Tragedy of the Ethereum Security Commons

Transcript

[music] [music] >> GM GM. How's it going, guys? So, we're going to feel free to hit the QR code and ask us questions at any point during the during the thing. We'll We'll throw some time at the end for questions. But, I'm really excited to talk about the tragedy of the Ethereum security commons. You know, the tragedy of the commons was is a is a common thing that everybody knows about. It's kind of aligned with the free rider problem. But, there's this amazing human, Elinor Ostrom, who won a Nobel Prize for effectively proving humans can overcome the tragedy of the commons. So, how do we do it? How do we do it for

Ethereum security? And I'm so happy to be hanging out with Jocelyn. Uh what is what's your title at Aave? Head of security? >> Security researcher. >> Security researcher, okay. And [clears throat] of course, also one of the main minds behind Trail of Bits for the last decade. Uh so, yeah. I guess open question, Jocelyn. How do we do it? What What do we do? What What do we got to do to actually make Ethereum more secure? >> Yeah, that's a good question because there are different levels to it. But, one thing we can kind of like think about is there are a lot of public goods and like open source that people rely on.

Uh that rely on a few people that are going to develop it, right? Like, you know, it's going to be like a few people that are going to have like uh uh a motivation a self-motivation to tackle a specific problem. Like, for example, fuzzing. Like, all our fuzzers rely on like five people, you know, in the industry. And everyone knew them. And this this is difficult because uh like these people, they have a job. They're like, you know, doing other things. And but, they still provide a lot of value for the community. Uh so, we're in a situation where we rely on the work of only a few people. And this is kind of like scary because if these people, you know, stop working or like stop being passionate about the way they Uh we might have a try no problem.

>> Are you talking about Gustavo? Just pull up. >> is an example. Like you know he he has been like building a kidna for I don't know many many years and uh Oh, sorry. Okay, sorry. Yeah, uh Gustavo is a good example, right? Right now he's doing like open source work for a kidna and everyone is a lot of people are using a kidna. Uh he if he stopped doing that well, we don't have a kidna anymore. So, that's a good example. >> everyone's using fuzzing. Fuzzing is like just spamming your contracts with random inputs to see if it breaks. And everyone's using a kidna, but who's funding it?

>> So, for >> Just Trail of Bits, I guess. >> for a long time like Trail of Bits, you know, spend a lot of time and resources to found open source tool, but even that doesn't necessarily scale because then you rely on one company to do it, right? Uh so, it is challenging. >> Yeah. And and the DAO wants to fund it. There's an initiative for So, the DAO Security Fund is a project that I'm running that effectively we have a bunch of money from the DAO back in the day that is staking and earning rewards. And so, right now we have a program called the ETH Security Initiatives where we're funding about a million dollars to different ETH Security Initiatives that get voted on. I see several people in the room actually with ETH Security Initiatives. We got Netta over here with

a great initiative for Blockful. Uh there's there's a few other people in the space, but Echidna is looking for funding for the next year. It's just like I think it's 48K. So, he and but the only way the DAO will fund any of these initiatives is if they get 25% as validation from the ecosystem because we want to make sure that the DAO is funding things that the ecosystem really needs. And the only way to do that and to help the ecosystem itself overcome the free rider problem is actually require some financial input from from this very wealthy ecosystem. So, uh and Echidna is a great is a really great project and everyone's using it

and it's just free out there. It's a free security tool. But it's so hard to get funding for it. >> And and it's tough because, you know, when you do a pen source, you basically or when you build something, you have like two world, right? Like either you are going to make it like a paid product, and you're going to build like a business off of it, and you know, you can be really successful and it can works well. Uh and for some for some project, it's probably like the way they should think about but should not, you know, we are doing a public good, so we are going to go the the world of open source and hoping for grant and everything. That doesn't, you know, usually work.

Um so, there is obviously like the world of building a business out of it. But the reality is that building security tooling and like getting like people to pay for it is also really difficult, and we see that also like in web two, like most of the like large uh large tool that people are using uh are either funded by one company or one foundation or like something similar to the Dow, or it's like a bunch of people on their weekend, you know, improving it. Um so, yeah. >> Yeah, and you know, I feel like there's just a real big challenge here because there's a free rider problem. I feel like that's the biggest thing. It's people are like, "Why should I fund a Kidnap? Yes, I use it, but a lot of people use it." And it's it's really hard to convince people to like we're

only we for for Gustavo on a Kidnap, we only need 12K from the community, and then the Dow will put in 36K. But if they don't get that 12K from the community, then that's a signal that we must not care about a Kidnap, you know? >> I I think it's a bit of a problem because of in a kind of like a cultural problem because we all used to get free stuff, right? We are used to, you know, go on internet and like, you know, you have Wikipedia for free, you have like all the things for free, and like in the blockchain community, there's a lot of content for free.

Uh but we don't realize that, okay, it's for free, but someone is somehow paying for it either with time, with resource, with allocation, uh and that can only work up to some limit if we if we don't change a bit the mindset and understand that okay, all these things which is nice uh sometimes do do need a bit of funding and a bit of help, right? So, there is also like one of the challenge I see when you build open source tool is that it is sometimes challenging to get feedback from the user and to get like like input from the user. So, you know, I I I built Twitter and I spent a lot of time on it and it was sometimes challenging just to understand uh just to get a connection with the community and to understand okay, what do people use, how do they use it,

how can we make it better? Uh so, it's also something where you can think of like funding to get like some signal out of it. Like, you know, okay, which features people want to see, which like I don't know integration or like you know improvement they want to see. Uh that may also be a get like a a good place to think about and kind of like try to improve. >> Dude, I think you just nailed something so huge and and and something that really uh we're trying really hard to push in the Dow Security Fund initiatives around because the problem with public goods is they often just don't get feedback, right?

There's no market feedback. When you have a business and you're trying to sell something, then if it's not selling, that's feedback, right? And you get feedback from the users and you then you try something else, you try something else. Now, if you're running a restaurant and people buy that dish once and then they never buy it again, well, okay, you stop serving that dish and you find try something else, try something else. And but in public goods, actually it's just hard to do that. When you're giving it away for free, you don't get that feedback. And so, in our round, most of the initiatives are actually required to have either a revenue component or a business model. They absolutely need to have users at the very least that to get the full amount

of funding cuz it's mile-based fund milestone-based funding. It's like the last few milestones are adoption-based and impact-based. And I think that helps a lot. And and the ones sometimes I had lots of challenging discussions with public goods organizations that I was like, well, actually, I think this is good enough you can make this into a service. And by making it and and really pushing them to add a revenue component, even if they don't know what it is, right? >> And and that's challenging sometimes because the people that work on public goods they don't necessarily have the mindset to build a business and they sometimes struggle to understand, okay, if I want to be, you know, to work on that project in the long term, maybe, you know,

that's something you need to force yourself to think about and try to maybe, you know, team up with someone who can help you get like, you know, like feedback from people that have been businesses because, yeah, at some point like you have to make a decision. I I think sometimes I see also people thinking of public goods and and grants as something like, okay, I'm going to make a public good and therefore I should get money from like the public, but it doesn't work that way, right? Like if if you want money from the public, then build a business, don't build like public good. Uh and I think people sometimes have a bit of a wrong mindset there where because they do build things that are useful for like, you know, everyone, they think therefore they should get money out of it and it's a bit of like a

it's a trade-off, right? >> I mean, I agree 100% they should and I actually for the last decade I found a Give It and the whole mission was how do we create economies around nonprofits that can appreciate the value they create and it's just really hard. I don't know how. I try I've been researching this for a decade. I don't know how, you know? And you know, we've In fact, Give It is now just a a donation platform we don't issue tokens for any of the nonprofits, we don't do and it it's just kind of sitting there hoping one day this problem can be solved because I do believe blockchain technology is the tool to solve that problem. We just need some brains out there to figure it out for us, please.

>> I might be a bit less optimistic. >> You're what you're what? >> I might be a bit less optimistic. Like I I think I think it's really like okay when I work on something public like an open source or something like that, I don't work on it with the hope of getting funding because again, if I were doing that, I think that would be the wrong mindset and I should work on it with the mindset of okay, I'm building a product. You can get grants to, you know, seed the product, but that's a bit of a different kind of perspective versus working on an open source tool with the hope of getting money to make that sustainable. Uh Some for some people it does work, but

like most of the time it's never going to work. So, I think having the when you start doing open source having the right mindset of okay, I want to make a product out of it. Here is how I'm going to do it. So, you know, money is needed and and so on. Or I'm going to do that for other reason which are not money related and if I get a bit of donation, that's great, but if I don't, I will still make it because that's not my goal. >> Yeah, I mean, and that works some of the time for a lot of things, but then you end up a lot of the times losing professionalism or you know, it's someone's side project. They they don't have their full focus on it. Eventually, they get a girlfriend who demands they get a real job and boom, the project

dies, you know? So, I don't know. It's it's not having some kind of and this is something that I really think that we can solve in the Ethereum security comments because the value there's so much value in that needs to be protected. I mean, it's just blows my mind. Like I know you weren't with Ave at the time when DeFi United happened, but we were able to coordinate to put together the and Ave was able to coordinate the ecosystem to get $300 to rescue, uh you know, KelpDAO and from the layer zero exploit.

And yet, we've raised only about 600k so far in the ETH security initiatives round. You know, it's um it it's kind of a hard for me to wrap my head around how how well we can coordinate when there's a huge problem that we can see and how difficult it is to coordinate around preparing to prevent the problems that are possible. >> I think it might be because it can sometimes be more difficult to identify and evaluate what you get out of like in the donation, right?

Um in particular these day like you know with AI like if you if you look at like some proposal sometimes like it's really easy to build a prototype, it's really easy to like have an idea and build something which is like good-looking. It doesn't mean that it will translate to something actually useful. So if you look at like the landscape of like open source there or like public initiative, some of them are have been existing before AI and we know they are useful because you know we have seen their impact in in the ecosystem. But for like the new ones, it's a bit more difficult because now you know you have like this idea, you want to explore like this building like block or or whatever. And on paper it looks good. Is it going to translate to something that people are

going to use and is it going to be something sustainable? That's that's a hard question today. >> It is. It's it's tough. I mean I feel like the mindset that at least I'm having some success with is talking to security researchers and talking to projects and saying like listen I you're and actually uh the analogy that I gave in my talk that the the MC kind of presented is like every if Ethereum is an apartment building, every project is doing a great job at securing their apartment, but no one is protecting the lobby. No one is working on making sure the stairwell is guarded, you know, and so attackers can get into the lobby and they can go up the

stairwell, find an air vent and dig through your floor, you know? But if we if we could get a few of the projects and a few of the security groups to actually work on securing the lobby, securing the stairwell, securing Ethereum writ large, actually their project would be way more secure, right? If you can allocate 10, 20% of the your security budget to actually share its security initiatives for Ethereum, it actually is the best allocation of those funds for the security of your project.

>> So, Okay, if we go in that direction, there are a couple of like things to consider because usually that like you know, if we take the analogy from like web two, you're going to have like a foundation like you know, the DAO which is kind of collecting money and try to to allocate um That's great, but we also have to be careful to make sure the grant are allocated in a way that produce value. You know, if we are being transparent, if we look at like some of the previous uh grant that were given like you know, to the ecosystem to like different partner, not all of them led to something like you know, really useful. So, I think and that create also a situation where for people donating, they're like, "Okay,

you know, I donated in the past. You know, I did not see that it would have really well well allocated." So, I think if we can also coordinate a bit more into what is valuable, what provide kind of like you know, long-term kind of like improvement in the ecosystem, uh what signal do we want that actually you know, can can can help to to to select a good allocation. >> Absolutely. Well, like you know, if we don't get 12K in the Echidna grant, then the DAO is not going to put it in and Echidna might just die, right? Uh there's some great initiatives that are like screening for resumes from North Korea or you know, EDR software that people will actually install, but you know, uh small companies do not install CrowdStrike or SentinelOne because it's a privacy like I don't know, just I

don't know if you can answer this publicly, but does does Ave use EDR software like CrowdStrike or >> Yeah, I might not go into detail on >> Yeah, okay. Well, and you know, but it's like I think a lot of large companies do, but the small companies almost none of them, you know? And that if we can just improve opsec, you know, that's like where all the hacks are happening, right? So, I I do while I agree that the grants in the past have been bad, we we got to be making grants that are not here's some money and keep coming back to ask, but are starting businesses. Right? Like EDR software, privacy-preserving EDR software is a business that will be bootstrapped. Like screening for North Korean IT workers, that's a

business that will be started. Those are way easier to fund. >> I I like the idea because, you know, currently like, you know, like if you want an investor to help you, that's that's a different path and you need to have like, you know, uh like good connection. We could imagine like the Dow fund or something like that move toward like a seeding phase for project that could become business without like the same complication that with investor, right? Uh so, with obviously like amount which will be much lesser than actual investor, right? But at least something where someone can try for like 2 months like a incubator type of approach uh would be really cool for the ecosystem.

>> I mean, I think a lot of these security initiatives are going to have a lot of trouble getting investment because they're they're businesses. They're not like there's not They're not going to become a unicorn, you know? So, getting VC money, that's not the way. It's almost like, yeah, they could get a business loan from a bank. You know, that's like kind of the normal path for these types of businesses and good luck getting a bank to give you a loan in crypto, you know? Like that's just not That's not going to fly. So, we got to do something. And maybe the loan approach is what we'll try next time. I mean, the Dow security fund is going to try things, you know, because I know from Giveth, public goods are almost impossible to fund.

But actually, I want to Before we go into questions, which if you guys have questions, QR code, like throw it up. Let's let's hear your thoughts. But uh one one thing I want to announce actually is that we are doing a public goods funding round coming up. So, uh Giveth actually just rebuilt its entire protocol. I want to give a shout-out to TurnKey uh who provides MPC wallets that uh have a strong policy engine. because one thing in one of the reasons I'm actually in the Dow Security Fund is to because I've seen nonprofits lose crypto in every way you can imagine. Been on product onboarding nonprofits for a decade. It's been tough. So we rebuilt

the Give it platform from the ground up to make it super secure for nonprofits to use and we're actually going to run our first QF round on the full thing sponsored by Wintermute. Huge shout out to Igor and the Wintermute team uh for for putting this together. Um Give it has been around for 10 years. This is like our our 10-year anniversary celebration. So uh you can apply to be It's only for public goods. Uh we have 100k so far about 100k uh but it's in crypto so hopefully the market stays friendly. Uh we're looking for more sponsors. If you want to sponsor the QF round and support public goods, we're here. Uh so yeah, I'm very excited. Uh we haven't had a good public goods QF round in a while.

>> Uh but one thing I will also recommend everyone like if you are using an open source project on a daily basis and you really like it and you know maybe you don't have like no a a lot of funding yourself but you work at a company, don't hesitate to promote it internally and to mention there is like a round happening now because a a format that I've seen work like in in some company is that uh you can get matching like from like your employer sometimes when you you donate to like a nonprofit or you donate to like you know the different entity. Uh and that's something you can try to see if that works within your company where you donate something, your company donate a bit and that creates also like a a good environment to to help on that front.

>> Uh yeah, I love that. Okay, well do we have any questions on the board yet? Oh my god, we have a bunch. >> Yeah. >> Wow. So we will thank you guys very much. Yes, security is short public goods so thank you for taking your part there and we look at the questions. I have to click it here because we have online audience so it's important to always know who we are answering. So I'll select the first questions I'm answering and I'll just read it. So, why Ave is not participating in this year? It was completely different engagement during previous years. Rather is being missed here as well. So, I guess that's a question for security researcher from Ave.

>> I am here. >> [laughter] >> And we also gave a talk on one thing like a couple of hours ago, so. >> I mean, but no Ave. I mean, there was DeFi United guys. Budgets are are tight. Come on. >> Yeah, so that was more more like an opener. And let's look at the next question. So, are there open competition audits a good and sustainable model for security audits? >> Okay, I won't be able to answer all of that in 4 minutes. The people that have worked on open competition have struggled to make it a sustainable business. Like there are multiple providers, and you know, that's also why we don't see many contests today.

There are still a couple of providers that are pushing it, but yeah, it it it is difficult to make it sustainable. I don't think it's impossible, but it does require like some iteration. One other thing that has been challenging also for competition is AI because now like you receive so many submissions that it's difficult to triage. But yeah, it does it's a bit it's a bit sad because it was a really good entry kind of like door for security researcher to start and playing with that. So, I hope we can see like contests, you know, getting back to where they were before.

But in terms of business sustainability is still TBD. >> We're we're going to go deep into this question at the security hub tomorrow. I forget the exact time, but I'm actually going to moderate a discussion on bug bounties and the death of bug bounties. So, if you want to hear that, check the security hub tomorrow. >> The bottleneck moved a little bit to triage, right? So, that's that's the All right. So, you think it's answered. And let's select the next question. So, uh Love the Ostrom reference. Can you talk more about what aspects of Ethereum DeFi security fits Ostrom's framework of self-governance.

>> Well, yeah. I mean, Ostrom proved that we can get out of the tragedy of the commons by coordination. And, you know, uh DeFi United is a great example of that on the most epic scale ever. Uh $300 million. But, then also, we can coordinate around co-funding initiatives together. You know, we need to have strong boundaries. We need conflict resolution. We need We need to be able to trust each other in the in the Ethereum space. And, this is where it doesn't fit or it's really difficult. Like, if you think of the banking ecosystem, they have really amazing standards. Uh but, it's there's a huge boundary layer on who can participate in the banking sector. So, in in Ethereum DeFi, we have very loose, open

boundaries, and everything is very uh interoperable. And, that's what makes it sort of difficult and why it doesn't fit Ostrom's frameworks. And, so we have to figure out how to overcome some of these challenges. But, it's very easy to overcome if there is a central coordinator. And, that's what we're trying to do with the DAO Security Fund. >> All right. So, the next one, uh can state regulation help Ethereum security at all or is it only an obstacle? >> So, that's going to be a personal take, but I think if we are waiting for regulation to help us with security, we we are not going to make it. Um regulation can help in some aspect,

to create a bit of a baseline of security of like things people needs to follow. But, at the same time, baseline can kind of like have a counter effect where people just try to follow the baseline and don't try to go beyond it. Uh so, it can help a bit in some case, but I don't think uh if we wait for the state regulation to help us in like significant way, uh it's going to happen. >> We we have to self-regulate. If it's imposed on us, we won't want it. I promise you this. >> All right. And, probably the last one.

So, uh even if we get better security going forward, how can we deal with all the old contracts holding billions? >> I I We actually have a really interesting initiative in the DAO Security Fund for a basically a open bounty on Ethereum. It's a white hat distribution platform. It's actually a legal initiative for lawyers to take on where they can create a legal entity that will be structured in a way where white hats can go and rescue funds as they need and send the money to this entity. They have to send 100% of course and then that entity will be focused on getting people to claim the money and they can do the goal is to do it without KYC so the white hat can truly

be anonymous but still get bounties but only as people claim the money back. The legal entity can't touch the the capital without it being claimed. And that's the kind of incentive alignment we need. And so if you know any lawyers that are really having fun making international you know entities, hopefully we can get that initiative funded and then I think that problem would actually be very well solved. >> [music]