►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/securing-cross-chain-communication/
The last year witnessed several cross-chain bridges being hacked and millions of dollars stolen by hackers. Despite the bridges having gone through several audits, we still see them getting exploited because hackers were able to get access to authorized private keys, signature replay attacks, etc. Let us see what a secure cross-chain bridge architecture should look like and what are the possible attack vectors and mitigation techniques.
Speaker(s): Nithin Eappen
Skill level: Intermediate
Track: Security
Keywords: cross-chain,bridge,security
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
I'll,
be
speaking
about
securing
cross-chain
Communications
you'll,
be
stuck
with
me
because,
due
to
Central
actors,
Colombia
did
not
give
visa
to
the
guy
who
was
supposed
to
come
and
present
this
okay
I
can't
even
imagine
why
they
would
cancel
the
Visa.
Imagine
you
know
the
business
that
was
supposed
to
have
been
here
right,
so
I'm,
not
a
technical
person
I'm
supposed
to
take
a
technical
presentation,
so
bear
with
me
if
I'm
going
wrong
I'll
try
to
keep
it
as
clear
as
possible,
I'm
on
the
phone
with
them.
A
If
there
are
questions
at
the
end,
that
I
don't
know
the
answer,
I'll
call
them
up.
Those
guys
are
very
technical,
okay.
So,
basically,
even
the
last
talk
was
about
securing
Bridges
and
stuff
like
that.
But
let
me
try
to
make
it.
Why
are
we
interested
in
bridges
what
is
making
it
so
attractive?
I
think
there
are
two
things
as
devs.
You
can
see
that
layer,
0
raising
135
million
hash
flow,
raising
25
million
no
about
raising
22
million.
Now
from
the
hack
side,
Ronin
Bridge
lost
600
million
last
year.
A
Warm
her
or
losing
325
and
Harmony
bridge
is
an
example
of
losing
100
million
right.
So
this
is
why
it
gathers
attention,
there's
so
much
money
involved.
So
before
I
go
deep
into
the
talk,
the
idea
is
I'm
going
to
explain
just
basic
about
the
space
about
bridges
cross
chain.
Why
is
it
important
some
of
the
examples
out
there
and
then
some
of
the
hacks
that
happen
and
what
caused
those
hacked?
Okay,
that's
the
the
general
idea
how
the
talk
is
going
to
go.
A
Fundamentally,
what
is
a
blockchain
if
there
are
people
who
know
this
is
out
here,
it's
basically
at
Ledger
and
what
does
it
store?
It
stores,
data
and
transactions,
data
and
transactions.
As
long
as
you
can
move
them,
they
have
value
and
when
they
have
value,
there's
a
price
and
there's
an
exchange
and
there's
a
market
cap.
A
So
numbers
are
a
little
off
you're
only
at
950
billion
today,
but
let's
assume
the
market
cap
is
400
and
at
1
trillion
we're
at
450
billion
in
Bitcoin,
200
billion
in
ether,
50
billion
binance
and
the
rest
of
them
make
the
market
cap.
So
basically,
there's
value
across
different
chains
and
it's
fragmented.
That's
why
cross
chain
swaps
are
cross
chain.
Bridges
are
important,
they're.
Just
so.
Basically,
blockchains
are
really
desperate
wall
Garden
Wall
islands
of
value.
A
So
you
have
two
islands.
If
you
can't
move
the
assets
across
these
islands,
you
can't
move
value
across
them.
Imagine
traveling
from
U.S
to
UK,
and
you
can't
use
your
money
over
there
kind
of
useless
right.
There's
a
restaurant
out
there
who's
willing
to
take
your
money
in,
but
you
you
don't
have
pound
with
you.
You
just
have
dollars.
So
that's
where
you
need
something
in
between
like
an
ATM
machine,
Banks
or
credit
card
processing,
something
like
that
to
move
these
value
from
one
Island
to
the
other.
A
Fundamentally,
that's
what
a
cross
Chain
Bridge
is.
You
have
some
assets
or
valuable
stuff
on
one
blockchain.
You
want
to
move
it
to
another
blockchain,
that's
a
bridge
when
you're
doing
a
swap,
you
take
exchanging
a
token
on
one
blockchain
for
a
different
token
on
another
chain,
so
fragmented
users
and
value
to
move
across
chain
without
friction.
A
Now
think
of
it
that
you
had
to
do
this,
let's
assume
that
you
wanted
to
use
a
Solana.
You
had
Solana
with
you
and
you
want
to
use
ethereum,
and
you
had
to
go
to
coinbase,
to
sell
your
Solana
to
USD
and
then
buy
ethereum
and
then
bring
it
to
your
app
imagine
doing
this
when
you're
traveling
imagine
you're,
you've
come
to
Bogota
a
lot
of
you
come
from
other
countries
right.
Imagine
going
to
the
bank
changing
money
instead
of
just
using
your
credit
card
somewhere,
you
know
at
your
hotel
or
at
the
restaurant.
A
The
D
Phi
is
going
to
be
very
big.
That's
the
Assumption!
Let's
assume
that
all
of
you
are
assuming
that
with
me.
We
are
all
going
to
replace
trade
fire,
the
traditional
Finance
one
day.
If
that
is
the
case,
this
piece
cross
chain,
swaps,
Bridges
or
cross-chain
communication
is
going
to
be
a
very
critical
infrastructure,
all
right.
So
fundamentally,
there
are
three:
there
are
three
three
things
that
are
very
important:
you're
moving
between
proprietary
blockchains,
taking
an
example
is
moving
Solana
from
an
SLP
standard
to
a
binance,
smart
smart
chain
with
a
bep20.
A
How
about
transferring
assets
between
layer,
twos
between
arbitrum
and
optimism,
if
you
want
to
do
that
today,
imagine
you
have
to
take
your
arbitrum
put
it
back
to
ethereum.
You
have
to
wait
seven
days,
then
you
have
to
move
it
to
optimism
right,
that's
what
that
is
the
friction
that
we
want
to
reduce
with
cross
chain
swaps.
So
generally,
there's
an
architecture
for
this.
You
are
you
you're,
transferring
information,
it
could
be
asset,
it
could
be
contract
calls
from
one
blockchain
to
the
other.
A
So
on
one
side
you
have
a
node
that
monitors
the
source,
gene
or
the
original
chain.
We
call
them
the
validator
that
transmits
information
from
the
sourcing
to
the
destination
chain
in
between
there
are
checks,
and
there
are
checks
happening.
You
know
on
requiring
what
is
the
consensus
among
the
validators
and
there
is
a
signature
and
eventually
the
validate
on
the
destination
chain
verifies
the
signature
and
issues
in
IOU.
This
is
typically
what
that
happens,
or
the
other
way
is
you
can
send
to
a
liquidity
pool.
You
can
use
amms
and
do
this
process.
A
So
I'll
now
talk
about
the
various
types
of
bridges
and
the
mechanisms
out
there.
One
is
the
proof
of
authority
Bridge
a
POA
Bridge.
You
have
a
small
set
of
actors
that
are
listening
to
events
on
the
source
chain.
They
validate
them
and
they
relay
this
across
to
the
destination
chain.
Incentivization
slashing
mechanisms
ensure
the
Integrity
of
this
thing,
so
the
pros
are
that
there
are
few
validators,
so
it's
very
fast.
You
can
easily
do
it,
but
the
cons
are
now
you've
introduced
Trust
on
these
few
validators
there's
a
collision
possibility.
A
Something
very
similar
is
a
POS
Bridge
or
the
proof
of
stake
bridge.
Now,
instead
of
one
node
you're,
giving
it
to
the
person
who
has
more
number
of
tokens
or
the
token
balance,
they
do
the
verification
and
signature.
What
are
the
cons?
The
security
depends
on
the
price
of
these
tokens.
The
next
is
a
light.
Client
Bridge
example
is
a
Rainbow
Bridge,
so
a
smart
contract
with
a
ethereum
like
client
functionality
is
deployed
or
near,
and
a
smart
contract
with
near-line
contract
functionality
is
deployed
on
ethereum.
A
The
verification
is
done
by
both
chains,
calculating
the
Merkel
routes
and
verifying
at
its
headers.
There's
no
need
of
a
validator.
Besides
the
miner,
for
both
the
chains
it
the
cons
are,
it
requires
a
high.
It
has
a
high
implementation
cost
over
there.
It
requires
smart
contract
development
to
hold
both
the
like
clients
on
both
the
blockchains.
So
there's
then
there's
an
ultra
light
node
with
Oracle
Bridge
adapters.
It
does
not
keep
track
of
headers,
but
it
then
it
depends
on
oracles
and
relayers.
So
then
they
can
start
colluding.
That's
also
possible.
A
The
other
option
is
we
do
chain
Bridges.
You
know
the
instead
of
validators,
you
have
a
chain
out
there.
Now
that's
an
elegant
solution.
When
you
take
it,
that's
truly
decentralized,
there's
a
dedicated,
POS
Hub.
Then
you
can't
do
middleware
logic
over
there.
So
that's
what
people
are
trying
to
solve
when
it
comes
to
chain,
Bridges,
side
chains,
again,
you're
connected
to
the
main
chain.
A
All
those
movements
happen
quick,
easy,
but
then,
when
you
want
to
do
between
other
blockchains,
it's
not
easy
over
there
different
kinds
of
bridges,
there's
one
as
a
custodial
bridge
wbtc
wbtc
is
bitco,
holds
the
custody
of
wbtc.
The
when
you
send
BTC
to
get
wbtc
bitgo
is
the
custodian,
a
decentralized
bridge
or
something
like
a
wormhole
unir
directional
bridge.
When
you're
doing
wbtc,
you
can
only
send
from
Bitcoin
to
ethereum.
You
can't
send
back
on
the
same
Bridge,
Wormhole
or
multi-chain
any
swap
those
were
the
multi-directional
bridges.
A
So
fundamentally,
the
idea
is
when
you're
moving
across
These
Chains,
there's
a
lock,
mint
and
burn
mechanism
on
how
you
move
assets
across
chains.
So,
let's
assume
you
have
to
move
n
tokens
token
Z
from
blockchain
A
to
blockchain
B.
So
what's
happening
is
these
validators?
They
are
locking
it
on
there
on
the
source
chain
on
the
contract
on
a
and
they're
minting,
a
wrapped
version
of
that
on
on
B
So.
Eventually,
when
it's
replaced,
it
gets
burned
and
it
is
released.
The
original
tokens
are
released.
The
problems
over
here
there
are
problems.
A
Also
it's
it's
not
like.
It's
so
easy.
As
it
sounds,
okay
and
the
problems
are,
as
vitalik
said
now,
you're
dependent
in
on
the
fact
that
nobody
can
change
the
chain
on
a
so
even
the
previous
speaker.
She
had
a
better
graph
for
this.
How
what
you
put
over
there
vanish,
but
the
other
side.
You
got
it
when
you
come
back.
Your
original
stuff
is
not
there
all
right.
So
when
you
burn
and
come
back,
your
original
should
be
there
to
get
any
benefit
out
of
these
we'll
talk
about
some
of
the
hacks.
A
That
happened
all
right,
so
the
barley
hack
was
2021.
It
was
a
600
million
dollar
hack.
So
what
happened
over
there,
the
polyhack
or
Paulie?
There
was
a
master.
You
know
you
need
a
huge
liquidity
to
do
these
things
right.
That's
what
Paulie
had
a
large
there's
a
large
TBL,
and
there
was
a
master
wallet
that
contained
these.
What
do
you
call
the
assets
and
it
was
based
on
Smart
contracts,
large
amounts
for
the
large
liquidity.
A
The
hack
was
possible
because
of
the
access
rights
through
these
eth
cross
chain
manager
and
heat
cross
chain
data.
They
got
access
because
of
the
you
know.
The
bug
over
there
they
got
access
somebody
outside
made
their
address
as
the
owner,
and
they
just
drained
the
funds
Wormhole
hack.
Here
it
was
a
little
different.
What
happened
again,
this
was
this
year:
325
million
dollar
hack
a
deprecated
function
was
there
they
updated
the
GitHub,
but
didn't
go
into
production
by
that
time.
A
The
hacker
knew
that
when
they
made
that
update
this
is
where
the
problem
is
and
there
you
go
just
use
that
drained
it
out.
It's
basically,
it's
like
you
had
at
that
point.
In
the
Wormhole
case,
you
had
issued
think
of
it.
Gold
certificates,
you're
issuing
gold
certificates,
hoping
that
there's
gold
under
the
Vault.
What?
If
there's
no
more
gold
under
the
world
and
people
are
coming
back
with
those
certificates
in
the
Wormhole
case,
you
know,
obviously
that
was
compensated
by
jump
crypto,
and
this
is
just
showing
what
really
happened
over
there.
A
The
root
cause
was
the
signature
was
not
set.
Okay.
Another
example
is
the
Ronin
hack
again
2022,
600
million
dollar
hack,
it's
more
realistically
here
it
was
a
web
2
issue.
So
there
are
two
kinds
of
security
issues
we
can
talk
about.
There's
a
web
2
issue
and
there's
a
web
3
issue:
smart
contract
hacks.
That's
a
web
3
issue
now
here
what
happened?
Was
they
had
kind
of
nine
validators
and
four
of
them
was
with
Sky
Mavis,
the
guys
who
developed
the
game?
A
What
happened
they
had
given
the
signature
to
the
sky
Mavis
team
a
year
ago
forgot
to
take
that
out.
This
is
how
at
least
I
read
about
the
problem
was
somebody
working
over
there.
They
were
given
a
job
offer.
I
was
very
excited,
I
think
they
gave
him
three
times
what
he
was
getting
paid.
They
sent
him
a
PDF
to
sign.
A
You
know
he
clicked
through
the
PDFs
and
the
keys
were
gone
now
they
have
control
of
four
of
the
nine
validators
and
the
Dao
and
boom
600
million
dollars,
mostly
in
ether,
was
gone.
So
the
funny
thing
here
was
for
close
to
a
week.
They
did
not
even
know
that
this
was
happening
at
least
most
of
the
other
ones.
There
was
somebody
trying
to
find
it
or
knew
about
it,
and
here
the
hackers,
the
funny
thing
was
they
even
shorted
axi
and
the
wrong
tokens.
A
They
got
liquidated
because
it
didn't
go
down,
so
you
know,
but
still
money
is
gone.
Nomad
hack
was
something
like
a
decision
that
they
made.
They
gave
up
security
for
Simplicity,
basically
the
like
clients.
They
decided
not
to
do
that.
When
the
update
was
done,
a
new
update
was
done,
they
could
spoof
transactions
or
fake
them.
Withdrawing
funds
which
are
not
theirs
and
The
Nomad
attack
was
the
funny
thing
was
after
some
time
anybody
could
hack
them.
A
You
could
do
it
yourself
and
they
were
the
white
hackers
who
helped
to
take
around
36
million
was
got.
They
proceed
back
total
I
think.
Eventually
the
loss
was
150
million.
Initially
it
was
190.
I.
Think
36
came
back
here.
You
go
the
Fey
hack,
80
million
dollar
hack.
That
was
a
re-entrancy
bug
now
these
are
all
very
now.
Nowadays,
three
entrancy
like
it's
like
four
years
ago.
You
didn't
know
about
the
re-entrants
or
most
people
didn't
know,
but
nowadays
you
have
to
know
what
were
the
previous
hacks.
A
So
knowing
about
these
things
helped
the
Beanstalk
hack
again.
Here
it
was
Flash.
Loans
were
used
to
accumulate
the
governance
protocol
and
then
the
once
he
got
enough
tokens.
He
just
put
a
proposal
saying
that
donating
funds
to
the
Ukraine
you
know
war
and
took
off
with
all
the
collateral,
so
I'm,
just
explaining
the
different
kinds
of
hacks
here
so
I,
don't
know
who
who
put
the
statement
out
there.
A
So,
if
you're
trying
to
create
a
bridge
between
n
different
cryptocurrencies,
there's
a
goo
guy,
I
think
the
complexity
of
that
is
N
squared
so
which
means
that
there
are
N
More
chances.
So
there
are
way
more
bugs
that
can
happen
over
here
than
where
you
started.
So
some
of
the
things
that
we
can
look
over
here
are
coding
practices
right
first
thing.
Obviously
you
should
know
the
web
2
security
stuff,
like
social
engineering,
phishing
running
a
malware,
spyware,
protecting
your
keys,
fundamental
things.
A
You
can't
assume
that
you're
in
web
3,
you're,
forgetting
all
the
web
2
stuff,
definitely
have
to
do
that.
Then
don't
let
a
regular
developer
go
and
code
a
D5.
You
know
blockchain
smart
contract,
where
you're
hoping
to
get
billions
of
you
know
dollars
into
that
contract,
because
that's
that's
really
like
I
put
the
exam.
It's
like
asking
your
house
contractor
go.
The
bank
is
asking
them
to
go,
build
your
world
over
there
right.
You
need
somebody
specialized.
A
So
first
you
get
somebody
who's
good
at
coding,
blockchain,
smart
contracts,
and
then
you
bring
the
security
auditor.
So
there's
a
paradigm
shift,
that's
happening
earlier.
We
just
had
one
code,
it
was
on
on
your
server.
Now
this
is
distributed.
It's
going
around
everywhere.
It's
it's!
A
total
paradigm
shift,
so
common
set
of
problems.
You
should
know
as
a
developer.
You
should
know
the
common
set
of
problems
like
re-entrancy,
integer,
overflow
and
again,
when
you're
trying
to
do
an
update.
A
You
know
that
there's
a
problem
and
you're
going
to
do
an
update
on
a
GitHub
before
it
goes
into
production.
There's
a
small
window.
You
should
know
that
the
hackers
out
there
are
also
waiting
to
Tamper
on
that
and
some
of
the
other
things
you
know
typos.
You
know
uninitialized
implementation
contracts,
like
proxies
people
have
forgotten
to
do
to
do
that
and
then
attacker
has
come
and
taken
that
rounding
errors
unsafe
casting.
Then
there
are
smart,
smart
wallet,
attacks,
there's
Merkel
proof
mishandling.
A
All
these
things
could
be
prevented
like
if
you're
doing
enough
number
of
tests,
whether
it's
unit
functional,
then
formal
verification,
fuzzing
plenty
of
documentation,
and
then
on
top
of
that,
you
give
it
for
audit.
Those
of
you
who
are
in
the
development
space
out
here
I
would
seriously
say,
consider
an
auditor
job
because
most
of
the
guys,
the
bridges
I
know
they
are
paying
a
ton
of
money
to
Auditors.
A
Despite
having
audit
people
on
their
team,
they're
running
these
contracts
through
multiple
Auditors
I
hear
right
now
it's
twenty
thousand
dollars
to
eighty
thousand
dollars
per
week
for
a
security
audit
engineer
per
week.
So
imagine
there's
a
bridge
out
there
or
D5
projects
out
there.
They
will
need
at
least
two
months
work
from
at
least
two
Engineers
very
lucrative
career
man.
So
think
about
it
all
right.
Can
we
stop
hacks?
It's
like
saying,
Can
Microsoft
can
with
all
their
money.
Can
it
stop
going
down?
No,
it's
a
hard
task.
A
There's
going
to
be
hacks,
it's
just
it's
going
to
happen,
because
projects
are
trying
to
scale
speed,
they're
using
speed
to
try
to
get
users
as
quick
as
possible,
so
they're
making
decisions,
sometimes
that
this
it
should
have
taken
much
longer
so
now,
but
there's
one
thing,
though:
the
hacking
of
large
amounts
is
easy.
Maybe,
but
taking
it
out
is
not
that
easy,
because
now
you
have
chain
analysis,
elliptic
and
all
those
guys,
they're
tracking
it
exchanges
are,
you
know
Banning
them.
A
Tornado
cash
is
being
bad,
so
there
are
a
lot
of
things
that
help
you,
but
that
doesn't
mean
that
you
should
not
take
care
of
your
code.
Okay,
so
keep
in
mind
in
2013
the
exchanges
were
being
hacked.
It's
just
that
right
now,
it's
the
bridges,
because
the
surface
area
for
them
to
attack
is
very,
very
large.
That's
the
main
thing
main
thing
is:
how
do
you
mitigate
these
things
and
what
is
your
response
once
this
happens?
A
Obviously,
as
mitigation
part,
you
know,
do
your
code.
Well,
then,
you
do
audits,
front
bug,
bounties,
but
always
remember.
If
you
lose
money
on
your
wallet
or
your
smart
contract,
the
auditor
is
going
to
lose
nothing
he's
just
going
to
lose
his
reputation
end
of
the
it
is
your
project.
The
project
is
not
the
Auditors,
so
you
can
come.
Try
to
compartmentalize.
You
can
prevent
contamination.
A
What,
if
it
happens,
how
do
you
respond
quick
enough?
There
are
multiple
times
where
these
white
hackers
have
contacted.
The
teams
out
there
saying
that
something
is
happening
to
your
contract
and
the
support
staff
said:
oh,
nothing,
we're
fine
and
all
their
money
was
gone.
I
I,
don't
have
those
tweets
with
me,
but
you
can
check
that
out
and
your
monitoring
systems
should
be
quick
and
you
should
have
some
kind
of
reporting
guidelines
once
this
happened.
What
are
you
going
to
do
as
a
team?
How
are
you
going
to
protect
yourself?
A
How
are
you
going
to
bring
your
chain
down
if
you
can?
Is
there
some
kind
of
kill
switch,
because
a
lot
of
these
things
are
centralized
so
basically,
Bridges
have
Pros
you're
bringing
collateral
cross
chain
you're,
getting
scalability
you're,
bringing
efficiency.
The
cons
are,
you
are
introducing
some
form
of
trust.
The
trustless
part
is
going
away,
so
this
space
is
going
to
grow
mainly
because
of
these
things.
So
much
money
money
has
to
move
and
a
lot
of
ways
to
attack
these
contracts.
A
I
think
that's
it
from
my
side,
questions,
I,
guess,
everybody's
being
nice
to
me!
Think
they
think
that
you
know
if
the
guy
doesn't
know
anything.
So,
let's
not
complicate
it
all
right!
There's
somebody
is
out
there
a
mic
over
there
please
I
can
I
can
try
to
answer
some
of
the
things,
but
if
I
can't
I'll
tell
you
guys
I'll
take
your
name
I'll
contact
the
guys
who
made
the
protocol
and
get
back
to
you
for
sure.
B
A
Got
it
I
think
the
best
is
first
learn
smart
contract
or
solidity
from
let's
say:
Patrick
Collins
is
a
YouTube.
Video
dap
University
is
out
there
and
then
securium
is
a
good
place.
They
have
a
boot
camp
and
they
have
a
lot
of
tests,
quizzes
and
stuff
which
they
go
through
all
the
possible
problems
that
you
can
face,
and
there
are
multiple
challenges
out
there
either
not
challenge.
There's
ethernet
they're
plenty
like
that.
I
forgot
each
of
the
names
where
I
can
get
get
it
out
for
you.
A
Okay,
that's
a
start,
learn
solidity.
Next
thing
is:
go
to
securium
and
find
out
how
they
do
and
that's,
as
I
said,
there
are
at
least
10
jobs
for
every
one
security
guy
out
there,
especially
in
the
web
3
space
and
it's
remote.
You
can
stay
at
your
home,
you
can
be
on
the
beach.
You
can
do
it
too.
The.
C
Perspective
was
pretty
bleak
when
you
talked
about
like
end
to
end
like
the
Android
complexity
of
like
bridging
all
kinds
of
bridges.
But
then
we
here
at
the
ethereum
Devcon
and
we
know
like
the
Roll-Ups-
are
the
way
to
scale,
so
we
want
to
have
actually
a
thousand
yeah
of
these
l2s
right.
So
what
is
your
perspective
on
that?
How
are
we
going
to
solve
this
issue
so.
A
Initially,
for
any
technology,
so
how
many
exchanges
are
being
hacked
today?
They're,
not
you
know
you
don't
say
coinbase
or
binance
being
hacked
on
a
daily
basis
right,
but
if
it
was
2013
literally,
every
exchange
was
being
hacked
right.
Everybody
so
same
thing
with
defy
or
Bridges
it's
new.
When,
when
did
bridges
come
into
being
it's
pretty
much
only
two
years
or
one
year
and
everybody
and
you
have
multiple
layer,
one
blockchains
out
there
and
you're
trying
to
connect
to
these
things.
A
What
what
are
the
number
of
years
of
experience
to
somebody
who's
coding?
This
right
majority
of
it,
is
one
to
two
years.
You
don't
have
four
years
six
year,
people
who
like
when
you
when
you're
building
your
NASA,
you
know
space,
shuttle
or
you're
doing
some
C,
sharp
or
C
plus
plus
code
Java
code.
There
are
guys
who
have
been
doing
it
for
20
years,
who
know
the
formal
methods
and
stuff
like
that,
so
those
problems
will
be
solved.
It's
like
the
buggy
and
the
car.
Okay,
the
car
was
initially
was
a
bad
technology.
A
It
was
slower
than
the
horse
technology
improves,
they
fix
those
kings.
The
wheels
were
flying
off,
you
flattened
the
roads.
You
make
better
Wheels,
you
make
better
shafts,
all
those
will
be
fixed,
so
the
future
is
not
Bleak.
The
future
is
really
good.
More
money
will
come
in
as
devs.
There's
there's
going
to
be
plenty
of
opportunity
now,
as
the
project
owner
who's
doing
one
of
these.
It's
it's
really
dicey
right
now,
because
you
don't
want
to
get
hacked
I
I
know
the
router
protocol
guys
they're
everyday
scared.
A
They
keep
their
TBR
low
because
once
the
tvl
becomes
high
you're
a
Honeypot
like
everybody
wants
to
attack
you
if
your
tvl
is
low.
You
know
that
this
all
the
great
hackers
are
not
so
interested
in
your
tvl,
which
is
low,
they're
thinking
of
high
Capital
efficiency.
By
keeping
the
TV
alone.
That's
how
they
are
trying
to
do
it.
Hi.
A
D
I
can
okay
great,
so
I
was
wondering
on
that
scenario
that
you
described
that
the
developer
he
got
a
contract
like
a
PDF
contract
with
a
virus
and
took
over
his
nine
keys
and
therefore
the
bridge
Jesus
Christ
that
that
just
made
my
palm
sweat
I
just
spoke
about
that.
So
it
I
would
like
to
understand
a
bit
more
about
that
case
like
he
had
the
keys
in
his
computer
just
lying
around
there.
How?
How
did
the
hacker
extract.
A
That,
instead
of
the
computer,
it's
not
like,
he
had
it
in
a
sand.
It's
in
the
computer
that
you're
giving
access.
Literally,
so
imagine
you
get
these
PDFs
nowadays
you
can
sign
your
PDF.
It
was
a
job
offer
right,
so
somehow
they
knew
that
this
was
the
guy,
so
they
could
get
into
the
system
they
just
have
to
get
into
the
system.
Because
it's
connected
right,
a
job
offer
came
well,
you
know
they
did
interviews.
A
They
were
formal
interviews
done
all
those
it
looked
very
legit
and
then
you
get
a
PDF
saying
and
you
got
the
call
saying:
hey
I'm,
sending
you
the
job
offer
you
just
click
on:
it
click
the
signs,
you're,
not
expecting
it
right.
So
there
it's
not
really
your
web
2,
the
web
3!
That's
a
problem!
It's
a
web
2
that
has
failed
so
both
have
to
be
considered
today.