawbacks of of traditional grand funding. So what we're experimenting with is right now kind of hybrid models where also the providers are stepping in and contributing parts of the subsidy fund as as discounts which is um more attractive for the ecosystems as they then can get

preferred terms from the providers and can kind of share the the discounts or grants being given to the the projects. And for the projects obviously great to see you know support one from the provider side and the the ecosystem side which more than than often really pushes them to then take the step to uh to do an audit. Um after all second topic that we're excited about I would say is the most early stage as it's by far the hardest nut to crack is anything in the direction of quality rating mechanisms. Um I always think about it as like an L2 beat for for auditors which is not as easy of a task to to turn around but um highly in

demand the more we take with uh talk with different stakeholders is really uh not only supporting and leaving the procurement task um at the mercy of the builders but also adding a layer of information to the builders that then enter the marketplace um to learn um the different quality criterias of providers and experience traction and um and the likes. The last topic is a a topic where we done first step uh end to end security where really we want to extend the marketplace not only for traditional smart contract audits but also now plugged in pre- audit scans um with some of the leading providers to move into a

a world where we can cover security needs of all kind of stages of builders. As we've seen often, the earlier the the stage of the builder um the the more likely is that they don't want to go down the audit route yet because it's a significant um or they face a significant budget constraint. So pre- audit scans at least give you an initial view on your state of security obviously should shouldn't um substitute an audit by now but is a yeah part of the toolkit that we want to offer to builders. And then on the uh other sides uh after you've done your smart contract audit uh also monitoring solutions as an interesting topic to plug in as a

offering via via the marketplace and the range of providers being being out there. This is just some of the reports that we're publishing um trying to you know map out the state of security that is currently live. Um, also call out if anyone um is keen to collaborate on any research pieces. This is really the angle for us is always as we're closer to onchain organizations and and ecosystems that have buildup programs is providing those really education pieces to builders. How to think about your security audit if you've never touched a topic. What are the easy uh fixes or easy checklist you should go through

before booking? um really as an offering to uh you know educate yourself and and help builders along the journey to to book their first audit and and increase the security of their their projects. Yes, that's about it. Thanks a lot for listening. Um I think we have a couple of minutes for questions if there are any. Happy to happy to answer them. Thank you. [applause] Awesome.

Then thank you a lot. Have a great rest of the summit.