1
00:00:02,870 --> 00:00:04,470
Hi, good morning, everyone.

2
00:00:04,830 --> 00:00:07,550
I hope you're well and enjoying your virtual conference.

3
00:00:07,930 --> 00:00:12,250
My name is Ryan Rubin and today I'm going to be talking about decentralised finance.

4
00:00:12,510 --> 00:00:14,050
Is it ready for prime time?

5
00:00:15,310 --> 00:00:23,590
I'm really sorry not to be in Vegas today with all of you, but all I can say is here in the UK, it feels pretty hot and it's almost like we are in the desert.

6
00:00:26,090 --> 00:00:27,890
First, the usual disclaimer.

7
00:00:27,890 --> 00:00:35,870
I'd like to confirm that the views expressed in this talk are my own and are not representative of any views from my employer.

8
00:00:36,370 --> 00:00:41,350
Of course, no animals were hurt other than potential unicorns in this research.

9
00:00:42,770 --> 00:00:57,590
So today I'm going to give a quick introduction, give you a 101 on what decentralised finance is all about, talk a little bit about the attack landscape and how people might target this particular protocol.

10
00:00:58,630 --> 00:01:11,030
And then I'll also talk about a methodology that we've introduced, which effectively looks at key indicators of vulnerabilities and how we might be able to assess DEFI projects in the future.

11
00:01:11,050 --> 00:01:14,870
I'll present the results and wrap up with some conclusions.

12
00:01:16,270 --> 00:01:17,990
So a little bit about myself.

13
00:01:17,990 --> 00:01:20,670
My name is, once again, Ryan Rubin.

14
00:01:20,670 --> 00:01:27,210
I've been in the security industry for the last 23 years, covering a whole range of different topics.

15
00:01:27,330 --> 00:01:34,550
Last couple of years I've had a big interest in blockchain security as well as cyber insurance.

16
00:01:34,830 --> 00:01:38,790
And I'm looking forward to sharing some insights here today.

17
00:01:39,010 --> 00:01:49,010
I actually start this talk where I kind of left off last year when I presented a talk in the blockchain village on a cryptocurrency heist.

18
00:01:49,010 --> 00:02:09,130
And what I found quite interesting during that investigation was that as the attackers started to move their money and funds around the Ethereum blockchain, they started to put some of their funds into a DEFI platform and actually converted quite a lot into something called the DaiCoin,

19
00:02:09,130 --> 00:02:11,070
which I'd actually never heard of before.

20
00:02:11,570 --> 00:02:25,230
And after doing a bit of research, I got quite interested in the whole DEFI protocol and kind of the alternative finance options that it has.

21
00:02:25,730 --> 00:02:48,470
What startled me was that the attackers of this particular heist were obviously ahead of the game and realized that they needed to put their cryptocurrency somewhere in order to ensure that the pricing did not fluctuate and the value or the proceeds of their crime did not reduce as the price of Ethereum drops.

22
00:02:49,990 --> 00:03:04,770
But this talk is not just about hackers and fraudsters that might be leveraging various platforms to realize their investments in the blockchain world.

23
00:03:05,050 --> 00:03:14,850
It's actually more generally about many of us that may be looking at alternative ways of financing and investing in the future.

24
00:03:17,270 --> 00:03:29,610
So I came up with this research hypothesis which states, firstly, DEFI is becoming really popular and I'll talk a little bit about that as the show goes on.

25
00:03:29,730 --> 00:03:38,650
But as their popularity grows, can they withstand the various types of attacks that are going to be attracted by their popularity?

26
00:03:39,990 --> 00:03:46,830
Also, is there a way that we can measure the security posture of DEFI projects and do so in a way that's non-invasive?

27
00:03:47,970 --> 00:03:55,110
Of course, the assumption we have is that they must have good OPSEC in order to be in this business, right?

28
00:03:58,080 --> 00:04:00,020
So why carry out this research?

29
00:04:00,020 --> 00:04:03,240
Well, unfortunately, people are still getting hacked.

30
00:04:03,780 --> 00:04:13,240
There are several stories in the news and quite a few that I'll discuss as the talk unfolds indicating that there are still compromises out there.

31
00:04:13,240 --> 00:04:15,700
People are still making money out of this.

32
00:04:15,940 --> 00:04:35,860
And therefore, it's really important to raise awareness of security-related issues, not only to those in the security community, like many of you that are attending the talks today, but also those outside that community, including a lot of blockchain developers who,

33
00:04:35,860 --> 00:04:41,740
I understand, frequent the BCS village.

34
00:04:43,080 --> 00:04:52,960
I also wanted to use this research to try and build upon some of the work that others are doing in this space and try and move the industry forward in a positive direction.

35
00:04:53,720 --> 00:05:18,800
And finally, I think this research could also be helpful for both consumers, those in the insurance space, investors, and also owners of DEFI projects, because the last thing you want to be doing after spending weekends, hours, days, months, and years building up your DEFI project is find that it all goes down the drain because of some city security issue that we've got to close.

36
00:05:21,280 --> 00:05:23,180
So, DEFI 101.

37
00:05:24,680 --> 00:05:27,000
So, what is decentralized finance?

38
00:05:27,000 --> 00:05:50,560
Well, if we look at traditional finance products that you might buy from your bank today or some of the financial products that investment bankers are using, you can see that there are common trends around loans, derivatives, asset swaps, and even insurance that can be provided to each of us through a traditional banking environment.

39
00:05:51,300 --> 00:05:57,360
One of the issues and challenges with that is the centralized aspects of it.

40
00:05:57,460 --> 00:06:12,360
And what decentralized finance aims to do is to introduce a new way of establishing financial products that's both decentralized, not controlled in any way, is trustless and transparent.

41
00:06:13,720 --> 00:06:23,860
So, if we look at the DEFI set of protocols and applications, you can see that there's a whole range of different services that are being offered in the space.

42
00:06:23,860 --> 00:06:35,060
There's distributed exchanges, which remove some of the concerns that many people have around working with traditional centralized exchanges.

43
00:06:35,220 --> 00:06:54,140
There's a variety of different loan products that are out there where you can take your cryptocurrency, pass it onto a platform, and earn some interest in it instead of leaving that money to, let's say, decay over time.

44
00:06:54,380 --> 00:07:06,860
There's also the concept of stable coins where you can basically take your cryptocurrency, convert it into a stable coin, which is pegged against the US dollar or some other fiat currency.

45
00:07:07,000 --> 00:07:17,520
And that's another way of ensuring that your hard-earned cryptocurrency coins do not necessarily fluctuate in value as the market continues to be volatile.

46
00:07:18,960 --> 00:07:24,180
And, of course, all the other things like the asset swaps and derivatives that are also there.

47
00:07:25,260 --> 00:07:27,180
So how is this big as this market?

48
00:07:27,180 --> 00:07:40,840
Well, I found this quite fascinating, but earlier on in the year, the total value that was locked up in the DeFi various protocols and projects was around $1 billion.

49
00:07:41,400 --> 00:07:50,420
And over the last couple of months, it's actually shot up to just over $4 billion in value locked in.

50
00:07:50,720 --> 00:07:56,100
So what we can see here is there's this tremendous amount of growth that's taking place.

51
00:07:56,200 --> 00:08:06,220
And this may continue in the future as long as there aren't any big hacks that come up and the confidence in these products doesn't start to fail.

52
00:08:06,600 --> 00:08:16,780
In terms of distribution, you can see that from the lending side, that's one of the more popular platforms and products.

53
00:08:17,020 --> 00:08:20,400
I'm assuming that's because it's actually quite easy to understand.

54
00:08:20,400 --> 00:08:38,940
We're talking effectively about either borrowing money or loaning money into the system, and then getting some profits out of that through some additional interest or being able to leverage the loans in order to invest in other products in the system.

55
00:08:39,500 --> 00:08:42,400
Distributed exchanges, again, gaining some value.

56
00:08:42,660 --> 00:08:48,100
Derivatives and payments, still early days, but again, the facilities are there.

57
00:08:48,100 --> 00:08:56,580
And there's some very interesting ways in which these protocols can be configured, which cannot actually be set up in the real world.

58
00:08:56,580 --> 00:09:08,060
So I suspect the investment bankers out there will be looking at DeFi as it continues to mature and seeing how they can exploit some of the value that it can provide.

59
00:09:10,840 --> 00:09:13,840
So how can you earn passive income crypto style?

60
00:09:13,840 --> 00:09:29,660
Well, if you have a look on the left-hand side of the slide, you can see a number of different projects, DeFi projects that are out there, providing the various services that I mentioned, lending, derivatives, distributed exchanges, assets or stable coins.

61
00:09:29,800 --> 00:09:36,400
And you've got a whole pick there of different types of companies and platforms that you can go to.

62
00:09:36,400 --> 00:09:49,360
On the right-hand side, you can also see that as part of these platforms, there are also a variety of different interest rates associated with the different types of coins and tokens that you might want to invest in.

63
00:09:49,360 --> 00:10:06,680
So if you look at Nexo, for example, you can get an 8% return if you invest in one of their products and perhaps buy some die and look to get some value from that.

64
00:10:07,160 --> 00:10:10,280
If you go down the list, NUO, 13.68%.

65
00:10:10,280 --> 00:10:18,140
So when you're looking at these numbers, of course, you're not going to earn this type of return from a bank today.

66
00:10:18,600 --> 00:10:25,580
But of course, there's obviously a lot more risk involved in this and that's why these prices tend to fluctuate a lot.

67
00:10:27,820 --> 00:10:31,700
So before we go any further, I thought I'd just talk a little bit about some terminology.

68
00:10:32,480 --> 00:10:33,780
Firstly, crypto wallets.

69
00:10:33,780 --> 00:10:36,620
So many of you will be familiar with crypto wallets.

70
00:10:37,260 --> 00:10:43,200
This is the place where you have your private keys and you hold your cryptocurrency.

71
00:10:43,380 --> 00:10:46,420
And it's, of course, an area that you need to protect really well.

72
00:10:46,420 --> 00:10:59,020
In the context of distributed finance, the wallet is also used and can be the key towards holding source code or smart contracts.

73
00:10:59,020 --> 00:11:03,620
And that becomes quite important as we look at the security of these platforms.

74
00:11:03,680 --> 00:11:20,880
So when we look at platforms such as Ethereum, for example, it not only has a cryptocurrency, which is the Ether, but it has a whole distributed system available which is based on executing distributable code in the form of smart contracts.

75
00:11:20,880 --> 00:11:32,880
And once again, the control of those contracts, when they're uploaded, what the contents of them are, etc., is all linked into the crypto wallets that's associated with those projects.

76
00:11:33,220 --> 00:11:37,260
In order to unlock those, we talk about admin keys.

77
00:11:37,440 --> 00:11:50,400
And these are kind of like the keys to the kingdom, almost similar to the domain administrator accounts in the Windows world, for those of you that are joining from the security community today.

78
00:11:50,800 --> 00:12:00,440
And effectively, if you get hold of these keys, you can do a whole lot of bad stuff, including potentially uploading or changing smart contracts.

79
00:12:00,600 --> 00:12:02,300
Now, why would that be important?

80
00:12:02,300 --> 00:12:06,240
Well, inside the wallet, we've got a whole lot of cash.

81
00:12:06,400 --> 00:12:16,540
And smart contracts define a way in which transactions can communicate and can take place over the blockchain.

82
00:12:16,940 --> 00:12:32,900
So if we have a wallet that has a lot of cash in it, and we have an ability to influence the logic by which that cash gets used, then it obviously can be very detrimental to the DeFi platform.

83
00:12:33,620 --> 00:12:35,580
There's also a concept of time lock.

84
00:12:35,580 --> 00:12:40,980
And this isn't got anything to do with going back in time.

85
00:12:40,980 --> 00:12:55,220
But what it is, is it's a method that owners of the DeFi platform can use to effectively slow down the transactions that are taking place on the blockchain.

86
00:12:55,260 --> 00:13:33,950
And this is very useful because it allows the owners or those that are governing the DeFi projects to potentially have a look at any unusual transactions and normally there's a time window, either it's four hours, 72 hours, 48 hours, that the owners of that platform or those that govern the platform can actually monitor the transactions and potentially reverse any transactions that have been introduced into the system by an unauthorized hacker or potentially even just by mistake.

87
00:13:34,280 --> 00:13:37,900
So that's something that's really key to look into.

88
00:13:37,900 --> 00:13:43,640
There's a big debate around decentralization and centralization, right?

89
00:13:43,640 --> 00:13:53,800
So we spoke at the beginning, the whole purpose of distributive finance is to have decentralized systems and finance that is not under anyone's control.

90
00:13:54,480 --> 00:14:07,060
And by putting in a time lock, we're effectively giving a level of that control back to the owners and those that run the project in order to better control it in the case of things going horribly wrong.

91
00:14:07,060 --> 00:14:24,640
But I think, you know, for most of us that are still, let's say, dabbling in this particular world, it's better to have some level of governance in place to protect the assets and information and, of course, the currencies that are in there.

92
00:14:25,560 --> 00:14:45,660
We also have the concept of an oracle and this can either be a system that's inside the decentralized ecosystem of the DeFi platform or it's something that the DeFi platform uses as a source of information in order to make decisions.

93
00:14:45,940 --> 00:15:04,440
So an oracle could, for example, be publishing prices for various types of coins, like I showed you earlier, that are coming from various exchanges and pumping that information back into the DeFi protocol and application so that it can use them in order to make decisions.

94
00:15:04,440 --> 00:15:10,560
Now, again, there's pros and cons on whether this oracle concept is a good idea or not.

95
00:15:10,640 --> 00:15:24,980
If we're looking to peg, for example, a currency against the dollar, then we do need an oracle that can tell us what the price of the dollar is and provide an accurate reflection of what's happening in the real world.

96
00:15:25,140 --> 00:15:36,980
So there are some benefits to it, but, of course, if we're able to influence or compromise the oracle, that can have devastating effects on the DeFi project.

97
00:15:37,020 --> 00:15:40,780
And finally, we talk about DApps or smart contracts.

98
00:15:40,840 --> 00:15:45,220
Once again, this is the source code that's been run on the blockchain.

99
00:15:45,360 --> 00:15:48,120
It's source code that is immutable.

100
00:15:48,440 --> 00:15:51,480
It runs forever on the blockchain.

101
00:15:51,480 --> 00:15:52,900
It's been signed.

102
00:15:53,260 --> 00:16:00,070
It's available to be reviewed and seen by those that transact with it.

103
00:16:00,360 --> 00:16:05,160
And it forms the heart of the logic behind the DeFi platform.

104
00:16:06,220 --> 00:16:08,260
Okay, so how does this work in practice?

105
00:16:08,300 --> 00:16:10,120
So I'll just give you a quick example.

106
00:16:10,540 --> 00:16:16,660
Let's take a cryptocurrency investor and she decides she's got some Bitcoin.

107
00:16:16,820 --> 00:16:22,960
She's really worried about the fluctuation of the Bitcoin, which I believe is about $11,000 today.

108
00:16:23,160 --> 00:16:26,840
If we went back a couple of months, it was a lot less than that.

109
00:16:27,300 --> 00:16:33,320
But if we went back maybe two or three years, we had obviously a real spike in the prices.

110
00:16:33,500 --> 00:16:49,810
So with her hard-earned Bitcoin, she's got a choice either to keep that in Bitcoin or to potentially loan it out to a DeFi platform and gain some interest or gain some potential value from that.

111
00:16:50,160 --> 00:16:54,220
So she deposits some Bitcoin into the DeFi platform.

112
00:16:54,280 --> 00:17:00,960
There'll be a smart contract within the DeFi platform that will effectively receive that Bitcoin.

113
00:17:01,100 --> 00:17:05,720
It might wrap it up or transfer it into a token.

114
00:17:05,720 --> 00:17:10,100
And in my case, I'm going to use the DAI token as an example.

115
00:17:10,740 --> 00:17:27,360
And that basically allows our investor to take these DAI tokens and potentially push them into other DeFi products in order to earn interest or potentially just to peg the value of that Bitcoin against the dollar one to one.

116
00:17:27,360 --> 00:17:36,760
Because as I mentioned, DAI coin is a stable coin which is linked to the dollar.

117
00:17:37,120 --> 00:17:55,440
So she can then take that DAI coin and actually push it into potentially another platform which might actually go ahead and invest that DAI coin into other products which then could actually generate some level of return for her.

118
00:17:55,440 --> 00:18:07,100
At some point, she might then decide there's been some growth or perhaps there's been some stability in the DAI coin that it's time to cash out and she wants her Bitcoins back.

119
00:18:07,120 --> 00:18:23,700
So she can go back to the platform and effectively the platform might again do some checks against the oracle to see the current price between the DAI and the Bitcoin and then push that Bitcoin back to her.

120
00:18:23,700 --> 00:18:29,860
Now of course, this is what would happen in theory but sometimes that money might disappear.

121
00:18:30,380 --> 00:18:31,920
Why might it disappear?

122
00:18:31,920 --> 00:18:46,040
Well, potentially the DeFi platform which is holding these Bitcoins may not still have the Bitcoins that were provided by her and by other cryptocurrency investors.

123
00:18:46,800 --> 00:19:06,740
It is also possible and we talk about liquidity that there simply isn't enough cryptocurrency inside the DeFi to be able to pay out all the people that have loaned its money and that could also potentially be a problem.

124
00:19:06,900 --> 00:19:24,860
Or of course, maybe somebody might intercept or influence the logic within the DeFi platform and basically change the smart contract to maybe push the money somewhere else rather than to the person that had requested it.

125
00:19:25,360 --> 00:19:35,360
So let's talk a little bit about the attacks on the blockchain and smashing stacks, breaking blocks or loosening the chains for profits.

126
00:19:36,060 --> 00:19:54,160
So once again, the high-level scenario of our investor or person that has some cryptocurrency looking to engage with the DApp ecosystem in order to get some value from their currency.

127
00:19:54,800 --> 00:20:03,280
You've got the Oracle and the exchanges on the right-hand side that this particular DeFi application or platform is relying on.

128
00:20:03,280 --> 00:20:10,380
And of course, we might have a corporate entity that is owning and running and governing the DeFi platform.

129
00:20:10,440 --> 00:20:15,960
So let's look at some of the potential attacks that could occur throughout this lifecycle.

130
00:20:15,960 --> 00:20:20,960
Firstly, from the user's perspective, users can be phished.

131
00:20:20,960 --> 00:20:24,860
Their passwords and keys could potentially be stolen.

132
00:20:24,940 --> 00:20:33,220
As we've seen in the case of the Twitter attack that happened just over a month ago, social engineering scams are possible too.

133
00:20:33,300 --> 00:20:44,500
So hackers might not necessarily get in and steal the keys, but if they can convince the person to transfer some money across, then they can lose that way.

134
00:20:44,600 --> 00:20:58,300
And of course, there are potential vulnerabilities in the software that the user has downloaded or is using, which might intercept communications and potentially steal the keys.

135
00:20:58,440 --> 00:21:15,300
If we move into the distributed environments, and again, a good example of this is Ethereum, which leverages the ERC-20 tokens, there are still vulnerabilities in smart contracts, and we'll talk a little bit about more of those.

136
00:21:15,300 --> 00:21:18,550
There is the possibility of key compromises.

137
00:21:18,880 --> 00:21:32,480
There are DDoS attacks, potential man-in-the-middle attacks, often that occur because there is often an interface between these DApps, a web interface or an API, and again, its users.

138
00:21:32,880 --> 00:21:43,560
And so again, depending on where the keys are and the way things get handled, there is some possibility to perform some attacks there.

139
00:21:43,640 --> 00:21:57,920
From a protocol perspective, again, all of these distributed apps, Ethereum itself, it's still relatively new, and there may still be some underlying vulnerabilities in the way that the distributed system is working.

140
00:21:58,600 --> 00:22:00,080
And I guess we still have to...

141
00:22:00,080 --> 00:22:03,820
time will tell whether some of those get out there in the wild or not.

142
00:22:04,720 --> 00:22:17,380
The oracles themselves, so again, the whole purpose for having the blockchain and these cryptocurrencies is that they are inherently secure and built with all the wonderful cryptography and so on that's inside them.

143
00:22:17,440 --> 00:22:25,980
But when they start relying on third parties, for example, the oracles and exchanges, that's potentially when things can go wrong.

144
00:22:26,220 --> 00:22:40,480
So once again, the oracle might be manipulated to provide the wrong interest rates, for example, or an exchange might make a mistake and publish the wrong rates, which could then lead to people taking advantage of that.

145
00:22:41,360 --> 00:22:47,240
One thing that we've looked at in our research is the corporate entity itself.

146
00:22:47,240 --> 00:22:59,740
And this is really important because these apps are run by people and by a company, often a startup, maybe it's a small organization to start, to begin with that grows.

147
00:22:59,780 --> 00:23:10,300
But there are people inside that organization that communicates with customers and with individuals and those that are invested in the tokens and the cryptocurrencies.

148
00:23:11,640 --> 00:23:18,660
Some of those people also might operate and have access to the keys and the wallets.

149
00:23:18,760 --> 00:23:22,460
Some of them might have to update the smart contracts from time to time.

150
00:23:22,960 --> 00:23:30,840
And so the corporate entity itself needs to have a level of security that we would expect of a bank or another financial institution.

151
00:23:31,020 --> 00:23:41,320
But of course, because a lot of these organizations are still growing, they may not necessarily have matured yet to provide all the right OPSEC that we would expect.

152
00:23:41,720 --> 00:23:57,480
So another route into this environment could potentially be through the entity or the organization that is running the platform, targeting either the employees or some of their resources, their email, their social media, et cetera.

153
00:24:02,240 --> 00:24:14,660
So if we look just in the last couple of months, there have been quite a few hacks that have taken place in the DeFi world, most notably the BZX hack, which I'll talk about a little bit later.

154
00:24:15,020 --> 00:24:26,840
But literally within a couple of days, they lost around a million dollars in a very sophisticated attack, which impresses a lot of folks that have looked into this.

155
00:24:27,420 --> 00:24:29,680
Maker itself, it had a price crash.

156
00:24:29,680 --> 00:24:37,380
It wasn't specifically a deliberate attack, but there was a drop in ether that happened for a few seconds.

157
00:24:37,380 --> 00:24:59,240
And this landed up causing a lot of mayhem and Maker actually had some liquidity challenges, which actually forced a lot of the users on the platform to have their loans effectively canceled in order for Maker to ensure that it had the right level of liquidity.

158
00:24:59,420 --> 00:25:10,240
And there's a big class action suit going on right now for those individuals that have lost money by loaning money into Maker and not being able to get it out again.

159
00:25:11,120 --> 00:25:19,420
Again, later in the year, we had INBTC being hacked by an ERC-777 re-entry attack.

160
00:25:19,460 --> 00:25:27,880
Now, for those of you that know about the DAO attack that happened a few years ago on the Ethereum platform, this is a very similar type of attack.

161
00:25:28,140 --> 00:25:42,720
And interestingly, a day later, there was another platform, LendFme, that lost $25 million because they were using the same source code in their smart contract as another organization.

162
00:25:43,240 --> 00:25:48,280
So again, these things kind of can happen in various different ways.

163
00:25:48,880 --> 00:26:13,320
Talking a little bit about the BZX hacks, and I don't want to spend too much time in this area, but when we think about hacks and exploits, the ninjas of the security community are running machine code and machine-level assembly to smash the stacks and do buffer overloads and all sorts of things.

164
00:26:13,540 --> 00:26:16,420
And what we see here is a different type of hack.

165
00:26:16,420 --> 00:26:36,840
We see that somebody with a lot of knowledge was able to leverage the different protocols, leverage the different DEFI protocols out there, DYDX, which was allowing loaning, Compounds, which was allowing interest, the Kyber network and the Uniswap network,

166
00:26:36,840 --> 00:26:40,860
which were allowing people to swap coins.

167
00:26:41,020 --> 00:26:56,140
And they exploited basically a situation where an exchange was providing a very favorable rate of interest, we call it interest or pricing, for a particular coin combination.

168
00:26:56,140 --> 00:26:57,840
And they realized this.

169
00:26:58,240 --> 00:27:08,500
They took advantage of something called a flash loan, which is a very interesting concept in the DEFI world that allows people to borrow money without providing any collateral.

170
00:27:08,800 --> 00:27:16,520
As long as they borrow the money, carry out a transaction, and pay the money back very quickly, the platform is happy to support that.

171
00:27:16,520 --> 00:27:19,180
And that's exactly what happened in this particular instance.

172
00:27:19,180 --> 00:27:24,380
So they borrowed some money from the DYDX loan platform, 10,000 ETH.

173
00:27:24,380 --> 00:27:30,580
They then did some fancy transactions and manipulations.

174
00:27:30,820 --> 00:27:36,680
They took advantage of the price hedge, if you like, that they found in the market.

175
00:27:37,380 --> 00:27:45,700
And then they were able to then pay back that loan and profit around $300,000 for that particular transaction.

176
00:27:46,520 --> 00:27:53,060
Literally a few days later, they did the same thing and managed to earn another $600,000.

177
00:27:55,570 --> 00:28:04,210
So in response to this, the BZX actually made some really dramatic statements, which I'd like to read out.

178
00:28:04,290 --> 00:28:12,470
This attack was one of the most sophisticated we've ever seen, possibly only with an extremely in-depth knowledge of every DEFI protocol and its tools.

179
00:28:12,870 --> 00:28:15,010
This space is evolving quickly.

180
00:28:15,130 --> 00:28:23,110
The security is becoming increasingly more dire as the barriers to entry for executing an exploit drop to zero.

181
00:28:23,110 --> 00:28:29,050
There is no analog for this in the traditional finance system and we're now in uncharted territories.

182
00:28:29,610 --> 00:28:38,710
So if that doesn't give you a huge amount of confidence, then you might want to think twice about using these particular platforms.

183
00:28:38,910 --> 00:28:53,390
But with anything, this happened on the internet and e-commerce many moons ago, eventually the maturity of the industries get there and it becomes harder to do these types of things.

184
00:28:54,670 --> 00:29:06,930
So, again, if you're looking to put some money into one of these platforms, how might you assess whether they're good, they're safe, they're bad, etc.?

185
00:29:06,930 --> 00:29:09,310
So that's where our research comes in.

186
00:29:09,310 --> 00:29:21,470
And the first thing we did, which, again, I find quite interesting, you know, you think you've got a good idea and you do some googling and then you find out, actually, quite a lot of other people have come up with the same idea.

187
00:29:21,890 --> 00:29:25,010
So it's part of the early research.

188
00:29:25,010 --> 00:29:30,130
We found that there is an open source group or groups.

189
00:29:30,130 --> 00:29:48,310
There's the DefiScore as well as DefiWatch and the Codify project as well that essentially are starting to build out an index of various features on the Defi platform that give us some indication of how risky they may be.

190
00:29:49,150 --> 00:30:00,330
So some of the types of things that the DefiScore provides, for example, is looking at, you know, has this particular platform carried out any smart contract audits?

191
00:30:00,330 --> 00:30:01,590
How many audits?

192
00:30:01,690 --> 00:30:04,070
Do they use a time lock or do they not?

193
00:30:04,230 --> 00:30:11,890
Have they implemented some form of multi-signature for protecting those very special admin keys that I spoke about earlier?

194
00:30:12,770 --> 00:30:20,870
They also then look into some additional factors which are more linked to the financial viability of the platform.

195
00:30:20,870 --> 00:30:26,870
And that includes the liquidity index, centralization index and utilization index.

196
00:30:26,870 --> 00:30:35,650
But all of these things come together to form a score out of 10 which is there to try and help and guide those that want to potentially put money in.

197
00:30:35,650 --> 00:30:46,770
You might get all excited about that 13% rate you're going to get but then you might want to check to see whether that particular platform has scored very well on a DefiScore or on some other score.

198
00:30:47,770 --> 00:30:51,750
So with that in mind, we thought we would build upon this platform.

199
00:30:52,070 --> 00:31:02,030
And one thing that we did notice is that, again, the communities that developed this actually form part of the community and part of the crypto community.

200
00:31:02,030 --> 00:31:07,610
So the focus of their scoring was very much based on some of the things in the crypto world.

201
00:31:07,610 --> 00:31:19,750
And so we, coming from a, let's say, a wider cybersecurity perspective, started to think about some of the other OSINTs that we might be able to find about those companies.

202
00:31:19,770 --> 00:31:21,510
So we took a traditional approach.

203
00:31:21,510 --> 00:31:25,610
We looked at IP addresses, DNS records.

204
00:31:25,970 --> 00:31:31,090
We looked at the email platform that these particular providers are using.

205
00:31:31,210 --> 00:31:40,330
We looked at a couple of open sources connected to the internet, mail servers, web servers, et cetera.

206
00:31:40,650 --> 00:31:45,530
We looked on LinkedIn to see what kind of social media platform they have.

207
00:31:45,530 --> 00:31:51,930
We did some third intel to see whether there's any chatter involved in these particular projects.

208
00:31:52,110 --> 00:32:04,450
We also assessed the bug bounty and how ready or how mature they are in using the hacking community to find vulnerabilities and publish those.

209
00:32:04,450 --> 00:32:11,450
And also whether they were open source or closed source and whether there was any breach history.

210
00:32:11,970 --> 00:32:28,750
Finally, we also looked at privacy and cookies just to kind of get a perspective on whether, from a regulatory perspective, these guys are starting to think about some of those really important things that regulators look out for when you're dealing with individuals and consumers,

211
00:32:28,750 --> 00:32:31,890
especially those, for example, in Europe under GDPR.

212
00:32:32,810 --> 00:32:43,690
On the crypto side, again, we kind of thought through the various indexes that DEFI scored already provided.

213
00:32:43,750 --> 00:32:53,510
And then we thought about a few other things like general audits, publication of whether they've been assessed by third parties.

214
00:32:54,110 --> 00:33:12,090
We wanted to look into cryptocurrency transactions and whether there was any links between fraudulent transactions and the platforms, the financial backing, and also whether there's any mention of KYC, your client's procedures.

215
00:33:12,090 --> 00:33:25,090
Once again, going back to the beginning of my talk, if any of these platforms start to receive cryptocurrency funds as a result of a fraud or an attack, then they shouldn't be accepting them.

216
00:33:25,110 --> 00:33:34,170
Or potentially, if they have accepted them, maybe there's something we can do to seize those assets before they go back to those that have stolen them.

217
00:33:36,550 --> 00:33:48,470
So I guess just a caveat in terms of the limitations of our research, we sampled 17 projects, both a mix of large, medium, and small DEFI projects.

218
00:33:48,490 --> 00:33:50,670
And we did this over a period of seven days.

219
00:33:51,910 --> 00:33:59,050
Because of the type of testing that we performed, which was very non-intrusive, obviously we don't have any permission to do any testing.

220
00:33:59,430 --> 00:34:02,010
So we could only look at open source information.

221
00:34:02,550 --> 00:34:05,890
And as a result of that, some of the findings might be false positives.

222
00:34:06,290 --> 00:34:12,770
And of course, there's certain things that are very hard for us to gather from the open source.

223
00:34:13,650 --> 00:34:19,350
But also, there are quite a few important things that we definitely were not able to look at.

224
00:34:19,350 --> 00:34:30,390
And things like incident response planning, being able to deal very quickly with a breach scenario where perhaps the keys have been stolen, or there is a smart contract vulnerability.

225
00:34:30,870 --> 00:34:32,450
Key generation storage.

226
00:34:32,450 --> 00:34:36,810
People talk about the fact that they're using multi-sigs, but are they really?

227
00:34:37,310 --> 00:34:38,950
Has that been audited?

228
00:34:39,950 --> 00:34:41,870
Have they done all the right things?

229
00:34:42,570 --> 00:34:44,790
The oracles and exchanges.

230
00:34:44,790 --> 00:34:47,550
We didn't look too much into that world.

231
00:34:48,310 --> 00:34:53,130
And of course, some of these smart contracts themselves might be linked to other smart contracts.

232
00:34:53,130 --> 00:34:58,570
And I mentioned that protocol fuzzing and security is something that we didn't get into either.

233
00:34:59,370 --> 00:35:17,270
In terms of the scope and the way that we carried out the testing and the scoring, we did a subjective scoring, fairly simple crude approach where we allocated a score of 1 if the practices are very poor, a 2 for medium, or a 3 for high.

234
00:35:17,590 --> 00:35:26,810
We also took the view that we wouldn't necessarily skew any of the findings and weights against particular categories.

235
00:35:26,930 --> 00:35:36,230
It's recognized that certain types of tests are going to have more of an impact than others, but also that might depend on the type of attack that we're worried about.

236
00:35:36,370 --> 00:35:43,170
So if we're worried about phishing attacks, then certain types of dimensions will actually carry more weight than others.

237
00:35:43,210 --> 00:35:55,090
If we're more worried about, for example, the smart contracts having poor code, then we would have a higher weight on some of the categories that link into smart contracts.

238
00:35:56,550 --> 00:35:59,910
So without further ado, I'll talk about some of the results.

239
00:36:00,050 --> 00:36:08,490
And as you can see on the left-hand side, we've basically segmented the vendors into large, medium, and small.

240
00:36:08,830 --> 00:36:17,410
The red, again, are those organizations that have been marked as having very low security, in our opinion.

241
00:36:18,110 --> 00:36:25,250
Those in the middle with the yellow, and those that are doing pretty well in the green.

242
00:36:25,730 --> 00:36:35,210
And as you can see, if we start with a multi-sig, we have quite a lot of small and mid-sized companies that haven't gone with this multi-sig approach.

243
00:36:35,650 --> 00:36:45,990
And I guess it's a bit disappointing, in a way, because a lot of these projects are small, but they can grow very big very quickly.

244
00:36:45,990 --> 00:37:00,070
And if they haven't done the basics of setting up their wallets and their key administration the right way in the early days, then it can be quite difficult to retrofit that as the project goes from zero to hero.

245
00:37:00,970 --> 00:37:09,070
Also, interestingly, in the large category, there was one that wasn't using multi-sig, which, again, was quite a surprise.

246
00:37:09,770 --> 00:37:18,410
And these multi-sigs also range from 2 of 2 all the way to 3 of 5 or 3 of 8.

247
00:37:18,610 --> 00:37:39,810
So there were quite a few that are starting to adopt what I call very good practices around having potentially quite a few multi-signatories having access to the keys, often distributed across different organizations as well, to really make it effective.

248
00:37:40,510 --> 00:37:46,070
But one of the issues here, again, is that it's very hard to tell exactly how this was implemented.

249
00:37:46,510 --> 00:37:50,850
You can have multi-signatures, but you could have three signatures.

250
00:37:50,850 --> 00:37:53,730
Maybe they're paper-based, but they're all in the same place.

251
00:37:54,650 --> 00:38:02,250
And therefore, the kind of op-sec on the key management is something that is very hard to distill.

252
00:38:02,830 --> 00:38:18,630
There also weren't many talking about, if not any, talking about audits that these companies had done on their key generation process, which I think is fundamental and something that happens a lot in the traditional finance industry today.

253
00:38:19,610 --> 00:38:20,590
Time locks.

254
00:38:20,590 --> 00:38:25,410
So once again, I mentioned this earlier, I think it's a pretty good idea to do this.

255
00:38:25,410 --> 00:38:37,850
It gives some confidence to those that are using the platform that if something goes wrong by mistake or potentially, again, because somebody's done something bad, there is a way to roll back.

256
00:38:37,850 --> 00:38:46,270
There's a way to monitor and get ahead of the transactions and do something about it.

257
00:38:46,270 --> 00:38:53,510
And once again, you can see a mixture of large, medium, and small companies that actually haven't implemented this.

258
00:38:54,310 --> 00:39:07,030
As we move on to the other thing of interest on the time lock side was, again, some projects are using 48 hours, some are using four hours, others 72.

259
00:39:07,030 --> 00:39:13,950
Again, I kind of, as a more conservative individual, would rather go with a slightly longer period.

260
00:39:13,950 --> 00:39:37,010
It might mean that certain transactions take a little bit longer to take place, but at least I know that if I put my Bitcoin into that platform and something goes wrong, I've got a chance of keeping it rather than the purest approach of decentralization where effectively the transactions happen and there's nothing you can do about it.

261
00:39:38,590 --> 00:39:48,630
From an Oracle perspective, again, some interesting results on those that are using Oracles, external Oracles, those are some that are using their own.

262
00:39:49,310 --> 00:40:05,630
And we found some interesting concentration risk in this space where quite a few organizations are using the same external Oracle, so that might potentially ring some alarm bells if those particular Oracles are not set up in the right way.

263
00:40:05,630 --> 00:40:12,530
Something that was really disappointing was no real discussions around KYC.

264
00:40:12,730 --> 00:40:25,530
And again, I think this is really important in the longer term if you want to have a legitimate business that's going to deal with the kind of wider markets, the wider finance markets.

265
00:40:26,030 --> 00:40:33,470
And this is something that for whatever reason these players are not necessarily too focused on today.

266
00:40:33,470 --> 00:40:46,210
I suspect that as the industry matures and some of the platforms do want to become more regulated, this will have to change.

267
00:40:46,750 --> 00:40:50,270
On the smart contract side, again, kind of a mix.

268
00:40:50,270 --> 00:41:02,770
For this particular dimension, we looked at whether the smart contracts were being reused by other organizations, and we found quite a few of those.

269
00:41:02,770 --> 00:41:13,010
A couple of smart contracts that had been compiled with older versions of compilers, some of which are known to have security weaknesses in them.

270
00:41:13,670 --> 00:41:25,070
And then quite a few that actually were not very forthcoming with publishing certain information about their smart contracts.

271
00:41:25,610 --> 00:41:31,110
We did see some very positive signs on the side of smart contract audits.

272
00:41:31,110 --> 00:41:35,950
And here are quite a few of the platforms are doing regular audits.

273
00:41:36,030 --> 00:41:43,270
It kind of ranged from 2 to 15, and that kind of got me thinking, well, maybe you need to audit these things a bit more frequently.

274
00:41:43,830 --> 00:41:55,050
But what was quite strange was that probably aligned to the whole open-source methodology, the audit results were open-sourced as well as all of the audit reports.

275
00:41:55,430 --> 00:42:10,870
And this contains a wealth of information about what the testers did, pieces and snippets of source code, and various types of vulnerabilities that they found, which personally I think might be a little bit unnecessary.

276
00:42:11,430 --> 00:42:13,730
I think it's good that an audit has happened.

277
00:42:13,730 --> 00:42:30,550
It's good to understand that remediation was taking place, but really to show the full-blown audits every time might be giving a little bit away, especially if those testers didn't find all the holes and perhaps there are a few extra things that aren't there.

278
00:42:30,970 --> 00:42:39,330
Great news for the community at DEF CON that are involved in bug bounty programs and supporting them.

279
00:42:39,550 --> 00:42:46,410
Some good indications that the DEFI industry is taking this on board as well.

280
00:42:46,410 --> 00:42:48,410
And if you're interested, go and have a look.

281
00:42:48,410 --> 00:42:53,630
Programs vary from $10,000 all the way up to $250,000.

282
00:42:54,510 --> 00:42:57,490
So put down those laptops and get started.

283
00:42:57,950 --> 00:43:13,390
Interestingly enough, a few projects are actually not offering to pay you in real money, but to pay you in their own tokens, which again potentially could be very valuable or potentially not, depending on the circumstances.

284
00:43:15,410 --> 00:43:25,570
If we have a look at the general OSINT, one of the first things we did was we looked at whether these particular organizations had been hacked in the past.

285
00:43:25,950 --> 00:43:34,650
I decided to redact the findings in that section because it might indicate some of the organizations involved in our study.

286
00:43:35,610 --> 00:43:45,210
What I can say is that there was a mix of large, medium and small organizations that have been hit in the past.

287
00:43:46,050 --> 00:43:49,510
And again, is that an indicator that the company is bad?

288
00:43:49,510 --> 00:43:57,710
Or is it an indicator that because they've been hit, they've actually now put in a lot better controls, they've learned their lesson and they're improving their security?

289
00:43:58,050 --> 00:44:04,690
And often in my experience, those that have a breach do come out of it a lot better in the longer term if they're still around.

290
00:44:06,130 --> 00:44:08,250
So that's kind of one factor.

291
00:44:08,690 --> 00:44:18,350
We did look into credentials that are on the web and on the darknet that have been sold for particular platforms.

292
00:44:18,350 --> 00:44:20,790
And that was on average pretty good.

293
00:44:20,790 --> 00:44:28,090
As you can see, there was a surprisingly large organization that had quite a lot of data published.

294
00:44:28,090 --> 00:44:37,390
And this is something that we will need to take up with the vendor directly because I think it's something that they should be looking into.

295
00:44:39,770 --> 00:44:41,670
But otherwise, pretty good.

296
00:44:41,710 --> 00:44:45,050
And once again, this is the kind of thing that's a bit hit and miss.

297
00:44:45,190 --> 00:44:50,710
But it was interesting that we did get two results coming through that particular dimension.

298
00:44:51,190 --> 00:44:52,870
Anti-spam protection.

299
00:44:53,250 --> 00:45:05,490
Obviously, we discussed how important phishing is to either the users that could be targeted and also the individuals that are working for the platform.

300
00:45:05,910 --> 00:45:20,370
And here, we did find that the maturity within the space was actually okay for protocols like SPF but for DMARC, it was actually around 50%.

301
00:45:20,370 --> 00:45:24,950
And for DECIM, it was very low as well.

302
00:45:24,950 --> 00:45:41,410
So I think there's definitely some room for improvement for these companies to be setting up their DNS records and their mail records so that they can better protect themselves and their customers from phishing-related attacks.

303
00:45:41,810 --> 00:45:54,730
I mentioned infrastructure and we took a very hands-off approach to this, so we looked in Shodan and pointed some of the project IP addresses to the Shodan platform.

304
00:45:54,890 --> 00:45:58,170
And we came up with a couple of interesting results.

305
00:45:58,430 --> 00:46:05,250
Some unnecessary ports, some remote access facilities that perhaps shouldn't be there.

306
00:46:05,370 --> 00:46:13,170
But again, kind of a mix and something that you probably would find if you did a proper scan on a lot of organizations.

307
00:46:13,590 --> 00:46:21,410
But definitely something that needs improvement for the reasons that I've spoken about before.

308
00:46:21,430 --> 00:46:30,230
We dipped into the Darknet chatter and we had a look to see who was talking about particular projects.

309
00:46:30,790 --> 00:46:42,830
And again, we found some information, nothing earth-shattering, but definitely some talk about targeting or weaknesses, vulnerabilities, etc.

310
00:46:43,030 --> 00:46:59,870
And again, this is something that probably the project owners should definitely be dialing into just to make sure there's nothing major that's being discussed and giving them a head start to try and fix any issues that arise.

311
00:47:00,630 --> 00:47:03,430
From a social media perspective, we just chose LinkedIn.

312
00:47:03,430 --> 00:47:08,410
We had a look at individuals that belong to these projects.

313
00:47:10,050 --> 00:47:16,030
Interestingly, I was looking for some CISOs or kind of security managers and I didn't find many.

314
00:47:16,330 --> 00:47:29,330
So either those involved are pretty good with their own OSINT, or perhaps, and I think this is more likely, there aren't too many people in these organizations that have the title of CISO or security manager.

315
00:47:29,490 --> 00:47:36,490
We saw a lot of CTOs, we saw a lot of COOs, but not that many people with a security title.

316
00:47:36,970 --> 00:47:41,250
And that, again, is just something to be wary of.

317
00:47:41,250 --> 00:47:54,810
If you don't have anyone focused and dedicated in the space, then you might fall short and that's kind of why you need to take these things a little bit more seriously.

318
00:47:54,990 --> 00:48:04,110
Quite a few people in the IT department publishing information about themselves and, again, that could be potentially used as a target.

319
00:48:05,250 --> 00:48:07,570
Kind of very old OSINT around Whois.

320
00:48:07,570 --> 00:48:09,650
Most people did this very well.

321
00:48:09,830 --> 00:48:19,190
We did come across one company that was allegedly in stealth mode, but had leaked some of the details in the Whois information.

322
00:48:19,510 --> 00:48:22,050
But pretty good on that side.

323
00:48:22,490 --> 00:48:26,270
And then data privacy policies as well as cookies.

324
00:48:26,390 --> 00:48:33,290
We did a quick check on whether these particular aspects would be taken care of on the websites.

325
00:48:33,290 --> 00:48:45,070
We found that most were not compliant to GDPR and, actually, some of the privacy policies fell short of some of the requirements that are expected.

326
00:48:45,350 --> 00:48:55,970
So, once again, these organizations dealing with consumers might need to dial into this vector as well because it could come back to bite them.

327
00:48:55,970 --> 00:49:14,690
On a hosting side and as well as on an email platform side, we saw some concentration risk on particular vendors being chosen to host websites to support DDoS platforms and also to support the email platform as well.

328
00:49:16,110 --> 00:49:25,270
So, I guess some of the highlights, again, smart contracts, 64% were being audited but the full results were published.

329
00:49:25,910 --> 00:49:33,410
64% of the smart contracts required some kind of improvements either because of reuse or older compilers being used.

330
00:49:34,050 --> 00:49:39,670
Some vendor concentration in the use of external oracles.

331
00:49:40,550 --> 00:49:43,090
Time locks, again, 58% not using them.

332
00:49:43,090 --> 00:49:44,670
That's a bit disappointing.

333
00:49:44,830 --> 00:49:56,530
Almost 50% not using multi-signatures and missing audits in the key management space as well as per KYC and privacy activities.

334
00:49:58,210 --> 00:50:16,430
Right, on the OSINT side, great registration on the IP, mixed DNS results as I mentioned, some chatter going on, credentials being dumped per cookies and privacy policy management and so on.

335
00:50:18,550 --> 00:50:32,330
So, with the scoring, we basically put together our score and allocated out the various companies against the score and you kind of see kind of a mix.

336
00:50:32,330 --> 00:50:34,990
It's not a huge differential.

337
00:50:35,370 --> 00:50:40,610
Some of that differentiation was coming in to very particular dimensions that we assessed.

338
00:50:41,590 --> 00:50:59,550
Interestingly, looking at the DEFI score itself, we actually found that of the companies we looked at, 50% of them had the same kind of ranking as our scoring, but actually 33% were worse and 70% were slightly better.

339
00:51:00,150 --> 00:51:11,330
Therefore, our conclusion in this is definitely that we need a combination of both crypto and Open OSINT in order to tackle this thing correctly.

340
00:51:11,330 --> 00:51:31,130
By breaking it up into large, medium and small, some of the results that can be seen there do indicate, as expected, the larger projects probably are ahead in certain areas but definitely there is some room for improvement.

341
00:51:32,250 --> 00:51:55,330
Similarly, when we look at the OSINT, we can see there that there are a couple of large projects that actually fall behind the mark compared to some of the medium and small businesses but often the small and medium ones are the ones that actually do need to improve.

342
00:51:57,550 --> 00:52:06,990
Okay, so wrapping up, our conclusion is that DEFI definitely needs to do even more to maintain trust and stay out of the headlines.

343
00:52:07,310 --> 00:52:25,950
Whilst we are encouraged that there are some community-driven activities to provide transparency and raise the bar, not everybody is covered in these community-driven activities and there are a few extra dimensions around security and OSINT that we think need to be added.

344
00:52:26,090 --> 00:52:30,050
A lot of goodness out there but not really full consistency.

345
00:52:30,650 --> 00:52:39,770
And as I described, quite a few of the larger players that are mature but there are some that are not fully there and are missing the mark.

346
00:52:39,970 --> 00:52:46,230
We did find some isolated, highly vulnerable indicators of potential issues.

347
00:52:46,630 --> 00:52:58,230
We do see some high potential for phishing attacks given the concentration of usage of certain email platforms that the industry is relying on.

348
00:52:58,230 --> 00:53:11,110
And also some smart contracts improvements on the management of those contracts that need to be done, especially around reuse and looking into the compilers that are compiling the code.

349
00:53:11,830 --> 00:53:16,210
Once again, I think I mentioned this a few times but just wanted to repeat it again.

350
00:53:16,210 --> 00:53:18,690
Lack of transparency on the key OPSEC.

351
00:53:19,110 --> 00:53:28,030
Again, if those keys get stolen, there is a chance of the smart contracts being rewritten and changed.

352
00:53:28,310 --> 00:53:31,370
But we don't know how well that's being done.

353
00:53:31,770 --> 00:53:39,010
And I think the industry and stakeholders would be keenly interested to see how that happens in practice.

354
00:53:39,290 --> 00:53:47,250
And as we move towards a more regulated environment, data privacy and KYC are also extremely important.

355
00:53:48,010 --> 00:53:50,730
So, some final recommendations.

356
00:53:50,730 --> 00:53:53,830
Lock down your G Suites and Office 365 environments.

357
00:53:53,830 --> 00:53:59,490
Train your staff to minimize public information leaks and phishing attacks.

358
00:53:59,970 --> 00:54:07,870
Dip into the world of fake intelligence and look into stolen credentials and chatter just to make sure that you're not on the list.

359
00:54:08,110 --> 00:54:20,190
Check out and make sure that your dependency on vendors is appropriate and that there's not too much concentration risk associated with certain suppliers, vendors, oracles, etc.

360
00:54:20,190 --> 00:54:25,450
Make sure that you're using the right level of security on your email domains.

361
00:54:27,520 --> 00:54:32,320
On the crypto side, again, tuning into the threat intelligence is important.

362
00:54:32,560 --> 00:54:36,180
Regular code reviews but don't necessarily publish everything.

363
00:54:37,260 --> 00:54:39,660
Provide greater assurance over the OPSEC.

364
00:54:40,300 --> 00:54:44,040
Ensure that those oracles are protected and can be really trusted.

365
00:54:44,500 --> 00:54:49,860
For those of you that are not implementing bug bounty programs, have a look at them.

366
00:54:49,860 --> 00:54:51,580
I think there's a lot of value in them.

367
00:54:52,900 --> 00:54:55,840
And make sure the keys are adequately protected.

368
00:54:56,840 --> 00:55:04,920
Whilst I know there's a strong move towards decentralization, I do think an element of governance for centralization is the way to go.

369
00:55:05,580 --> 00:55:12,740
And I see that as the kind of future stable way in which DEFI projects will succeed.

370
00:55:13,980 --> 00:55:18,340
From a research perspective, I think that there's still quite a lot to do here.

371
00:55:18,700 --> 00:55:28,420
It would be great to have an automated scoring process, very similar to what DEFI score has for the crypto controls.

372
00:55:28,600 --> 00:55:33,060
I think we can expand out into the general OSINT as I mentioned before.

373
00:55:33,760 --> 00:55:43,640
It would be great to have some better tools and visibility on smart contract code that's automated, that can be published and is available to the community.

374
00:55:43,640 --> 00:55:54,740
I think further adoption of transaction analysis for KYC and fraud is going to be really important to make DEFI kind of hit the prime time in the future.

375
00:55:54,900 --> 00:56:08,400
And of course, doing protocol stress testing and further digging into the key management OPSEC is also really important.

376
00:56:09,360 --> 00:56:17,420
With that, I'd like to give a very special thanks to some folks that helped me through this presentation.

377
00:56:17,900 --> 00:56:25,640
Specifically, Danny Howard, who was responsible for the illustrious slides that have been put together.

378
00:56:26,240 --> 00:56:29,200
Nick and Ferez helped out with some of the research.

379
00:56:29,540 --> 00:56:40,520
This particular piece of work also couldn't have been done without leveraging a lot of valuable resources from the DEFI score project, the DEFI watch project, and also DEFI Prime.

380
00:56:40,880 --> 00:56:48,920
So I encourage you to link out, reach out to these particular sites if you want to learn more.

381
00:56:49,660 --> 00:56:52,620
And then I think I might have a little bit of time for questions.

382
00:56:52,800 --> 00:56:58,600
So I am listening in on the presentation that's happening right now.

383
00:56:58,600 --> 00:57:03,700
So feel free to reach out with any questions that I can answer.

384
00:57:04,160 --> 00:57:09,940
And I appreciate it and hope to see you next year in Vegas for another chat.

385
00:57:12,440 --> 00:57:14,260
Goodbye and stay safe.