How zero knowledge technology affects blockchain security, ChainLight explains

0:01I'm Ashen Addison from the cryptocoin show and today on blockchain interviews with Andrew weisi co-founder and CTO of chain light Andrew welcome to the show and thank you for taking the time thank you for having me here very welcome I'm excited to dive into cyber security uh in crypto uh the latest Technologies the latest hacks how safe are we becoming

0:24I'm sure I'm hoping it's getting safer each and every year or each and every day uh with the help of chainlight as well uh with love to dive into your insights today but I would love to start our conversation off just hearing a high level on what you and the team are working on at chainlight and what does the uh company sort of Encompass in terms of cyber security in crypto and

0:44maybe out of crypto and then we'll dive into all the details yeah thank you uh so we founded chain light in 2016 uh we started with more of the traditional security working with a lot of commercial and government customers and then over a couple years we then moved into sort of the web 3 and blockchain space and so what we really try and bring is uh bring together

1:09experts so we're based from the CTF Community we've won a lot of competitions there we try and hire from inside of that community and then we try and bring everyone together into one team that can help our customers okay and what is the CTF community so C def flag uh competitions are basically where you have Security Experts who are going against each other

1:35in order to see who is better at knowing their knowledge of cyber security really so it's just sort of like a fun exercises sort of War Games is how you can think of it and by doing that we sort of found some of the best talent in the world for cyber security nice that's always great to have sort of a gameification you know and uh when there's so many hackathons in uh crypto

2:00that I see and when you can do it in a positive way you know you're you're a white hat hacker or you're protecting people's funds uh and you're having fun while doing it uh that that always makes for a good time yeah definitely like hackathons are great for developers and the ctfs are sort of the equivalent for cyber security and there's some of them

2:18in the blockchain world as well that we've done very well at um but they're always uh fun competitions now can you talk about cyber security in crypto year-over-year trying to keep up with you know the new developments uh the protection of them and then new attack vectors that are coming in as new technologies come out as well I'm guessing it's a bit of an

2:41uphill battle Yeah so there's a couple of different reasons for that right so one of the reasons is that the technology itself has become more complex if you look at the sort of the origination of blockchain with Bitcoin at the time it was sort of a very simple protocol there wasn't much than inac would be able to do with it once we got into uh ethereum

3:04smart contracts all of a sudden there was a lot more ways for an attacker to steal funds uh because people could now write these complex systems that were run in a decentralized way that anyone could access and these systems had to be foolproof they they had to be bulletproof um because any small in their armor an attacker is going to take advantage of and potentially steal

3:30a lot of money so I think as we see the technology progress uh we're seeing a lot more for instance Zer knowledge systems out there uh those are even more complex than what ethereum was and so we're going to continue to see the attacks evolve we get better each year at protecting against the sort of known attacks but each year new attacks come out and those we need to learn how to

3:58protect against as well mhm defin definitely and I want to dive into the ZK Tech which is a bit newer in crypto implementation at least uh in a little bit later in the conversation I'm curious on uh the you know some of the contracts that I've seen in on ethereum for example if there's a DEX uh or there's like a D5 platform some of them just have like a simple smart contract

4:22um which of course all the code for that is public and you can see it and from what I understand you know aart contract is only as secure as as you think it is until it gets attacked you know it's you might have not noticed uh a hacker might notice a flaw in a contract and although everyone can see it um when it's launched you don't really know how secure it is until it gets attacked and

4:45some of these smart contracts have hundred million do in it or few hundred million and they probably need few hundred few hundred million doar worth of security to be backing that simple contract to ensure that it's not an attack Vector for hackers that's exactly right and that's sort of one of the challenges I think for users of these smart contracts is how do users judge

5:10how secure a project is uh it experts like us still have a hard time of figuring out whether code is secure or not it's going to be almost impossible for normal users uh who are non technical to do that assessment themselves so yes the code is public but that's only used if you have experts looking at the code in order to find these uh problems and and when you do an audit of

5:41a smart contract there's only I'm guessing there's like a checklist of like the basic things but then sometimes as these contracts get more complex there's new variables that come in that either they haven't been thought of or you know a semicolon was missing here or there or something and that allows for the hackers to come in yeah so there's always there's been

6:04several uh known issues in uh ethereum or solidity smart contracts for instance but as an example of sort of new attacks that have come to Bear uh price Oracle manipulation attacks for instance uh several years ago that wasn't even on the radar but then once one of those was uh found in the wild once someone actually exploited a contract with the Oracle manipulation all of a sudden this

6:32is something now that we have to look for in every single contract that has an external Oracle as an example um recently uh rounding attacks are the same thing so in computers you can't precisely uh measure a value necessarily so when you do a division there's going to be some rounding error and so that's something else that you have to sort of now take account for when you look

6:59through all this code mhm very very interesting and I'm guessing you have some of the industry insights for 2023 you know it was pretty good year for Bitcoin um and for layer 2 is becoming more known and more used what are the the numbers for the amount of exploits that happen compared to you know 2020 21 22 23 are we seeing a major decrease in

7:30overall the amount of hundreds of millions that have been exploited and the percentages are going down or so what is you know what is the direction that um and how efficient is it becoming with chain light making protective measures over uh smart contracts and and crypto overall yeah so we are seeing the numbers grow but part of that is because the amount of money that is in crypto is

7:55also growing so because of that it's going to be the case that these are attacks are going to get larger uh so I wouldn't necessarily see that as a bad thing um it's not necessarily good but um it's just because the market itself is larger uh you know one of our customers is blast uh we've done an audit for them recently they've been very proactive about okay we now have

8:221.3 billion dollars of lock value let's make sure we keep that secure because you know that would be that's a very juicy Target for an attacker uh so we're definitely working on that um we can't protect everything so we uh protect our customers by looking at their Cod and helping them with that but that's not necessarily the entire attack surface we've seen other folks get attacked in

8:50ways where uh it wasn't through the smart contract code that they got hacked but because uh someone was able to hack into their servers get their keys and such and that's something that we can't really protect against uh but those are still sort of included in the whole blockchain security space yeah no that's a great point and you know I mentioned about different layer twos there's a lot

9:14of airdrop incentives going on right now with all these layer twos that have raised hundreds of millions of dollars they've yet to come out with a token there's a lot of incentive for people to move their ethereum uh over to new networks and also expl with new applications that you know might not all be safe or there might be fishing attacks I very well know there are some

9:36fishing attacks or disguised contracts to you know whenever there's free money so to say on the line people sort of get excited and take risks with their Capital um and I know one of the top airdrops that's supposed to be coming out in the future is the ZK sync uh layer 2 Network um I believe there was an exploit of some sort that chain light helped with uh to protect some of the

10:00capital in ZK sync maybe you can talk about that story and and what exactly happened there yeah so ZK sync is like many uh ZK rollups they have a zero knowledge circuits which are equivalent to you think of as code that they use in order to U prove that transactions are doing what they're supposed to do um proving that they follow the rules of the

10:28network and so we found a way where the circuit had a bug and so a malicious PR could uh change the behavior of a transaction so you know it's one of the important things to know is that right now with all of these ZK rollups there is generally a centralized Pro there's only one person who's allowed to actually put these proofs onto their main chain be the ethereum um and so

10:58while we found a bug in these circuits only a malicious prover would be able to want to actually exploit it and at the moment that's all that control is centralized into matter labs and um they're the only ones who can run aover um but they their goal and the goals of every other L2 rollup out there is to decentralize that role to allow anyone to push out these proofs and so that's

11:23where this bug would have became uh very dangerous is that if anyone can push a proof and there's a bug in the circuit then anyone would be able to manipulate the system and potentially steal all the funds oh my gosh and yeah I was reading that the numbers were almost totaling $2 billion do yeah that's roughly how much money has been flowing through zky era

11:48uh before and after that we found that bug um so it's fits now thankfully um also ZK sync era has been very proactive about going and Gain Audits and finding more issues so we participated in one of their audits recently where we found a couple more similar issues in their um version two of their ZK syira and so they're being proactive about getting

12:15audits done and making sure that uh these vulnerabilities are found and fixed yeah no that's good to know especially when there are new protocols like this and you're not and hackers are looking they're not just looking at one smart contract perhaps they're looking at a new attack Vector for the whole blockchain uh then you're looking at you know billions of dollars as you're

12:38saying not just hundreds of millions um so you really have to be proactive about the security and because the ZK technology is new and I don't understand the the computer programming uh expertise behind it but from what I understand being zero knowledge um there's parts that are you know you you can verify things without having information about it and that might have

13:03some information asymmetry on different aspects do you know what are some of the advantages and disadvantages of introducing ZK technology into not just ZK sync but any blockchain and smart contracts how does that affect the security of it adding in ZK generally speaking it doesn't greatly affect the security what it really does

13:31affect though is the scalability or privacy of the system so if you um you can use zero knowledge in order to scale more because you need to send less data to every Network participant or you can use ZK to increase privacy because you can hide information now where security comes into play is that right now there are fewer people who know know and are

14:00able to audit ZK circuits and the code that uh interacts with ZK circuits so because there's fewer experts it means that it's a lot more expensive for projects to get their code audited that decreases the chances for them to actually get those audits done because every time you push out new code every time you add a new feature you really want to audit all that code and all

14:24those features but if there's just not anyone around that has expertise to do this audit that becomes very difficult mhm yeah sort of the downside of innovative technology and that if you're the first one to make something new who's going to audit it to determine whether it's it's secure or not moving forward exactly and there's this other challenge where right now the zero

14:49knowledge systems are kind of distinct we have three or four different uh ZK rollups that are deployed with mainnet and each of them have a different code base and so they're all based on zero knowledge but as an expert who wants to go and look at their code and make sure it's uh working correctly we need to now learn a completely new code base for each of those and it's we're talking

15:15about hundreds of thousands of lines of code and so it's a substantial time investment and do you think with the introduction of these Layer Two that have all these advantages with ZK do you think that technology is going to be sort of a a standard practice moving forward as more blockchains will adopt it and you know all new blockchains in

15:42the future will introduce part or a whole part of ZK in their technology just as as a standard is it that good of Technology it's that good of a technology for scalability and ethereum as an example there's been a lot of issues with scalability and they've always are looking for solutions for how to get more transactions per second or um how to get more data onto the network so the

16:13new ethereum upgrade that's coming hopefully this spring introduces Proto sharding which in some ways is an example of zero knowledge because you have this data that's going to be on the network it's going to be verified and then it's going to be thrown away and all future uh nodes in the network just sort of rely on the Zero knowledge proofs instead of actually having the

16:39original data that's good to know and when a hacker is looking at attacking a different blockchain is there an incentive for them to go after a ZK blockchain in that if they find an exploit maybe there's more privacy around them exploiting the funds and not being able to get caught or does the Privacy matter functions inside of the blockchain not really affect them in

17:07that specific instance we always see attackers utilize privacy Technologies in order to sort of hide their tracks and that happens um whether it's a private Network or not so on ethereum we have tornado cach tornado cach is used in many many attacks just because it sort of hides the source of the original funds and allows the attacker to then get their funds back

17:33out without uh associating it with the hack so we see that and I think you'll see attackers use more private networks as they come out potentially just for their as a way to mix the funds uh not necessarily targeting those networks specifically but just using them to sort of attack any network because the attackers don't really what they're looking for is where's the juiciest

18:00Target where is the most money that I can easily get and then they'll use a bridge they'll use a swap we swapping website whatever they need to in order to get it to either tornado cash or some other privacy uh app okay yeah no that's good to know and with chainlight what are some of the focuses for 2024 Big Year here a lot of new institutions new

18:28ERS coming into crypto more holding Bitcoin and probably that will trickle down into other more Innovative blockchains and ZK as well um and as you said the there's there's more being exploited because there's a lot of capital coming in and I'm sure the future hackers are probably excited that there's lots of new billions coming in um into new technologies hopefully uh

18:53you got that will keep you guys busy as well to protect all this Capital what are some of the focuses for you and your team for 2024 and what you think might happen in the industry and where your focus is to protect capital and protect people and projects yeah there's a couple of ways that we're sort of uh positioning our company the first is that we recognize

19:15that there are going to be a lot of projects and a lot of developers that need Audits and so we're looking at ways to be able to help more of them we're Limited in the industry and in our company with how many people we have that can actually look at these audits line by line and then write a report so we're looking at ways of automating those with static analysis tools maybe

19:41automating some of the report generation as well using generative AI any of the tools that we can use to make uh our Auditor's time more effective so that's definitely one way that we're positioning ourselves and where we're looking to grow in 2024 the other way way is through zero knowledge so you know since it is such a new technology it's a space where we are trying to

20:06build up the skills ourselves as well as find customers that we can help that need these audits done and make sure that we can review their code and find any of the issues so we started that a bit last year with working with CK sync era and we're hoping to expand that to other ZK RS as well very cool I appreciate your insights into the industry and it's good to know that

20:32you guys are staying on top of the new technologies make sure that uh these smart contracts and people that are just getting into crypto um can have a safer experience and not get burned right away sort of puts a black mark on on what they think crypto is you know I think the the exploits are a very small percentage of what all the total innovation of what's happening in in

20:54blockchain and I know chain L's helping keep that percentage very low um so thank you guys for for what you're doing and for your insights into the industry all the best in 2024 moving forward here and let's definitely follow up in the near future yeah thank you Ashton it was a pleasure