ETH Escape Winner Revealed by Michael O'Keeffe | Devcon SEA

[Music] all right welcome welcome it's been a long day uh you all have done a quite bit of great work over the first five rounds have some folks coming in now to probably take a look at this this session will be live streamed in addition to the uh panel we'll be doing later in a bit um but this is the big the big reward here to uh to get towards the top of the 50k prize pool um again here we've got our Wi-Fi network that'll work faster than the venue Network um the password and then this website here which you should already be familiar with because you've been playing around with it today the last session will be 105 minutes consist of three challenges just a reminder um that you are working on your own I think we know that at this point and that the tiebreaker will will be speed um and so all of the finalists will be getting a physical reward as well as a monetary reward but the top spot is uh the top spot and this and two and three are particularly uh great rewards so um good luck keep Focus I will be interrupting a little bit more than I did previously we do have a little more time for this one um and we'll see how we do uh good luck to all of you raise your hand with questions if you get into any issues with the tech or you have questions about um the challenges themselves that we can answer for you so good luck we'll get started here and we'll get the timer going in the Live Leaderboard here is our code for the final challenges top secret all caps we have a smaller group for this round I want to make sure that everybody gets started at precisely the same time so um I'll ask in just a minute if you're all in and ready to start solving all right is everybody in and ready to roll all right I'll give us who needs a little more time hand in the air if you need another moment all right it looks like we're ready good luck everybody get started raise your hand if you need anything e e all right you passed the first test so good job everybody gets 100 points is it working for everyone now all right best of luck e e just a reminder of what's on the line here folks as we live stream this the winner of this round will get an additional $10,000 the runner up $7500 the second runner up $5,000 so a lot of stake here today in addition to the cash prizes you've already already won so keep it up we'll keep going back and forth between the leaderboard as well e e [Music] back [Music] oh [Music] back come back back [Music] back back [Music] 15 minutes in 90 minutes remain no solves yet all prizes remain up for grabs [Music] back [Music] every [Music] o pap [Music] is this [Music] he B o oh [Music] you is [Music] o [Music] o the [Music] he oh [Music] the [Music] all right we have our first solve here at minute 76 dust 2 dust 2 where are you congratulations on getting this started kicked off here in the finals you've got the lead how does it feel a little bit nervous actually a little bit nervous what is your hacking spirit animal that you try to uh inhabit while you hack sorry my braining all right we'll go with elephant they're very smart [Music] fire second solve NP hard we've got two people up on the leaderboard to take the top two spots so far with 72 minutes left MP hard where are you remind me all right good work what did you eat for breakfast that's making you so successful today all right love it power of Corgi and the shirt says it all let's see you can jump into the number three spot I'm betting it's happening soon and then it's going to be a Race So you could finish the next two [Music] challenges e o by oh [Music] e [Music] o la [Music] in the leaderboard third solve looks like they went with a different challenge to start so one now in first place currently poised for $10,000 rewards we've got DS 2 in second place currently pois for 7500 in rewards and NP hard for 5,000 in rewards uh currently as it stands where is one located top of the leaderboard where are you that you all right they're staying and on okay fair enough 65 minutes remain and remember if we have three people solve all three that'll end the clock before the remaining 64 minutes so keep hacking away guys [Music] the oh got [Music] back 1 hour remaining 1 hour remaining la e [Music] this [Music] the [Music] [Music] he [Music] pap [Music] o [Music] got a real race for the prizes now rage congrats for getting on the board got three folks who have solved one particular Challenge and then one at the top of the leaderboard who solved a different challenge so wide open for who's going to get the rewards but again as it stands now we've got one taking home $10,000 in addition to their winnings already 7500 for dust 2 and NP hard uh would get $5,000 in this round so anybody's game still 51 minutes and 45 seconds left keep hustling everybody's doing a great job the [Music] oh another update to the leaderboard one pushing ahead by solving the Second Challenge so on their way it's possibly capturing the $10,000 grand prize reminder that places 4 through 14 in the finals all receive the same amount so if we have a top three that solve all three before the timer's up the finals will be over so [Music] o welcome to the leaderboard Mage inter it's heating up who can get into those top three spots for the big prize money 47 minutes to go [Music] this [Music] Bill joins the leaderboard in position two to shake things up a bit in the top three and MP hard drops to number four so good work Bill getting in there for the $7,500 spot as of right now to [Music] pap [Music] the oh welcome to the leaderboard slipper slipper with two solves very quickly to put them into second place now over bill so it's heating up we've got two folks with two solves the first one to get the last one is going to take home the $110,000 prize unless someone can solve two before they get to that last one with third place wide open still but being held by Bill as we speak just under 40 minutes left of the final round coming into it before in case it ends as people start to solve things I want to give a big thank you to the ethereum foundation I want to give a huge thank you to our friends here at Friendly malt citizens putting together these awesome challenges we appreciate all the hard work you did on that and then we also want to give a huge shout out to uh the upcoming ethereum protocol attack Aon with rewards up to 1.5 million and the wonderful support uh that we've all received from byit wormhole the graph GMX and base but thank you again to Friendly malti citizens you guys did a great job created great events so keep it up everyone keep your heads down coming in the home stretch here [Music] the la e [Music] this oh [Music] the [Music] com [Music] this oh [Music] the [Music] o to [Music] e 30 minutes remaining 30 minutes remaining [Music] the [Music] o com [Music] he is [Music] o the to [Music] you e all [Music] only Chang the leader leader board we have is Bill getting a second solve a few minutes ago that means that our 1 two and three right now are all racing to get that third solve first one to do it gets the $10,000 grand prize coming down to the wire we got 22 minutes left three people in the driver's seat to stay in one two and three and plenty others behind who can certainly get up there as well so keep it up let's see what happens to [Music] he [Music] the [Music] oh [Music] B e is [Music] he the [Music] what [Music] all right players we have 15 minutes left and as a token of my appreciation for letting me bother you all day while you're trying to focus we will release a hint right now to see who could try to take home the prize in the last 15 minutes this [Music] there were typos on the first hint so there's a second hint out there now to clarify the [Music] as it stands now we still have one in first place with $10,000 prize as it stands now 7500 to slipper if if things stand as they are and Bill would take home 5,000 the rest of the pool up to the to the rest however it does seem that if there's one solution to one of these uh to one of the ones that has not been solved yet that person can easily jump into first place if there's no other solvers so anybody's game in this room in the last 12 minutes good luck [Music] oh [Music] the [Music] 10 minutes com [Music] he [Music] the [Music] oh [Music] 5 minutes remaining but we can now say with confidence that slipper is the inaugural champion of the Devcon CTF and will take home the grand prize of $110,000 in addition to what he's already made today so 10,000 plus what he's already made and the physical gift will'll be giving him huge hand for his work today there's still a few minutes left to see who can take the other uh spots cuz it's wide open with uh with one more solve for for pretty much anyone on the board right now the [Music] f oh [Music] e all [Music] 5 seconds will anybody be able to get a solve in all right pencils down a big round of applause to the whole group here everyone in this room should be pretty proud that was a lot of people that came in this room and did some speed hacking today and you are the uh best among them today uh a huge congrats to uh slipper where are you slipper come on up for a minute congratulations on winning the whole thing I have a question for you you took a little bit of a mitigated risk there in holding two answers at the same time it looked like you submitted back to back was that intentional strategy to put pressure on one uh so I saw I have already submitted the one solution but it turns out I was not showed on the scoreboard so I just realized I didn't submit the one successfully so so it looked like a brilliant strategy that was actually a brilliant accident um congratulations you did a fantastic job today uh how do you think you'll spend the money uh how much would I get 5,000 cuz you and I all split $5,000 no $110,000 plus what you already got uh from the previous round so you'll get a little over $10,000 and a gift from us at the award ceremony later but I haven't decided yet so but I would thank uh chat GPT for helping me so I would pay for them so a nice donation to go to chat GPT for uh for helping during the competition congrat congatulations to you for being the inaugural winner I want to uh I want to shout out really quickly again um our great friends over here the friendly malti citizens for putting these challenges together I think they did a really great job of putting challenges that were of all uh difficulty types and managing the event and the platform so we really appreciate their help here um our team here as well I want to thank the ethereum foundation for allowing us to run this the first one they've done I believe at Devcon and hopefully not the last um and for being our partner in doing so and I really want to thank the um as you know the upcoming attakathi for the theory and protocol the entire things in scope saw a lot of really talented people in this room today who I think could do a really great job working on this project that starts in about 12 or 11 days uh eight weeks of hunting a ton of educational materials to get you up to speed um and the sponsors of that program who are supporting it uh we'd also like to which is byit Wormhole arbitrum the graph GMX and base so a huge round of applause I also want to uh I want to congratulate our second and third place uh winners for uh respectively earning $7500 and $5,000 so that's one where's One raise your hand one stand up one congratulations [Applause] and then Bill where's Bill Bill congratulations winning $5,000 plus what you did earlier today so um really great work by all of you I think you're all coming out in the in the black today by getting getting some rewards in cash we also have a reward for you later which we'll do at the you know uh award ceremony here after we do a little bit of a fireside chat um regarding security so hopefully you'll stick around for that so you can collect your gear and then get to our team uh with uh your your wallet numbers if you haven't already done that so you can collect your usdc in the next few weeks the last thing is a lot of the folks in this room which is amazing didn't even sign up until they walked up today and just came in and and uh dominated so really great job on you all for showing up um coming through here getting into the finals making a few dollars uh and because of that I don't believe you got swag packs so we have swag packs for you as well Ash if you could raise your hand over there he has for you so make sure you collect those as well uh Before You Before you depart um but yeah thank you all for participating um find anyone in immuni shirt to give some feedback to because we want to make sure we give feedback to the ethereum foundation so when they run these again uh they can kind of uh decide you know what the best route to do and get some good feedback from you all of what's too hard what you would have changed and and we'll try to adapt it that way but thanks for participating the first one and uh have a great day stay tuned for the fireside chat thanks gentlemen really appreciate [Music] B the oh [Music] you [Music] oh [Music] o [Music] all right all right we'll start the fireside chat here in about 3 minutes folks [Music] he [Music] oh pap [Music] o [Music] [Music] oh this [Music] all right folks we're going to get started here in a minute if we could actually just get folks to sit down to the left or the right and not in front of the camera that would be great [Music] five [Music] o [Music] just a reminder to all finalists who just participated quick reminder to all finalist who just participated please stay here for the award ceremony so we can give you your gift and ensure that you've talked to our team and given us your wallet address so we could deliver your reward money all right with that I think we'll start to get the fireside chat here going uh since we got the live stream um and what I think we'll do first to make it quite easy on ourselves is just uh introduce who we have here um you've heard me talking all day so enough of me but I'm might go Keef I head up sales and customer success at IM UniFi um which is is crowd crowds uh bug Bounty programs and audit competitions and I will let's just move left to right to start all right hey everyone my name is Michael lellan I'm the head of solutions architecture at open Zeppelin uh I focus a lot on working with our security audit team with some of our top clients working on kind of weird uh outof theordinary sort of audit requests maybe things that are outside the evm um and then also do a lot of work on security operations for Dows security councils and lots of other very particular things for the industry hello uh my name is Neville so I'm a program analysis expert primarily at um Management in doob um so I'm also a co-founder my time is spread throughout you know like Engineering Management uh sales and a lot of operations as a co-founder uh but yeah I'm a security researcher at heart hey I'm hey I'm Luna I'm the co-founder and CEO of zelic um yeah my background is in vulnerability research reverse engineering so I used to do like iOS uh zero click um that's the kind of background I have and then yeah nowadays I mainly just do zic with my co-founder Jazzy uh we recently acquired a company called code finina you might have heard of it um I work very closely with that team as well now um so that's kind of what I do yeah I'm Petro I'm a lead auditor at chain security and we are a noi company based in zich who specializes in U complex defi projects and we've audited a bunch of U uh project that you might know maker curve Lio poly market we've got bugs if you want later uh we find them and we package them um and uh we specialize on evm ecosystem awesome and so um thank you all for joining the panel thanks for coming here today uh nice way to end the the long uh day of deep focus these these folks had and I think it's been great because I think immuni has worked with all of you in different capacities throughout the years so um it's it's a great collection of folks here I'm going to start with one that's a little off script that that we hadn't talked about yet is uh um Petro Petro you participated today what did you think of the CTF what do you think of the uh strength the challenges and um you know how how you felt you performed yeah so I'm not too satisfied with how I performed I review code eight hours a day all year but I very rarely deploy anything RAR very rarely interact with rpcs myself so uh I found the bug quite quite rapidly I was in round three and I I think they were very easy to to spot uh but then I had some trouble with uh with the onchain part uh it was uh interesting challenge still but I'm I'm curious to see uh what the other rounds were about there were six with different challenges and the the finals also seemed very interesting but I haven't read the code so I'm curious to see that perhaps a team format would work uh would work better for you next time you spot the bugs and then you hand it off to a to a teammate um yeah probably or just uh taking a couple of hours to get used to deploying stuff beforehand also would have worked well we were thrilled to have you participate um a lot of the audience today a lot of the participants in the CTF today which was fantastic uh were developers security researchers Auditors we had a really great mix and many others I'm sure as well um so I think keeping that in mind keeping the audience in mind when we go through the next few questions over the next 15 minutes or so um we can kind of cater to those audiences however you please and whatever angle you guys want to come at it from but the first thing I'd like to ask is a lot of these folks are involved in crowd sex security that's kind of what the um you know what the uh ethereum protocol ATT haathon will be about I'm curious how you all see crowd secc um security next to your businesses and how you operate and maybe um and maybe where I'll start actually is with you Luna because you all recently acquired Cod Arina um so you obviously see some value next to the audit so I'd love to hear your perspective yeah I mean the main reason we acquired code arena is we just think we can deliver like better experience better security for our customers the main thing that I I would show is this concept that we have introduced called audits plus so when you have a consultative audit you're going to get like you know a small number of very highly skilled people and they're going to look at the most important parts of the protocol but it's fundamentally a timebox audit right so they're going to get maybe one week two weeks three weeks to look at this thing so they can't afford to look at every single like gas optimization that there could be or like oh no this function is not documented they need to go find and make sure that the critical variant of the protocol are firm now on the other hand a lot of times you do want to get information about all the possible things that could go wrong and not just that you may want to have you know hundreds or thousands of eyes on the codebase because that is what you want before you uh not just you know ship it to mayet but also before you put it in front of a bug Bounty right because that would be very expensive the earlier you catch a bug in your development life cycle the cheaper it is whether that be um at the integration test or the unit test or the code review internal audit the earlier catch these things it's cheaper so you want to you know get a consultative audit because you can have a firm Authority say like okay yeah we looked at it and we're pretty sure it's secure um and then you want the additional reassurance of like okay now not this that we've got a crowd of people that looked at it and it's definitely been very thoroughly picked apart so because of that we think that consultative Audits and competitive audits um or you know crowd security these two go hand inand in creating something that's extremely uh High Assurance so that's kind of what we think we think that crowd security is very important yeah that's I mean why we call Crow Arena wonderful I'll open up to the rest of the panel for anyone that's got a response to this question as well uh well Crow um this kind of security is really really effective and it's really enabled by the community I mean listen um everyone is motivated to learn new technologies you know make a name for themselves and also do the right thing and finally make a little bit of money and especially for bug bounties um which is the line last line of defense I mean be having participated in bug bounties myself you know I feel that you are highly motivated you know like to spend a whole night looking for a bug or something like that um so yeah it is highly itive you know in certain contexts but it really depends who's there you know looking at your code to be fair white hat program is the last line of defense right but that's something that I wouldn't do because of legal issues and things like that sorry I I was just posting I can't help myself predeployment post- deployment yeah um it's a model we definitely seen a lot of our clients start to work with like we do mainly consultative audits private audits lots of different names for it but it's something that opens up and's been doing since like 2016 um we expect to continue to do it we expect to continue to see demand but um we've definitely seen a lot of clients that are like specifically integrating us into our broader process where you know we're typically doing a private audit or consultative audit um and then they plan to later go to a uh a crowdsource competition so it's it's good from the perspective if like if we did buy some chance which is always some chance miss something like there is additional uh layers of security that are going to potentially catch that so it's not all on us um you know and potentially there's several private audits as well um and then afterwards we've actually found ourselves working more and more with clients in the fixed review process of competitive audits because of the fact that uh you can have a lot of issues coming in um even if they're low that could be uh applied to the code base and having someone who's already seen that code base and picked apart a bit uh can help with the fix review process as well and ensure it uh the code is as secure as possible before it goes to mainnet so um yeah I do expect this this is going to be a model that continues to grow and there's going to be probably a lot of coordination between both private and competitive Audits and the ways that clients use them yeah so we work with u traditional audits but we we also uh recommend a competitive audit if you can also afford it and uh we have seen the class of bugs that are Cod are not necessarily the same between the two uh competitive audits don't guarantee that you will have good people but in generally you have a high probability that people who are skilled at what you're doing will look at it and they will find specific things in which they are very proficient uh what we do is really more trying to cover everything and um we try to give guarantees uh in the sense that we we know what we understand and we know what we don't understand at the end of an audit with a competitive audit it's harder to uh to know what's been seen and what's not been seen yeah um and one thing we really like about like the collaboration between uh close collaboration between an audit firm like a open Zeppelin chain security or zelic for example um and a competitive audit is that for example you do the private audit and then the researchers who were assigned on that private audit now they have a very high context understanding of the code base and they can prepare the notes that then arm the or equip the community Auditors to be even more effective than they would if they had just been going in blind so to speak they can be like hey watch out for these parts um these parts are especially important to check but of course don't let that rabbit hole you one more thing I to add is uh if you start with a private audit first you're more likely to be told you're not ready go back and try again uh as opposed to a conod competition that's just going to say all right it's payday so probably do the private art first 400 issues so true excellent point um so I'll skip around a little bit uh especially for the audience who I know is here since I surveyed them earlier um particularly for developers uh what are some of the best practices you see as Auditors that you wish were more widely adopted and why do you think they may not be widely adopted so I think developers uh often think about Security in a later stage of a project and they're not thinking about uh their code in an adversarial way from the get-go they should do more uh code reviews internals they should do more internal audits in a way where some part of the team tries to break the protocol uh I think this is very useful um yeah two things two things you can do today to improve your security is 100% code coverage uh I know you guys out there you guys do not have 100% code coverage I know I know um and the other thing is uh write your functions um I read this great blog post by I think it was Million um I think they're totally right you should do function requirements um and then checks and variance and then and then protocol and variance at the end so you should just assert that the like if you have like a you know CFM just assert the constant function is still constant at the end um or like you know like the whatever solvent that kind of thing if you just throw on a bunch of assertions at the end it can just kill a lot of a lot of attacks or at least mitigate them what might have been a crit might not be a medium yeah so one other thing that I wish people do a bit more is uh more static analysis and more formal verification uh we don't see this as much um probably because it's like a little bit hard to use some of these tools also these tools haven't evolved haven't benefited from enough uh money for R&D at this point and also like the underlying language changes so much so it's hard to make them really really spot on um but yeah it might also be a cultural thing and it's also like uh this is like offloaded to towards the Auditors so the Auditors do use these tools but like the developers themselves don't use them as much currently yeah I I definitely put like a big Plus on invariants and just like doing it throughout the process like both defining them building a threat model around it testing against and even when you're going to production like monitoring and looking for like flaws in the inv variant occurring later um another thing that I think doesn't happen nearly as enough is like for people to include the access control and deployment process and other things like if not in the scope of the audit then they very at least like being very thorough about how that's going to impact the code I mean we have actually seen things that we we were basically putting down as a critical vulnerability because we saw in the documentation about how they were going to deploy the code in a way that like was basically going to wreck them and they actually were arguing with us saying like oh it's not in the code I'm like well now it's in the docs that was in the code that was in the scope and it would have wrecked your protocol uh so we're going to count it um so I think like people including the deployment process as almost part of the code and scripting it and being very careful about how the keys that are signing deployments being done using a multisig or something else uh to handle that process and yeah never putting your your in a position where some EA key on some developer laptop is hopefully not going to get fished and wreck the protocol and I wanted to add on to what Petro had to say like it is true I think all of us will empathize with the fact that a lot of teams essentially this is very common and I totally understand why they feel that way because they just need to you know go to market um they think of security in like a oh we'll just do it at the end kind of way but that's really bad it's actually more expensive it's more slow because you're going to get an audit by one of us um cuz all these people here are you know very good firms um and we're going to tell you like hey your design does not work you're going to have to rewrite this entire component come back in two months after you've Rewritten it so before you thought you were going to launch in December and now you're launching in March so it's like tax planning it's like post Hawk tax planning doesn't work it's really bad um you should think about your security as you are building your protocol at the design phase yeah yeah and something you said earlier is the biggest Roi Splash you're going to get is catching that stuff to the left of the audit beforehand which is not as sexy as the bug Bounty business or just giving it to the Auditors or uh all of that stuff but um you know I equated it to like the job of Homeland Security right like the best job you do to the left of the audit is never going to be talked about but it's the highest Roi and the highest uh the most difficult to calculate um avoiding those those situations so I think sorry a lot of the the work you do initially is also relevant to Security even if it's not security oriented sometimes like good design is something that makes security assessment much easier even if you have been thinking about security the whole time then so I would say being good at software development helps Security in general yes y that dub Tails nicely into another question I want to ask the the panel here and then maybe we'll have time for a question or two from the audience if uh they have some which is you know talking to some folks here today who are developers early in their projects sometime some of them being first or second time through this process what's the the best piece of security advice you can give them at the earliest stage of their journey of creating something new yeah oh sorry Michael did you want to go go for um yeah like figure out what you want your protocol to do and what you want it to not do and write them down and then like look at them while you developing your code and then add test for them add assertions for them like we find this to be a very common problem in our audits is that we talk to the customer like okay so like what are you worried about and they're like well you know we don't want to get hacked I'm like okay what does that mean right you should know what it means for your protocol to get hacked so then you can like actually think about like okay well I'm worried about this or that basically having a real threat model I I'll add to that like definitely 100% throt modeling is like where you should start um I I think because the other thing is like people like security has to scale with the project like are you going to be able to afford to have like a full monitoring infrastructure set up like going to deployment if you're like you know you don't have any tvl you don't have a lot of things like we will still say like yeah you should probably do that but if you like literally can't you don't have the resources like um a lot of teams I think will because they start out without like a lot of the security infrastructure or support uh but then like suddenly in a couple of months their tvls like grown it's gotten massive there's a lot of lot more value at stake they never really thought through how are we going to like upscale our security like I've seen people that will build up their access control and hardcode in something like a eoa owner and they're like well maybe we should transfer it to a multi sign now and they're like actually we don't know how to do that we didn't prepare for it that's like a a particularly egregious example that does exist in a billion dollar protocol try looking for it um where someone just hardcoded the owner and you just hope that whoever has that key uh never gets like kidnapped or decides to go Rogue um so like but just in general be prepared to like scale up your security as you have the resources to spend on it um and just even if you can't spend on it today plan to know like okay at some point at like this level of tvl let's start like taking whatever profits might come from that and like invested in uh making our protocol more secure because like most of yall here unless you're got unless you win enough from this competition to pay for a whole audit um you know you can't get your code audited from a top tier firm but maybe at some point you do or want to and and and yeah be prepared to cre and other things yeah like you want to have Escape hatches for yourself it's kind of like lawyering stuff up like have you anyone here work with lawyers before they're like so expensive it's like so annoying so you tell them like okay okay we don't need like this like freaking Cayman Islands Panama thing just like make me the Delaware LLC and just we'll fix it later if it gets really big but you like these things are you know lawyers are good at like okay yeah we'll just like move all this stuff over it'll be fine they're good at like having these Escape hatches for you because uh people have been making legal contracts for a long time think about your security and ways so that you have Escape hatches for okay now my thing has scaled how I'm going to keep this secure as it's growing but you know you don't want to like be dumping tons of money on making your protocol super fancy secure early on because you probably don't need it yeah I would say start really simple you might have a lot of very good ideas but really make the minimal protocol you can do and you will save a lot of money on security on audits reuse valid components that have been audited previously and understand how they work and uh the audit process will be much simpler for everybody one final thing that I'd like to add is um probably what you're going to be building 99% of the time it's not going to be original like a lot of people have built something which is similar and you can look at what happened to that thing probably it failed probably it had some security issues probably it had some economic issues right if it's a web three project um you know so go back see what what happened how it failed and make sure that your design um at the very early stages and also your requirements um are such that this will not happen that's obviously very hard but if you do it at an early stage it's going to be much cheaper excellent um any questions from the audience any that we could squeeze in one or two questions if people have it hi uh so I'm building a uh debit card solution uh where I'm assuming that once our transaction signed and went to the network it will be successful because the whole thing is standardized but on the parallel I am running a consensus model which will monitor those transaction if those are successful or not and if if it goes fails uh it will trigger the system and act accordingly so what things I should keep in mind like what could be the security threat uh which I could uh I could face or yeah so just understand you're trying to build a system where someone signs a transaction submits it uh it succeeds or fails and this is just for like a normal payment so what we are trying to do we are providing the transaction time to 4 to 5 Seconds so once the transaction is signed and sent to the network we assume that that will be successful but the on the parallel we are running a consensus model that will monitor those transaction and build a consensus that that will that transaction is successful or not if it's successful we are good to go but if it fails we will trigger the system and that system will act accordingly like if it fails due to network congestion or some some logic error or something so what other things I should keep in mind uh like what other uh like scenarios of of which transaction could fail or how it it's hard to say exactly because I I think there's there's a lot more I would need to know about the system but uh just off the top of my head I would say uh there could be an instance where like the way that you're like the node that you're monitoring it from uh is somehow down or like I guess be prepared for whatever infrastructure relying on to be able to confirm success or failure uh you have like a backup plan if it goes down or you're able to like ensure that someone isn't able to exploit that um making some very general assumptions here uh like we we are using blockless protocol uh which have different nodes and uh I think those nodes are uh building the consensus not a single node is building the consensus or a proof that a transaction is failed or successful so I think that that wouldn't be the case but there could be something uh of which should be a aware about again I'm trying to Second guest of about how your system works but one of the things that comes up is whether the consensus algorithm has a finality Gadget whether you can actually tell whether a transaction has been finalized or not because otherwise you'd need to wait a lot more time than 4 seconds 4 seconds does sound really really low though thank you time one more question if anyone in the audience has one one question over to the left there hi uh so I'm not a security Reser myself but uh I've seen a lot of hacks that are uh due to consensus mechanisms and sometimes uh Mass Social Engineering of a protocol I was wondering what do you think about uh how we can basically build uh mechanisms that are more hardcoded to to prevent such uh exploits more hardcoded though yeah because uh basically the human factor is more unpredictable how can we hard code consensus to be less maybe it's a difficult question when you say consensus do you mean like like for example a multi sick does that count as consensus yes and also at scale like for a DA for a da um yeah so transparency is very important here because it makes it a lot easier to see what you're voting for for example I think one notable example was there was one for um tornado cache where they just like proposed a thing and they were like yeah totally does this and it just like did something else so yeah like monitoring your dowo is pretty good transparency another thing is just time locks So like um make it so it's easy to cancel a thing that's in the pending state in the time lock so this way there's a longer window for like for things that are like potentially breaking to get canceled and noticed of course the downside there is you get a lot more latency so if you have some critical thing that needs to get jammed through uh it may make it hard to do that timely so that's another trade-off do you guys have any ideas yeah I I've actually we' we had some really fun experience and I say fun in a sarcastic way with Dows that were under some form of governance attack um in one case like a whale buying a lot of tokens and trying to push through a proposal on compound that would have given them even larger part of the treasury and then control the Dow and it the way they did it was very tricky they took a bunch of tokens they had purchased they spread it amongst bun of counts it we did actually have security monitoring that picked this up as strange activity um but even then it's like okay so who is like a new a genuine new delegate and who's one of who's like uh you know one of these many accounts controlled by this one entity um there's very few ways to do that in a permissionless system because you know it's essentially a civil attack in that sense as long as they have the resources to allocate um I I think at least being aware I think ultimately like having reputation in the ecosystem and then having some checks and balances on them um and Recovery mechanisms like in that case like having a multisig that can veto proposals if they're somehow violating the Dow but you have very specific rules that multi is elected by the Dow they're accountable that's where I'm starting to go towards especially for Dows uh and for multisig themselves uh I think definitely having strong reputation possibly even kyc kind of depends people are you know controversial around that but I think if you can if everyone's if it's appropriate to like say we know these are individual people do a signing ceremony where they're all in different places and they can verify they're all different people it's not like one guy controlling four or five different Keys um yeah I think it's like there's no good technical solution to these things these are just like okay having strong social de mechanisms to recognize who's a good actor and who's not because it it's not as easy as like a ethereum where it's like okay running a bunch of nodes that are all coming to determine Asic answers and the general idea is just like make sure you have enough nodes that they can always outvote the bad nodes on the deterministic answer with multisig and Dows these are not determin these are not deterministic answers of like yes this is good yes this is bad so there does have to be a lot more work on the consensus of who are the actors why are they allowed to participate in the system and how do you root out Bad actors and prevent them from Gaining control as a as a post you could take the maker doubt approach and you could make the decisions deterministic by offloading it to AI all right end of post all right uh it's also an interesting experiment anyways I'm curious how it goes so another mechanism of saying is to make the Quorum of a governance mechanism increase in size the more contemptuous the vote is so that a simple majority is not enough um so it's a variable Quorum yeah of course it's like a trade-off between like how easy it is to get stuff done same with time locks and how safe it is yeah I mean on one end of the spectrum is just everything is hardcoded on the other end of the spectrum is just like whatever goes yeah any other final comments from the uh from the panel here today and I know we're a little bit over time but I want to thank you all for for joining for anyone in the audience who hasn't had an opportunity to work with either ammuni or any of these firms these are some of our favorites in the industry um there are there are many others that are great too but I was really happy to to put together a panel uh with this group because it's really great uh can't can't go wrong with anyone sitting up here um so uh anything any last words panel I think everyone in this panel is really awesome likewise I agree very nice VI thank you all for joining us really appreciate it and uh and hope everyone has a great rest of the week um and with that I can let the the panel go and I think we owe some some rewards to uh to our CTF participants today thank you all [Applause] again awesome e [Music] the close out the day we have here our awards for our wonderful CTF participants we're going to go ahead and start with slipper again what's that I'm gonna I'll let slipper show yeah all right so in addition to your cash rewards again make sure that you've given your wallet information your correct Wallet information double triple check it so you get your correct payment um but if slipper is still here we do have a physical gift for you if you want to come up and grab it slipper you still here where come on up real quick so in addition to the cash congratulations again on being the first one maybe you can show the rest of the participants what we'll be giving out here um to the finalist so in addition to the cash prize we've got a nice uh set of Beats by Dre Studio Pro headphones for everybody to take home and make sure you get your immuni swag bag as well uh commemorating the event here today um let me go through and call names up to come get your stuff uh are you okay yeah it's fine it's all right don't worry about it I'll just go all right so I'm going to go in a I'm going to go in a random order now just because my spreadsheets a little screwy um oh perfect um wait no something's wrong all right uh Billy is Billy here Billy come on up receive your uh receive your gift or I can bring it to you Billy here you are sir congratulations a great uh great job done by you today chain security also left a little bit of Swag here too so feel free to grab something there all right uh next we have Tony Tony come on up congratulations to you way to be a a finalist here in the CTF lot of hours spent here today heads down you next we're looking for uh naoa I'm I hope I'm pronouncing that correctly is NOOA here naoya maybe that's the better pronunciation all right we'll hold that one off to the side is is but are you sure that's a yeah this is from Mixie no no no thank you you go all right yep uh Harry har All [Applause] Right congrats great work today good work ches chiu great [Applause] work J R we've got somebody that's going by the name of just Jay Jay the email is RK s k e k and some numbers oh you got one okay so that's okay it's all the same it's fine yep so that means we're missing a bill still then right yeah it's all good yeah just you could just yeah it's all the same we can just pass them out great all right perfect rage next rage rage I love the hat good work all right there we go already knew just need a bag congratulations great work great work thank you thank you Mage inter Mage inter great work congratulations Mage M4 K2 congratulations y Vlad Vlad are you still here all right Vlad Vlad I think you even won your group too I believe so congratulations neun nepon great work the early leader stays on the leaderboard and Valera last but not least Valera congratulations great work great [Applause] work uh once again thanks everybody for coming through thanks for participating the CTF I know there a lot of hard Focus work in one room all day um please uh look forward to the $1.5 million ethereum protocol at tathan that will be hosted soon um and with uh the sponsors for that program and again big thank thanks to the ethereum foundation for uh for allowing us to run this event here at Devcon and the friendly malti citizens Okami are you still here Okami Mino right thank you again take care have a great rest of your week and enjoy the rest of Devcon