Latest / Hardwired by AlphaWire / The Real Cost of Trust in DeFi - Fidesium

Transcript

The Real Cost of Trust in DeFi - Fidesium · Hardwired by AlphaWire

• 0:00
  SPEAKER_02: Hello, everybody.
• 0:01
  SPEAKER_02: Welcome to another episode of Hardwired.
• 0:03
  SPEAKER_02: Thank you very much, Abraham, for joining us.
• 0:06
  SPEAKER_02: Hi, everyone.
• 0:07
  SPEAKER_02: Hi Harry.
• 0:08
  SPEAKER_02: Thanks for having me.
• 0:09
  SPEAKER_02: So I always like to start these off with just tell me a little bit about yourself.
• 0:14
  SPEAKER_02: How did you get to where you are today?
• 0:16
  SPEAKER_02: Sort of following on from that, how did you get into crypto?
• 0:18
  SPEAKER_02: But give us a little insight into sort of Abraham's journey to where you are now.
• 0:24
  SPEAKER_00: So hi everyone.
• 0:25
  SPEAKER_00: Like Harry said, my name's Abraham.
• 0:27
  SPEAKER_00: I've been in tech for coming up in two decades now, primarily in startup land.
• 0:32
  SPEAKER_00: You know, started my career out in San Francisco, live in London now.
• 0:36
  SPEAKER_00: And I've been in crypto off and on since the very early days.
• 0:40
  SPEAKER_00: I actually mined Bitcoin on my laptop back in like 20, oh God, I want to say 12, uh, for let's call it libertarian reasons.
• 0:49
  SPEAKER_00: But I got into the space in earnest uh in the 2021 bull market, you know, had spare cash sitting around and nothing better to do with my life.
• 1:00
  SPEAKER_00: So started trading, started degening, enjoyed my time immensely, made money, lost money.
• 1:05
  SPEAKER_00: Uh, but in the process, kind of realized that a lot of the um security landscape, which I'd been taking for granted in Web 2, you know, uh real-time checks at build time, various integrations, developer tools that just exist and are standard practice.
• 1:23
  SPEAKER_00: No founder in Silicon Valley would dream of running a business without them.
• 1:27
  SPEAKER_00: Pretty much don't exist in Web3, or didn't, right?
• 1:30
  SPEAKER_00: Uh, and set out to fix that gap, plug it really, uh, and help this industry raise the bar on what it takes to attack a protocol.
• 1:42
  SPEAKER_00: And now I'm here.
• 1:43
  SPEAKER_02: Now you're here.
• 1:44
  SPEAKER_02: And I always I always like to say to people, sorry, what cycle do you get in?
• 1:48
  SPEAKER_02: Were you for 2014 or 17?
• 1:51
  SPEAKER_00: Um so I got in a couple of times, right?
• 1:56
  SPEAKER_00: So I got in the very, very first time in, I think it was 2012, mined a bit of Bitcoin.
• 2:01
  SPEAKER_00: Uh then I got into a couple of large caps in the 2017 cycle, uh, and then got into the broader Web3 ecosystem, let's call it, in the 2021 cycle.
• 2:14
  SPEAKER_02: And do you think it's well it obviously has changed, but what have you seen that's changed, I suppose, is uh is the thing I always like to ask.
• 2:21
  SPEAKER_02: Is you were kind of mining, I think like a bit like me, I was like in it in the 17 cycle from a trading point of view, but not really in the kind of Twitter sphere or X sphere as it is now called.
• 2:32
  SPEAKER_02: Like, but what have you seen that's changed?
• 2:34
  SPEAKER_02: Like how have you kind of perceived it differ?
• 2:37
  SPEAKER_00: So the 2017 cycle, I literally bought some large caps.
• 2:41
  SPEAKER_00: I bought some Bitcoin, I bought some Ethereum, I think I bought some XRP.
• 2:44
  SPEAKER_00: Uh, nothing, nothing crazy.
• 2:46
  SPEAKER_00: I bought and I held.
• 2:47
  SPEAKER_00: That's it.
• 2:48
  SPEAKER_00: Right?
• 2:48
  SPEAKER_00: I didn't even trade.
• 2:49
  SPEAKER_00: Uh so I wasn't super connected to the community or the ecosystem.
• 2:53
  SPEAKER_00: Uh I can say that from the original, like the 2012 era uh to now, the thing that really has changed, or even the 2021 cycle, the thing that's changed is uh there's much, much less of like a philosophical um bent to this place, right?
• 3:13
  SPEAKER_00: Like originally this was kind of almost like an anarchist collective of just like people who wanted to change the world.
• 3:21
  SPEAKER_00: Change the world in one way or the other.
• 3:23
  SPEAKER_00: Um 2021, it was it was still wearing a lot of those clothes, but under the hood it was just about a bunch of people trying to make as much money as possible.
• 3:34
  SPEAKER_00: Uh with generally mixed results.
• 3:38
  SPEAKER_00: Uh let's say, let's call it.
• 3:40
  SPEAKER_00: Uh and now, I mean, now the banks are here, now the institutions are here, it's an entirely different ballgame.
• 3:46
  SPEAKER_00: It is no longer the same industry that it was, you know, three, five years ago, let alone 15.
• 3:52
  SPEAKER_02: Yeah, no, I I can't say I disagree.
• 3:54
  SPEAKER_02: It's um it's quite a recurrent theme, but it's sort of two points I want to pick a pack pick apart there.
• 3:59
  SPEAKER_02: But quite a recurrent theme of a lot of people had a cycle where they just joined in, like they invested, or maybe they traded, and then the following cycle they got involved in the community, which is always kind of interesting.
• 4:10
  SPEAKER_02: I suppose it's like one of those like I suppose psychological things of like doing well in one cycle, maybe making some money, maybe just holding, and then seeing it come around again, and then going, Well, I'm kind of surprised it's come around again.
• 4:24
  SPEAKER_02: What actually's going on here?
• 4:26
  SPEAKER_02: Can I get involved in something?
• 4:28
  SPEAKER_02: And then I agree totally with your philosophical point about how it started off, or originally was much more evangelical's the wrong word, but it's the only word I can think of in terms of the core tenants of cryptocurrency or blockchain being much more important than just number go up or users or revenue or fees.
• 4:49
  SPEAKER_02: Whereas before it was what did this do that was innovative?
• 4:53
  SPEAKER_02: Now it's does it make any revenue or does it make any money?
• 4:57
  SPEAKER_02: Um which leads me quite nicely on to what are you doing at the minute?
• 5:02
  SPEAKER_02: What's the main focus of your time?
• 5:05
  SPEAKER_00: Yeah, absolutely.
• 5:06
  SPEAKER_00: So I'm uh founder and CTO at a company called Fidesium.
• 5:10
  SPEAKER_00: Uh we're an audit company and a uh deaf tooling house.
• 5:14
  SPEAKER_00: So fundamentally I spend my time separated between two uh angles, so very complementary.
• 5:20
  SPEAKER_00: One is I run audits for our customers, I review their code and I help them stay safe.
• 5:25
  SPEAKER_00: Uh and the other is I build and provide tooling, so SAST tooling specifically, uh, which is a kind of software that automates the discovery of bugs in other software, right?
• 5:38
  SPEAKER_00: And I resell that to often the same customers to help them stay safe while they build and maintain velocity.
• 5:45
  SPEAKER_02: Very, very interesting.
• 5:47
  SPEAKER_02: One thing that I think for maybe people that don't understand that area of would you call it cybersecurity, or would you call it tooling?
• 5:55
  SPEAKER_02: I suppose it's a bit of both, is what the hell is a manual audit?
• 5:59
  SPEAKER_02: Like in most simple terms, like if you've never come across it, you're not a developer, how would you describe it to somebody?
• 6:06
  SPEAKER_00: So at the highest possible level, uh what a manual audit is, is um you take a system, whether that be a software system, a hardware wallet, or indeed architecture diagrams for a bridge, right?
• 6:22
  SPEAKER_00: In principle.
• 6:23
  SPEAKER_00: Uh and then you have a qualified professional, somebody with expertise in that domain, and an understanding of how that domain can fail.
• 6:30
  SPEAKER_00: You know, whether it is your hardware wallet being hacked and your money stolen, whether it's somebody draining your liquidity pool in your DeFi protocol of choice, or whether it's your bridge collapsing and cars falling to the sea and looking for things that you might have missed while building it.
• 6:46
  SPEAKER_00: That's it.
• 6:47
  SPEAKER_00: At a 10,000-foot view, that's what an audit is.
• 6:51
  SPEAKER_00: And then obviously, as you drill down, there's a variety of techniques that apply.
• 6:54
  SPEAKER_02: So if we if we drill down a bit and take, let's say we take a smart contract for a lending protocol and the way in which they would run their uh their lending pools, like you would deposit whatever you wanted to deposit and you borrow whatever you wanted to borrow.
• 7:07
  SPEAKER_02: They came to you and said we'd like you to audit our code.
• 7:10
  SPEAKER_02: Can again try to keep it fairly like top level, but feel free to go into a bit more detail.
• 7:15
  SPEAKER_02: How would you explain that to somebody?
• 7:17
  SPEAKER_02: Like what are you doing for them?
• 7:18
  SPEAKER_02: What's the thing that some of the things that you're looking to protect them from?
• 7:23
  SPEAKER_00: Yeah, of course.
• 7:24
  SPEAKER_00: So um at a the thing I'm looking to protect them from, in particular lending pool, right, is a couple of things.
• 7:32
  SPEAKER_00: So one is somebody figuring it out, figuring out a way to uh withdraw more money than they are due in one way or another, right?
• 7:42
  SPEAKER_00: And there's a handful of ways this can happen, right?
• 7:44
  SPEAKER_00: Like but you can do it on both sides, either as a provider or the lender, but there are ways in which people attack lending pools and get more money.
• 7:53
  SPEAKER_00: Um or um the uh misbalancing and failure of underlying assets, right?
• 8:00
  SPEAKER_00: So obviously for a lending pool, especially uh in this space where you're high where things are highly volatile, I mean, even Bitcoin is down what near enough 50% against all-time highs at the moment, right?
• 8:14
  SPEAKER_00: Uh and that's Bitcoin, right?
• 8:16
  SPEAKER_00: If you're running a lending pool against Elon Doge Inu, uh those numbers are much wider, right?
• 8:24
  SPEAKER_00: So how do you kind of what invariants exist in the system?
• 8:28
  SPEAKER_00: And an invariant is a mathematical formula to expect to never change, uh, that you have to protect against in order to make sure that your protocol is solvent and nobody walks away with more money than they need to.
• 8:40
  SPEAKER_00: Uh and typically the kind of three uh most common angles for where this fails, right?
• 8:49
  SPEAKER_00: Uh is well, one is just failed invariant enforcement.
• 8:53
  SPEAKER_00: Through one way or another, you don't protect yourself sufficiently, and somebody figures out a way to just withdraw more money.
• 9:00
  SPEAKER_00: This happens.
• 9:02
  SPEAKER_00: Um two is um privilege escalation, right?
• 9:08
  SPEAKER_00: So typically most long-running stable DeFi protocols have some flavor of privileged roles, an owner, an admin or whatever, who has, in effect, emergency powers, uh, either responding to court orders these days, so or just general temporary freezes to debug or whatever, right?
• 9:26
  SPEAKER_00: Uh and if somebody were to figure out a way to escalate themselves to be such a privileged person, they could conceivably now have the rights to, I mean, in some cases, just withdraw the money, right?
• 9:40
  SPEAKER_00: Uh or the third one is, and this is very common kind of software, really, in general, but the weakest point of any software system is when he talks to other software systems, right?
• 9:51
  SPEAKER_00: Because you don't control those other software systems and you're implicitly trusting them.
• 9:55
  SPEAKER_00: For a lending pool, that's typically oracles, right?
• 9:58
  SPEAKER_00: So how do you how does a lending pool track the value of its underlying?
• 10:02
  SPEAKER_00: Uh, and depending on how much trust is put into that oracle and how that integration is run, you know, do you accept stale Oracle feeds?
• 10:11
  SPEAKER_00: Uh, do you run a consensus across multiple oracles?
• 10:15
  SPEAKER_00: How do you protect yourself from sudden spikes in the Oracle feed?
• 10:19
  SPEAKER_00: Um, those kinds of failures, and they can be uh, on the face of it, benign, right?
• 10:26
  SPEAKER_00: Like sometimes software makes mistakes, sometimes an Oracle will misreport data for largely no reason, uh, or put it, let's put it without an external attacker, right?
• 10:36
  SPEAKER_00: And if somebody just happens to be paying attention, they can abuse that.
• 10:40
  SPEAKER_00: Or sometimes attackers will deliberately uh inject malicious Oracle feeds or even malicious Oracle contracts that uh feed bad data to its customers.
• 10:51
  SPEAKER_00: Um Lazarus Group in North Korea runs this playbook fairly frequently.
• 10:56
  SPEAKER_00: In fact, this was part of the Calc Dow attack.
• 10:59
  SPEAKER_02: Well, that fair thank you for explaining that.
• 11:02
  SPEAKER_02: And I think it gave a very succinct description of kind of how it functions.
• 11:05
  SPEAKER_02: Maybe if you're not a developer or even an auditor, you might have got something from that.
• 11:10
  SPEAKER_02: But it leads me very nicely on to talking about the state of crypto security and blockchain security as it stands, as I'm sure you have many, many opinions out.
• 11:19
  SPEAKER_02: But to give a bit of a top-level overview from myself, and please correct me if I get any of this wrong.
• 11:25
  SPEAKER_02: We've had absolutely loads of exploits, hacks, operational security failures, physical security failures, code security failures.
• 11:35
  SPEAKER_02: Like we could spend probably the next four hours discussing what's gone on, but let's start with Kelp DAO.
• 11:40
  SPEAKER_02: Like, so tell me a bit about what happened there, but give me an overview of like what Kelp DAO is before you just go into like what happened so people have a bit of a framing.
• 11:49
  SPEAKER_02: I'm sure you may be furiously googling away just to get there.
• 11:52
  SPEAKER_00: I'm Googling, I can't quite remember.
• 11:54
  SPEAKER_00: Oh, right, got it.
• 11:55
  SPEAKER_00: Okay.
• 11:55
  SPEAKER_00: So Kelp Dow was a re-staking protocol.
• 11:58
  SPEAKER_00: Uh so fundamentally it allows you to take staked assets and stake them again for additional profit, like in a nut in a nutshell.
• 12:05
  SPEAKER_00: Uh and uh one of the external systems that was trusted by Kelp Dow was uh Layer Zero's bridging infrastructure, which allowed you to effectively move these wrapped assets between chains.
• 12:18
  SPEAKER_00: Uh and what the Lazarus group in particular, this North Korean hacking group, who I haven't seen the latest numbers.
• 12:26
  SPEAKER_00: I know that three years ago they were responsible for something on the order of 75% of crypto hacks.
• 12:34
  SPEAKER_00: Uh I don't know if that number still stands, but I do see them come up all the time.
• 12:39
  SPEAKER_00: So take that as you will.
• 12:42
  SPEAKER_00: Anyway, uh so they targeted the bridge, right?
• 12:45
  SPEAKER_00: The external system that was responsible for bridging those assets, which ultimately let them walk away with I think it was about$300 million of Kelp Dow's money.
• 12:56
  SPEAKER_02: It's a big number.
• 12:57
  SPEAKER_02: Yeah, it's a big number.
• 13:00
  SPEAKER_02: So in that in that one, they what did they actually do?
• 13:06
  SPEAKER_02: They they basically somehow info.
• 13:08
  SPEAKER_02: Didn't they have somebody working on the inside that allowed them to get control of it?
• 13:11
  SPEAKER_00: No, that would that that was Drift Protocol.
• 13:13
  SPEAKER_00: That was Drift.
• 13:14
  SPEAKER_00: Yeah, yeah.
• 13:14
  SPEAKER_00: No, so at Calp Dow, they didn't have an A insider, but they managed to well, they stood up malicious RPC nodes.
• 13:21
  SPEAKER_00: So an RPC node, for anybody who doesn't know, is a node that reads data from the blockchain and presents it to you at like 10,000 foot fee, right?
• 13:30
  SPEAKER_00: So they stood up malicious RPC nodes, uh, got layer zero to accept those RPC nodes, and then use them, use them to feed bad data into the protocol itself, uh, allowing them to effectively withdraw money they didn't know.
• 13:45
  SPEAKER_00: Right.
• 13:47
  SPEAKER_02: It's a dangerous, dangerous world out there.
• 13:49
  SPEAKER_02: You've got to be so on top of all of the attack vectors now in DeFi.
• 13:52
  SPEAKER_02: Yeah.
• 13:53
  SPEAKER_02: If you're especially if you're running something with north of 100 million in TVL, it just becomes almost impossible to not do some of these things, I suppose, without facing sort of unbelievable risk.
• 14:05
  SPEAKER_02: Yeah.
• 14:07
  SPEAKER_02: Yeah.
• 14:07
  SPEAKER_02: Go on, do you want to say something?
• 14:09
  SPEAKER_00: No, look, I was just gonna say that uh look, the numbers are huge, right?
• 14:13
  SPEAKER_00: Uh$300 million is a a lot of money.
• 14:16
  SPEAKER_00: Uh, but fundamentally, this is not actually a new failure mode, right?
• 14:21
  SPEAKER_00: Like if you really strip everything away, uh, what went wrong is they trusted an external system they didn't control with no verification.
• 14:29
  SPEAKER_00: That's it.
• 14:30
  SPEAKER_00: That's that's the headline finding right there.
• 14:33
  SPEAKER_00: So in general, any time you integrate with an external system, whether it be a bridge, an Oracle, an RPC node, uh anything that you do not directly control, tr verify.
• 14:47
  SPEAKER_00: You know, don't just trust the DALPA blindly.
• 14:51
  SPEAKER_02: I can't say I disagree.
• 14:53
  SPEAKER_02: And then on the other side of things, so that's when the function, the way in which the protocol, the application function gets messed around with in its most simple terms, and therefore injected with some malicious code, or they give it the wrong feed, which makes the maths break, which allows you to do things you shouldn't.
• 15:12
  SPEAKER_02: But on the other side of that failure is what I believe is called operational security.
• 15:17
  SPEAKER_02: So that's when somebody has administrative powers over a contract to do something, maybe in exceptional circumstances, or to change something in the in the way in which protocol runs.
• 15:28
  SPEAKER_02: Can you run me through just how that functions and maybe where things have gone wrong in the past?
• 15:34
  SPEAKER_00: Of course.
• 15:35
  SPEAKER_00: So the first thing to say here is so yes, it's you're referring to OPSEC operational security, right?
• 15:41
  SPEAKER_00: Uh and the kind of knee-jerk reaction here might be to say, well, actually, in a decentralized, trustless world, nobody should have admin rights.
• 15:50
  SPEAKER_00: Uh and while that aligns very well with the um foundational ethos of the space, let's call it, uh, given the um amount of money that is now circulating in the ecosystem and the regulatory pressure that these protocols are facing, um the ability to respond to such circumstances is no longer optional, right?
• 16:15
  SPEAKER_00: So the hand-wavy, oh well, just don't have admins, it sounds great.
• 16:20
  SPEAKER_00: And I guess if you're buying pump.fun coins, that's probably what you want.
• 16:25
  SPEAKER_00: Uh but if Aave didn't have admins, they would no longer be allowed to operate today.
• 16:30
  SPEAKER_00: It's that simple, right?
• 16:32
  SPEAKER_00: Uh so we have to accept, unfortunately, that privileged roles are going to be exist, going to exist, which, by the way, isn't actually different to any other financial product you use outside of crypto, right?
• 16:48
  SPEAKER_00: Every time you log into your Halifax or Chase or whatever, there exists somewhere an admin with the ability to see your data, edit your data, etc.
• 16:58
  SPEAKER_00: Right?
• 16:59
  SPEAKER_00: You're ultimately trusting a third party.
• 17:02
  SPEAKER_00: Now, the thing that's important is how those roles are protected, right?
• 17:08
  SPEAKER_00: So, first of all, exactly what process exists at the organization, what what the playbook is for this sort of privilege escalation?
• 17:18
  SPEAKER_00: And I mean the internal privilege escalation, right?
• 17:20
  SPEAKER_00: Can a sysadmin literally just log in on their laptop and move your money around?
• 17:25
  SPEAKER_00: This is bad.
• 17:27
  SPEAKER_00: Right.
• 17:28
  SPEAKER_00: Uh is there a um collective, like a sharded uh multi-sig wallet controlled by several people, some of which might be, say, a board observer, uh, who generate a provable audit log and have to go through some flavor of governance vote, this is better.
• 17:49
  SPEAKER_00: Right?
• 17:50
  SPEAKER_00: So, and I think one of the things that uh a lot of this space kind of neglects, really, and something that we we help people with at Fidesium is auditing that side of the business, right?
• 18:04
  SPEAKER_00: So the code will ultimately only tell us so much, right?
• 18:08
  SPEAKER_00: Yes, there is an admin role, but how it's held is important, right?
• 18:12
  SPEAKER_00: So I would generally encourage uh anybody who is either running software, running a protocol in this space, or interacting with one to provide this uh process documentation, get that audited and certified in and of itself.
• 18:29
  SPEAKER_00: And if you're looking to deploy capital, I would not trust a protocol that does not do the above, right?
• 18:37
  SPEAKER_00: Uh and then the last part of OPSEC really is um well, just standard kind of like being security conscious in an online world, right?
• 18:51
  SPEAKER_00: Anytime anybody sends you a link on Telegram, I mean, first of all, I probably just wouldn't click it.
• 18:58
  SPEAKER_00: Uh but certainly, you know, right-click it, make sure you get the source URL because you can mask the URL.
• 19:05
  SPEAKER_00: Uh run it through a uh homoglyph checker.
• 19:08
  SPEAKER_00: So homoglyph attacks are where you use a Cyrillic A in the URL.
• 19:13
  SPEAKER_00: So it's Cyrillic Aave.com, right?
• 19:16
  SPEAKER_00: Which looks identical to the real thing, but isn't.
• 19:20
  SPEAKER_00: Um anytime you approve anything in your wallet, actually read the approval notification.
• 19:26
  SPEAKER_00: Uh anytime you receive an email, look for signs of phish.
• 19:31
  SPEAKER_00: They're pretty they're honestly not that different in Web3 than they are in traditional landscape, right?
• 19:37
  SPEAKER_00: Um is the URL weird?
• 19:40
  SPEAKER_00: Are they asking you to go out of band and call them?
• 19:44
  SPEAKER_00: Are they asking you to send them any money?
• 19:46
  SPEAKER_00: Are there any weird typos that you wouldn't expect from an organization of this caliber?
• 19:50
  SPEAKER_00: Uh those sorts of things, right?
• 19:53
  SPEAKER_00: Um that is also very much OPSEC, and that is just a function of internal training, right?
• 19:59
  SPEAKER_00: People at the organization have to have clear documentation for what to look for, how to act, and how to identify breaches.
• 20:07
  SPEAKER_02: Interesting.
• 20:08
  SPEAKER_02: So to kind of split out the sections that people need to sort of be aware of, there is auditing the code, looking at the way in which the code functions, can people, in the very simplest terms, mess with the maths of how it should function, either by doing funny things or changing things or interacting with the application in a very, very maybe non-standard way?
• 20:31
  SPEAKER_02: There's then like the operational security of can I either get somebody's keys, impersonate them, get control or admin rights that I shouldn't be able to.
• 20:40
  SPEAKER_02: Are there any other areas that you'd be considering in terms of like your security from a protocol point of view or application point of view?
• 20:51
  SPEAKER_00: Um, so I think the other thing worth considering from a protocol point of view is um what the interactivity service looks like, right?
• 21:00
  SPEAKER_00: So typically most smart contracts will be interactable with in two ways.
• 21:05
  SPEAKER_00: Uh, one is by going directly on Etherscan and just running commands.
• 21:11
  SPEAKER_00: Uh, and one is through whatever DAPs you have built, so applications that talk to your smart contracts.
• 21:18
  SPEAKER_00: Uh both of those are threat vectors and both of those are worth modeling and considering, right?
• 21:22
  SPEAKER_00: Always think about the surface where your software touches other software or real users, because that's ultimately where attacks are gonna happen.
• 21:32
  SPEAKER_00: Um so the the first thing, honestly, that I I mean, this is the first thing any auditor will do, and this is the first thing that I think every so everybody building software should do, is draw it.
• 21:45
  SPEAKER_00: Right?
• 21:45
  SPEAKER_00: Take a pen, take a piece of paper, draw your surface, connect lines on it, and see if there's any lines that you can delete.
• 21:54
  SPEAKER_00: Right?
• 21:55
  SPEAKER_00: If there are components speaking to each other, that's a risk vector.
• 22:00
  SPEAKER_00: So why are they speaking to each other and what would happen if they stopped?
• 22:03
  SPEAKER_00: That's it.
• 22:03
  SPEAKER_00: That's that's the first thing that I would suggest everybody do.
• 22:08
  SPEAKER_00: Um it's it's annoying.
• 22:11
  SPEAKER_00: It kind of takes time.
• 22:12
  SPEAKER_00: You can speed it up a little bit with AI, but obviously the problem with AI is that it hallucinates.
• 22:18
  SPEAKER_00: So you have no guarantee that the thing that it gives you is right.
• 22:21
  SPEAKER_00: Uh the job kind of changes from valid from drawing from first principles to validating what it has drawn.
• 22:27
  SPEAKER_00: Um and then the second thing I would encourage everybody to think about, um, and by everybody here, I mean developers, people running Web3 companies, right?
• 22:38
  SPEAKER_00: Uh for your system to keep functioning, for your system to remain profitable, remain solvent, uh, what mathematical truths are you are you assuming, right?
• 22:52
  SPEAKER_00: What what does solvency look like?
• 22:55
  SPEAKER_00: How would it break?
• 22:56
  SPEAKER_00: Right?
• 22:57
  SPEAKER_00: Uh and typically it's basically money out more than money in, to simplify, but drill in, drill into the details of your specific calculations, how are LP tokens computed, uh, how do you compute somebody's borrowing capacity, et cetera, et cetera, et cetera.
• 23:13
  SPEAKER_00: Model it, write down the mathematical formulas, and then hunt through your code for anything that touches any value, any value in that formula.
• 23:24
  SPEAKER_00: That's it.
• 23:27
  SPEAKER_02: Interesting.
• 23:28
  SPEAKER_02: It's a it's a wild west out there to kind of think of all this stuff when you I suppose I come at it from a slightly different angle.
• 23:34
  SPEAKER_02: Like I don't build smart contracts, I work with companies that do.
• 23:38
  SPEAKER_02: Um, and I usually refer to somebody like yourself when I have these questions.
• 23:42
  SPEAKER_02: But it is a dangerous world of a mess that you've got to kind of figure it all out and make sure that you're not coming a cropper of any of these problems.
• 23:50
  SPEAKER_02: And I suppose the goalposts are constantly moving forward as people come up with innovative and more weird and wonderful ways to take over things or explore.
• 23:59
  SPEAKER_00: I mean, yeah.
• 24:01
  SPEAKER_00: I think the honor the honest truth is the same as it's always been in cybersecurity.
• 24:05
  SPEAKER_00: It's fundamentally an arms race, right?
• 24:07
  SPEAKER_00: Uh there are people like myself who are researching the space with a view to try and protect people.
• 24:13
  SPEAKER_00: Uh for every one of me, there's a guy in a basement somewhere in North Korea thinking about it from the opposite angle.
• 24:19
  SPEAKER_00: Uh sometimes I win, sometimes he wins.
• 24:22
  SPEAKER_00: It's it is it's just the way of the world.
• 24:25
  SPEAKER_00: Um but one thing that I will say is um in general, and this has become worse, not better, in the world of AI, right?
• 24:36
  SPEAKER_00: Uh what you want to be is a hard target.
• 24:40
  SPEAKER_00: Right.
• 24:41
  SPEAKER_00: Uh people are out there scanning for vulnerabilities, looking for mistakes.
• 24:47
  SPEAKER_00: Uh you want to make the attacker's life as difficult as possible, because chances are he'll just move on to somebody else.
• 24:55
  SPEAKER_00: Certainly until you hit billions of, you know.
• 24:58
  SPEAKER_00: If you have over a billion dollars in your protocol, you're just you're just a target.
• 25:03
  SPEAKER_00: That's it.
• 25:04
  SPEAKER_00: Uh but if you're a smaller protocol, make yourself as hard to attack as possible.
• 25:10
  SPEAKER_00: Like defense in depth is a term.
• 25:13
  SPEAKER_00: Uh so the uh basically what that means is assume for any defense you put in place, assume it's going to fail.
• 25:21
  SPEAKER_00: So defend at every single possible level of your system.
• 25:24
  SPEAKER_00: You know, defend the front end, defend the back end, defend the smart contract ingestion, defend every single function in your smart contract.
• 25:31
  SPEAKER_00: Every point is going to fail.
• 25:33
  SPEAKER_00: Defend every point.
• 25:36
  SPEAKER_02: So, where where do you think the space is going next in both terms of people building smart contracts and building applications and how they're going to protect them?
• 25:46
  SPEAKER_00: Yeah, absolutely.
• 25:47
  SPEAKER_00: So uh people building smart contracts and people building applications.
• 25:50
  SPEAKER_00: I mean, this is probably gonna be a somewhat boring answer, if I'm honest.
• 25:55
  SPEAKER_00: Uh, but I think the story of the moment is institutional adoption, for better or worse, is finally here.
• 26:03
  SPEAKER_00: And we're gonna see a tighter and tighter integration between what we would have historically called tried Fi and the blockchain ecosystem.
• 26:10
  SPEAKER_00: And people are gonna build more and more apps targeting kind of that niche.
• 26:14
  SPEAKER_00: Whether that be well, I mean, RWAs are the easy answer, and the one everybody talks about, you know, kind of effectively fractionalizing ownership over traditional assets, right?
• 26:25
  SPEAKER_00: Uh I'm sure there are more along the same line.
• 26:28
  SPEAKER_00: Uh I think reconciliation in the banking space is probably an interesting target.
• 26:33
  SPEAKER_00: Um I think insurance claims and insurance claims remediation is probably overdue rework after however many centuries it's been.
• 26:43
  SPEAKER_00: Uh I'm sure there's others, right?
• 26:45
  SPEAKER_00: Any traditional financial domain where a public, provable, auditable ledger of individual steps is valuable is a target.
• 26:54
  SPEAKER_00: Uh and when I say target, I don't necessarily mean that, you know, three scrappy dudes in a basement are going to rebuild it.
• 27:02
  SPEAKER_00: I think that'll happen sometimes.
• 27:04
  SPEAKER_00: Uh but I actually think more of the time the traditional institutions are going to just lean on the new technology and do it in-house themselves.
• 27:12
  SPEAKER_00: Yeah.
• 27:13
  SPEAKER_00: Um better or worse, I don't know, no value judgment.
• 27:18
  SPEAKER_00: It's different.
• 27:19
  SPEAKER_00: Um but so on the security side, I think a couple of things are shifting, right?
• 27:25
  SPEAKER_00: I think there's a couple, there's a bit of a perfect storm happening in the security space in general.
• 27:30
  SPEAKER_00: Um so first of all, I think um, well, it's fair to say that AI models have reduced the cost of hunting of hunting vulnerabilities, right?
• 27:42
  SPEAKER_00: Uh so historically, bug hunting, vulnerability hunting was a reserved, difficult to acquire manual skill set.
• 27:51
  SPEAKER_00: And that's, to be honest, to some extent still true.
• 27:55
  SPEAKER_00: Uh but um using AI models, uh the uh speed at which that skill can be applied has decreased.
• 28:05
  SPEAKER_00: Uh and it's important to note that does not only apply to me, that applies to the aforementioned gentleman in North Korea as well.
• 28:13
  SPEAKER_00: Right.
• 28:14
  SPEAKER_00: Now, what I don't want to do here is oversell AI, right?
• 28:17
  SPEAKER_00: Like I've we've all seen the news stories, you know, AI labs, AI escapes containment, hacks however many pieces of software, Mythos identifies however many vulnerabilities they said it found.
• 28:31
  SPEAKER_00: I for I forget now.
• 28:32
  SPEAKER_00: Some obscene number, right?
• 28:34
  SPEAKER_00: Uh I think it's um fair to say that some of that is um very clever marketing.
• 28:43
  SPEAKER_00: Uh I think the easiest place to point at is um curl.
• 28:47
  SPEAKER_00: So curl, for anyone who doesn't know, is a piece of software that developers use to fetch data from their computer without using a browser.
• 29:00
  SPEAKER_00: Just summarizing.
• 29:02
  SPEAKER_00: And uh the initial claim was that Mythos found uh, I think it was three criticals in the software.
• 29:07
  SPEAKER_00: Uh curl went, and it's been in use for like 40 years, right?
• 29:11
  SPEAKER_00: 30, 40 years.
• 29:12
  SPEAKER_00: Uh one of the best audited pieces of code on the planet.
• 29:16
  SPEAKER_00: So um curl went through the findings.
• 29:21
  SPEAKER_00: Um all three were false positives.
• 29:24
  SPEAKER_00: Uh a false positive is a finding that is reported but isn't real.
• 29:28
  SPEAKER_00: Um there was a low, like a low-risk security issue that was real.
• 29:36
  SPEAKER_00: Um, which isn't nothing, right?
• 29:38
  SPEAKER_00: Like somebody feel like the agent found a real security vulnerability.
• 29:42
  SPEAKER_00: That's not nothing.
• 29:43
  SPEAKER_00: Uh it's also not quite the earth-shattering world-ending result being touted by anthropic, right?
• 29:50
  SPEAKER_00: So I think the honest statement to make here is that um the cost of security research for a qualified human has reduced.
• 29:59
  SPEAKER_00: Uh the cost for running set agent, by the way, anthropic half-shared, uh, was on the order of$20,000 per target repository.
• 30:10
  SPEAKER_00: Uh, which is I mean, it depends on what you're comparing it to, right?
• 30:14
  SPEAKER_00: Like if you're comparing it to a team of six hackers in Langley somewhere running for six months, yeah, that's dirt.
• 30:22
  SPEAKER_00: That's that's that's dirt cheap.
• 30:24
  SPEAKER_00: Uh if you're comparing it to the funds available to most startups, it's it's not dirt cheap, right?
• 30:33
  SPEAKER_00: Um so I think that's one thing, right?
• 30:35
  SPEAKER_00: Uh and uh as uh these models get better, and they will continue to get better, although it is again unclear how fast that's gonna happen, right?
• 30:46
  SPEAKER_00: Um defense and depth will become more and more important.
• 30:50
  SPEAKER_00: And I think uh that takes a few shapes.
• 30:53
  SPEAKER_00: Uh the first is you gotta harden your OPSEC.
• 30:57
  SPEAKER_00: Just in general, you gotta harden your OPSEC.
• 31:00
  SPEAKER_00: Uh, don't click links you don't trust, etc.
• 31:03
  SPEAKER_00: We talked about this a minute ago.
• 31:04
  SPEAKER_00: Uh and the second is that fundamentally you gotta start running your own tools to protect yourself in real time, right?
• 31:12
  SPEAKER_00: That's monitoring, that's code level scanning.
• 31:14
  SPEAKER_00: Manual audits are great.
• 31:16
  SPEAKER_00: They're super valuable.
• 31:17
  SPEAKER_00: I you know, I do them.
• 31:19
  SPEAKER_00: I have saved our customers from pretty exceptional hacks.
• 31:23
  SPEAKER_00: Uh but on their own, they're in the thing.
• 31:27
  SPEAKER_00: They're not the only thing.
• 31:31
  SPEAKER_02: But even then it was a bit of a risk.
• 31:33
  SPEAKER_02: But the the sophistication of the people that are trying to get at these protocols has just increased and increased and increased.
• 31:42
  SPEAKER_00: And I think it correlates to another thing as well, right?
• 31:45
  SPEAKER_00: Uh the space is no longer just like ideological purists who edit for the love of the game.
• 31:51
  SPEAKER_00: Uh there is incre and by this this time I mean web 3 as a space, right?
• 31:55
  SPEAKER_00: There's an increasing migration of uh Web2 engineers into the space.
• 31:59
  SPEAKER_00: More and more people are building who might have built in the past in other spaces.
• 32:04
  SPEAKER_00: Uh the big institutions we've touched on already, uh, who are fundamentally not, in fact, Web3 companies, right?
• 32:10
  SPEAKER_00: They're just yeah.
• 32:11
  SPEAKER_00: I mean, even calling them tech companies is probably generous.
• 32:14
  SPEAKER_00: Uh so um they're used to a very different life cycle, right?
• 32:20
  SPEAKER_00: A life cycle of software where you make changes, you ship, you see if it works, you change it, you tweak it.
• 32:26
  SPEAKER_00: Uh the idea of a forever immutable contract is somewhat out of date.
• 32:33
  SPEAKER_00: In fact, has been for a while now, right?
• 32:35
  SPEAKER_00: With proxy contracts.
• 32:36
  SPEAKER_00: Uh, and in that space, uh nobody can afford a manual audit on every single change.
• 32:44
  SPEAKER_00: It just can't be done, right?
• 32:45
  SPEAKER_00: I mean, it's just the numbers become silly quickly.
• 32:49
  SPEAKER_00: So the question is really, one, how do you keep yourself safe while you're making smaller changes?
• 32:57
  SPEAKER_00: What automations, what tooling can you apply?
• 33:01
  SPEAKER_00: And two, how do you know when it's time for another manual audit?
• 33:07
  SPEAKER_00: Uh, and again, like there's an easy answer, which is, oh, we do it once a year or once every six months, or whatever, which is better than nothing.
• 33:16
  SPEAKER_00: But really, what you should be thinking about is um how much has the system under tests changed, right?
• 33:24
  SPEAKER_00: Have you integrated with three new Oracle providers and added a perpetual swap to your decks?
• 33:34
  SPEAKER_00: Yeah, you should probably get another audit.
• 33:36
  SPEAKER_00: Have you, I don't know, uh, slightly changed the math on how an LP token computes?
• 33:44
  SPEAKER_00: Yeah, maybe you can maybe you can just lead on automated systems, right?
• 33:48
  SPEAKER_00: Uh that risk register needs to be in-house.
• 33:52
  SPEAKER_00: We help people build it for themselves, like build it for our customers.
• 33:55
  SPEAKER_00: Um it'll vary, obviously, with um, well, with two things, right?
• 34:01
  SPEAKER_00: With exactly what kind of business you run and uh how much money it is you're sitting on, right?
• 34:06
  SPEAKER_00: Uh again, not because, oh, if you have more money, you can pay auditors, although that is true.
• 34:13
  SPEAKER_00: Uh it's more, if you have more money, you're a higher priority target, right?
• 34:17
  SPEAKER_00: So every change is just higher is just higher priority.
• 34:22
  SPEAKER_00: So I think those two things together, you know, the rise of AI and uh the influx of non-Web3 natives effectively, um change the landscape and have to change the methodology of security.
• 34:37
  SPEAKER_02: I think there's gonna be quite a litany of problems that companies that are doing things in web 3 because they've never kind of interacted with blockchain and the rules in which that you need to instill in the way that you develop and test and protect yourself from exploits, they're gonna make the same mistakes everybody else did the first time around and more, which is kind of a little bit disheartening.
• 35:03
  SPEAKER_02: But I don't think this other than education and drilling it into people's head, I don't think there's really a way around it, is there?
• 35:08
  SPEAKER_00: No, and I think it's actually I think you're underselling the problem there as well, right?
• 35:12
  SPEAKER_00: Like I think the other side of this is we've touched on the eye a bit on this call already, but the other thing to just be honest about is that people are vibe coding.
• 35:21
  SPEAKER_00: Just the a lot of people are just trusting an AI to generate code for them.
• 35:27
  SPEAKER_00: Um and look, if you get an AI to build you a blog, and that blog gets taken over by an attacker because the AI stored some sort of key in plain text, that's obviously bad, but ultimately not that big a deal.
• 35:49
  SPEAKER_00: If you vibe code a lending protocol and the AI just uh trusts the external oracle with no verification, you've just allowed an attacker to rinse you for everything you have.
• 36:05
  SPEAKER_00: And um look, uh vibecoding is here to stay.
• 36:11
  SPEAKER_00: People are going to use AI to write software.
• 36:15
  SPEAKER_00: Uh railing against it is uh largely not productive.
• 36:20
  SPEAKER_00: Uh what I'd think um Web3 is a incredibly poor fit for is pure vibe coding, right?
• 36:29
  SPEAKER_00: People who literally just ask an AI agent to build them a thing and run it.
• 36:33
  SPEAKER_00: Sure, lean on your AI, get it let it build stuff for you, but you gotta review the code, you gotta build tests, and you gotta really think about what it's getting built, which is less gram less glamorous, slower, but if you don't do it, you're gonna get hacked.
• 36:51
  SPEAKER_00: End of.
• 36:52
  SPEAKER_02: Yeah, you you run the risk, don't you?
• 36:56
  SPEAKER_02: Dangerous times ahead for the for the security world, I suppose.
• 37:00
  SPEAKER_02: There's gonna be a lot to a lot to sort out.
• 37:02
  SPEAKER_02: What are you I suppose what are you excited about and what are you fearful before I kind of ask closing statements?
• 37:10
  SPEAKER_02: What am I excited about what I'm fearful?
• 37:12
  SPEAKER_00: Um So I am excited about um the I mean it's it's weird, right?
• 37:27
  SPEAKER_00: So I'm excited and fearful about two things and they're both the same thing.
• 37:32
  SPEAKER_00: Uh so I'm excited about the uh power being put into our hands by the aforementioned AI.
• 37:40
  SPEAKER_00: It has certainly made my life easier.
• 37:43
  SPEAKER_00: Um I'm also fearful of people leaning on that power uh not applying manual checks on it, whether it be on the by-coded side or worse, on the audit side.
• 37:58
  SPEAKER_00: Uh and um the sorts of vulnerabilities that remain open as a result.
• 38:04
  SPEAKER_00: Um the second side is the institutional adoption piece.
• 38:08
  SPEAKER_00: I'm very happy the big banks are here.
• 38:10
  SPEAKER_00: I think it's had to happen eventually.
• 38:13
  SPEAKER_00: I'm also somewhat worried about what the landscape will look like in uh five to ten years because to be blunt, I like crypto Twitter.
• 38:24
  SPEAKER_02: Yeah.
• 38:25
  SPEAKER_02: It's gonna change whether anybody likes it or not.
• 38:27
  SPEAKER_02: It'll be yet to see whether it retains some of its philosophies.
• 38:35
  SPEAKER_02: We live in hope.
• 38:36
  SPEAKER_01: Yeah, we do.
• 38:37
  SPEAKER_02: We do.
• 38:38
  SPEAKER_02: Well, thank you very, very much for coming on.
• 38:41
  SPEAKER_02: I learned a hell of a lot there.
• 38:42
  SPEAKER_02: I hope anybody listened did as well.
• 38:44
  SPEAKER_02: I always say to anybody if they want to plug anything or say how they could get in touch, please let them know.
• 38:51
  SPEAKER_02: Amazing.
• 38:52
  SPEAKER_02: Thank you, Harry.
• 38:54
  SPEAKER_02: So go on, so how how could anybody get in touch with you if they wanted to?
• 38:57
  SPEAKER_00: Oh, sorry, yeah, sorry, that was a question.
• 38:59
  SPEAKER_00: Yeah, but so yeah, sorry.
• 39:00
  SPEAKER_00: Uh so absolutely.
• 39:01
  SPEAKER_00: So look, um the easiest way to find me is um well, I've got an email address abe at fidesium.xyz.
• 39:11
  SPEAKER_00: Uh so if you go to fideesium.xyz, you can see more about the business.
• 39:14
  SPEAKER_00: Uh, there's a contact us link there, or you can send me an email directly.
• 39:18
  SPEAKER_00: Um that's probably the easiest way to find me.
• 39:22
  SPEAKER_02: Very good.
• 39:22
  SPEAKER_02: Well, thanks very much for coming on.
• 39:24
  SPEAKER_02: It's been a pleasure.
• 39:25
  SPEAKER_02: This has been hardwired, and I look forward to the next episode.