Latest / Hardwired by AlphaWire / The State Of Risk In DeFi | ft. Charles Holmes & Greg Bock

Transcript

The State Of Risk In DeFi | ft. Charles Holmes & Greg Bock · Hardwired by AlphaWire

• 0:00
  SPEAKER_01: Hello everybody, welcome to another episode of Hardwired.
• 0:03
  SPEAKER_01: I've got Charles Holmes from Verdict Finance and Greg Bok from Fidesium here with me.
• 0:09
  SPEAKER_01: Thank you, both of you for coming on and agreeing to do this.
• 0:13
  SPEAKER_01: The title of this episode is The State of Risk in DeFi, which I want to dive into in a moment.
• 0:20
  SPEAKER_01: But if you could give everybody a little short introduction of your good selves, that would be very helpful.
• 0:28
  SPEAKER_00: All right.
• 0:29
  SPEAKER_00: Hello, I'm Greg Bach.
• 0:30
  SPEAKER_00: I represent Fetesium.
• 0:32
  SPEAKER_00: We are a cybersecurity firm uh operating out of London, England.
• 0:36
  SPEAKER_00: We help projects, uh Solidity, Solana, Rust, uh, you name it.
• 0:42
  SPEAKER_00: Our uh core is EVM chains.
• 0:45
  SPEAKER_00: Uh we also build our own tooling in-house to help projects protocols find vulnerabilities in their smart contract code, as well as other security uh services from Pentas, OPSec, uh you name it.
• 1:05
  SPEAKER_00: Um we're a small team, and our kind of differentiators are you get the team.
• 1:10
  SPEAKER_00: We do not farm out our security work.
• 1:13
  SPEAKER_00: You get uh the A team every time, and just trying to help uh the ecosystem be a little safer.
• 1:20
  SPEAKER_00: Charles?
• 1:21
  SPEAKER_02: Thank you, sir.
• 1:22
  SPEAKER_02: Um yep, so my name's Charles Holmes from verdict.finance.
• 1:26
  SPEAKER_02: Um, and we are specialists in looking at risk within protocols so that you can understand the dependencies that certain protocols have.
• 1:36
  SPEAKER_02: We then build a dependency graph based on that to elaborate on exactly where risk sits uh when interacting with the protocol.
• 1:44
  SPEAKER_02: This is expanded into us providing coverage products so that you can get cover for certain protocols depending on their risk.
• 1:52
  SPEAKER_02: Um, and we've also just built, um, with Fidesium being one of the people on it, uh, an audit marketplace, a pen testing marketplace, um, and a monitoring marketplace so that we have all the tools a protocol could need when launching so that they can be as safe as humanly possible.
• 2:09
  SPEAKER_02: And the thing we're recently branching out into is quantum readiness, because we see that as the largest attack vector in the next two or two years or so as entanglement improves within quantum computing.
• 2:24
  SPEAKER_01: Well, thank you very, very much for giving those very succinct introductions.
• 2:29
  SPEAKER_01: The first thing I want to dive into is a question posed to you both, and I'll I'll go to you, Charles, first, is the state of risk in DeFi.
• 2:37
  SPEAKER_01: It's kind of an open-ended question and statement at the same time.
• 2:41
  SPEAKER_01: But where do you think we're up to with the state of risk?
• 2:44
  SPEAKER_01: How do you think it's being managed or rather mismanaged?
• 2:48
  SPEAKER_01: Um, and just what's your opinion on it, and then I'll I'll come to you, Bach, afterwards.
• 2:53
  SPEAKER_02: Okay, uh, quite a large question.
• 2:55
  SPEAKER_02: And I could answer it with one word as we discussed before the podcast, but uh that would be uncouth.
• 3:01
  SPEAKER_02: Um, so the state of risk at the moment uh is well, let's use a a suitable word, it's extreme at the moment.
• 3:07
  SPEAKER_02: We've got a lot of challenges in the DeFi space um when it comes to risk, because you have teams that aren't necessarily open to bug reports.
• 3:19
  SPEAKER_02: We've got challenges when it comes to white hats slash grey hats.
• 3:23
  SPEAKER_02: Um and so because of this, there's a a lot more risk with the advent of AI and open source models, jailbroken models.
• 3:32
  SPEAKER_02: And so, because of that, we're seeing quite a lot of hacks on a daily occurrence.
• 3:38
  SPEAKER_02: Um and I think that what we'll see in the future based on this is a revitalization of the security space.
• 3:48
  SPEAKER_02: Uh, security teams um such as Greg's um have more strings to their bows so they can deal with the different attack surfaces.
• 3:57
  SPEAKER_02: And I think it's it's going to be okay long term, but at the moment, I think there needs to be some inward looking so that we can determine exactly how to improve on things to allow white hats to be still be white hats rather than verging into the grey hat territory.
• 4:14
  SPEAKER_02: So, yeah, I think that's where we are in terms of risk at the moment.
• 4:18
  SPEAKER_02: It's quite high, um, but it will improve over time.
• 4:24
  SPEAKER_00: What about you, Buck?
• 4:26
  SPEAKER_00: Uh yeah, I mean, largely agree.
• 4:30
  SPEAKER_00: Um, this year has seen an I mean just amazing increase in state-sponsored actors, um more sophistication, um, sometimes leaving uh the code uh behind in favor of um traditional OPSEC infiltration plays, supply chain attacks.
• 4:57
  SPEAKER_00: Um basically the funding has gone up for the attackers as well as the cost coming down.
• 5:04
  SPEAKER_00: So the AI tools make a slew of very complex, very intricate attacks a lot easier to pull off.
• 5:16
  SPEAKER_00: And this is, you know, whether it's uh writing bogus patches for uh supply chain attacks, um poisoning uh developer machines, uh setting up phony companies and posing as partners in order to get uh developer trust for larger protocols.
• 5:38
  SPEAKER_00: And I think this is then not helped by the advent AI producing slop on both ends, right?
• 5:49
  SPEAKER_00: Uh me and Charles had a brief talk about this uh uh earlier.
• 5:55
  SPEAKER_00: Uh the AI slop kind of factory of new projects coming out, uh being purely Vive coded, um, they take longer to audit, they are more difficult.
• 6:08
  SPEAKER_00: Uh the people running these um sometimes, you know, they have a lack of knowledge of coding, and so therefore, that lack of knowledge um percolates further into the protocol where they don't have an idea of what they don't know around security, so their OPSec can be poor.
• 6:29
  SPEAKER_00: And then on the other end of it is you see new security researchers uh using AI tools a lot more, uh, especially in the submission of uh bug bounties.
• 6:42
  SPEAKER_00: You know, you also see the hackers using it a lot more to speed up their discovery of vulnerabilities in projects, and so we're just hitting a confluence where everything is moving so fast that it is making it very difficult uh currently to stay abreast and stay safe.
• 7:00
  SPEAKER_00: Um I'm with Charles, I'm I'm optimistic uh largely that these are growing pains.
• 7:07
  SPEAKER_00: Um, every industry is facing them with the advent AI and large language models.
• 7:12
  SPEAKER_00: I think we will get past it, but right now is yeah, just kind of an incredibly dangerous time um with making new attack vectors uh cheaper and more accessible?
• 7:30
  SPEAKER_01: Scary times ahead.
• 7:31
  SPEAKER_01: It would see.
• 7:32
  SPEAKER_01: I just want to pick apart one one little area that you touched on, Bok, and and maybe ask Charles to comment.
• 7:38
  SPEAKER_01: But is the kind of rise of AI coding for smart contracts having a measurable increase in in the sort of surface area of attacks or the attack vector surface area?
• 7:49
  SPEAKER_01: Like how how is it changing what's going on?
• 7:53
  SPEAKER_00: So the rise of it, um, with vibe coding, it uh and the advent of that, it hasn't really increased uh the surface area.
• 8:05
  SPEAKER_00: That stayed largely the same.
• 8:07
  SPEAKER_00: I think uh it has made it more porous as people use um these tools if they are not rigorously checking what they're committing to individual projects.
• 8:21
  SPEAKER_00: You know, we've seen uh I can't think I went off the top of my head, but you know, um an LLM may not have all the context and it may check in a fix to whatever problem you're currently having without understanding that some other functions or code were there for protection and then it checks in a more porous result, and fixing one bug exposes two or three more.
• 8:55
  SPEAKER_00: So I think there is you know, there's always been danger moving fast and breaking stuff.
• 9:02
  SPEAKER_00: It's you know, it's fine for everybody, quote, Zuckerberg when you're talking about, you know, sharing pictures online.
• 9:11
  SPEAKER_00: It is less fine when you're talking about derivatives, perps, and you know, 500 million TVL.
• 9:21
  SPEAKER_01: Yeah, it's a different kettle of fish, as they would say, up in Yorkshire.
• 9:25
  SPEAKER_01: Um what do you think about where it's gonna go, Charles?
• 9:29
  SPEAKER_01: I suppose we we've we've come at it from sort of two separate ends, just for the listener's benefit of uh Fidesium is very much an audit and uh pen testing and monitoring company and touches on mostly cybersecurity problems to do with DeFi and and blockchain, whereas Verdict is more a ratings and risk agency with with other services built on top of it, which we can go into in a minute.
• 9:52
  SPEAKER_01: But it's two ends of the market in the cybersecurity for blockchain space.
• 9:57
  SPEAKER_01: Like, where do you think it's gonna go in the sort of near future in terms of AI and in terms of just anything you want to share, really?
• 10:05
  SPEAKER_01: What's your prediction?
• 10:06
  SPEAKER_02: I'm gonna build on what uh Greg said because he's absolutely 100% accurate on his previous answer.
• 10:12
  SPEAKER_02: Um, and just to elaborate on that, um if you're using AI to build your smart contracts, it starts becoming obvious.
• 10:20
  SPEAKER_02: So smart contracts used to have 1,000, 2000, 3,000, 4,000 lines of code.
• 10:26
  SPEAKER_02: Now they've got thousands and thousands of lines of code.
• 10:30
  SPEAKER_02: And you can start telling that uh an AI isn't succinct enough.
• 10:34
  SPEAKER_02: And Greg's right, it's down to the context limits that the generally older models had.
• 10:38
  SPEAKER_02: So where I think this is going to go is oh, and and this opens up daisy chaining, so you can start getting all these low vulnerabilities that can get brought together to make a higher a critical, and and that causes massive problems, and you have to really dig into the code base to understand exactly where the AI was at that specific context limit within that specific session.
• 10:59
  SPEAKER_02: Um where this is going to go is back to humans.
• 11:02
  SPEAKER_02: So we're gonna have to get to a stage where everyone's realizing that if your if your money is tied up within a contract written by an AI, you want you essentially want a human to have written that rather than an AI with a small context limit.
• 11:16
  SPEAKER_02: So I think what we're gonna see is a resurgence of expert smart contract engineers being hired by projects to actually build things.
• 11:27
  SPEAKER_02: And I think we're seeing at the moment a lot of cheaper projects being launched at the moment where one gentleman or one person in a room somewhere can build a whole protocol in a week or a month.
• 11:39
  SPEAKER_02: Um, it's actually gonna have to be two or three people who are gonna be able to should be able to build this because you're gonna need expertise in different realms to actually get this done.
• 11:48
  SPEAKER_02: And while potentially building a front end with uh an AI is okay if you're not doing anything too security conscious, but you're still gonna need your pen tests, you're still gonna need your audits, and so on and so forth.
• 12:01
  SPEAKER_02: So I think we're gonna go full circle within a year or so and and go back to humans doing the the difficult and financially responsible areas.
• 12:10
  SPEAKER_01: What what do you think, Paul?
• 12:12
  SPEAKER_01: Do you agree?
• 12:13
  SPEAKER_00: Oh yeah.
• 12:14
  SPEAKER_00: I mean, it's just gonna have to happen.
• 12:16
  SPEAKER_00: Um we did a pen test for a large exchange recently, and you know, sure, you can point uh the AI at certain bits, and it can help some of the developers move faster, but you know, an AI cannot make sure your devs don't uh commit their keys that, you know, your c is correct, that uh your fireblocks, AWS configuration is secure.
• 12:52
  SPEAKER_00: There are so many moving parts to actually keeping the system running that there needs to be human, I mean, overused term, but human in the loop is just gonna keep on getting more and more important.
• 13:08
  SPEAKER_00: Um the AIs are getting better.
• 13:13
  SPEAKER_00: Um they are doing a better job, uh larger context windows, writing somewhat cleaner code.
• 13:24
  SPEAKER_00: But again, this is all down to the human in the loop behind it.
• 13:28
  SPEAKER_00: Um used correctly, um, very narrow focused, uh, very good architecture, which takes a senior engineer, as Charles was talking about.
• 13:39
  SPEAKER_00: It's doable and it can make people faster as long as you're doing it the correct way, and then having the AI write tests, making sure those tests pass, um, and keeping it clean.
• 13:54
  SPEAKER_00: But yeah, the other the other problem with Charles mentioned is absolutely correct is we've seen contract uh size explode.
• 14:04
  SPEAKER_00: Um, and it's just an argument for, you know, uh, for lack of a better term, elegance.
• 14:11
  SPEAKER_00: Um, you know, uh elkin code is easier to audit, um, less chance of anything going wrong.
• 14:20
  SPEAKER_00: You know, uh a simpler system, a tight, a more tightly written system is always going to be more secure by the very nature of there's less things to go wrong.
• 14:32
  SPEAKER_00: So uh yeah, it's gonna be an interesting time.
• 14:35
  SPEAKER_00: I think we'll start moving back.
• 14:37
  SPEAKER_00: Um, the other thing we'll possibly move towards, so that's like moving back to that is one fix.
• 14:44
  SPEAKER_00: The other fix to this is maturity, right?
• 14:48
  SPEAKER_00: Um we can handle complex systems, uh secure cybersecurity can absolutely handle complex systems, but uh the other end of that uh is it just makes more it takes more time to um securely audit all the different moving parts of that.
• 15:11
  SPEAKER_00: So you either have elegance and simplicity or um complexity and maturity.
• 15:18
  SPEAKER_00: Both find solutions, uh, but they, you know, they're very different paths and it's an interesting thing for I think a young protocol to look at which one they want to take.
• 15:31
  SPEAKER_01: Very interesting way of looking at, and something I've not really thought of before is there is kind of a trade-off, I suppose, between the way in which you approach your smart contract and the way in which you build it, who builds it for you and what their level of experience is, and then leading on from that, who you get to audit it.
• 15:49
  SPEAKER_01: And it's a a question that a statement that very nicely leads me on to my next question.
• 15:54
  SPEAKER_01: So thank you for that.
• 15:55
  SPEAKER_01: Um, is to Charles.
• 15:57
  SPEAKER_01: So we touched on the fact that you are building a ratings agency for DeFi and you are looking at providing a basically a package of information to anybody who purchases it all around the risk of a protocol or an application, and and you would be looking at that risk, and what one component of that risk is the smart contract and who's done the audit and how detailed that audit may be.
• 16:23
  SPEAKER_01: So it's kind of an open question of how are you approaching that?
• 16:27
  SPEAKER_01: Is there anything that we could kind of get Bach in to explain around how that might function, especially from the manual audit kind of point of view?
• 16:35
  SPEAKER_01: But what is it?
• 16:36
  SPEAKER_01: How does it work?
• 16:37
  SPEAKER_01: What who does it help, and and and why is it beneficial, I suppose.
• 16:41
  SPEAKER_01: Just to put you on the spot slide.
• 16:42
  SPEAKER_02: No, no, no, that's absolutely fine.
• 16:44
  SPEAKER_02: So our rating system is quite complex, but um there are about three or four questions which actually deal with security audit, and it's usually down to the time scale involved and whether there are any upgrades that have actually happened to the contract since the audit itself.
• 16:59
  SPEAKER_02: So if you're looking at a point-in-time snapshot from uh a major or even any auditing firm, often things can get changed uh further on down the line.
• 17:10
  SPEAKER_02: And these types of things may not be included in the audit if they're not within the retest period, you know, after a couple of uh a month or so, which I think is the normal cadence for uh most auditing firms.
• 17:23
  SPEAKER_02: So what we do is we try and look at when the last time a protocol was audited, we try and incorporate the audit results, see how many highs, so many criticals there was in the actual audit report, and we encompass that into our ratings itself.
• 17:38
  SPEAKER_02: Um that that's what we do generally.
• 17:41
  SPEAKER_02: And I think where this is probably going to go, um, and I know a couple of people have touched on it in the past, is potentially starting to rate audit agencies themselves as another product line that we're going to be introducing in the future.
• 17:56
  SPEAKER_02: Because as we're building out our audits marketplace, um, we're finding that it's a little opaque who's actually audited a protocol and then there's been a subsequent hack on it.
• 18:10
  SPEAKER_02: Obviously, people don't want to highlight, oh yeah, we've audited 300 protocols and we've, you know, lost two to hacks and things like that.
• 18:17
  SPEAKER_02: But all this data is public.
• 18:19
  SPEAKER_02: Um, so I think that's going to be the next stage of what we're looking at within our rating system, is trying to understand how to do that and then rating the audit firms itself to build another node within our dependency graph so that we can say, this was the auditing firm, this is their track record, this is what they've done in the past and how many hacks there have been.
• 18:39
  SPEAKER_02: There are actually a number of uh cybersecurity companies, I'm pretty sure Fideesium is one of them, that hasn't had any hacks whatsoever in a protocol that they've audited.
• 18:50
  SPEAKER_02: Um, and this is why we are looking at our auditing marketplace, because we find when we're speaking to seed, pre-seed companies, that they don't know any of this information.
• 19:01
  SPEAKER_02: And surely that's some of the most valuable information for a protocol to be taking on board is like what is the track record of an auditing firm?
• 19:11
  SPEAKER_02: So that's where we're going to be going in terms of our ratings agency is actually building out other nodes within our dependency graph to highlight to our customers exactly what they should be looking at.
• 19:23
  SPEAKER_01: And I suppose I'll put the question straight to Boc.
• 19:27
  SPEAKER_01: How does that fit into kind of your worldview of manual orbiting and security?
• 19:32
  SPEAKER_01: Is it a public good?
• 19:33
  SPEAKER_01: Is it public bad?
• 19:34
  SPEAKER_01: Like how does it does it help you as a company and does it help your customers or the general state of security, I suppose?
• 19:41
  SPEAKER_00: Yeah, I think it's I think it's great.
• 19:43
  SPEAKER_00: Um I think it listen, more knowledge is always useful.
• 19:49
  SPEAKER_00: Um I think there's an important thing.
• 19:52
  SPEAKER_00: I mean, thank you very much, Charles, for highlighting that uh we have we none of our uh clients have been hacked.
• 19:59
  SPEAKER_00: But I mean the danger there is it's kind of a yet.
• 20:03
  SPEAKER_00: You know, um if a proto there's there's a limit there, right?
• 20:09
  SPEAKER_00: I mean, it is only luck if uh some security firms' clients never get hacked.
• 20:18
  SPEAKER_00: It is is always almost more of a when rather than an if.
• 20:23
  SPEAKER_00: Security is an arms race, novel exploits come up.
• 20:27
  SPEAKER_00: Um you are you you simply cannot catch everything, and there are always gonna be holes.
• 20:33
  SPEAKER_00: So I would never want to, you know, dance on the grave of uh, you know, another security firm if they miss something to a client.
• 20:42
  SPEAKER_00: It's it's an incredibly large, complex um attack surface, and uh there's an interesting one to something else Charles uh brought up about rating a protocol on whether they've been audited, and then is that audit fresh or stale?
• 21:03
  SPEAKER_00: Um is a really important one.
• 21:06
  SPEAKER_00: And it's not even on um whether or not their contract's been updated, right?
• 21:13
  SPEAKER_00: Uh novel exploits uh springing to existence month on month.
• 21:18
  SPEAKER_00: Um an audit three months ago is definitely worth more than an audit uh two years ago.
• 21:27
  SPEAKER_00: Uh there was a slew in um April, May of recent hacks with the advent once again of the LLMs looking at old contracts.
• 21:42
  SPEAKER_00: But there are now novel exploits that you know didn't occur to the security researchers back then.
• 21:48
  SPEAKER_00: And so they had um weaknesses that could be exploited.
• 21:52
  SPEAKER_00: Uh, the other one Charles brought up a little bit that I think is very, very important is then the dependence.
• 22:00
  SPEAKER_00: Right?
• 22:01
  SPEAKER_00: So smart contracts don't exist in a vacuum.
• 22:06
  SPEAKER_00: What is the exposure those contracts face with how many dependent contracts they hit, uh different oracles, um other service providers, off-chain data.
• 22:22
  SPEAKER_00: And have there been any been any updates to the security pasture of those third-party vendors to whatever uh protocol you're interacting with?
• 22:34
  SPEAKER_00: Um there were a couple hacks recently where the hack only took place due to uh sophisticated attacks on the oracles they were using.
• 22:47
  SPEAKER_00: You know, no problem with the actual contract itself of the protocol, but uh independent third-party feeds were able to be manipulated to uh create a situation where funds could be extracted.
• 23:02
  SPEAKER_00: So uh, you know, a dependency map uh could be an interesting thing to build out one day.
• 23:12
  SPEAKER_00: I I know you're already doing a lot, but if you need more to do and what do you think is going to happen next?
• 23:26
  SPEAKER_01: So with regard, one thing I want to touch on is is the recent hacks that have have happened in exploits.
• 23:31
  SPEAKER_01: And before this we started recording, we were talking a little bit about the the Bitcoin hack that was recently returned.
• 23:38
  SPEAKER_01: Do you think that the the landscape has materially changed from what it was a couple of years ago?
• 23:43
  SPEAKER_01: I know that it seems to be that there are more and more large-scale hacks happening.
• 23:48
  SPEAKER_01: Is that just a feature of the fact that more liquidity is going into sort of DeFi and into new protocols and it's moving around?
• 23:56
  SPEAKER_01: Or is it like you say about the LLMs have kind of sped up the ability to find some of these exploits?
• 24:02
  SPEAKER_01: Is it just a burgeoning industry where it's like we've we've talked about this before, Buck, about this kind of this idea of an endless war of kind of the the people that are trying to defend it and the people that are trying to attack are in a constant kind of backwards and forwards, and it seems like the attackers have been winning recently.
• 24:18
  SPEAKER_01: Like what's the what's the state of play?
• 24:20
  SPEAKER_01: Why is it happening so much?
• 24:23
  SPEAKER_00: Um, so twofold.
• 24:25
  SPEAKER_00: A, the tooling's gotten better, and the I think the hackers were slightly quicker to adopt, but they were uh quicker to adopt because the price of failure on their end is less, right?
• 24:40
  SPEAKER_00: Um cybersecurity has always been an asymmetrical game uh where the attackers only have to get right once, and the defenders have to be right every single time across like the board.
• 24:55
  SPEAKER_00: Um couple that with an ever-growing market, people doing new things.
• 25:01
  SPEAKER_00: Um, yeah, I mean the the one you're referencing, the Bitcoin liquidity drain is an interesting one.
• 25:13
  SPEAKER_00: You know, but people are doing new things.
• 25:19
  SPEAKER_00: Um and these new projects uh don't have the maturity, they have not been battle tested for long enough, and you know, holes will appear.
• 25:34
  SPEAKER_00: I mean, this time, thankfully, by me and Charles were talking about this earlier as well, um definitely by uh inspired a white hat, who uh you know was there for the protection of uh the protocol and the funds, uh, reached out, uh made sure that the uh vulnerability he discovered was fixed before the funds were returned.
• 26:06
  SPEAKER_00: Um there is some question if he crossed the line a little bit with uh the bounty he set for himself.
• 26:16
  SPEAKER_00: Um, given the amount of funds uh removed and returned, 10% is quite high.
• 26:26
  SPEAKER_00: Uh, but I would need more information.
• 26:28
  SPEAKER_00: Like we haven't got all the details, you know, how much did he try to report this beforehand?
• 26:34
  SPEAKER_00: What were those discussions like?
• 26:36
  SPEAKER_00: Um so I think he's still on the maybe dirty white end of uh white hat.
• 26:44
  SPEAKER_00: Um but I Charles, if you want to dump in with any uh I know your opinion slightly differs.
• 26:51
  SPEAKER_02: Um yeah, I I just feel as if uh I can well put it this way, I can't wait till the PGP keys get released so we can actually read all the interactions on-chain um between the hacker and blockstream or liquidity or whomever was discussing these things.
• 27:08
  SPEAKER_02: Um I think that uh I think what happens next is we need some sort of situation where as as gr in fact, this is our previous conversation that Greg and I were having.
• 27:22
  SPEAKER_02: At the moment, if you want to submit a bug, you have to sometimes pay 25 bucks, 100 bucks, something like that.
• 27:28
  SPEAKER_02: And I think as Greg was saying, this needs to be returned if it's an actual bug, rather than it just being a paywall to get in.
• 27:35
  SPEAKER_02: And there needs to be an industry solution to change this.
• 27:39
  SPEAKER_02: So go back to your question, Harry.
• 27:41
  SPEAKER_02: Um, and it's just something that I thought about while you both were talking.
• 27:46
  SPEAKER_02: Um, with people finding getting work in Web3 during the bear market, does that mean people have had more time on their hands to experiment with uh various hacking solutions and things like that?
• 28:01
  SPEAKER_02: Um, and does a bear market contribute to hacks going on?
• 28:07
  SPEAKER_02: Because people have more time on their hand, there's not meme coins, cat coins, laptop coins to focus on.
• 28:14
  SPEAKER_02: I don't know if that's something that that people have been looking at as the markets change.
• 28:20
  SPEAKER_01: It's a very, very good question and one that makes you think about where we're at in the market cycle.
• 28:26
  SPEAKER_01: And if the question is, do are the do more hacks happen in the bear than in the bull?
• 28:32
  SPEAKER_01: I I don't know is the honest answer.
• 28:36
  SPEAKER_01: My my opinion would probably be that they're larger but less frequent, if that makes sense.
• 28:44
  SPEAKER_01: So the ones that they're going after or the ones they're trying to exploit would be the ones with much larger TVL, not so much the new protocols that are popping up.
• 28:54
  SPEAKER_01: They're gonna be going after things that have been there a long time and looking for kind of complacency in the bear market.
• 29:01
  SPEAKER_01: Whereas the other hand of that, the other side of that, in my opinion, again, would be the Transverse.
• 29:06
  SPEAKER_01: If you were to ask the question, are there more or less hacks during a bull market?
• 29:11
  SPEAKER_01: I'd say they're probably more in number, but maybe less in amount garnered or gathered from the hacks.
• 29:18
  SPEAKER_01: Maybe because maybe they're going after the new protocols more often, but those ones will have less TVL in there.
• 29:25
  SPEAKER_01: I don't I don't know what you think, Box.
• 29:26
  SPEAKER_01: This it's quite a good question, and it really makes you think about where we're at.
• 29:30
  SPEAKER_00: Yeah, I think um I think there's definitely some anecdotal evidence to sport um bigger attacks on maybe kind of sleeping giants, and uh, you know, the anecdotal evidence I'll offer is, you know, the the bonk uh governance hack, right?
• 29:52
  SPEAKER_00: 4 million in to take 20 million out because people aren't paying attention, the bear market gets sleepy, no one would, you know, basically the the governance council was asleep at the wheel, everyone's just like uh it's the bear market, nothing's going on.
• 30:08
  SPEAKER_00: And then, you know, there are obviously huge problems with that government structure as well, right?
• 30:16
  SPEAKER_00: Uh, another another area, another attack service that definitely needs to be looked at.
• 30:23
  SPEAKER_00: You know, no time lock, no vetting of the new person, no uh seasoned funds before they could make, you know, these kind of moves.
• 30:32
  SPEAKER_00: And basically they put four million, uh put it a vote to uh the the Dow that was heavily weighted based on number of voting shares, and they voted that give themselves the rest of the holdings in the DAO.
• 30:52
  SPEAKER_00: It's just absolutely insane.
• 30:55
  SPEAKER_01: It's a very important point to talk about, and I think one that maybe people who aren't involved in cybersecurity or manual auditing contracts don't really perceive, which is governance is part of that.
• 31:06
  SPEAKER_01: The way in which a DAO sets up its governance, the way in which a protocol manages its keys, manages who has access, manages who has what permissions is part of an audit.
• 31:17
  SPEAKER_01: It is part of that service to understand where there could be vulnerabilities or where there could be exploitation of the rules in which they have set to do something that they didn't intend somebody to be able to do, such as the bank DAO is a very, very good example of that.
• 31:35
  SPEAKER_01: Do you think there's going to be more of those types of exploits in the future where DAOs have got complacent, they've built through a bull market, made some money, done whatever they've done, and and maybe they're going through a transition, and they're not, they haven't got that kind of eye on the security as maybe they once had.
• 31:54
  SPEAKER_00: I don't think there's gonna be more like like all these things, um, a lot of it is largely self-correcting, right?
• 32:02
  SPEAKER_00: So there was a you know, April was huge for OPSEC attacks.
• 32:08
  SPEAKER_00: Um and following that, everybody started taking a look at their operational security.
• 32:17
  SPEAKER_00: They started um really paying attention more to who had access to their to the keys, where were those keys stored.
• 32:26
  SPEAKER_00: Um you know, partnerships got a lot tighter, less access was given.
• 32:33
  SPEAKER_00: And the same thing with governance, right?
• 32:35
  SPEAKER_00: Um, after the bank won, any DAO with funds um sitting idle with it immediately threw on new rules around um, you know, voting rights and seasoned funds and whatever their missing kind of breakers were in there, um, I think got added in fairly short order.
• 33:00
  SPEAKER_00: So, you know, it's now it's not everybody, right?
• 33:06
  SPEAKER_00: Some people will have missed the news, some people won't have done it.
• 33:10
  SPEAKER_00: Uh but every hack, especially when it's a new flavor, right?
• 33:15
  SPEAKER_00: When there's a new meta comes in the land of what's being attacked and how, um the protocols that are still building do pay attention and we do see a reaction.
• 33:26
  SPEAKER_00: So it's it's a bit self-fixing, uh, but you know, it should have been in there in the first place.
• 33:37
  SPEAKER_00: You know, realistically, it was a poor design and it it it should have never happened.
• 33:44
  SPEAKER_00: And you know, uh same thing with a lot of these.
• 33:47
  SPEAKER_00: Uh the the worst I heard, um I can't remember who it was off, and uh no point in naming and shaming other than just mentioning that you know, uh one hack happened because they had uh multi-sig on their treasury and all seven keys were on the same laptop.
• 34:05
  SPEAKER_00: And it's just like, come on guys.
• 34:10
  SPEAKER_01: It does beg belief sometimes.
• 34:13
  SPEAKER_01: One thing that you spoke a little bit about earlier, Charles, was this marketplace that you're building for auditors or audit companies to to list their services for Dsium as being one of them.
• 34:27
  SPEAKER_01: But I know from my own kind of research that there are a couple of others out there that what are the other ones called box that they're just picked before, not to shill your competitors' uh verdict, but just to talk about the space.
• 34:38
  SPEAKER_01: There's what Sherlock do audit, they could give you the opportunity to put on audit competitions, is that correct?
• 34:46
  SPEAKER_00: Correct.
• 34:47
  SPEAKER_00: Um then you have a rate of marketplace that allows companies to go and view different auditors and put uh an audit job up for tenor.
• 34:58
  SPEAKER_00: Um those are kind of the big uh hack and proof is very good at uh hack and proof and immunify, uh bug bounty programs, and then I believe also have a limited like partners of uh you know uh suggested auditors.
• 35:19
  SPEAKER_00: So yeah, places around do exist.
• 35:22
  SPEAKER_00: Um I don't think anyone's going as deep as Charles is looking to go with the rating, which I think is very interesting and very good.
• 35:34
  SPEAKER_00: I think um, you know, uh consumer information is very important.
• 35:41
  SPEAKER_00: And I think if there was a rating AGC, I think uh the uh the audit house that shall not be named that everybody knows has uh stepped across the line once in a while with a little more uh public scrutiny around, I think uh would be good for everybody.
• 36:04
  SPEAKER_01: It leaves me very nice onto kind of my my question for for Charles, which is why does it exist?
• 36:08
  SPEAKER_01: Why why have you built it and who does it who is it there to service?
• 36:11
  SPEAKER_01: I suppose Box already touched on it, but but in your own words, why?
• 36:15
  SPEAKER_01: Why does verdict.finances, audit, marketplace, and aggregator exist?
• 36:22
  SPEAKER_02: Okay, so using the security alliance, so that's SEAL Teams org's own stats for last week.
• 36:28
  SPEAKER_02: This is just last week, so between the 1st of September and the 8th, there were 48 security incidents uh where people lost funds, 48 in a week.
• 36:37
  SPEAKER_02: Um, so the current audit marketplaces, while are very good at connecting uh teams to auditors and things like that, they're not as granular as I think they should be.
• 36:48
  SPEAKER_02: They don't really highlight what the special specialities are of various auditing firms.
• 36:54
  SPEAKER_02: You know, some guys specialize in chain links, some guys specialize in Rust, some guys specialize in EVMs, Move, Cairo, so on and so forth.
• 37:03
  SPEAKER_02: Other guys have got experience doing hundreds of protocols.
• 37:06
  SPEAKER_02: We've got one auditing firm that can turn around audits in um, you know, start an audit in 24 hours.
• 37:11
  SPEAKER_02: Others take a week before, you know, a bit of back and forth.
• 37:15
  SPEAKER_02: Um, and it's something that Greg brought up was that the fact that, you know, on some of these auditing platforms, you get one opportunity to offer an audit price.
• 37:27
  SPEAKER_02: Whereas in actual fact, you should probably have multiple opportunities with different things being added and subtracted so that teams can pick their own level of security that they're willing to pay for.
• 37:37
  SPEAKER_02: Um so if you go to a big uh huge uh auditing firm, they might charge you 600 grand.
• 37:44
  SPEAKER_02: Whereas another brand new auditing firm might charge you 10 for the same thing.
• 37:48
  SPEAKER_02: Are you getting the same level of security?
• 37:50
  SPEAKER_02: No, you're not.
• 37:51
  SPEAKER_02: Um, and this is why one of the reasons why Fidelisium's on ours is because they've got a small, excellently experienced team that are deployed on every single engagement rather than bringing in a researcher who's never done anything on it before but is free at the time because everybody else is busy.
• 38:06
  SPEAKER_02: So, as far as I'm aware, we need to have more granularity uh when it comes to choosing teams, understanding their specializations, and not just going for the cheapest option.
• 38:16
  SPEAKER_02: Because if you go to the cheapest option, this is why we have 48 instants in a week, because people are skimping on various aspects of security, and that's affecting the confidence levels.
• 38:27
  SPEAKER_02: And we're never going to onboard a billion users so that they can comfortably use DeFi and generate some money like some of us have done.
• 38:35
  SPEAKER_02: So, yeah, we need to put our big boy pants on and understand that companies are different.
• 38:41
  SPEAKER_02: Some companies are amazing at some things, some companies can be amazing at other things.
• 38:45
  SPEAKER_02: And this is what we're trying to create is a differentiation with these auditing firms and only allow the best or the most nimble or um or the most specialist auditing firms in the space under one uh marketplace uh rather than every Tom Dick and Harry auditing firm who can do audits but have got no track record, might cut corners, are only there because they see you know other firms are charging 50 grand, 60 grand for a week's worth of work.
• 39:16
  SPEAKER_02: But you know, sometimes that's justified.
• 39:18
  SPEAKER_02: Sometimes a security researcher is worth five, ten to fifteen thousand dollars um a day or a week.
• 39:23
  SPEAKER_02: It just all really depends on their experience.
• 39:26
  SPEAKER_02: So this is why we're building it, is because like when we speak to the pre-seed companies, they think, oh, we found a great auditing price, 10 grand for a whole code base.
• 39:35
  SPEAKER_02: Whereas if you were to show it to you know a top top-tier dev team as auditing team, they'd say, no, no, no, this needs five different guys with different expertise because of this, this, this, and this, these dependencies here, these contracts that aren't quite yours have been audited, but it interacts with.
• 39:53
  SPEAKER_02: And so you need to map out the whole situation of what's going on with the contracts.
• 39:57
  SPEAKER_02: So that's why we're building what we're building is we we need to hand hold protocols uh a little bit more while they're picking their audit partners, and that's what we're trying to achieve.
• 40:06
  SPEAKER_02: So we could have just come out and just released this, but what we've actually done is spent the last month speaking to loads of auditing companies to understand what are the pitfalls that they normally experience, giving them questionnaires, and that's how we're building this from the ground up.
• 40:20
  SPEAKER_02: So, based on feedback from auditors themselves.
• 40:23
  SPEAKER_02: So fingers crossed, we're trying to create a better solution that can help companies moving forward.
• 40:29
  SPEAKER_01: I definitely think it plugs a gap.
• 40:31
  SPEAKER_01: I would I would say that though, because I'm involved with your company, but uh being impartially impartial, um I think it does plug a gap.
• 40:39
  SPEAKER_01: I think there is a sort of a disconnect between information and track record and the ability for companies to find out about that when it comes to audit companies.
• 40:50
  SPEAKER_01: The amount of times I speak with a startup and they go, Do you know anybody you trust?
• 40:55
  SPEAKER_01: Because it is hard to find companies not to kind of put um any disparaging comments uh out there about them, but they're it's a very expensive thing if you have a large area to cover, it can get very expensive very quickly, sometimes needing needlessly, sometimes for very fair reasons.
• 41:16
  SPEAKER_01: Um but yeah, before we wrap up, have you got anything else to add?
• 41:23
  SPEAKER_01: Bob?
• 41:23
  SPEAKER_01: Anything else to chart Charles for you to add?
• 41:25
  SPEAKER_01: Otherwise, I think we'll we'll sort of start finishing up.
• 41:29
  SPEAKER_00: Yeah, um, I was just about to say I've got a call, so I've got a blast out pretty quick.
• 41:35
  SPEAKER_00: But um I think Charles hit uh most interesting points of you know I understand the pain of uh you know startups and uh new protocols and getting off the ground with not very much funding.
• 41:54
  SPEAKER_00: It is a struggle, and to suddenly get a you know 10 to 50 grand bill to make sure you are uh ready to go out uh into the world and start transacting can be a really big hit.
• 42:15
  SPEAKER_00: And you know, um, especially in the bear market, uh, we've all seen the market change.
• 42:21
  SPEAKER_00: Um, you know, uh VCs, uh, well, first they're uh dumping all of their money into AI, and so uh funds are not being deployed into blockchain like they were in the other uh cycles.
• 42:38
  SPEAKER_00: So I think it is much harder.
• 42:41
  SPEAKER_00: Um yeah, I think the biggest thing I'd I'd warn people off about is really do your due diligence about Thought at House, and Charles is helping with that.
• 42:56
  SPEAKER_00: So I just I think it's uh it is a net good kind of whether you're involved with the project or not.
• 43:03
  SPEAKER_00: I think uh what he's doing is just a net good contribution, and so yeah, fully support.
• 43:09
  SPEAKER_02: Thank you.
• 43:10
  SPEAKER_02: That's very kind words.
• 43:11
  SPEAKER_02: Uh I think my closing comments would be um on a slightly different tact, uh, just to keep everybody safe.
• 43:17
  SPEAKER_02: If a celebrity shills a token, do not buy said token.
• 43:20
  SPEAKER_02: I think that that covers that one quite nicely.
• 43:24
  SPEAKER_01: Yes, I can't say I disagree.
• 43:27
  SPEAKER_01: Um even if it's a former president's son.
• 43:30
  SPEAKER_00: Oh yes.
• 43:31
  SPEAKER_00: Yes.
• 43:32
  SPEAKER_00: Damn it, I wanted to get into that, but next call.
• 43:35
  SPEAKER_01: Next call.
• 43:35
  SPEAKER_01: I was gonna say, I think next time.
• 43:37
  SPEAKER_01: Um well, thank you very, very much both for coming on.
• 43:40
  SPEAKER_01: It's been a great time chatting with you.
• 43:42
  SPEAKER_01: I really enjoyed it, and I've learned a little bit more about the cybersecurity space, as I always do, coming off the back of a phone call with your good selves.
• 43:50
  SPEAKER_01: This has been hardwired, and thanks for coming along.
• 43:54
  SPEAKER_00: Thank you, Harry.
• 43:55
  SPEAKER_01: Thank you, Charles.
• 43:56
  SPEAKER_02: Thank you, thank you, thank you, Greg.
• 43:58
  SPEAKER_02: Have a lovely day, guys.