Qredo - Introduction to Digital Asset Custody

welcome my name is Ben Whitby I am a physics geek that ended up in corporate investment banking I went down the crypto Rabbit Hole in 2013 and I haven't really come back um in 2013 I was working for HSBC and I came across the the Bitcoin white white paper and there was this guy that per 50 Canadian Dollars into a BOGO coin ATM in Vancouver and he happened to work for HSBC at the time and it was my job to go and walk around the car park and explain to him why HSBC doesn't invest in Bitcoin which is what the headline of wired wrote at the time which is going to cause all sorts of different challenges and problems but that really kind of took me down the rabbit hole and everybody's got their own Rabbit Hole story I tried to move the needle with an HSBC for four years before I eventually gave up when I I found a team based in London that had done an Ico called token card the subsequently rebranded to monolith but it was a great experience and we came out and we had a treasury full of ease I think that we were the sixth team that had done an Ico in the ethereum blockchain so it was a it was a very special time and when we were trying to form this company trying to do this amazing thing which was we actually did it we we built the world's first smart contract wallet with a Visa card we did all the negotiations with Visa we had one real problem and that problem was that we had this treasury of eth that we were managing to run our company we were managing to run our team and yet we had no ability to really govern those assets other than keeping them on a ledger or Tresor with 12 words so at one point our CFO had a ledger with 108 million dollars worth of assets that he was taking home every night which is crazy when you think about that you can't run an organization where your whole company is dependent on one person not getting mugged with their private seed is stolen so you know there was a massive problem that needed to be solved in terms of these teams that we're going to tread in our footsteps and do an Ico so I left the I left the monolith team in 2018 when I met the founders of of Credo Anthony and Brian and we were in having lunch and we talked about the various different challenges I recapped this story to them and Brian told me hey man there's this amazing piece of technology called MPC and BLS signatures and I think I've got a way to crack it and so over the next two years we we got out into the market and we built a wallet that is based on NPC and so can sign ecdsa signatures which means we can sign against any blockchain that's currently out there at the moment at the moment and we abstracted that using the BLS framework that Mary's just described from from the ethereum foundation we abstracted that through BLS and using blockchain technology into governance so we had a wallet that could store assets where my token card monolith CEO was a CFO at the time could share and delegate governance between the team so we got a threshold based sector over over that wallet structure now we've been incredibly fortunate if I Just Step forwards until next one I've been incredibly fortunate in terms of our journey about how we've raised funds we've come to this space um we've managed to be supported by some of the most amazing teams in the crypto ecosystem um we are very close and great partners with metamask institutional who have selected us as one of their Partners to to run the the governance over the MMA wallets and we've signed up close to 300 hedge funds family offices and various different types of firms that are in the crypto space today doing crypto business today and finding the challenges that I just described with my old team as a significant limiting factor in terms of the way that they run their assets and the only other way that they can do this today which slows them down massively is by giving their assets up to centralized third parties and that's just not going to happen right so what we've got is we've really kind of got the challenge of finding out how we manage this normal business activity in a crypto space how do how do we regulate the authorization of transactions how do we Define the governance model over your team when your team changes maybe on a day-to-day basis people get sick people leave people get promoted people get fired you need to have a very flexible and dynamic kind of way to manage those policies and how do you manage to build a system and build a technology layer that enables firms from the biggest banks to the smallest teams to be able to really utilize the technology and make sure that it passes all of the due diligence now I think we're on the right direction here of those 300 firms that have signed up today and that number is growing every day in fact I'm probably massively out of date we transacted three billion dollars of transactions a worth of transactions last month three billion dollars and that for me staggering absolutely staggering with the various different positions that we've got as the whole world starts to tokenize Ticketmaster has issued close to 100 million dollars worth of tickets in the nft space Nike did it uh nft project where they've monetized well over 150 million dollars of nft sales this is going to be a very real thing for Enterprises for financial institutions and there's an awful lot more to come so I'm going to stop there I hope I've got you quite excited about the The Credo layer of governance and what and why we're doing it I'm going to pass over to Graham Graham's going to tell you a little bit more about the the the how and the the what of what we do and hopefully it will build on kind of Mary's position [Applause] yeah thank you Ben and also my first time doing this sort of thing so tremendously exciting to see all of you this evening developers enthusiasts entrepreneurs all pioneers of the web 3 Frontier Believers in decentralization the democratization of Finance advocates for censorship resistance and freedom of speech unless of course you're from PayPal now today I'm going to tell you a story and it's a tale of two Journeys I was trying to bridge the story because I know you're probably all anxious to get to the pub but this journey is something that's close to my heart having lived through it both personally and professionally as a network architect for many years it's the story of what we would call web1 and web 2. and I joined IBM in 99 just in time for the dreaded Millennium book which turned out to be a huge nothing Burger but don't worry because the.com Bubble Burst shortly after and interestingly I took a job at Credo just in time for this bear Market cycle so I'll let you know my next career move in advance on LinkedIn just sure everything connected with that industry and you can go to the beach um so the second Journey as you may have guessed is is one we're all on together it's it's a journey of building our decentralized future on web3 so how do these Journeys coalesce intertwined to tell you something meaningful next time over the years the industry started oh that's the right slide sorry go back yeah yeah first we've got to address some elephants in the room just this year we've had multiple hacks on Ronin Bridge the Wormhole Bridge binance smart chain Harmony One amongst others we've seen crashes and cascading liquidations from some of our not so favorite actors at 3ac Voyager Celsius and of course Terror we have private Key Management the very essence of authorizing web 3 transactions billions of dollars of assets with one private key one key to hack one key to lose one single point of failure and these represent a clear risk to the Integrity of web3 and certainly makes me think what can we do better how can we improve so the industry started evolving its approach to custody via protecting our assets through cold storage and it's still a widely adopted practice today and it gives us a degree of protection but to superimpose this onto our first journey it's a little like disconnecting your 90s modem and PC because you're worried you might get a virus or the art images you've downloaded may get stolen and those are images by the way they took a agonizingly long time to download um but this mechanism when we apply it to digital assets it's Capital inefficient your funds are a liquid and bring them online again depending on your custodian it can be a time consuming cumbersome process so again we needed to improve our approach introducing multi-sig so multi-sig removes the dependency of a single private key for the first time it gave us thresholds as Mary was describing and it was a rudimentary attempt at governance where if enough approvers sign up on a transaction and meets threshold it's approved and a signature is created and your transaction is on its way but it wasn't really the Silver Bullet that the industry kind of is looking for um because multi-sig schemes are prone to human error and you don't have to look much further than the Ronin Bridge hack earlier this year for evidence of this web enough private keys to meet a threshold was stored on one validator node and that was a very costly lesson in private Key Management now one of the the issues with multi-sig is it doesn't really have the concept of who has the keys how they acquired them or possess any real means of verification to layer into that our first journey here the early days of the internet so the evolution of Ip access lists where only Network a could talk to network B and that was cool but they didn't really have any contextual information of who was behind those networks of what they were really doing or if their application was behaving legitimately they much like multisig were just part of the Journey part of the evolution introducing NPC multi-party computation and I'm so glad I was after Mary um so leveraging NPC we can sign transactions via multiple sharded Secrets coming together in other words there is no private key and MPC when combined with governance is a powerful tool to improve the integrity of transactions and governance but there's more Nuance than that because what I would call the the first gen MPC custodian providers they would run the governance layer on a database and this is to an extent where our Journey's intertwine because database database is even a wonderful things you can create read update delete information but they did then and still do today have the same it's a problem problem they pose a security risk they're centralized data only needs to be changed once and in one place now security by Design architecture today means we cocoon them with firewalls we spread them across DMZ we have security software to to mitigate against knowing exploits but think of these countermeasures as building castle walls to protect the crown jewels but all the time you still have that same inherent Achilles heel an attacker only needs to strike once and in one place and of course what if our bad actor is already inside the castle walls and a lot of it Network attacks originate this way one bad actor one Rogue administrator indeed one incompetent administrator and you can lose your crown jewels in network architecture parlance you're only as strong as the weakest link in your design and let's look at a different model what I'd like to call a next-gen NPC custody model and here it's one that tries to embrace the ethos verify don't trust and instead of leveraging a database to perform governance this is replaced by a blockchain just happens to be of course The Credo blockchain and this makes a difference because it makes our governance consensus driven that's no longer a centralized database or Honeypot to attack and there's a lot going on in this diagram so let's just take it left to right we have an approval layer and these approvers could be human or programmatic agents and these are the only nodes that are permitted to submit governance data and workloads to the blockchain and the governance layer itself exists on chain and it includes all kinds of role-based access we can apply different policies to various wallets and crucially changes to these policies also need to pass through the same governance workflows as transactions so there is no out-of-band easy hack to this the MPC execution layer is where the the secrets converge to create signatures to broadcast out to whichever blockchain we're talking about and this means this decoupling of the architectures means we can have multiple changes occurring at the governance layer we can have people coming people going policies changing thresholds changing all with no interruption to the NPC secrets or the wallet structure and the only thing that can drive executions on the MPC layer is that governance layer nothing else can instantiate execution of NPC secrets how does this compare to our web one and web 2 journey well oh that one sorry Ben and quite finished waffling yet um well it Network Security started implementing something called layer 7 firewalls and they had the ability to regulate traffic Beyond which network was talking to which or what protocol happened to be used but crucially it gave insights into what the traffic meant who was behind the network and it had the ability to verify their application was behaving legitimately it gave us an extra layer of intelligence to safeguard against attack and this is exactly what we do here we achieve intelligent security via blockchain and cryptography to provide this extra layer of Defense okay so I'll talk a little bit about cryptography thankfully thankfully my Approach is story driven so um BLS BLS is used to securely link governance agents to The Credo Network and just a quick story about encryption I I personally find fascinating and it's it relates to something called Netscape Navigator in the 1990s I'm not sure if any of you guys have ever heard of that or I'm just showing my age here but they they tried to ship and Export encryption with their browser and at the time encryption was actually classified by the US authorities as a munition alongside sarin nerve gas and Tomahawk cruise missiles and partially due to its its Legacy in military history it was considered a weapon and they would go before Congress and they were investigated by the NSA all the time insisting that no no one day somebody's going to use encryption everybody's going to use encryption to do their shopping or book holidays and it was a long drawn-out sequence of events but ultimately the US government relented perhaps on the grounds that they were basically trying to ban mathematics and there were some obvious parallels with our two Journeys because the same opposing arguments are rehashed and resurfaced again decades later and the past two acceptance it reminds me of a quote from Jeff Booth's excellent book the price of tomorrow where he States innovation is Unstoppable now MPC as we know it removes the risks and dependencies associated with a with a single private key and it does this via sharded secrets um I want to take just a moment to talk about credo's NPC implementation and high availability so Credo run 24 NPC nodes as as hsms or high security modules split across six data centers now this creates a network that can withstand simultaneous outages at four out of these six sites so it's highly available and to tie this back into our first journey um it wasn't uncommon for internet services sometimes important ones in the early days to be running on a Pentium 386 and windows stuffed under someone's desks with uh in an office somewhere and maybe the cleaner would come along at night and pull the power cable or your your disc would stop spinning or more often than not though Windows crashed yeah and that's one of the reasons I've always been a Unix guy um but the network industry it it learned from these lessons the high availability became more accessible and the industry started to embrace that and you can now find this in things like Cloud technology and elastic scalability all kinds of lessons that we've learned during our first journey we don't need to repeat in web 3 because we can already do better so that's why at Credo we built this network from the ground up with these security by Design principles that's why we Implement these advances advances in cryptographic security and leverage High availability Networks on our blockchain an NPC next slide please so how do you use Credo how do you use our MPC wallets with the governance structure and secure signing with web3 well we have a few different options we have a metamask institutional wallet where we partner with consensus to give you access to all of the evm chains and this is a comparable experience to anybody who's ever used metamask orange but you get the added security that institutional gray security that lets you have thresholds and signing schemes and policies um and of course you get the added Assurance of The Credo MPC Network actually signing your transactions we also have wallet connect which is coming available to both institutions and Retail users again you have the same degree of governance and NPC signatures here as you do with MMI um and I'd like to talk to you a little bit about the The Credo Network because this for me is one of the big exciting things that that Credo have that's a a paradigm shift if you like because it's a unique blockchain it's a layer 2 network but it's built on top of multiple underlying layer ones it's built on top of Bitcoin ethereum cardano Solana algorand polka dot we'll soon have arbitrum optimism polygon and more now when you have a layer 2 wallet it gives you some special abilities it gives you the ability to execute OTC trades or perform Atomic swaps or even transfer between other Credo wallets and you can accomplish all of this with instant settlement and also vastly reduced gas fees if you can compare them to layer 1 gas fees now you can also interface with the world of C5 on layer 2 through exchanges and liquidity providers and every MPC wallet that is created on the network is self-custody because you control the BLS governance Keys necessary to release transactions so we are not a custodian as such we are a technology provider a partner now what you also get is 100 provable liquidity which if you consider some of the earlier examples of the the crashes and liquidations a lot of those were founded on opaque liquidity particularly with Celsius for example where they would re-hypothecate your assets now even if you have a layer 2 Network a layer 2 wallet on Credo we have our own blockchain explorer that is fully transparent where you can prove assets are there 100 of the time please so I'd just like to give you a bit of an indication about what's next and what's coming up on on The Credo road map and our vision for the future so we have defy API while it's an approver agent software and combine these two together and we're able to support fully programmatic Solutions so you may have high frequency Traders or someone may have a certain algorithm or insert your reason here they want to behave and interact with us in a programmatic fashion and these two features support that we have computational policies which enrich and improve the governance workflows and policies that we can create including smart contract whitelisting we've got forthcoming Integrations with Solana and Cosmos defy wallets um we also have Credo markets with features such as power swaps glaster we have Fiat ramps we have um liquidity providers coming on board and all of these incentivize the utility of The Credo layer 2 Network now over the longer term um our vision again is is one of decentralization and that's why we have a validator node Federation program where we will introduce third-party validator nodes to The Credo blockchain to increase decentralization we also believe in dow-based governance ultimately to give our community the power to enact decisions and we also want to get to a stage where our layer 2 Network is open and permissionless where developers can come and build their own protocols drop them on top of the Credo layer 2 Network and enjoy all of the benefits that it has to offer so in summary I think it's inevitable that the world of web 3 is going to innovate evolve and build and that's also our plan to innovate evolve and build and decentralize and the lesson that I think we can all learn here is that protecting your assets along the way is more than a worthwhile exercise it's it's a necessity so it's the end of the story but only to start at the second Journey and it's been a a big pleasure speaking in front of all of you tonight it really has and just in case you were wondering if you have any burning or very difficult technical questions I am quite close to the door so thank you very much [Applause]