start	end	text
2870	4470	Hi, good morning, everyone.
4830	7550	I hope you're well and enjoying your virtual conference.
7930	12250	My name is Ryan Rubin and today I'm going to be talking about decentralised finance.
12510	14050	Is it ready for prime time?
15310	17830	I'm really sorry not to be in Vegas today with all of you,
17830	21450	but all I can say is here in the UK, it feels pretty hot
21450	23590	and it's almost like we are in the desert.
26090	27890	First, the usual disclaimer.
27890	31510	I'd like to confirm that the views expressed in this talk are my own
31510	35870	and are not representative of any views from my employer.
36370	41350	Of course, no animals were hurt other than potential unicorns in this research.
42770	46190	So today I'm going to give a quick introduction,
46190	49890	give you a 101 on what decentralised finance is all about,
50410	52390	talk a little bit about the attack landscape
53130	57590	and how people might target this particular protocol.
58630	63050	And then I'll also talk about a methodology that we've introduced,
63050	66270	which effectively looks at key indicators of vulnerabilities
66270	71030	and how we might be able to assess DEFI projects in the future.
71050	74870	I'll present the results and wrap up with some conclusions.
76270	80670	So a little bit about myself. My name is, once again, Ryan Rubin.
80670	84410	I've been in the security industry for the last 23 years,
84410	87210	covering a whole range of different topics.
87330	91890	Last couple of years I've had a big interest in blockchain security
91890	94550	as well as cyber insurance.
94830	98790	And I'm looking forward to sharing some insights here today.
99010	102530	I actually start this talk where I kind of left off last year
102530	109010	when I presented a talk in the blockchain village on a cryptocurrency heist.
109010	113170	And what I found quite interesting during that investigation
113170	117730	was that as the attackers started to move their money and funds
117730	120390	around the Ethereum blockchain,
120390	125610	they started to put some of their funds into a DEFI platform
125610	129130	and actually converted quite a lot into something called the DaiCoin,
129130	131070	which I'd actually never heard of before.
131570	133890	And after doing a bit of research,
133890	139930	I got quite interested in the whole DEFI protocol
139930	145230	and kind of the alternative finance options that it has.
145730	149770	What startled me was that the attackers of this particular heist
149770	151630	were obviously ahead of the game
151630	156510	and realized that they needed to put their cryptocurrency somewhere
156510	161090	in order to ensure that the pricing did not fluctuate
161090	163650	and the value or the proceeds of their crime
163650	168470	did not reduce as the price of Ethereum drops.
169990	175730	But this talk is not just about hackers and fraudsters
175730	179870	that might be leveraging various platforms
179870	184770	to realize their investments in the blockchain world.
185050	189970	It's actually more generally about many of us
189970	192050	that may be looking at alternative ways
192050	194850	of financing and investing in the future.
197270	201950	So I came up with this research hypothesis which states,
201950	205850	firstly, DEFI is becoming really popular
205850	209610	and I'll talk a little bit about that as the show goes on.
209730	212450	But as their popularity grows,
212450	215330	can they withstand the various types of attacks
215770	218650	that are going to be attracted by their popularity?
219990	222710	Also, is there a way that we can measure the security posture
222710	226830	of DEFI projects and do so in a way that's non-invasive?
227970	230730	Of course, the assumption we have is that
230730	235110	they must have good OPSEC in order to be in this business, right?
238080	240020	So why carry out this research?
240020	243240	Well, unfortunately, people are still getting hacked.
243780	245580	There are several stories in the news
245580	249780	and quite a few that I'll discuss as the talk unfolds
249780	253240	indicating that there are still compromises out there.
253240	255700	People are still making money out of this.
255940	259940	And therefore, it's really important to raise awareness
259940	264220	of security-related issues,
264220	267720	not only to those in the security community,
267720	271100	like many of you that are attending the talks today,
271100	273580	but also those outside that community,
273580	275320	including a lot of blockchain developers
275320	281740	who, I understand, frequent the BCS village.
283080	285600	I also wanted to use this research
285600	287620	to try and build upon some of the work
287620	288960	that others are doing in this space
288960	292960	and try and move the industry forward in a positive direction.
293720	296060	And finally, I think this research could also be helpful
296700	300520	for both consumers, those in the insurance space,
300840	304540	investors, and also owners of DEFI projects,
304540	306660	because the last thing you want to be doing
306660	311200	after spending weekends, hours, days, months, and years
311200	312720	building up your DEFI project
312720	314860	is find that it all goes down the drain
314860	318800	because of some city security issue that we've got to close.
321280	323180	So, DEFI 101.
324680	327000	So, what is decentralized finance?
327000	329480	Well, if we look at traditional finance products
329480	331680	that you might buy from your bank today
331680	334320	or some of the financial products
334320	336360	that investment bankers are using,
336360	338420	you can see that there are common trends
338900	343040	around loans, derivatives, asset swaps,
343040	346340	and even insurance that can be provided to each of us
346340	350560	through a traditional banking environment.
351300	353800	One of the issues and challenges with that
354320	357360	is the centralized aspects of it.
357460	361160	And what decentralized finance aims to do
361160	366000	is to introduce a new way of establishing financial products
366000	370380	that's both decentralized, not controlled in any way,
370380	372360	is trustless and transparent.
373720	378960	So, if we look at the DEFI set of protocols and applications,
378960	381320	you can see that there's a whole range of different services
381760	383860	that are being offered in the space.
383860	385640	There's distributed exchanges,
385640	388120	which remove some of the concerns
388120	391340	that many people have around working
391340	395060	with traditional centralized exchanges.
395220	399300	There's a variety of different loan products
399300	403130	that are out there where you can take your cryptocurrency,
403680	405500	pass it onto a platform,
405500	407940	and earn some interest in it
407940	414140	instead of leaving that money to, let's say, decay over time.
414380	416260	There's also the concept of stable coins
416260	420640	where you can basically take your cryptocurrency,
420640	422760	convert it into a stable coin,
422760	424880	which is pegged against the US dollar
424880	426860	or some other fiat currency.
427000	428740	And that's another way of ensuring
428740	431140	that your hard-earned cryptocurrency coins
431140	433740	do not necessarily fluctuate in value
434260	437520	as the market continues to be volatile.
438960	441420	And, of course, all the other things
441420	444180	like the asset swaps and derivatives that are also there.
445260	447180	So how is this big as this market?
447180	449800	Well, I found this quite fascinating,
449800	451140	but earlier on in the year,
451140	453960	the total value that was locked up
453960	458460	in the DeFi various protocols and projects
458460	460840	was around $1 billion.
461400	463160	And over the last couple of months,
463160	466560	it's actually shot up to just over $4 billion
468160	470420	in value locked in.
470720	472420	So what we can see here is there's
472420	474040	this tremendous amount of growth
474040	476100	that's taking place.
476200	477920	And this may continue in the future
478300	481160	as long as there aren't any big hacks
481160	482900	that come up and the confidence
483360	486220	in these products doesn't start to fail.
486600	488640	In terms of distribution,
488640	490980	you can see that from the lending side,
490980	496780	that's one of the more popular platforms and products.
497020	498360	I'm assuming that's because
498360	500400	it's actually quite easy to understand.
500400	502480	We're talking effectively about
503880	506080	either borrowing money or loaning money
506080	508520	into the system,
508520	510520	and then getting some profits out of that
510520	512480	through some additional interest
513540	515760	or being able to leverage the loans
515760	517780	in order to invest in other products
517780	518940	in the system.
519500	522400	Distributed exchanges, again, gaining some value.
522660	525560	Derivatives and payments, still early days,
525560	528100	but again, the facilities are there.
528100	529400	And there's some very interesting ways
529400	533860	in which these protocols can be configured,
533860	536580	which cannot actually be set up in the real world.
536580	539040	So I suspect the investment bankers out there
539040	542680	will be looking at DeFi as it continues to mature
543380	545200	and seeing how they can exploit
545200	548060	some of the value that it can provide.
550840	553840	So how can you earn passive income crypto style?
553840	557120	Well, if you have a look on the left-hand side of the slide,
557120	560500	you can see a number of different projects,
560500	562560	DeFi projects that are out there,
562560	564460	providing the various services that I mentioned,
564460	567980	lending, derivatives, distributed exchanges,
567980	569660	assets or stable coins.
569800	571400	And you've got a whole pick there
571400	574900	of different types of companies and platforms
574900	576400	that you can go to.
576400	578660	On the right-hand side, you can also see
578660	580980	that as part of these platforms,
580980	583660	there are also a variety of different interest rates
583660	585900	associated with the different types of coins
586500	589360	and tokens that you might want to invest in.
589360	591820	So if you look at Nexo, for example,
591820	593520	you can get an 8% return
594500	598380	if you invest in one of their products
598380	601140	and perhaps buy some die
601140	606680	and look to get some value from that.
607160	610280	If you go down the list, NUO, 13.68%.
610280	613440	So when you're looking at these numbers,
613440	615580	of course, you're not going to earn
615580	618140	this type of return from a bank today.
618600	621680	But of course, there's obviously a lot more risk involved in this
621680	625580	and that's why these prices tend to fluctuate a lot.
627820	629420	So before we go any further,
629420	631700	I thought I'd just talk a little bit about some terminology.
632480	633780	Firstly, crypto wallets.
633780	636620	So many of you will be familiar with crypto wallets.
637260	640000	This is the place where you have your private keys
640000	643200	and you hold your cryptocurrency.
643380	646420	And it's, of course, an area that you need to protect really well.
646420	649560	In the context of distributed finance,
650720	654600	the wallet is also used and can be the key
654600	659020	towards holding source code or smart contracts.
659020	660300	And that becomes quite important
660300	663620	as we look at the security of these platforms.
663680	668560	So when we look at platforms such as Ethereum, for example,
668560	671440	it not only has a cryptocurrency, which is the Ether,
671440	674800	but it has a whole distributed system available
674800	678140	which is based on executing distributable code
678140	680880	in the form of smart contracts.
680880	683280	And once again, the control of those contracts,
683280	686840	when they're uploaded, what the contents of them are, etc.,
687440	690340	is all linked into the crypto wallets
690340	692880	that's associated with those projects.
693220	697260	In order to unlock those, we talk about admin keys.
697440	700940	And these are kind of like the keys to the kingdom,
701720	704560	almost similar to the domain administrator accounts
704560	707640	in the Windows world, for those of you that are joining
707640	710400	from the security community today.
710800	713280	And effectively, if you get hold of these keys,
713280	716360	you can do a whole lot of bad stuff,
716360	720440	including potentially uploading or changing smart contracts.
720600	722300	Now, why would that be important?
722300	726240	Well, inside the wallet, we've got a whole lot of cash.
726400	731660	And smart contracts define a way in which transactions
731660	736540	can communicate and can take place over the blockchain.
736940	740040	So if we have a wallet that has a lot of cash in it,
740040	743380	and we have an ability to influence the logic
743380	746080	by which that cash gets used,
746080	748240	then it obviously can be very detrimental
750500	752900	to the DeFi platform.
753620	755580	There's also a concept of time lock.
755580	760980	And this isn't got anything to do with going back in time.
760980	763940	But what it is, is it's a method
763940	768000	that owners of the DeFi platform can use
768000	772180	to effectively slow down the transactions
772180	775220	that are taking place on the blockchain.
775260	782040	And this is very useful because it allows the owners
782040	785180	or those that are governing the DeFi projects
785180	789700	to potentially have a look at any unusual transactions
789700	792820	and normally there's a time window,
792820	796460	either it's four hours, 72 hours, 48 hours,
796460	799000	that the owners of that platform
799000	801320	or those that govern the platform
801320	803140	can actually monitor the transactions
803140	805580	and potentially reverse any transactions
805580	808300	that have been introduced into the system
808300	811680	by an unauthorized hacker
811680	813950	or potentially even just by mistake.
814280	817900	So that's something that's really key to look into.
817900	821060	There's a big debate around decentralization
822380	823640	and centralization, right?
823640	824680	So we spoke at the beginning,
824680	827440	the whole purpose of distributive finance
827440	831820	is to have decentralized systems and finance
831820	833800	that is not under anyone's control.
834480	836440	And by putting in a time lock,
836440	839040	we're effectively giving a level of that control
839040	841880	back to the owners and those that run the project
841880	843660	in order to better control it
843660	847060	in the case of things going horribly wrong.
847060	849960	But I think, you know, for most of us
849960	853000	that are still, let's say,
853000	855540	dabbling in this particular world,
855540	858920	it's better to have some level of governance in place
858920	861780	to protect the assets and information
861780	864640	and, of course, the currencies that are in there.
865560	867140	We also have the concept of an oracle
867140	871180	and this can either be a system
871180	875480	that's inside the decentralized ecosystem
875480	878240	of the DeFi platform
878240	881400	or it's something that the DeFi platform uses
881400	885660	as a source of information in order to make decisions.
885940	889840	So an oracle could, for example, be publishing prices
889840	893060	for various types of coins, like I showed you earlier,
893060	895660	that are coming from various exchanges
895660	897580	and pumping that information
897580	901220	back into the DeFi protocol and application
901220	904440	so that it can use them in order to make decisions.
904440	906600	Now, again, there's pros and cons
906600	910560	on whether this oracle concept is a good idea or not.
910640	914560	If we're looking to peg, for example,
914980	916660	a currency against the dollar,
916660	918880	then we do need an oracle that can tell us
918880	920160	what the price of the dollar is
921040	923040	and provide an accurate reflection
923040	924980	of what's happening in the real world.
925140	926960	So there are some benefits to it,
926960	930440	but, of course, if we're able to influence
930440	932800	or compromise the oracle,
932800	934560	that can have devastating effects
934560	936980	on the DeFi project.
937020	939220	And finally, we talk about DApps
939220	940780	or smart contracts.
940840	942880	Once again, this is the source code
942880	945220	that's been run on the blockchain.
945360	948120	It's source code that is immutable.
948440	951480	It runs forever on the blockchain.
951480	952900	It's been signed.
953260	955260	It's available to be reviewed
955260	960070	and seen by those that transact with it.
960360	962240	And it forms the heart of the logic
962240	965160	behind the DeFi platform.
966220	968260	Okay, so how does this work in practice?
968300	970120	So I'll just give you a quick example.
970540	972940	Let's take a cryptocurrency investor
973640	976660	and she decides she's got some Bitcoin.
976820	978460	She's really worried about the fluctuation
978460	980360	of the Bitcoin, which I believe
980360	982960	is about $11,000 today.
983160	985160	If we went back a couple of months,
985160	986840	it was a lot less than that.
987300	989500	But if we went back maybe two or three years,
989500	993320	we had obviously a real spike in the prices.
993500	996240	So with her hard-earned Bitcoin,
996240	997960	she's got a choice either to keep that
998350	1000500	in Bitcoin or to potentially
1001700	1004200	loan it out to a DeFi platform
1005000	1007600	and gain some interest or gain
1007600	1009810	some potential value from that.
1010160	1011800	So she deposits some Bitcoin
1011800	1014220	into the DeFi platform.
1014280	1015420	There'll be a smart contract
1015420	1017960	within the DeFi platform that will
1017960	1020960	effectively receive that Bitcoin.
1021100	1022440	It might wrap it up
1022700	1025720	or transfer it into a token.
1025720	1027140	And in my case, I'm going to use
1027140	1030100	the DAI token as an example.
1030740	1032400	And that basically allows
1032960	1035800	our investor to take these DAI tokens
1035800	1038900	and potentially push them into other DeFi products
1038900	1040520	in order to earn interest
1040520	1043720	or potentially just to peg
1043720	1046060	the value of that Bitcoin against the dollar
1046060	1047360	one to one.
1047360	1049000	Because as I mentioned,
1049000	1050500	DAI coin is a stable coin
1051060	1056760	which is linked to the dollar.
1057120	1059600	So she can then take that DAI coin
1059600	1061660	and actually push it into
1061660	1063700	potentially another platform
1063700	1067440	which might actually go ahead and invest
1067440	1069980	that DAI coin into other products
1070900	1072800	which then could actually generate
1072800	1075440	some level of return for her.
1075440	1077220	At some point,
1077220	1078500	she might then decide
1078500	1080220	there's been some growth
1080220	1081820	or perhaps there's been some stability
1082440	1083680	in the DAI coin
1083680	1085180	that it's time to cash out
1085180	1087100	and she wants her Bitcoins back.
1087120	1089020	So she can go back to the platform
1089020	1090520	and effectively
1091160	1093360	the platform might again do some checks
1093360	1094140	against the oracle
1094140	1096000	to see the current price
1096000	1099020	between the DAI and the Bitcoin
1099740	1101960	and then push that Bitcoin back
1101960	1103700	to her.
1103700	1104660	Now of course,
1104660	1106560	this is what would happen in theory
1106560	1109860	but sometimes that money might disappear.
1110380	1111920	Why might it disappear?
1111920	1114800	Well, potentially the DeFi platform
1114800	1117740	which is holding these Bitcoins
1117740	1120400	may not still have the Bitcoins
1120400	1122320	that were provided by her
1122320	1126040	and by other cryptocurrency investors.
1126800	1128000	It is also possible
1128000	1129440	and we talk about liquidity
1129440	1133000	that there simply isn't enough
1133000	1136320	cryptocurrency inside the DeFi
1136320	1137680	to be able to pay out
1137680	1142400	all the people that have loaned its money
1142400	1146740	and that could also potentially be a problem.
1146900	1147840	Or of course,
1147840	1151080	maybe somebody might intercept
1151080	1153620	or influence the logic
1153620	1155080	within the DeFi platform
1155080	1158540	and basically change the smart contract
1158540	1161160	to maybe push the money somewhere else
1161160	1163140	rather than to the person
1163140	1164860	that had requested it.
1165360	1167020	So let's talk a little bit about
1167020	1169080	the attacks on the blockchain
1169080	1172540	and smashing stacks,
1172540	1173120	breaking blocks
1173120	1175360	or loosening the chains for profits.
1176060	1177420	So once again,
1177420	1179000	the high-level scenario
1179000	1181100	of our investor
1181820	1183940	or person that has some cryptocurrency
1183940	1189320	looking to engage with the DApp ecosystem
1189320	1194160	in order to get some value from their currency.
1194800	1196580	You've got the Oracle and the exchanges
1196580	1197560	on the right-hand side
1197560	1200500	that this particular DeFi application
1200500	1203280	or platform is relying on.
1203280	1204120	And of course,
1204120	1205420	we might have a corporate entity
1205420	1206840	that is owning and running
1206840	1210380	and governing the DeFi platform.
1210440	1213220	So let's look at some of the potential attacks
1213220	1215960	that could occur throughout this lifecycle.
1215960	1217780	Firstly, from the user's perspective,
1218920	1220960	users can be phished.
1220960	1222420	Their passwords and keys
1222420	1224860	could potentially be stolen.
1224940	1227500	As we've seen in the case of the Twitter attack
1227500	1230060	that happened just over a month ago,
1230680	1233220	social engineering scams are possible too.
1233300	1235220	So hackers might not necessarily get in
1235220	1238200	and steal the keys,
1238200	1239880	but if they can convince the person
1239880	1241920	to transfer some money across,
1241920	1244500	then they can lose that way.
1244600	1245380	And of course,
1245380	1247080	there are potential vulnerabilities
1247080	1247980	in the software
1247980	1252860	that the user has downloaded or is using,
1252860	1255080	which might intercept communications
1255080	1258300	and potentially steal the keys.
1258440	1262320	If we move into the distributed environments,
1262700	1264400	and again, a good example of this
1264400	1265720	is Ethereum,
1265720	1270660	which leverages the ERC-20 tokens,
1270660	1272340	there are still vulnerabilities
1272340	1273580	in smart contracts,
1273580	1275300	and we'll talk a little bit about more of those.
1275300	1278550	There is the possibility of key compromises.
1278880	1280540	There are DDoS attacks,
1280540	1282500	potential man-in-the-middle attacks,
1282500	1284220	often that occur because
1284220	1286120	there is often an interface
1286120	1287940	between these DApps,
1288020	1290220	a web interface or an API,
1290220	1292480	and again, its users.
1292880	1294740	And so again, depending on where the keys are
1295380	1297980	and the way things get handled,
1297980	1299460	there is some possibility
1299460	1303560	to perform some attacks there.
1303640	1305220	From a protocol perspective,
1305220	1308100	again, all of these distributed apps,
1308100	1309100	Ethereum itself,
1309100	1311140	it's still relatively new,
1311140	1313460	and there may still be some underlying vulnerabilities
1314160	1317920	in the way that the distributed system is working.
1318600	1320080	And I guess we still have to...
1320080	1321720	time will tell whether some of those get
1321720	1323820	out there in the wild or not.
1324720	1326380	The oracles themselves,
1326380	1327480	so again,
1327480	1328920	the whole purpose for having the blockchain
1328920	1330840	and these cryptocurrencies is that they are
1332080	1333000	inherently secure
1333000	1335500	and built with all the wonderful cryptography
1335500	1337380	and so on that's inside them.
1337440	1340740	But when they start relying on third parties,
1340740	1341380	for example,
1341380	1343320	the oracles and exchanges,
1343320	1345980	that's potentially when things can go wrong.
1346220	1347220	So once again,
1347220	1349620	the oracle might be manipulated
1349620	1352280	to provide the wrong interest rates,
1352280	1353200	for example,
1353200	1355120	or an exchange might make a mistake
1355120	1356860	and publish the wrong rates,
1356860	1360480	which could then lead to people taking advantage of that.
1361360	1364220	One thing that we've looked at in our research
1364220	1367240	is the corporate entity itself.
1367240	1369580	And this is really important because
1369580	1372020	these apps are run by people
1372020	1374440	and by a company,
1374440	1375800	often a startup,
1375800	1377840	maybe it's a small organization to start,
1377840	1379740	to begin with that grows.
1379780	1381820	But there are people inside that organization
1382640	1384900	that communicates with customers
1384900	1386200	and with individuals
1386200	1389200	and those that are invested in the tokens
1389200	1390300	and the cryptocurrencies.
1391640	1394560	Some of those people also might operate
1394560	1398660	and have access to the keys and the wallets.
1398760	1401020	Some of them might have to update the smart contracts
1401020	1402460	from time to time.
1402960	1405340	And so the corporate entity itself
1405340	1406800	needs to have a level of security
1406800	1408960	that we would expect of a bank
1408960	1410840	or another financial institution.
1411020	1411780	But of course,
1411780	1415520	because a lot of these organizations are still growing,
1415520	1417440	they may not necessarily have matured yet
1417440	1421320	to provide all the right OPSEC that we would expect.
1421720	1423700	So another route into this environment
1423700	1426500	could potentially be through the entity
1426500	1430500	or the organization that is running the platform,
1431220	1432660	targeting either the employees
1432660	1434180	or some of their resources,
1434180	1437480	their email, their social media, et cetera.
1442240	1445380	So if we look just in the last couple of months,
1445380	1447560	there have been quite a few hacks
1447560	1450340	that have taken place in the DeFi world,
1450340	1452720	most notably the BZX hack,
1452720	1454660	which I'll talk about a little bit later.
1455020	1458540	But literally within a couple of days,
1458540	1460360	they lost around a million dollars
1460940	1463020	in a very sophisticated attack,
1463020	1465100	which impresses a lot of folks
1465100	1466840	that have looked into this.
1467420	1469680	Maker itself, it had a price crash.
1469680	1471560	It wasn't specifically a deliberate attack,
1472000	1474620	but there was a drop in ether
1474620	1477380	that happened for a few seconds.
1477380	1481500	And this landed up causing a lot of mayhem
1481500	1485580	and Maker actually had some liquidity challenges,
1485580	1489380	which actually forced a lot of the users
1489960	1492180	on the platform to have their loans
1492180	1495900	effectively canceled in order for Maker
1495900	1499240	to ensure that it had the right level of liquidity.
1499420	1501380	And there's a big class action suit
1502080	1504600	going on right now for those individuals
1504600	1507740	that have lost money by loaning money into Maker
1507740	1510240	and not being able to get it out again.
1511120	1512980	Again, later in the year,
1512980	1515100	we had INBTC being hacked
1515100	1519420	by an ERC-777 re-entry attack.
1519460	1521740	Now, for those of you that know about
1521740	1523800	the DAO attack that happened a few years ago
1523800	1525460	on the Ethereum platform,
1525460	1527880	this is a very similar type of attack.
1528140	1530900	And interestingly, a day later,
1530900	1533740	there was another platform, LendFme,
1533740	1535140	that lost $25 million
1535740	1537740	because they were using the same source code
1537740	1542720	in their smart contract as another organization.
1543240	1545500	So again, these things kind of can happen
1546240	1548280	in various different ways.
1548880	1552340	Talking a little bit about the BZX hacks,
1552340	1555200	and I don't want to spend too much time in this area,
1555200	1559040	but when we think about hacks and exploits,
1559040	1561100	the ninjas of the security community
1561100	1565600	are running machine code
1565600	1567060	and machine-level assembly
1568060	1571960	to smash the stacks and do buffer overloads
1571960	1573320	and all sorts of things.
1573540	1576420	And what we see here is a different type of hack.
1576420	1579280	We see that somebody with a lot of knowledge
1579280	1583400	was able to leverage the different protocols,
1583400	1587460	leverage the different DEFI protocols out there,
1587460	1590160	DYDX, which was allowing loaning,
1590160	1594660	Compounds, which was allowing interest,
1594660	1596840	the Kyber network and the Uniswap network,
1596840	1600860	which were allowing people to swap coins.
1601020	1604620	And they exploited basically a situation
1604620	1606980	where an exchange was providing
1607700	1612120	a very favorable rate of interest,
1612120	1613920	we call it interest or pricing,
1613920	1616140	for a particular coin combination.
1616140	1617840	And they realized this.
1618240	1621360	They took advantage of something called a flash loan,
1621360	1624020	which is a very interesting concept in the DEFI world
1624020	1626580	that allows people to borrow money
1626580	1628500	without providing any collateral.
1628800	1630860	As long as they borrow the money,
1630860	1631980	carry out a transaction,
1631980	1634000	and pay the money back very quickly,
1634000	1636520	the platform is happy to support that.
1636520	1639180	And that's exactly what happened in this particular instance.
1639180	1642580	So they borrowed some money from the DYDX loan platform,
1642580	1644380	10,000 ETH.
1644380	1648380	They then did some fancy transactions
1648940	1650580	and manipulations.
1650820	1654000	They took advantage of the price hedge,
1654000	1656680	if you like, that they found in the market.
1657380	1660780	And then they were able to then pay back that loan
1660780	1663140	and profit around $300,000
1663140	1665700	for that particular transaction.
1666520	1668100	Literally a few days later,
1668100	1669200	they did the same thing
1669200	1673060	and managed to earn another $600,000.
1675570	1677550	So in response to this,
1677550	1682510	the BZX actually made some really dramatic statements,
1682510	1684210	which I'd like to read out.
1684290	1687430	This attack was one of the most sophisticated we've ever seen,
1687430	1689850	possibly only with an extremely in-depth knowledge
1689850	1692470	of every DEFI protocol and its tools.
1692870	1695010	This space is evolving quickly.
1695130	1697410	The security is becoming increasingly more dire
1697410	1703110	as the barriers to entry for executing an exploit drop to zero.
1703110	1705890	There is no analog for this in the traditional finance system
1705890	1709050	and we're now in uncharted territories.
1709610	1713210	So if that doesn't give you a huge amount of confidence,
1713210	1718710	then you might want to think twice about using these particular platforms.
1718910	1720390	But with anything,
1720390	1723250	this happened on the internet and e-commerce many moons ago,
1723990	1729650	eventually the maturity of the industries get there
1729650	1733390	and it becomes harder to do these types of things.
1734670	1741630	So, again, if you're looking to put some money into one of these platforms,
1741630	1746930	how might you assess whether they're good, they're safe, they're bad, etc.?
1746930	1749310	So that's where our research comes in.
1749310	1753710	And the first thing we did, which, again, I find quite interesting,
1753710	1755350	you know, you think you've got a good idea
1755350	1757270	and you do some googling
1757270	1759090	and then you find out, actually,
1759090	1761470	quite a lot of other people have come up with the same idea.
1761890	1765010	So it's part of the early research.
1765010	1770130	We found that there is an open source group or groups.
1770130	1772550	There's the DefiScore as well as DefiWatch
1773550	1777570	and the Codify project as well
1778530	1781970	that essentially are starting to build out an index
1781970	1784990	of various features on the Defi platform
1784990	1788310	that give us some indication of how risky they may be.
1789150	1794290	So some of the types of things that the DefiScore provides, for example,
1794290	1797070	is looking at, you know, has this particular platform
1797070	1800330	carried out any smart contract audits?
1800330	1801590	How many audits?
1801690	1804070	Do they use a time lock or do they not?
1804230	1806650	Have they implemented some form of multi-signature
1807370	1810250	for protecting those very special admin keys
1810250	1811890	that I spoke about earlier?
1812770	1816150	They also then look into some additional factors
1816150	1820870	which are more linked to the financial viability of the platform.
1820870	1823430	And that includes the liquidity index,
1823430	1826870	centralization index and utilization index.
1826870	1829510	But all of these things come together to form a score out of 10
1829510	1833510	which is there to try and help and guide those
1833510	1835650	that want to potentially put money in.
1835650	1839250	You might get all excited about that 13% rate you're going to get
1839250	1841170	but then you might want to check to see whether
1841170	1844110	that particular platform has scored very well
1844110	1846770	on a DefiScore or on some other score.
1847770	1849010	So with that in mind,
1849010	1851750	we thought we would build upon this platform.
1852070	1855270	And one thing that we did notice is that, again,
1855270	1857790	the communities that developed this
1857790	1860090	actually form part of the community
1860090	1862030	and part of the crypto community.
1862030	1865110	So the focus of their scoring was very much based on
1865110	1867610	some of the things in the crypto world.
1867610	1870930	And so we, coming from a, let's say,
1871030	1873050	a wider cybersecurity perspective,
1873050	1875610	started to think about some of the other OSINTs
1876430	1879750	that we might be able to find about those companies.
1879770	1881510	So we took a traditional approach.
1881510	1885610	We looked at IP addresses, DNS records.
1885970	1887490	We looked at the email platform
1887490	1891090	that these particular providers are using.
1891210	1895310	We looked at a couple of open sources
1895310	1897490	connected to the internet,
1897490	1900330	mail servers, web servers, et cetera.
1900650	1901830	We looked on LinkedIn
1901830	1905530	to see what kind of social media platform they have.
1905530	1906530	We did some third intel
1906530	1908490	to see whether there's any chatter
1908490	1911930	involved in these particular projects.
1912110	1914050	We also assessed the bug bounty
1914050	1917570	and how ready or how mature they are
1917570	1920590	in using the hacking community
1920590	1924450	to find vulnerabilities and publish those.
1924450	1928130	And also whether they were open source or closed source
1928130	1931450	and whether there was any breach history.
1931970	1934590	Finally, we also looked at privacy and cookies
1934590	1936490	just to kind of get a perspective
1936490	1939410	on whether, from a regulatory perspective,
1939410	1941010	these guys are starting to think about
1941010	1943190	some of those really important things
1943190	1945230	that regulators look out for
1945230	1948750	when you're dealing with individuals and consumers,
1948750	1951890	especially those, for example, in Europe under GDPR.
1952810	1954990	On the crypto side,
1954990	1958890	again, we kind of thought through the various indexes
1959570	1963690	that DEFI scored already provided.
1963750	1965750	And then we thought about a few other things
1965750	1968130	like general audits,
1968130	1973510	publication of whether they've been assessed by third parties.
1974110	1976710	We wanted to look into cryptocurrency transactions
1976710	1980510	and whether there was any links
1980510	1985630	between fraudulent transactions and the platforms,
1985630	1987370	the financial backing,
1987370	1989810	and also whether there's any mention of KYC,
1989810	1992090	your client's procedures.
1992090	1995450	Once again, going back to the beginning of my talk,
1995450	1999430	if any of these platforms start to receive cryptocurrency funds
1999430	2002130	as a result of a fraud or an attack,
2002130	2005090	then they shouldn't be accepting them.
2005110	2008490	Or potentially, if they have accepted them,
2008490	2010570	maybe there's something we can do to seize those assets
2010570	2014170	before they go back to those that have stolen them.
2016550	2020570	So I guess just a caveat in terms of the limitations of our research,
2020570	2023230	we sampled 17 projects,
2023230	2028470	both a mix of large, medium, and small DEFI projects.
2028490	2030670	And we did this over a period of seven days.
2031910	2034450	Because of the type of testing that we performed,
2034450	2036130	which was very non-intrusive,
2036130	2039050	obviously we don't have any permission to do any testing.
2039430	2042010	So we could only look at open source information.
2042550	2045890	And as a result of that, some of the findings might be false positives.
2046290	2049270	And of course, there's certain things that are very hard for us to gather
2050010	2052770	from the open source.
2053650	2056150	But also, there are quite a few important things
2056150	2059350	that we definitely were not able to look at.
2059350	2061770	And things like incident response planning,
2061770	2065450	being able to deal very quickly with a breach scenario
2065450	2067250	where perhaps the keys have been stolen,
2067250	2070390	or there is a smart contract vulnerability.
2070870	2072450	Key generation storage.
2072450	2075150	People talk about the fact that they're using multi-sigs,
2075150	2076810	but are they really?
2077310	2078950	Has that been audited?
2079950	2081870	Have they done all the right things?
2082570	2084790	The oracles and exchanges.
2084790	2087550	We didn't look too much into that world.
2088310	2090910	And of course, some of these smart contracts themselves
2090910	2093130	might be linked to other smart contracts.
2093130	2096410	And I mentioned that protocol fuzzing and security
2096410	2098570	is something that we didn't get into either.
2099370	2103830	In terms of the scope and the way that we carried out the testing
2103830	2105240	and the scoring,
2105970	2109630	we did a subjective scoring, fairly simple crude approach
2109630	2114510	where we allocated a score of 1 if the practices are very poor,
2114630	2117270	a 2 for medium, or a 3 for high.
2117590	2121730	We also took the view that we wouldn't necessarily skew
2121730	2126810	any of the findings and weights against particular categories.
2126930	2129650	It's recognized that certain types of tests
2129650	2132490	are going to have more of an impact than others,
2132490	2134850	but also that might depend on the type of attack
2134850	2136230	that we're worried about.
2136370	2138810	So if we're worried about phishing attacks,
2138810	2140190	then certain types of dimensions
2140730	2143170	will actually carry more weight than others.
2143210	2146570	If we're more worried about, for example,
2146570	2148690	the smart contracts having poor code,
2148690	2152370	then we would have a higher weight on some of the categories
2152910	2155090	that link into smart contracts.
2156550	2159910	So without further ado, I'll talk about some of the results.
2160050	2162530	And as you can see on the left-hand side,
2162530	2165950	we've basically segmented the vendors
2165950	2168490	into large, medium, and small.
2168830	2172650	The red, again, are those organizations
2172650	2176230	that have been marked as having very low security,
2176230	2177410	in our opinion.
2178110	2180490	Those in the middle with the yellow,
2180490	2185250	and those that are doing pretty well in the green.
2185730	2189090	And as you can see, if we start with a multi-sig,
2189090	2192950	we have quite a lot of small and mid-sized companies
2192950	2195210	that haven't gone with this multi-sig approach.
2195650	2198930	And I guess it's a bit disappointing, in a way,
2198930	2202190	because a lot of these projects are small,
2202190	2205990	but they can grow very big very quickly.
2205990	2209510	And if they haven't done the basics of setting up
2209510	2212050	their wallets and their key administration
2212050	2214090	the right way in the early days,
2214090	2216410	then it can be quite difficult to retrofit that
2216990	2220070	as the project goes from zero to hero.
2220970	2223870	Also, interestingly, in the large category,
2223870	2227110	there was one that wasn't using multi-sig,
2227110	2229070	which, again, was quite a surprise.
2229770	2233810	And these multi-sigs also range from 2 of 2
2233810	2238410	all the way to 3 of 5 or 3 of 8.
2238610	2241610	So there were quite a few that are starting to adopt
2241610	2244490	what I call very good practices around having
2245510	2249550	potentially quite a few multi-signatories
2249550	2253010	having access to the keys,
2253010	2256910	often distributed across different organizations as well,
2256910	2259810	to really make it effective.
2260510	2262410	But one of the issues here, again,
2262410	2264550	is that it's very hard to tell exactly
2264550	2266070	how this was implemented.
2266510	2268470	You can have multi-signatures,
2268470	2270850	but you could have three signatures.
2270850	2271870	Maybe they're paper-based,
2271870	2273730	but they're all in the same place.
2274650	2278250	And therefore, the kind of op-sec on the key management
2278250	2282250	is something that is very hard to distill.
2282830	2286150	There also weren't many talking about, if not any,
2286150	2288990	talking about audits that these companies had done
2288990	2291890	on their key generation process,
2291890	2293290	which I think is fundamental
2293290	2295730	and something that happens a lot
2295730	2298630	in the traditional finance industry today.
2299610	2300590	Time locks.
2300590	2303170	So once again, I mentioned this earlier,
2303170	2305410	I think it's a pretty good idea to do this.
2305410	2306870	It gives some confidence
2306870	2308910	to those that are using the platform
2308910	2310770	that if something goes wrong by mistake
2310770	2313170	or potentially, again,
2313170	2315850	because somebody's done something bad,
2315850	2317850	there is a way to roll back.
2317850	2319370	There's a way to monitor
2319370	2323550	and get ahead of the transactions
2324190	2326270	and do something about it.
2326270	2327870	And once again, you can see a mixture
2327870	2330970	of large, medium, and small companies
2330970	2333510	that actually haven't implemented this.
2334310	2338530	As we move on to the other thing of interest
2338530	2340710	on the time lock side was, again,
2340710	2343750	some projects are using 48 hours,
2343750	2347030	some are using four hours, others 72.
2347030	2351010	Again, I kind of, as a more conservative individual,
2351010	2353950	would rather go with a slightly longer period.
2353950	2355570	It might mean that certain transactions
2355570	2357870	take a little bit longer to take place,
2357870	2359490	but at least I know that if I put my Bitcoin
2359490	2362850	into that platform and something goes wrong,
2362850	2365910	I've got a chance of keeping it
2366690	2369210	rather than the purest approach
2369210	2371290	of decentralization
2372350	2374610	where effectively the transactions happen
2374610	2377010	and there's nothing you can do about it.
2378590	2381030	From an Oracle perspective, again,
2381030	2382830	some interesting results on those
2382830	2386550	that are using Oracles, external Oracles,
2386550	2388630	those are some that are using their own.
2389310	2392230	And we found some interesting concentration risk
2392230	2395310	in this space where quite a few organizations
2395310	2397180	are using the same external Oracle,
2397650	2400430	so that might potentially ring some alarm bells
2401150	2403390	if those particular Oracles
2403390	2405630	are not set up in the right way.
2405630	2407830	Something that was really disappointing
2407830	2412530	was no real discussions around KYC.
2412730	2415350	And again, I think this is really important
2415350	2417210	in the longer term
2417210	2419930	if you want to have a legitimate business
2419930	2423750	that's going to deal with the kind of wider markets,
2423750	2425530	the wider finance markets.
2426030	2428430	And this is something that for whatever reason
2428430	2431270	these players are not necessarily
2431270	2433470	too focused on today.
2433470	2436930	I suspect that as the industry matures
2437810	2441850	and some of the platforms do want to
2441850	2443810	become more regulated,
2444190	2446210	this will have to change.
2446750	2448930	On the smart contract side, again,
2448930	2450270	kind of a mix.
2450270	2452530	For this particular dimension,
2452530	2455150	we looked at whether the smart contracts
2455150	2460570	were being reused by other organizations,
2460570	2462770	and we found quite a few of those.
2462770	2465310	A couple of smart contracts that had been compiled
2465310	2468210	with older versions of compilers,
2468210	2469990	some of which are known to have
2469990	2473010	security weaknesses in them.
2473670	2477190	And then quite a few that
2478130	2480770	actually were not very forthcoming
2480770	2483430	with publishing certain information
2483430	2485070	about their smart contracts.
2485610	2487770	We did see some very positive signs
2488350	2491110	on the side of smart contract audits.
2491110	2493770	And here are quite a few of the platforms
2493770	2495950	are doing regular audits.
2496030	2498270	It kind of ranged from 2 to 15,
2498710	2500290	and that kind of got me thinking,
2500290	2501970	well, maybe you need to audit these things
2502090	2503270	a bit more frequently.
2503830	2505930	But what was quite strange was that
2507310	2510450	probably aligned to the whole open-source methodology,
2510450	2512530	the audit results were open-sourced
2512530	2515050	as well as all of the audit reports.
2515430	2518030	And this contains a wealth of information
2518030	2521030	about what the testers did,
2521770	2524030	pieces and snippets of source code,
2524030	2527670	and various types of vulnerabilities that they found,
2527670	2530870	which personally I think might be a little bit unnecessary.
2531430	2533730	I think it's good that an audit has happened.
2533730	2537690	It's good to understand that remediation was taking place,
2537690	2540610	but really to show the full-blown audits every time
2540610	2543470	might be giving a little bit away,
2543470	2546450	especially if those testers didn't find all the holes
2546450	2550550	and perhaps there are a few extra things that aren't there.
2550970	2554090	Great news for the community at DEF CON
2554090	2557450	that are involved in bug bounty programs
2557450	2559330	and supporting them.
2559550	2563230	Some good indications that the DEFI industry
2563230	2566410	is taking this on board as well.
2566410	2568410	And if you're interested, go and have a look.
2568410	2573630	Programs vary from $10,000 all the way up to $250,000.
2574510	2577490	So put down those laptops and get started.
2577950	2580350	Interestingly enough, a few projects are actually
2580350	2583810	not offering to pay you in real money,
2583810	2586810	but to pay you in their own tokens,
2586810	2589150	which again potentially could be very valuable
2589150	2593390	or potentially not, depending on the circumstances.
2595410	2598950	If we have a look at the general OSINT,
2598950	2601590	one of the first things we did was we looked at
2601590	2605570	whether these particular organizations had been hacked in the past.
2605950	2608970	I decided to redact the findings in that section
2608970	2612610	because it might indicate some of the organizations
2612610	2614650	involved in our study.
2615610	2618230	What I can say is that there was a mix
2619030	2622590	of large, medium and small organizations
2622590	2625210	that have been hit in the past.
2626050	2629510	And again, is that an indicator that the company is bad?
2629510	2632290	Or is it an indicator that because they've been hit,
2632290	2634930	they've actually now put in a lot better controls,
2634930	2637710	they've learned their lesson and they're improving their security?
2638050	2640470	And often in my experience, those that have a breach
2640470	2644690	do come out of it a lot better in the longer term if they're still around.
2646130	2648250	So that's kind of one factor.
2648690	2652750	We did look into credentials that are on the web
2652750	2655110	and on the darknet that have been sold
2656370	2658350	for particular platforms.
2658350	2660790	And that was on average pretty good.
2660790	2664410	As you can see, there was a surprisingly large organization
2665030	2668090	that had quite a lot of data published.
2668090	2671510	And this is something that we will need to take up
2671510	2673750	with the vendor directly
2674710	2677390	because I think it's something that they should be looking into.
2679770	2681670	But otherwise, pretty good.
2681710	2685050	And once again, this is the kind of thing that's a bit hit and miss.
2685190	2687330	But it was interesting that we did get two results
2687330	2690710	coming through that particular dimension.
2691190	2692870	Anti-spam protection.
2693250	2696270	Obviously, we discussed how important phishing is
2696270	2700050	to either the users that could be targeted
2700050	2705490	and also the individuals that are working for the platform.
2705910	2708650	And here, we did find that
2708650	2710770	the maturity within the space
2711330	2716210	was actually okay for protocols like SPF
2716210	2720370	but for DMARC, it was actually around 50%.
2720370	2724950	And for DECIM, it was very low as well.
2724950	2727030	So I think there's definitely some room for improvement
2727030	2732010	for these companies to be setting up their DNS records
2732010	2734570	and their mail records so that they can
2734570	2737510	better protect themselves and their customers from
2738650	2741410	phishing-related attacks.
2741810	2743430	I mentioned infrastructure
2743430	2746390	and we took a very hands-off approach to this,
2746390	2748710	so we looked in Shodan
2749390	2752390	and pointed some of the project IP addresses
2752390	2754730	to the Shodan platform.
2754890	2758170	And we came up with a couple of interesting results.
2758430	2761310	Some unnecessary ports, some remote access
2762810	2765250	facilities that perhaps shouldn't be there.
2765370	2767470	But again, kind of a mix and something that
2767470	2770830	you probably would find if you did a proper scan
2770830	2773170	on a lot of organizations.
2773590	2776130	But definitely something that needs improvement
2777350	2781410	for the reasons that I've spoken about before.
2781430	2783110	We dipped into the
2783110	2786310	Darknet chatter and we had a look to see
2786310	2790230	who was talking about particular projects.
2790790	2791750	And again, we found
2791750	2794970	some information, nothing earth-shattering,
2794970	2797830	but definitely some talk about
2797830	2801270	targeting or weaknesses,
2801270	2804410	vulnerabilities, etc. And again, this is something
2804410	2806950	that probably the project
2806950	2810250	owners should definitely be dialing into
2810250	2812930	just to make sure there's nothing major
2812930	2816450	that's being discussed and giving them a head start
2816450	2819870	to try and fix any issues that arise.
2820630	2822130	From a social media perspective,
2822130	2824370	we just chose LinkedIn. We had a look at
2824370	2828410	individuals that belong to these projects.
2830050	2831410	Interestingly, I was looking
2831410	2834490	for some CISOs or kind of security managers
2834490	2836870	and I didn't find many. So either
2836870	2839970	those involved are pretty good with their own
2839970	2844050	OSINT, or perhaps, and I think this is more likely,
2844050	2846490	there aren't too many people in these organizations
2846490	2849330	that have the title of CISO or security manager.
2849490	2852410	We saw a lot of CTOs, we saw a lot of COOs,
2852410	2856490	but not that many people with a security title.
2856970	2858970	And that, again, is just something
2858970	2861250	to be wary of.
2861250	2864750	If you don't have anyone focused and dedicated
2864750	2868010	in the space, then you might fall short
2869150	2871150	and that's kind of why
2871150	2874810	you need to take these things a little bit more seriously.
2874990	2877550	Quite a few people in the IT department
2877550	2879990	publishing information about themselves
2879990	2884110	and, again, that could be potentially used as a target.
2885250	2886750	Kind of very old OSINT around
2886750	2889650	Whois. Most people did this very well.
2889830	2892390	We did come across one company that was allegedly
2892390	2895410	in stealth mode, but had leaked
2895410	2899190	some of the details in the Whois information.
2899510	2902050	But pretty good on that side.
2902490	2904130	And then data privacy policies
2904790	2907470	as well as cookies. We did a quick check
2907470	2911370	on whether these particular aspects would be taken care of
2911370	2913290	on the websites.
2913290	2916750	We found that most were not compliant to GDPR
2916750	2920190	and, actually, some of the privacy policies
2920190	2923130	fell short of some of the requirements
2923130	2926090	that are expected. So, once again,
2926090	2928150	these organizations dealing with consumers
2928150	2931530	might need to dial into this vector
2932490	2935970	as well because it could come back to bite them.
2935970	2939070	On a hosting side and as well as on an email
2939070	2941810	platform side, we saw some concentration
2941810	2944970	risk on particular vendors being chosen
2944970	2947650	to host websites
2947650	2950650	to support DDoS platforms
2950650	2954690	and also to support the email platform as well.
2956110	2956810	So, I guess some
2956810	2960250	of the highlights, again, smart contracts, 64%
2960250	2962510	were being audited
2962510	2965270	but the full results were published.
2965910	2968930	64% of the smart contracts required some kind of
2968930	2971350	improvements either because of reuse or
2971350	2973410	older compilers being used.
2974050	2977570	Some vendor concentration in the use of
2977570	2979670	external oracles.
2980550	2983530	Time locks, again, 58% not using them. That's a bit
2983530	2986670	disappointing. Almost 50% not using
2986670	2989050	multi-signatures and
2989050	2992210	missing audits in the key management space
2992210	2995130	as well as per KYC and privacy
2995130	2996530	activities.
2998210	3001470	Right, on the OSINT side, great registration
3001470	3005650	on the IP, mixed DNS results as I mentioned,
3005650	3007330	some chatter going on, credentials
3007330	3009890	being dumped per cookies and
3010650	3012290	privacy policy management
3013050	3016430	and so on.
3018550	3021070	So, with the scoring, we
3021070	3023190	basically put together our score and
3024030	3026990	allocated out the various
3027750	3029890	companies against the score
3029890	3033130	and you kind of see kind of a mix. It's not a huge
3033130	3036070	differential. Some of that
3036070	3039210	differentiation was coming in to very particular dimensions
3039210	3042330	that we assessed. Interestingly,
3042330	3045110	looking at the DEFI score itself, we actually found
3045110	3047950	that of the companies we looked at,
3047950	3050470	50% of them had the same kind of ranking
3051210	3054250	as our scoring, but actually
3054250	3057550	33% were worse and 70%
3057550	3059550	were slightly better.
3060150	3063110	Therefore, our conclusion in this is
3063110	3065430	definitely that we need a combination of
3066110	3069150	both crypto and Open OSINT in order
3069150	3071330	to tackle this thing correctly.
3071330	3074370	By breaking it up into large, medium and
3074370	3077190	small, some of the results that can be seen there
3077190	3080650	do indicate, as expected, the larger projects
3081330	3083530	probably are ahead in certain areas
3084510	3085150	but
3087270	3089310	definitely there is some room
3089310	3091130	for improvement.
3092250	3095830	Similarly, when we look at the OSINT,
3095830	3098430	we can see there that there are a couple of
3098430	3100590	large projects that actually fall
3101410	3104530	behind the mark compared to some of the
3104530	3107050	medium and small businesses
3107050	3110570	but often the small and medium ones are the ones
3110570	3112530	that actually do need to
3113890	3115330	improve.
3117550	3120010	Okay, so wrapping up,
3120010	3122510	our conclusion is that DEFI
3122510	3125470	definitely needs to do even more to maintain trust and
3125470	3126990	stay out of the headlines.
3127310	3131390	Whilst we are encouraged that there are some
3131390	3133970	community-driven activities to provide transparency
3133970	3137130	and raise the bar, not everybody is covered
3137130	3139930	in these community-driven activities
3140470	3143030	and there are a few extra dimensions around
3143030	3145950	security and OSINT that we think need to be added.
3146090	3148410	A lot of goodness out there but not really
3148410	3151790	full consistency. And as I described,
3151790	3154890	quite a few of the larger players that are
3154890	3157890	mature but there are some that are not fully there
3157890	3160790	and are missing the mark. We did find some
3160790	3163050	isolated, highly vulnerable indicators
3163790	3166230	of potential issues.
3166630	3169250	We do see some high potential for phishing attacks
3169790	3172890	given the concentration of usage
3172890	3175510	of certain email platforms that
3175510	3178950	the industry is relying on. And also
3178950	3181930	some smart contracts improvements on the management
3181930	3184410	of those contracts that need to be done, especially
3184410	3187930	around reuse and looking into the
3188690	3191110	compilers that are compiling the code.
3191830	3193830	Once again, I think I mentioned this a few times
3193830	3197050	but just wanted to repeat it again. Lack of transparency
3197050	3200110	on the key OPSEC. Again, if those
3200110	3202130	keys get stolen,
3202130	3205990	there is a chance of the smart contracts
3205990	3208730	being rewritten and changed. But
3208730	3211910	we don't know how well that's being done. And
3211910	3215390	I think the industry and stakeholders would be keenly
3215390	3219010	interested to see how that happens in practice.
3219290	3221050	And as we move towards a more
3221050	3224130	regulated environment, data privacy and KYC
3224130	3227250	are also extremely important.
3228010	3230730	So, some final recommendations.
3230730	3233830	Lock down your G Suites and Office 365 environments.
3233830	3236070	Train your staff to minimize
3236830	3239490	public information leaks and phishing attacks.
3239970	3242830	Dip into the world of fake intelligence and
3242830	3245790	look into stolen credentials and chatter just to make sure
3245790	3248870	that you're not on the list. Check out
3248870	3251750	and make sure that your dependency on vendors
3251750	3254510	is appropriate and that there's not too much
3254510	3257250	concentration risk associated with certain
3257830	3260190	suppliers, vendors, oracles, etc.
3260190	3263110	Make sure that you're using the right level of
3263110	3265450	security on your email domains.
3267520	3270600	On the crypto side, again, tuning into the threat
3270600	3273540	intelligence is important. Regular code reviews
3273540	3276180	but don't necessarily publish everything.
3277260	3279660	Provide greater assurance over the OPSEC.
3280300	3282860	Ensure that those oracles are protected and can be
3282860	3285400	really trusted. For those of you that
3285400	3289140	are not implementing bug bounty programs,
3289140	3291580	have a look at them. I think there's a lot of value in them.
3292900	3295840	And make sure the keys are adequately protected.
3296840	3299000	Whilst I know there's a strong move towards
3299560	3302100	decentralization, I do think an element of
3302100	3304920	governance for centralization is the way to go.
3305580	3307880	And I see that as the
3307880	3310700	kind of future stable way in which
3310700	3312740	DEFI projects will succeed.
3313980	3316680	From a research perspective, I think that there's still
3316680	3319600	quite a lot to do here. It would be great to
3319600	3322620	have an automated scoring process, very similar
3322620	3325680	to what DEFI score has for the
3325680	3328420	crypto controls.
3328600	3331540	I think we can expand out into the general OSINT
3331540	3334680	as I mentioned before. It would be great to
3334680	3337360	have some better tools and visibility on smart
3337360	3340740	contract code that's automated,
3340740	3343640	that can be published and is available to the community.
3343640	3346560	I think further adoption of transaction analysis
3346560	3349740	for KYC and fraud is going to be really important
3349740	3353020	to make DEFI kind of hit the
3353020	3356240	prime time in the future. And of course,
3356240	3359020	doing protocol stress testing
3359020	3360980	and further
3362660	3364940	digging into the key management
3364940	3368400	OPSEC is also really important.
3369360	3371060	With that, I'd like to
3371060	3374240	give a very special thanks to some folks
3374240	3377420	that helped me through this presentation.
3377900	3379520	Specifically, Danny Howard, who
3380280	3383260	was responsible for the illustrious slides
3383260	3385640	that have been put together.
3386240	3389200	Nick and Ferez helped out with some of the research.
3389540	3392240	This particular piece of work also couldn't have been done without
3392240	3394880	leveraging a lot of valuable resources
3394880	3399320	from the DEFI score project, the DEFI watch project,
3399320	3402000	and also DEFI Prime. So I encourage you to
3403340	3405560	link out, reach out to these particular
3405560	3408920	sites if you want to learn more.
3409660	3411240	And then I think I might have a little bit
3411240	3414020	of time for questions. So I am
3414020	3416760	listening in on the presentation
3417190	3419940	that's happening right now. So feel free to
3420980	3423700	reach out with any questions that I can answer.
3424160	3426240	And I appreciate it and hope to see you
3426240	3429940	next year in Vegas for another chat.
3432440	3434260	Goodbye and stay safe.