Hyperledger Foundation Hyperledger India Chapter, 2 Jan 2023

Previous Meeting Next Meeting

⏯

youtube image

►

From YouTube: Fireside Chat With QuillAudits Ep 1

Description

A virtual meetup hosted by Hyperledger Hyderabad on December 17, 2022 featuring. This is a conversation between Sanket Agarwal and Pradeep Damie covering topics specific to Hyperledger Fabric & a case Study on Smart Contract Hack.

More about the meetup is at: https://www.meetup.com/hyperledger-hyderabad/events/290353375/

----
Hyperledger – Open Source Blockchain Technologies

Hyperledger is an open source community focused on developing a suite of stable frameworks, tools and libraries for enterprise-grade blockchain deployments.
It serves as a neutral home for various distributed ledger frameworks including Hyperledger Besu, Fabric, Sawtooth, Indy, as well as tools like Hyperledger Avalon, Cactus and libraries like Hyperledger Aries, Ursa. Learn more about Hyperledger projects: https://www.hyperledger.org/use

Discord: https://discord.gg/rVCn4j7UFd
Case Studies: https://www.hyperledger.org/learn/case-studies
Training & Certification: https://www.hyperledger.org/learn/training
Tutorials: https://www.hyperledger.org/use/tutorials
Webinars: https://www.hyperledger.org/learn/webinars
Events: https://www.hyperledger.org/events
Vendor Directory: https://www.hyperledger.org/use/vendor-directory

Subscribe to the Hyperledger Newsletter: https://www.hyperledger.org/newsletter

Follow-us on Twitter @Hyperledger

Learn about Hyperledger Membership: https://www.hyperledger.org/about/join

#Hyperledger #Blockchain
License
Creative Commons Attribution license (reuse allowed)

A

So hello, everyone good morning, thanks for joining for this session, we are having quill audits with us and we'll be discussing a lot of questions and one use case related to hyperledger how audits are done and what are they up to so that we can make some good decision in future uh over to pradeep sure.

B

C

Morning, uh everyone.

B

C

All right, um I am pradeep: I, represent cool audits, I head the marketing division at Quail audits. uh uh If, if any one of you have already heard about pill audits uh you you would know what we do uh for those who do not know. uh Cool audits is basically in the business of securing smart contracts, securing webflow projects, and we do it in a very uh passionate way in a way that uh uh you know our mission uh speaks for itself. Our mission is, we are.

C

We are here to make web 3 a safer, Place uh The. Testament of that is. We have done already 700 plus projects. The clients are Global, uh are spread across the globe and uh they speak highly of us. And uh if you, if you look at the world's rankings, uh we are at number three or number four. So we are a fast growing. uh We are making a very positive impact and uh we ordered smart contract. uh You know for the sole purpose of making the whole Victory.

C

uh uh You know the weapon technology to evolve in a positive direction, so this is about uh lawyers. This is about me um sanket. Do you want to share about what you do and uh at will audits.

D

Sure so um I mean another thing. I would like to add to pradeep's description of Queen audiences. Our CEO pritam has said multiple times that the money is in the court and if the money is in the court, but the code is written by developers and developers are humans who make mistakes.

D

So it's important uh that we do not understand the flaws in the code which could lead to potential disasters in terms of the funds that has that, have you know, been deposited by users into different protocols, so uh yeah, that's it, and um my name is sanket and I. Work on products on different products, uh in cool audits, so equivalent quill audits is a cyber security firm and we do audits primarily but um simultaneously. We are also developing cyber security products to automate cyber security.

D

Given the fact that audits do tend to be really difficult, um but nonetheless, audits will not go anywhere, because tools are only such as the measures and my role is to understand how we can benefit our users and how we can give them options to assess the cyber security protocols uh implemented by different protocols before investing into them and also understand the vulnerabilities uh present in smart contracts by developers uh that have been written by developers. So yeah.

A

Yeah. Thank you very much for the introduction.

C

Maybe you can uh now tell a bit about uh what hyperledger Hyderabad does and how have you been? uh You know over.

A

Here sure, so uh is one of the oldest Community, which we have in India. It's one of the largest community under hypology Foundation. We have close to 1500 people and hyperledger is having different different chapters. All across India Noida. Is there Mumbai Hyderabad Bangalore. We rank second up just after Bangalore and we used to organize all such meetups, where developers can understand. Take some idea. Take some inspiration. So it's always a open source. Community and I also contribute to hypology Foundation in different ways.

A

So it's uh move on to our today's topic. uh Shall we start with some questions or you want to pick up some sure.

C

On that note, uh um maybe uh you know uh you know, I'll have a continuity of you know what you were talking about, and uh maybe you can answer uh you know answer the audience about. uh You know that concept uh just wanted to ask in that regard. uh How does hyperledger handle authentication and access control.

D

A

So hyper readers have a different uh ways of handling it. uh We have our own set of rules and regulation which we can write it on configuration file and then organizational level uh dependencies are there depending on how how you make the nodes there. We have authentication things.

A

I'll take a pause one letter.

A

A

Can we take some questions which you can answer.

C

I'll show yeah go ahead.

A

Like have you done any uh audit for hyperledger.

C

uh Sanket, or do you want to answer that question.

D

Yeah, so um not to my knowledge, uh I mean we usually work with solidity and uh rust-based uh projects on Solana and majorly work on projects um with the polygon and finance smart chain, so hyperledger is I, I believe an Enterprise level, Tech. Okay, my video is so sorry.

D

I mean the number of audits that do come are very less. So, um to be honest, our exposure to hyperledger is very limited.

B

A

I would also like to understand. uh There is one more thing called hyperledger bisu, which does work with uh it does work with, does work with solidity and evm based things, you can also upload something on ethereum main Network and something so have you worked on some some kind of audit with apple as a Basu I.

D

Mean um we in general uh avoid but I mean not as in avoid, but uh we don't have that sort of expertise working with hyperledger fabric, and the thing is that, uh as pradeep earlier mentioned, I mean I, understand that it uses solidity.

D

um But to be honest, since we don't have a lot of exposure to the infrastructure uh and we tend to uh deal with individual protocols that are currently developing their projects with solidity or rust. uh So we have Auditors that have expertise. uh You know that have built uh certain um uh that have built certain protocols. uh You know um on uh on these. uh These languages use um our Auditors are used to.

D

uh You know, auditing uh protocols that are made on these languages and since, as I mentioned, pradeep also mentioned that um uh our service is a testament to the best quality that is out there and since uh we believe in making web free safer with the best quality as well.

D

um We avoid uh you know um we avoid of taking on projects that we can't deliver the best.

A

Okay, okay, so I I have one more question: if, if you.

B

A

That yeah, let's say uh how how convenient it is to use some kind of libraries like open, zip plane like do.

B

A

Recommend using it or uh yeah.

D

Okay, I got division.

A

D

So um from a security standpoint, it's fine, because all these libraries are audited right and uh already have the security implementations in place. So uh what we do in terms of so okay, so in our audit process also. So, firstly, we try to get a hang of the code quality while Gathering the specifications from the clients.

D

So um our focus is on the complex code that has been written by the developers of the project and uh I mean using standard libraries like open, zip, plane or code from uni swap or pancakes or usually comment out, or you know.

D

We consider that as a dead code, because these are already audited, this code is already audited and the cyber security implementations are there and then we try to look for consistent coding style and follow those Style Guidelines for rust or solidity, and then we make sure that the contracts can be compiled and tested perform unit tests. So uh this is how we work and um I mean there is no harm in using opens Zeppelin standard libraries or you know, taking code from different organizations that are open source and whose code has been audited.

A

Okay, thank you and moving forward. I'll have one more question. So do you use? Do you do mostly the audit of coding manually or there are certain tools which you, okay, so.

D

Yeah, so basically um so as I mentioned, the first part is to look for those specifications and understand what uh the the protocol, how the protocol wants the contract to behave. What is the intended behavior of the contract that it has coded so, as I mentioned after testing the code, removing the dead code and marking the complexity marking the complex part of the code? What we do is we freeze the code and specify the commit hash. Oh sorry, specify committees, and then we do a manual review as you, as you guys already know.

D

uh We look for unusual behavior, common security vulnerabilities, like bscw guidelines and everything. So then we do functional testing uh in which um you know it is the the contract is deployed in your sandbox environment, using hard hat, ganache or different tools. We also do gas analysis, uh look for uh you know uh latest attack, vectors, say escrow manipulation or Access, Control, authentication, token Supply, manipulation things like that and to your point. We also use different automated testing tools like mythix methyl you know and then solid graph or solidity courage also use.

D

We also use Slither. So we have a mirror of tools at our disposal and we try and test all different tools. We also have some internal tools um that we use and uh part of my work in the coming uh in the coming months.

D

I believe would be to develop such tools to help us identify different uh attack, vectors in code and how the content and functions is wrapped and pass through all that code to find that code and to find uh I mean, as you mentioned code in opencline, so part of my work would be to find code that is already present in standard libraries and then separate that from complex code and then analyze the complex code for a different vectors and possibilities of vulnerabilities and exploits.

A

Yeah, okay, so uh thanks for answering that I have few more questions, sure sure.

A

So the the other question I would like from you to get it answered. Is uh so developers always think through like before deploying it to main Network? They should test it properly in in some local environment or maybe on test Network. So, let's suppose, if, if I put something uh fishy on some, some vulnerability, mistake and I have put it on Main net yeah. So now, what will you advise.

D

I mean um the advice would be uh I mean obviously you're getting audited the code audited, so um I mean we would have to redeploy The Code by uh testing it for the vulnerability and um we'll have to test it in a sandbox environment. By as I mentioned, freezing the code and specifying the commit hash. And then uh we will audit the code manually for each line and once we do find the vulnerability that could be exploited, uh we will try to fix the code and redeploy yes.

A

So there's one question: maybe either you or pradeep can answer. Somebody is asking in chat what kind of skill we need to have a career in the three Securities and future scopes. So I think you can also cover some bit of private blockchain. Also here, if.

D

Yeah, no, so uh we would love for you to actually uh give more insight on um how a career in security for private blockchains uh you.

C

D

For that could be made because uh I mean I honestly, don't have a lot of exposure to that. So what do you think.

C

So I would like to add in one point here uh in order to make any career in uh this thing, one of the things that uh Quail artist does is uh We've. uh We have conducted one uh cohort, wherein we train uh enthusiasts with the basics of uh auditing, and uh you know so so that they can, you know, start initiating. uh You know these practices in their career and uh you know step into the world of uh uh web 3 auditing, and uh you know security.

C

uh This is something that uh you know as an uh uh as a as a step to uh support web free, guys, I.

C

Think uh one of the things that is absolutely important in in an evolution of a project is uh is auditing itself, so any company or any uh anybody who wants to enter into uh web 3, you know or who maybe was an entrepreneur or so these uh these Founders or entrepreneurs, should take into consideration uh the security and auditing aspects, which means that in their technical team they should also have people who are knowledgeable about this. So to support that and to drive such a participation. uh We are doing.

C

uh We have already done that this cohort and uh the other cohorts are, uh uh you know, uh are in the pipeline, which will be announced later, but this is just wanted to. uh You know put this award in because uh you know it's it's totally worth it. Yeah.

D

So um I think um to answer the question. Exactly uh an auditor is somebody who has uh good expertise with um with you know or the development part of things, because once you know how to code um probably- uh and you know the my the nitty gritties and the details and the techniques to sort of Ensure uh I mean you.

C

D

Practices basically basic coding, um so much and so frequently and building different projects. So what this does is uh it gives you a handle on how different codes can be manipulated or what are the flaws that you need to look out for while writing the code? So an auditor is basically an experienced developer. Who has some techniques or a method uh to identify flaws and vulnerabilities?

D

So say, for example, and I know solidity I mean is not that older skill, uh wherein you say that you know I have 10 years of expertise and I will be an auditor, but in one or year or six months or maybe 1.5 years. If you've been coding thoroughly on solidity, then you must know that uh you know there are certain things that you need to look out for, uh while you are coding and stuff and obviously there are cohorts like ours and many other cohorts as well.

D

They do offer uh you know, strategies to look out for these flaws and vulnerabilities and uh contracts. So to summarize, I would say: uh I mean, um learn solidity and whatever comes before it. Just the basics then practice on solidity for some time develop projects uh showcase. Your projects at different hackathons and try to get it, uh try to get its flaws uh exploited by different people and then develop your own techniques and then also join different cohorts or there's a lot of substance available online. Also, a lot of medium blogs.

B

D

Own uh road maps to development and best resources and practices on our portal called web3 suggests as well, which indexes all the information about development and how to become developers and how to uh get into different careers into web 3 security and web 3 in general, and then uh probably uh you know just uh try to get some more experience uh by uh taking out bug bounties for different projects, uh so in munify is one such platform that allows you access to different bug, bounties by different protocols.

D

So once you tend to go through the code for these protocols and try to understand what sort of vulnerabilities can be exploited or exposed, that would probably give you more experience and help you to understand. uh You know how you can better your methods, so I think I hope that answers the questions for public blockchains and I mean Karthik I would love for you to sort of shed some light on uh how we can do the same for private blockchains. If.

A

D

Mean I'm sure there must be a difference.

A

Yeah so I also as part of my day, job I also work for one of the big four, where I do some kind of audits and uh it's my past experience in auditing, some of the private blockchain I would say your your knowledge of understanding. One architecture is very, very important like how the data flows through how that entry point is, is there and how how well you can understand one architecture, okay and read as much as possible about the Securities. That itself is very, very important. I'll.

A

Give you one example uh in every audit is very different. Basically to me, whenever some audit will reach out to me, I have to think through the architecture first, and you can understand every project and every implementation is different in this in in its own architecture. So there is no specific thing or thumb rule that we have to follow Okay. So let's say if the architecture contains private, key and public key of the user, so you are to Think Through. Is the public key and private key secured properly?

A

Is it put into a hashicopt wallet or how it is like made secure, so jump? Some general principles you have to derive actually from the architecture itself, how the data is actually flowing, how everything is like kept in place. uh How well it is documented documentation plays a very, very vital role, at least for your team to understand and for others also to understand so document tensor plays a very important role that also I believe is one part of auditing.

A

When we audit, we also used to take care of how well you have documented certain stuff like how are you protecting your password? There should not be single admin to one cloud provider or whatever Cloud you are using so first is, and very very important is read as much as and through all the architectures which are available. You can you can Google it around. What is a architecture of let's say, uh broader architecture might be available for npci or something okay, so broader architecture of some supply chain, which must be available.

A

A broader architecture of so many nfts are available. Architecture means just not means the smart contract, some other API calls or how it is done. So there are several such examples which are already existing, uh go through those architecture and understand because since it's a private blockchain, your architecture is already in your control. Okay.

A

So uh when, when the architecture itself is in public production, we don't deal much with the architecture, because that is not in our control, yeah, so reading as much as I bought the architecture that will actually help okay, so I can take some questions on.

B

D

Made a very valid point in terms of uh security of any project, uh so uh I mean you know, as you were also mentioning that probably the business logic and how uh things work. Apart from you know the core part uh and the business operations work and the stakeholders involved are also very important and um I mean more so uh even in uh I mean in public blockchains I would say, uh I mean. Obviously the business logic is important. You need to understand how uni support, probably any other protocol is working.

D

But what do you think uh is its implication in you know uh private blockchains uh or in a private blockchain segment.

A

The question is, for me: yeah.

B

A

I missed the question. I thought you were asking this question.

D

No, no, no I, really love.

A

Station or to also.

D

Okay. Okay, so um please, if you can allow Shane to answer that would be your beautiful yeah.

B

A

B

uh Hi um so yeah I mean uh we in my firm. We actually build uh mostly in their private blockchain and.

A

Everything I'm. Sorry. Can you give a brief introduction about yourself and then you can take the question. Oh.

B

Yeah sure uh so, I'm, currently a developer for the southeast Asia blockchain net, for one of the big four to uh the rules increase in like developing the professional concept, Solutions and some auditing, uh mainly for the central banks and Enterprises um so yeah. So as I was saying um some of these risks, especially uh when dealing with a large and complex systems such as like the central banks. So what we discovered is uh some of the vulnerabilities right.

B

He does not come from the codes, but mostly of what is not in the course so, for example like because they have their internal controls, and they also have their governance that we have to match with our, uh like. You said infrastructure, so in case of, for example, um it's uh maybe I should give one example, for example, like uh it's multi-seat really needed in the private blockchain right. I know it is uh multi-stick, for example, in a public chain.

B

It will be more secure uh in that way, but it's arguably uh introducing more risks if you are implementing it in the private blockchain. Why? Because now you have two uh wallets that you have to be secure and this not only costs more, but it's also uh introduced more actors but interacting with blockchains. So I guess this kind of like perspective on um whoever thinking about making a career in a private blockchain space that it depends on the industry right.

B

So, if you're dealing with like a renewable energy industry, where requirements is way more different than the central or the banks or the Furnishings institutions, so uh getting the understanding or on the how the operation Works, who are the actors that we're dealing I think this will be like a very, very important in developing a much more secure architecture, yeah sure I.

C

Think uh uh on this note, I I have to request sanket, because yeah uh sanket has uh you know, uh has a a case study to sort of present, which has uh you know, which is absolutely interesting in this context and uh sanket. We want to uh share that piece of information uh with us. Please and.

D

I'll share my screen all.

C

Right, foreign.

D

D

Okay, perfect um yeah, so um right so on, 2nd of December am I, audible, guys, yes, okay on 2nd of December 2022, um we had anchor protocol, uh which was uh you know, exploited and uh more than five million um uh dollars were lost and not only were they lost uh other. uh You know other protocols using their services uh also, uh you know, had to wear the brunt of this crash, so uh I mean I'll.

D

Just briefly explain what anchor protocol is so anchor protocol um was or based on DLT and uh was basically an integral part of uh I mean you know the new web, and this was before web3 was termed as web3. There was just cryptocurrencies and blockchain and the different underlying technology, so um they initially so we'll just talk about its uh staking platform. It has a lot of different services, but we'll just talk about this taking protocol, uh since uh that was the part that was hacked um so anchor.

D

Basically, what it does is it allows you to stake uh your cryptocurrencies uh for different uh for different blockchains and in return it gives you an uh it gives you its own cryptocurrency called a eth or a BNB or a Matic um which, but basically what you can do. Is it represents?

D

um It represents the currency that you had deposited plus this taking rewards for that currency, and um you know um that is how the pool of users that had staked their currencies are rewarded through the anchor currencies. uh So um I mean you know you can deploy development nodes and build the apps and everything. uh But there are a lot of benefits to you know becoming stakers on anchor with three platform which uh you know, uh which result from basically two types of tokens.

D

So you will see two types of tokens: moving forward: a BNB b and a b and b c. So the two types of tokens are basically reward earning and reward bearing tokens. So a b and b b is a reward earning token. uh So basically, uh the number of these tokens increases in your wallet and it's packed one to one to BNB. So, for example, uh if so, for example, one A, B and B is equal to one BNB.

D

So then, if your reward is 2bnb and you had deposited uh 100 BNB So, currently you will have one zero to a b and b b and uh the other token is a b and b c, which basically is um which basically just represents the tokens the reward, but in terms of the value of the token. So if you are deposited 100 BNB and your reward is one zero, two BNB, then your a b and b c will still be 100, but the value of each a b and b c will increase yeah.

D

So, um okay, so um basically, as I mentioned, um the a b and b b and the a b and b c are were the two models of tokens in which uh anchor used to uh reward its users right. So uh they were actually updating some of the reward policies and schemes in the contracts. For um these two tokens and while updating uh these contracts, they were using the private key, uh but the hacker while the update was going on, uh was able to steal the keys because of the update.

D

The private key was not, and the private key was not completely secured, so the hacker was able to. um You know just steal uh the private key from the deployer's wallets of the deployer's wallet, uh which allowed them to gain absolute control of uh what I mean the wallet and allowed them allowed the attacker to Mint more tokens to his address.

D

So, as you can see on the screen, uh the attacker minted 10 trillion tokens to address uh to his address. So these are some of the on-chain details. I'll share this PPT uh with you guys so that you can see what actually happened and make more sense of uh the flow of things. uh So these are the address and I mean obviously on different block explorers.

D

You can go and check what actually happened, um but if you go to nansin dot portfolio, it allows you to see uh basically that what are the funds in each of these address. So if you just go to nansin- and you can just paste these contracts right now, I think the funds would be depleted, but around second December when it happened, you would see that um how the hacker had implemented the contracts- and you know minted- 10 trillion tokens of a B and B uh to uh his own wallet.

D

This is a short activity that anyone can do Yeah. So basically, uh this is what I was talking about from uh anal address. uh The hacker uh you know had deployed this contract and if you want to see how this implementation contract was created, so anchor was so. uh This is the hacker only the deployer, because uh he had the private key, so uh it uses um basically, the hacker use, the private key to deploy a b and BC tokens, which are the reward earning token, which means uh the value of the token increases.

D

Instead of the number of tokens increasing- and he implemented this to Mint more tokens, so now you can see in this transaction after uh minting uh the tokens he had transferred these tokens to his own wallet and for that uh he had to pay a gas fee, and for this gas we transferred the 1.1 2 5, B and B from deployers compromise wallet to his own wallet.

D

um So you can see that not even the gas fee uh the hacker had to spend of his own so in in different uh attack, vulnerabilities or maybe you can see even you know like a Honeypot or anything mostly. What hackers do is they use their own funds, uh firstly, uh to get a sense of liquidity and how the pools are working and everything, but in this case hacker did not have to spend anything. Why?

D

Because I mean uh he had already got an access of the private key of the deployers wallet, so I mean it's one of the most basic things to keep your private key most secure, and you often take it very lightly that you know um I mean it's the private key and obviously no one would expose it. But uh if such a multi-billion um protocol could do such a simple mistake, then probably uh I mean you know we should Implement more cyber security protocols or probably use a cold storage or whatever I mean you know.

D

There are a lot of different uh ways to keep your private key secure, even while exposing it while updating your protocol. But there are a lot of things you can do to safeguard your private key. While doing such updates and such a protocol should have kept them in mind.

D

Given the fact that you know more than I mean I think almost 30 billion dollars have been lost in uh more than 800 hacks in the past seven or eight years, and in the last year alone, I think around 2.5 3 billion dollars have been lost so um and obviously after uh minting all these tokens and depleting the pools from pancakes or of the ABNB tokens um he started. uh You know just um uh transferring the amounts uh to tornado cash after bridging um the the funds to ethereum and polygon, using the seller.

D

Network- and uh you know the multi-chain or um you can see uh um the use of seller network uh to convert the to convert the funds to ethereum, to convert usdc uh binance back usdc to ethereum and uh to polygon, and then you and then sending those funds uh to tornado cash and tornado cash is basically I mean it's a protocol for laundering cash so that so, basically you put some funds into tornado cash and uh it uh divides uh the funds into multiple wallets and different things.

D

Basically, it allows you uh to uh I mean not exactly launder what transfer cash and make it more difficult for other people to track the flow of funds by Distributing These funds into different wallets different accounts, different currencies that sort of stuff, so you can see immediately after the crash. This happened and uh another interesting I mean another interesting impact of the price. Dropping was that there is this protocol, or maybe another seeking platform called Helios, so um uh yeah. So um there is this. Another protocol called Helios, which is a staking platform.

D

It uses a delayed I mean it uses an oracle, but the information of a b and b c dropping uh by 100 percent. Was um you know it was?

D

It was delayed, so the information did not reach to them in time because of which um the uh one of the hackers uh uh hacker was um basically what they did was uh they put um I mean they deposited I, think 183 000 a bnbc and took out a loan of 16 million uh dollars in hey stable coins, so basically using 183 000 uh tokens of a b and BC, they were able to extract 16 billion uh 16 million uh dollars worth of stable coins.

D

Yeah so, as you can see um on different chains, so tornado cache, as I mentioned, it helps you to convert and send cash. uh Sorry send funds into different wallets and you know it's sort of untraceable, uh so um the hacker used uh tornado cash to send uh to convert um funds, uh two different uh tokens of different blockchains. So if you can see there is one there is BNB and then there is Matic polygon polygonomatic and then there is ethereum.

D

So three different chains used uh three different tokens on three different chains: to send uh it to tornado cash and basically um make the funds untraceable uh for for the authorities.

D

So, um as I mentioned, uh um you know about Helios. Also so um I mean post that exploit uh the primary. uh The primary motive of anchor has become to alert different organizations or different platforms that have allowed the trading of Airbnb uh tokens, uh basically anchor like tokens uh to stop Trading, and uh obviously we had to use a new private key and secure all their smart contracts with the key to prevent the tampering uh so uh I mean next uh I mean the current steps that anchor could take.

D

um For for ensuring that you know all the users are. uh You know. None of the users are harmed in the long run and uh there is still some trust in their protocol because, even though those taking protocol did make some mistakes, uh anchor protocol also offers a myriad of different Services, which people will still keep on using regardless of the hack. So they had to instill confidence in people so that they don't stop using the uh they don't stop using anchors different other other different services.

D

So, uh firstly, I mean they should ensure uh that all the liquidity providers do different pools on different Protocols are identified about uh you know, I mean the people who provided liquidities to pools in which these tokens were traded. They are identified, they are, you know, just uh notified about the hack and uh they are notified about what actually happened and how anchor can compensate them.

D

So uh then, obviously, they will have to purchase five million dollars of BNB, which was the amount that the hacker ran away with and they would have to fill in the damage created to different liquidity pools.

D

um But in this case there were two types of people: one were the liquidity providers that were caught off guard right and the other type of people were. uh They knew that the hack happened. They were also liquidity providers, but then they made use of uh this information that uh airbnb's price had dipped by almost hundred percent and by making use of this information um or.

C

They actually were.

D

Able to dump the token and make profits, so um it will be interesting to see how anchor can identify, probably by taking snapshots of the before and after of funds of wallets, so um yeah, and then um this is in their scheme of things to launch new anchor, BNB tokens and uh airdrop to affected a B and B C and A B and B uh B users uh by as I mentioned, taking snapshots of users who were affected uh before and after the exploit actually happened, yeah, so um the snapshot.

D

Okay, so yeah as a user. The primary task should be that you should stop buying a b and BC uh tokens at any point from any pool and just wait for the anchor bnba drop uh and uh just redeem it against the state.

D

So that was it. uh Thank you.

C

Indeed, it's very important to sort of be as an end user. It's very all the more important to know about these hacks. um So one of the things that uh we also do uh you know uh in this context is that uh we publish a well-researched well uh studied uh newsletter.

C

uh That is, uh you know that is curated for the benefit of not only uh people who are technologically, uh you know informed about uh the Audits and uh programming languages and everything, but also to people who are uh in the world of investing who are interested in engaging with projects, and uh things like that. So I think uh from that uh standpoint uh following our newsletter is very important, because uh that is absolutely great wealth of information that you are getting at your fingertips uh every week and a very highly curated uh valuable information.

C

uh Shane has a question for us: uh do you guys have any involvement with proof of reserves? Audit if any, what are the key risks and takeaways from the project.

D

Yeah, so um at the moment we don't do um proof of Reserve audits, uh because primarily it deals with uh issuing a Merkel hash certificate by uh checking I mean you know, it's just not something that at the moment we are involved with. We I mean there are a lot of different organizations that are into this. In fact, I think someone from our team has shared the reference for web3 suggests.

D

So uh to ensure that you know you invest in two protocols and exchanges that do have a Merkel certificate or a proof of Reserve um two for preserve. We have created a list of exchanges that do have um that do have a proof of Reserve or a miracle certificate to ensure that you only invest. I mean you know the FDX, you don't lose money in uh disasters like the FDX, so um that is there in that three suggest uh yeah.

D

But at the moment to answer the question, uh we don't do proof of Reserve uh audits.

B

C

C

Do you mind if I ask questions I, think uh I.

B

C

Wanted to ask: uh are there any security, best practices uh or guidelines? uh That organization should follow when, uh where you, when they are using or probably considered, uh they are considering the using of hyperledger.

A

Yeah, so there are almost uh same kind of guidelines. What we do for public blockchain as well. Here specifically, what is very much important is how well we keep our private key publicly secure in uh some wallet like has a cop wallet or something, and then the architecture point of view. You have to build the whole architecture by yourself, like uh we do it on.

A

Well secured and the other aspect it, it relies again on which Cloud you are using, let's say, Azure or something. Then you have to understand more details about the security of the cloud and how well protected you are on your Cloud by firewalls and some other kind of security aspects when it comes to blockchain stuff, it's about the private key publicly. How it is secured and rest all is almost same. How we do it for other applications which are on kubernetes or on cloud securities.

A

I can take few more questions.

C

Are there any third party, security audits or certifications for hyperledger projects? Do.

A

C

Any recognized.

A

High pleasure, basically officially they don't give anything but I I I still recommend that uh one should definitely go through Cloud architecture and Cloud certifications, cyber Securities, and that will be very, very much important, then about the devops. If they have some day of security certification done for Docker kubernetes. Those things will be very, very much helpful.

C

uh But how does uh hyperture also ensure the Integrity of the data like on the network, for example, uh to prevent a tampering or manipulating of the records? uh Is there any in uh you know built? uh You know, uh processes that protects the Integrity of the data itself.

A

So for integrity purpose, we we depend on the consensus, how this consensus is actually working and we also provide the Explorer uh what sanket was showing as also an Explorer, where you can identify verify several other things. So the Explorer for hyperledger is also the same where it helps you to investigate any run transaction which have happened and uh it's a permission blockchain. So uh whenever we are enrolling one organization, so it's a close Consortium.

A

You know so uh different organization make one Consortium to uh for this private blockchain and this organization have their own set of rules which they can write in some ml file. Those rules are very, very critical to examine and those rules. uh You can understand I'm just giving you a very generic enlayment example how hyperledger used to work uh when somebody is joining the Consortium. They have to uh go through the rules which we have already written and those rules are very much critical to examine.

A

So those rules are written in uh this yaml files and the certification also, we should do is for hyperledger foundation gives their own certification. If you do the certification, you will get to understand all uh details and understanding the best understanding you will get once you pass that examination uh for hyper laser about the ml files, how these are actually configured so config configuring one organization is a very critical part. Cloud security is the second critical part and third, is this thing, what we say: private key and public security?

A

At least you know, smart contact is same. How we do smart contract also exist in private blockchain. uh Hyperledger allows you to have Smart contract in different different languages. There are primarily three golang, uh then JavaScript, and one is Java. Okay and smart contracts in this is mostly analyzed manually. So there are no such tools which hyperledger is providing currently for the chain code. Here, the smart contract is called as chain code to analyze a chain code. We are still trying to develop such uh tools where you can analyze your chain Port.

A

So primarily there are four things. I would say. First, is this configuration file then the cloud security. Then this is smart. Contract and last is the devops infrastructure security.

C

Awesome. Thank you for the answer. Yes,.

D

So, um okay, so I mean I just wanted to ask since I don't have a lot of exposure without pleasure in in public blockchains, we use a cryptographic hashing to maintain the Integrity, so um I mean is this? Is it the same case with hyperledger since you've mentioned, I mean a little bit about the chain code? So is that how it works with IQ pleasure as well.

A

D

Okay, that's, okay! No, so I was just saying that uh in public blockchains you have cryptographic hashing uh and that's how I mean you know, sort of.

A

D

Smart contracts also do it um on blockchain. So um since you did mention about the chain code in high pleasure as well, so do we also have cryptographic hashing to maintain.

A

D

With hypothesis.

A

Yes, it's it's same as it is low, so how we have a typical uh blockchain, uh like previous, has, is matching with the next has and all so. The blocks are created in such a way. So that's how same thing happens here, but little bit differences. We don't have continuous blocks flowing up whenever there is one transaction that will form one block so.

B

A

Public blockchain, what happens? There are like 30, 20 or sometimes hundreds of transaction in one block.

C

A

Happened: Whenever there is one transaction that will create a block and meanwhile it will.

C

A

And if there are two transaction at the time it will take two, but uh on an average there is only one transaction at one time in one block. So this uh and then also the cryptographic.

B

A

Is same, it uses r256 to hash it and there's some encryption and same kind of block structure. The only difference I can say the major big difference you can visualize is the formation of block in public blockchain. There is continuous block which is Flowing up whenever transaction is coming. Is it's just capturing, bundling all the transaction, but here in this, in this case, what happens? Is it just sits for even in ah private ethereum yeah is private ethereum also there is like blocks, are like keep on generating yeah.

A

Even when the data is not there even with even some transaction is not happening, the blocks will be keep on generating, but when it comes to hyperledger, the blocks will appear only when you do some some kind of transaction.

D

A

So if you have some more question from audience, we'll take up and the last half an hour is only for uh audience if they want to interact with us. If we don't have we'll wind.

B

A

So Shane Ashok anybody.

B

um I probably have a question right. So do you deal with any tokenization on hypnosis library, and if that is the case, and um how would you ensure that the tokenization is as secure as those implemented by the uh standard of ERC, for example,.

A

Yeah, so with the latest release of hyperledger 2.0, uh they they have given us this flexibility to have our own ERC, 721 esp20 or any such solidity evm based smart contract, but it it really depends on the use case where you want to use the erc20 okay, since it's a private blockchain for what purpose we will be using it. Your your token will have no value until you list it on some Exchange I. Think that's that's the thing so uh still figuring out. If the use case is uh demanding.

A

If the use case requires such kind of token, then we should use it otherwise, I'm still thinking for a best use case where uh erc20 or such thing can be, you know good fit for a hyper Ledger based application or architecture. Did you get my point.

B

Yeah, but in terms of the implementation right so, for example, is that your use case of um tokenizing like, for example, electricity, so on purpose, and we want to create an FDR field. So if you personally wish you would choose Fabric or Basu for this purpose,.

A

Yeah I'll I'll choose see, since this is a good use case. uh Let's say for tokenizing uh electricity grid, uh how much electricity you are using this for this purpose. I'll definitely use hyperlay fabric because it it is uh taking us to a private, Consortium. Okay, so this electricities will be privately dealed. uh We need not to put it on public blockchain and a Basu based private blockchain. I'll I'll prefer based private blockchain.

A

That will be more helpful than hyper layer fabric, because hypervisor fabric comes with a lot of configuration, details and some different different other things and PS2 will get rid of us and masses can adopt it very easily.

B

Is there any security concern on tokenization on tokenizing, uh like uh I know that we can deploy the ERC contract in federal, but um it does not work the same as the one that people on the edge will change. It was honestly correct.

A

Security concerns for this one will be as same as how we do it in public blockchain. Maybe Watson pradeep are discussing is about let's say if erc20 is deployed, then what are the vulnerabilities? Are there in the smart contract same volunteers will be here because of both the smart contracts are same, so we, in that case the security concerns, will be only those controls which we look for a normal erc20 in public Doctrine.

B

All right, thank you.

D

I mean: uh do you guys have any more questions? We would have to take them up.

D

Oh anyone else.

C

I have a question about uh a generic question about um uh in the interest of uh Auditors, who might be uh who might be interested to take up a career in Enterprise, blockchains or permission blockchains. uh You said uh you know there are uh uh internal uh processes that we that you follow for hyperledger.

C

So if somebody wants to become an expert in Enterprise, blockchain or permission blockchain, uh what kind of uh you know uh certifications are probably what kind of training would help uh does hyperledger conduct any uh security related trainings uh in specific in the interest of people who are interested in this field?.

A

Yeah yeah yeah see when it comes to private blockchain. It's just not not one technology. So uh yesterday, I was reading about some funny uh meme on LinkedIn itself, like there was one hiring happening for a blockchain expert and below that they have everything. There's nothing like blockchain expert. There are different different blockchains available right now, polygon ethereum many are there and when it comes to public private blockchain, it's it's just combination of all those Technologies. We have gone through it, it has devops it has. uh It have uh node.js completely.

A

Not just the smart contract is also in node.js. Apis is also in node.js, your rear, your securities with Cloud. How well you can secure firewalls many other things. So you need to be expert of each of those things. You have to get one certificate for kubernetes. You have to get one certificate for maybe insecurities of kubernetes, uh or maybe you have to get. Definitely. You should have a one certification for cloud security. You should have one certification for a high Pillager Foundation from hyperledger Foundation itself for hyperlab fabric, so combining all those you can get.

A

This thing is that answer clear. You have to be expert of cloud security. You have to do one Cloud security, Let, It, Be, gcp, AWS or Azure, or anything because.

C

You will be.

A

Ultimately hosting it on that, then some normal cyber security Securities related to apis, okay,.

C

A

Are written in node.js, then your interest actually based on kubernetes. You have to be expertise on kubernetes as well. Then you have to get one certification for hyperledger foundation itself, some anything like that. So that will.

B

A

Bunch of those technologies will help sure.

C

Sure so we have a question also from Ashok. uh He is asking I would like to know the demand for Auditors as a career in the future. So I would say: Ashok I think the technology itself is uh evolving in a positive direction, and there is a lot of uh uh uh you know. There is a lot of hopes in on this technology to uh to be replacing the existing ones right.

C

So from that standpoint uh you can, uh you can already witness the kind of innovations that are happening uh in the nft space in the D5 space.

C

uh In the uh you know, Enterprise blockchain, uh like hyperledger itself, so uh uh the the uh undeniable uh you know fact fact of uh you know any technology that is evolving is the security aspect of it, which remains as one of the concerns which has remained in the past, which will also remain in the future as one of the important aspects, so uh security guys will all already have will always have a demand. I would say- and uh you know, because this is an evolving technology.

C

It is, although more important that security guys are in the Forefront of any Innovation and take part actively in any product development, or so so from that context as well, uh the Auditors, uh you know become a very integral part of any web 3 project.

C

I hope I I hope this answers. Your question also thanks.