Understanding the Web3 Bounty Ecosystem w/ Brian Pak from Theori

Transcript

foreign welcome back to the roll up today we are here with our friend Brian from chain light um co-founder and CEO of chain light as well as Theory uh so we're gonna be we're going to be talking about uh Theory as a bigger picture what what the vision is and then diving a little bit deeper into chain light and before we started this recording we were talking about some conferences uh because I think today is the first day of permissionless and token 2049 is happening either today or tomorrow um can't get keep these time zones straight so yeah all over the world

conferences are happening whether you want to call it a bear Market or not people are building and um and you mentioned that the team is a bit spread out um across the United States and the rest of the world so I think that's a really great approach for conferences it's like a divide and conquer um and then you mentioned your team was able to kind of recap and share so that everyone gets a taste yeah exactly oh yeah we got a recap from the Stanford one the other day um hopefully we'll get another one from permissionless I think our CTO is going to be there so yeah cool so so maybe we could start like tell us a little bit about the team you know you mentioned your CTO your co-founder and CEO so like what what is kind of the dynamic across

the team how big is the team and what do you guys tend to do and and generally what do you what are you guys Building Together yeah um so we are so I'm a CEO but I also come from the very technical research-based uh background so I'm probably not the best uh executive officer to be honest but I pretend to be one um so our company name is Theory as you uh introduced and we built a new and special Brands display for web3 so we do a lot of stuff other than web3 or we do traditional security with the Consulting business we also have educational platforms and uh and so on but we focused on web3 under the name of chain

light um like shining the light like a guiding beacon in web 3 ocean is what we're kind of thinking of when we came up the name um and chain light is basically a team of what we call full stack web3 experts they're making the ecosystem safer so we don't just look at smart contracts but capable of you know referring literally every aspect and layers that make web 3 possible so that includes web to front-end back-end you know infrastructure Cloud node security uh Financial engineering point of view so we've audited you know a bunch of main Nets um l2s we also audited a lot of smart contracts so yeah um just any random things that make web3 safer oh

we're on it cool can you name drop a couple of the projects that you guys have worked with and help help audit yeah um so we recently finished the audit of the blend um it's the nft lending protocol from blur uh we also audited the blur itself when they're optimizing it for uh gas optimizations and stuff um and we also looked at the Clayton it's one of the mainnet popular in Korea uh we recently did the L2 called chroma Network um that uses the ZK for fault proof um it's optimistic roll up with the ZK uh with foolproof so that was interesting

stuff A lot of people are moving into whole zero knowledge technology and we've been you know auditing a lot of those too and I guess a little bit of uh our history um is that actual way before ethereum was this popular right this is like ethereum has become the the major uh L1 but before it was popular our team has reported to the ethereum foundation a couple of vulnerabilities in ethereum node implementation so back then it was Geth that was the pretty much the only implementation and that will cause it to bring down the entire network um so when you think about it right now I guess it's insane and invest you don't

have a headphone but back then we were able to find a couple bugs that would cause that um so we got the bug Bounty back then and it was about twenty thousand dollars worth of ethereum um yeah but but what what era was this so I'd say it was like around 2016 2017 uh very totally on three thousand dollars worth of eth when Eve was I know 2016. it was like 200 bucks or so yeah so we made a mistakes right yeah oh we made a mistake of you know kind of not sticking it to the East and you know changing it to Fiat back then but um only if we held it um yeah now we know

yeah exactly yeah the the we we Face a a similar Choice uh with the roll up where it's and and I think everyone in ethereum probably does it's like we all Gotta Eat Right like we gotta pay our bills especially the people who are working and building in ethereum but we all have this High conviction around if as a currency that it's this ultrasound money that's going to ten thousand dollars a token so like how do you it's a tough decision to reconcile that like when you are using it as a currency and Bitcoin has been faced with the same question all along it's like are these things stores of value are they currencies like how do you how do you reconcile as a CEO like

um your balance sheet right when you you have this belief in something that it is a store of value it's going to appreciate in price but you got to pay people um what are some of the trials and tribulations you face as a CEO that you you deal with on on this line of questions yeah um so obviously with um kind of running the companies in us and South Korea you kind of have to abide the regulations and law and especially the tax laws right so it's a lot cleaner and easier if you pay people in Fiat um so we kind of have this rule where we basically convert some of the um eth or

whatever tokens that we get paid with the Audits and other projects or bug bounties um some portion of that to enough to actually pay for our bills and our people but we still keep some of them in their native tokens so that way we kind of you know believe in that value going up and uh kind of trust in the project that sort of stuff yeah and and that way you start to build up this war chest um and especially during this bear Market where it almost seems like we're just in pure apathy right now like it's not it doesn't feel like bull or bear it just feels like there's like there's no movement like we're just like building in a silo like so in in these market conditions like prices are low but

they're they're stable but they're low um and it seems like the best time to start accumulating just accumulate because you're not losing that much because things everything is just kind of stagnant exactly but because prices are low they have the potential for appreciation so that that makes a lot of sense to start building that token War chest um so I'm curious like most of the business it sounds like is is hunting these bug bounties um which is really fun because I think it's like it's almost like you're a Headhunter you know like back in the wild like with the lines you're like going out your you know the the the men in the tribe are going out and hunting the animals and bringing them back for the for the try like what what is your approach to the

ecosystem bugs like what is what is that landscape look like and and I can give you some some context on this background it's like you know there's there's like immunify there's kind of these like projects out there that try to aggregate all of the bugs so that they're in one central place and then and then propose these bounties for them so is most of the theory to go onto these platforms and start to start to just kind of like whack down these bugs what is your approach to the landscape of projects when you start to hunt for bugs where do you normally go first yeah so um I'll be honest here uh we've been kind of unlucky with the bug Bounty

situations um as I mentioned with the ethereum case but it was more of a lucky case we got actually paid uh but we had some of the cases where we found the bug that are critical and we reported them but then it kind of collided with the whole bear market and like economies is crashing so some of the projects kind of just ran without paying us so like it kind of like we spent all this time and effort to find bugs and you know trying to make this uh ecosystem safer I guess we've made it safer but then we didn't really get compensated for it um so we I think kind of stopped doing bug bunnies recently and kind of hear it towards more auditing or actual contracts with uh customers uh there's there's still a business

there like there's still bugs and there is still value in those in those systems but but the the bug bounties are taking on a different different like Persona now right because yeah just look at the curve hack the other like this was maybe a couple weeks ago it's like these white white hats right that go in they find bugs and it sounds like that was kind of similar to the the approach but then instead of like bringing it to the attention of the project first they choose to actually exploit the project hold the project Ransom and then like all right you're gonna have to pay me to get your project back have you ever thought about maybe you can't maybe you

can't really you know but but it is it is like an interesting Dynamic that we've kind of found ourselves in where in order to to get paid like there are almost like these like this extra length that some of these hackers whether they start out as white hats or not they kind of go these extra this extra mile to ensure that they are taking seriously yeah um it's kind of sad that like it has to take that turn but um and we I personally and our team um don't really believe in that like that's the right way to do it so we never have actually tried it uh we always report it first to the vendor or

project Builders to get it sorted out first and then kind of they go try to negotiate and sometimes that goes well sometimes good goes south um but yeah I think it's very risky and dangerous um especially because you know like your basically as you mentioned it's it's basically Ransom at that point you're kind of threatening the project and all the people who are backing it or used to have funds in there as a ransom so like project owners or Builders don't really have a choice right like they'll kind of have to apply to like okay we'll pay you 10 or I guess the 10 became the norm um I feel like yeah I think so too

and um so yeah and then like they just give it back and take the 10 and just be happy I guess but I'm not sure if that's healthy um situation per se yeah it's it's not quite the ethical uh it yeah the ethical you know decision there is definitely questionable um there are I mean it is I don't wanna I don't want to make a case for blackmail so so maybe I'll spray away from arguing that like you know these people are better than the ones who actually exploit and then and then steal the funds but they're still not it doesn't feel right they're going about it the wrong way um I I feel like there is room here for

systems that put up some stake and they're like hey if I'm gonna if I'm gonna like have a protocol and I'm gonna put up a bug Bounty I have to stake some Capital so that bug bounty hunters go and and actually have insurance that their the money is there when they do find a bug and if it passes you know some Community consensus right and there's an oracle that says okay the community yeah this is a valid Bounty or to pay for this bug this is a valid bug that this this team found then the stake is released and the Bounty is paid and I think those Oracle systems are built right now because we do have on-chain insurance where there's like

this community consensus that arrives at you know should should this group be paid out their insurance money uh for some something that happened on chain so I think that infrastructure is there and maybe it just wasn't it it hasn't quite broken into the bug Bounty landscape yet but it's you you mentioned you kind of left that business behind um for a good reason it sounds like it isn't quite mature enough to have a real business so so when did the pivot happen and and kind of like what are you guys working on now that you've left the bug Bounty landscape in the rear view mirror yeah I guess bug bunny was never our main goal I guess end goal I was more of a like kind of proving our skill set

making sure that we find these bugs and you know kind of like a bounty was more of a byproduct that we could get on the way um and shortly after trying out bug bounties and finding bugs from Audits and whatnot we quickly turned to more of a scalable systems right like because we've been doing a lot of audits um there are only so many projects that we can do every year every month right with limited number of people number of you know resources so we were like how do we automate this uh process how do we scale so that way all these uh smart contracts and projects in the ecosystem can benefit from it

um with lower price um and you know faster a more scalable way and so we've been building a lot of internal tools to automatically find these vulnerabilities and simulate them and you know actually producing you know exploits that will prove that it is vulnerable and hopefully suggests ways to fix them awesome very cool yeah and it's again important it's it's the same vein is finding these bugs helping projects sort through those vulnerabilities and then and then executing them with the project behind the scenes um I think you know this kind of uh

folds into our contributor roll-up Theory where these businesses that are operating for multiple projects like ethereally it sounds like is almost like an internal audit support system that you guys can roll up into almost any project um so we we tend to see these projects and businesses that are like multi-faceted contributors some doubts have contributors that only contribute to this Dao other other projects tend to contribute to several Dows and I think there's there's lots of opportunities for collaboration and interoperability in in those sorts of styles so as you know a lot of our audience right

now is Builders because it is a very apathetic Market if you've survived up until this point dirt with these market conditions you're probably involved at some level with the ecosystem whether it's one project or it's several projects So speaking to the builders who are who are watching this video what do you suggest or what you know what advice can you give them for making sure and and being aware of the vulnerabilities that may exist in their project that they're not they're not readily ready to solve and fix themselves yeah um so obviously you know lots of tests when you develop stuff you're gonna make mistake like

we're human we're gonna make mistakes no one's perfect no code is perfect so kind of doubt yourself all the time it's I don't know if it's good for your mental health but um it's really good to kind of uh yeah just kind of doubt like always doubt and make sure things are correct um so lots of testing but we've seen a lot of cases as we're auditing that there are case test cases but they're usually not enough meaningful tests meaning that their edge cases that you could you know come up with but you're only testing the features that you know it's going to work so of course your Test's gonna uh pass but that's not enough to find these vulnerabilities or abnormal behaviors right so you should

you have to imagine the worst possible users using your product at the most evil attackers and hackers trying to attack your protocol so a lot of tests and secure coding guidelines there are some guidelines out there um I don't think it's you know very user friendly or developer friendly yet but we're building some of the tools that will help um developers you know abide by secure rules and secure coding guidelines um so that way they make less mistake they build better architecture uh build their designs um again it is good that developers do this and Builders are doing this but also always having other set of eyes to look at them is always helpful so getting audits

um is very useful um and then like you know just don't get one audit from one company probably get it from multiple if you can afford my cash but I think it's worth it at the end of the day especially if your project is going to be holding you know millions of dollars right um it's to save your uh basically users funds in a safe place and in the CI CD so continuous integration continuous development pipeline uh there are some tools to aim I bet the aim to help here but it's not good enough we feel like so we're building one as well and hopefully we'll be able to show off and have people use

them to make the ecosystem safer yeah that that peer review system of a continuous integration GitHub actions that that provide checks and balances super super important um because the old adage is even if you wanted to steal someone's funds and you couldn't that's the sign of a secure system um so so yeah almost like putting on your like hacker hat and thinking how can I break into this protocol is is like the best way to audit it right because then you know you have the intentions in mind that if you do find something you can fix it before it gets exploited yeah exactly yeah perfect so so Brian where can our

audience find you you know if you know their heads down building moving fast and breaking things and they're they don't have time to to fix you know the things that they break they should they should call you and then you your you and your team can go and audit uh some of the those holes uh where where can they find you um and what what's the best way to start um getting getting in touch yeah uh anyone can come to chainlight.io um that's our website um you can submit all the requests um I think we're launching a new product in two days um that's going to be risk assessment uh platform where people can come in where whether you be um cryptocurrency

exchange that are trying to figure out the risk of the tokens that you're about to list uh whether you're project builders that you have your own token you have your own smart contracts um that can basically upload and request automated Audits and automated risk assessment um there not only we look at the code security we also look at the on-chain data and events um that look suspicious and alert people so um chainlight.io is going to be our website you can also check out our Twitter uh chain light underscore IO so I guess we should call it X now yeah but yeah check them out on X uh cool chain light and and Theory

um very very important for the entire ecosystem I think there was something like four billion dollars in hacks last year so yeah yeah it's uh it's maturing past that you know move fast and great things but I think we've got a long way to go so uh thank you for the good work and keep it up um and thanks for coming on the show well thank you for inviting me it was a pleasure