Dyma Budorin - Why Smart Contract Audit is Not Enough - TOKEN2049 Singapore 2025

I'm co-founder and exce CEO of Hackin. Now I moved to chairman position. Uh ex Deoid spent eight years there and trying to build crypto deoid hacking uh for the last eight years. Um member of a lot of associations author of the books blah blah blah. So if for those who doesn't know, hacking is a company that have on its track record working with almost all big brands you you know in crypto.

Coinbase, Kraken, Binance, Bit all our clients. But of course, we're more proud of building products and tools and securing small guys who are the biggest victims of our vulnerable crypto world. So this presentation I will speak a little bit uh about I will scare you a little bit give you some solutions uh but I will also give some spicy stuff that I'm very excited about and that I want to share. So we start with some um educational stuff. So um we you can be you can spend hundreds of thousands of dollars on security or millions uh but uh as we say in our industry one week link can collapse the entire ecosystem.

So if if you don't pay enough money to your devops who is rotating keys or whatever and he is unhappy he will search for the jobs and he will click on some zoom link and your whole system all your crypto will be at risk that uh this guy will be hacked and you will lose all your money trust business and maybe you will even lose your wife sometimes it's a good thing you know you never know So uh there are uh there are things that you cannot predict, you cannot think of and for example by hack um they were not hacked like in reality like no one compromised their people, no one compromised cracked their code. Uh the reality is that they been hacked uh through a supply chain provider through safe and but this is the problem of like infra uh infrastructure design. So you have to think about a lot of things not just like paying the auditors for uh smart contract audit of a token but in reality all your TV all the defy infrastructure is hell of a mess and hackers don't even think about like cracking your token and of course if you run an exchange know that you are the number one victim. I know so many examples of the exchange hacks that are not even public. Uh usually exchanges don't want to talk about it but uh just bear in mind that all exchange employees are the first targets for the hackers and you can even and hackers have patience.

They when they are in your system they are waiting for the best moment. So when at your hot wallets for example is the biggest amount and they hit you hard uh it's usually on Friday evening of course uh in the moment when uh all already all people are already drinking beer and they are not able to prevent the laundering of the money. Um and of course yes um forget about u recovery of the funds it's almost impossible. So uh um and also you know like if you are hacked my personal advice to you um talk to your uh friends you know they will help you to blacklist your crypto chances that you're going to recover 0.05%.

And those who are saying to you we are recovering the funds they just taking upfront money and they do the same job like blacklisting in very non u public channels. Um and yeah just if you a smart guy you can take a picture of this slide just another you know mentioning of see I see few smart people that's cool. So um uh just like you know just a memo of what can go wrong you know smart contracts exploitation it's just one of the things yeah your security partner will for sure uh he can give you a very big scope of work that he can do usually people are looking at scope of work it's like no it's like too much I don't have a budget but the reality is like this is what what's is needed to sleep uh and not uh you know and drink beer on Friday with uh without being nervous. So uh another slides are for like what your security partner can do for you. Um obviously having a third party partner is cheaper in the long run rather than to have uh to hire a lot of people for different reasons like uh first reason that I I would like to highlight because because of experience no one in the industry have bigger in experience than professional security firms because of the products because a lot of clients because of different languages different attack vectors so um your CTO or CISO whoever you hire he will know very well your system but he will steal outside from the world of hacking and that's just the reality.

So our approach is like you do the sandwich approach when you are um building different layers to protect your liquidity your reputation and it starts with team and operations of course uh as I said uh uh it starts even with HR here um right now like a lot of people don't know this like some people know but if you are not um um if you are not Chinese speaking founder probably you will want to have a Chinese man in your team uh because to bring some experience integrate with some I don't know protocols if needed easily but the reality is uh we as Europeans we cannot distinguish a Chinese guy from the North Korean and North Koreans are sending their CVs applying to all the jobs even even if you have a job application I guarantee you will receive um a CV from Anderson Lee or whatever guy and they are having Taiwanese passports. Uh they pass the KYCs uh easily. They do fantastic job for the uh job interview and tests and you hire them and then he's in your system and then he's just patiently waiting when is the best moment to hack you and drain your funds. It happened already so many times. The problem is massive.

Almost all big protocols have uh North Koreans in their team. But how to how to do it? Starts with HR. So um yeah, let's go next. Secured infrastructure.

Yeah, the private keys compromise. Um the access control is the biggest problem. But there are there are tools there are best practices that you can follow. For example, I really recommend uh to to um to go through uh certification called CCSS is cryptocurrency security certificate because they have a guidance and b basically what you have to do from the like generating the private key up to deploying the uh protocol in the in the in the product. So there are things you you can follow even if you are not a technical founder.

So uh CCSS is my my reply to um yeah so the smart contracts u so many cases we have uh in our industry that people are just doing an audit for a very very small part so that they have marketing hey we worked with hacking or we work with some other brand but uh so that exchange can list them community is happy but yeah community doesn't know um how to read the smart contracts. Most of the cases they see the brand, they see okay uh they are happy but the the the scope the the coverage of that audit was just penis and in many many cases the audit uh is done on the smart contract that can be upgraded. So if the dev changes something after a it's no longer relevant and people doesn't know it and we don't have still in our industry the big database of the of the audience and no one is tracking the changes there but it's coming soon. So all you guys if you saved money on your smart contra and you change the code afterwards soon you're going to be um you're going to be in trouble. Yes.

Um next uh next next next bug bounty. Yeah. So and this is where we come to a spicy thing. So um back bounty is a must like no one uh no security auditor especially if he's a professional he will never give you an 100% assurance that he didn't miss anything. Everything can happen.

You know even the best teams they can miss some obvious bugs or not trivial bugs they cannot have all the u they cannot don't have enough time to do all the possible tests on your smart contracts. So that's why uh the bug bount is the best practice is what you have to do but uh back bounty is usually a very expensive thing. So you have to freeze like minimum 100k for a decent smart contract so that the community is interested to check your and like basically invest their time into uh your security for free like in the beginning it's free because you your smart contract can be done in a proper way that there is no bugs but there is a way. So uh what we started to do um with our oh it's different presentation okay so what we started to do with our uh clients so we started to offer them uh that we will take 10% of our revenue we will create the pool and uh we will um u make this pool available to community for very short u uh term period. and we limit this size of this pool.

So we can the community can get 100% plus uh yield from this pool and they have start putting money in they started to make yield but this is the deposit for bug bounty and the thing is that uh we immediately announced bug bounty at our platform hacking proof is one of the biggest best platforms for bug bounty and hackers start to search uh for the vulnerability critical mistake in the code uh just after our audit and if they find they get all the money. So not just the 10% but all the money that people have invested put it in the pool and basically it's a usually it's a good check. Uh if not yeah they didn't find anything and the guys who put money in the pool they get all the yield and they also very happy because it's more than 100%. So we started to do it. we run I don't know 15 20 uh uh like we call it dual defense um post audit bug bounty and yeah there was a case when we miss a critical well but the percentage was okay was fine then we started to um to offer this service to the projects uh who we didn't start working where we lost because of the money all the stuff and uh we got uh on this um dual defense we got the project from other auditors and the community who trust us they keep putting the money.

We have uh and we have uh three times in a row hacker win. So basically all the community lost money three times in a row they're furious. We are happy because we help the clients to um to pre prevent from being hacked. Um auditors are furious as well. They don't they hate us and don't want um us to find mistakes after them as well.

But the idea is that uh the community said, "Okay guys, this is amazing. Uh you helped the product, but we lost the money. Can we bet next time on hackers?" Like, "Oh my god, this is this a prediction market on security uh auditing? We love it.

Yes, let's do it." So this is a spicy thing. security prediction market. Yes, I know it's a buzz word. It's u it's uh it's not hype, it's coming from the reality.

So, we going to update our uh pools for the security prediction market um on the quality of the job done by not only us but others. So, imagine a big name reputable auditor has deployed the smart contraed and you will have a chance to bet whether hackers will crack it or not. So um yes security is a fun thing you know we always try to innovate and find a way how to deal with the blackhead hackers. Last not not least extractor is our own onchain um um monitoring tool that also can solve some of your compliance issues. If you uh want to get the license in Europe or Mina region, I'm living in Abu Dhabi by the way.

If we have Abu Dhabi crew, let me know. Uh and um yeah, so this is something that uh can prevent you on Friday evening as we talk today uh from the hacking. So if you you can set up onchain monitoring tools in the way that they automatically react to malicious uh smart contracts that are trying to interact with your protocol and timely block your liquidity. So that's uh uh it's not even theoretically possible to drain funds from your protocol. So yeah um hacking big company 150 people we have a booth if you have a questions I'll be very happy to talk thank you so much for your attention ciao