← Markets Outlook
Loading summary
Transcript24 lines
- [00:00]
A
It was a masterclass in how to handle a security incident. And I think anybody that is working on a protocol or any software like this needs to have a very tight security process, needs to be auditing their code and hammering it with these AI tools, not just by like bug bounty programs where you have random people just looking to cash in, but people that really kind of understand the underlying protocol, that can ask very targeted and specific questions.
- [00:32]
B
Markets move fast. Crypto moves faster. From the floor of the New York Stock Exchange, CoinDesk's public keys tracks the money markets and moves shaping digital assets. Josh Swihart, welcome to Markets Outlook.
- [01:06]
A
Good morning.
- [01:08]
B
Good morning. I gotta say, I called you Josh, sweetheart at consensys and there was a pretty hilarious reaction to it online. So, number one, I'm sorry for calling you Josh, sweetheart, but number two, I'm kind of happy I did because we got an amazing meme out of it.
- [01:23]
A
Yeah. So I'll take that any day. People can call me sweetheart any day.
- [01:28]
B
I know. What a lovely thing for people to call you. All right. We're not here to talk about how much of a sweetheart you are. We're here to talk about zcash. And zcash has been in the headlines a lot over the past few weeks over a bug that was found, a bug that had. Had been there for about four years. AI was able to identify it. Take us back to when that happened and just lay a groundwork for us. What happened?
- [01:55]
A
Yeah, so security researcher Taylor Ornby, he's. He's been around. He was like the electric coin company out of security for years. Knows the protocol really well. And so I, you know, AI, I would say it's like a combination of human and AI that found the book. So he's very good. He knows, he knows zcash. He knows the underlying orchard circuit. And he was able to use tools where, you know, he had audited. Lots of people had audited the code for years and years and years had never noticed that this could be an issue. But with Opus 4.8, which had just come out that day or the day before, he was able to kind of find an issue where theoretically, if an exploiter had found it or knew about it and knew how to exploit it, could have created additional zcash in the zcash shielded pool. So he notified my team. So I'm the CEO of zcash Open development lab zodl. It's a former ECC team. It's the team that built zcash to begin with, notified three members of our core team here. They remediated the issue, notified me, and then we went and coordinated a response which included a soft fork about two days later and then a hard fork another 24 hours after that to completely remediate the issue.
- [03:27]
B
What's going through your head when you get this notification?
- [03:33]
A
Dear Lord. I was sitting, having a cup of coffee on my Saturday morning, and our head of research, Dara Emma, called me on signal. Everything happens on signal. We have very tight security protocols in terms of who gets notified, when they get notified. Dara read me in. But as per our protocol, I didn't need to know exactly where the bug was or what the bug was, but I needed to know certain things about it in order to coordinate the response. And so we kind of limit again, who gets read in, who has information about it, how it works. And so, yeah, it wasn't. It just, you just go into a mode of, okay, you know, what kind of where, where do things sit today? What do we need to do? How do we get the, you know, proper response coordinated? In this case, we got to work with miners and exchanges and people running nodes all around the world. So some folks in China, some people in New York, in order to, to remediate it as quickly as we could. And it was pretty amazing. We remediated with within the time that we did
- [04:49]
B
so. The bug essentially could have allowed malicious actors to print zcash in the shielded pool. Is there any way to know if that actually happened?
- [05:01]
A
No, there's no way to know that if it actually happened. I think there's certain heuristics, there's certain patterns that you would see. So, you know, generally if somebody had, you know, exploits a vulnerability, they'll kind of sit on it quietly, they'll start to move money out in order because it's in their own best interest. They don't know who else may have exploited it or found an issue. So we have something in zcash called the turnstile, which limits the total supply, so it protects the total supply. And so just game theoretics, we would have seen a different kind of movement or different kind of activity likely if somebody had been able to exploit the vulnerability. But. But we haven't seen any such thing.
- [05:41]
B
And I guess, talk me through this. There have been a bunch of headlines. This has been unpacked in several different ways since it happened. But what impact does this have on the ecosystem moving forward?
- [05:52]
A
It hardens it. One, number one, with the vulnerability, the manner in which the ecosystem, which is more decentralized than it has ever been, was able to kind of come together to, number one, address the vulnerability. And number two, we're working on a new protocol that's formally verified that will be out in, in July. And it's across organization various developers with different groups that are working on this and working on it to make it happen. Formal verification is also new. So while AI was used to assist in finding the vulnerability, AI will be used to assist to ensure this vulnerability doesn't exist or anything like it in the future. And I think so ultimately, you know, we, we demonstrated we can very move very fast in a crisis. We can execute very professionally. We're very transparent. And both the community and I think the, the protocol, we even more hardened
- [06:58]
B
kind of coming out now. I had a guest on the show recently. We were talking about the privacy narrative. He said, you know, there are so many privacy solutions out there, and was kind of skeptical of zcash as the privacy solution to answer all of the privacy challenges that we have. And something he told me was, you know, I don't know a lot of people who have sold their Bitcoin to get zcash. I'm just. I just want you to respond to that. Tell me a little bit about how you see zcash in the privacy ecosystem and for you, what makes it stand out amongst some of the other privacy protocols out there.
- [07:37]
A
The irony with that statement, right, is there's data out there. So we enabled swaps from various coins to zcash. I think that the top. And you can see when the swaps happen, right, because half of the transaction is transparent. The people that are coming in from Bitcoin or USDC or Tether or whatever, you can see that coming in and coming into the zcash yield pool. So the top two coins traditionally that swap into Zach are USDT and usdc. But post that, it's like Bitcoin. And so he can say he doesn't know anybody, but people are doing it and the data is there to show that. I think he had a whole bunch of replies to that interview where people are saying, I'm one of them. And actually I am one of them. Right? So I started as a bitcoiner. I was a bitcoiner long before zcash existed. But, um. And so like, I. I think that's like a. I don't know, it's. It's a narrative he was kind of throwing around. But the reality is like, Zcash has been around since 2016. It was proof of work. So it's fair distribution. People have been accumulating or not for a long period of time. It's had price discovery. Typically price discovery takes about 10 years before you see it. And so you can't recreate that, that 10 years of history by taking some tech and throwing it on another chain.
- [09:14]
B
Markets move fast. Crypto moves faster. From the floor of the New York Stock Exchange. CoinDesk's public keys tracks the money markets and moves shaping digital assets. Another guest that was on the show recently was a trader. And we were talking about some of the more prominent narratives that are happening right now. And zcash came up and while he acknowledged how well zcash is doing, he said, you know, where, where he lives and amongst his, his group, the worry is that, that governments are not going to be as bought into privacy as the end users. Is that something you think about? What if governments decide, you know what, we don't actually want people using private currency and we're going to make it really, really hard for them to get their hands on zcash and use zcash.
- [10:06]
A
I don't think you can put all governments in the same bucket. I think there's some differences. We have somebody that works full time in Washington D.C. that was out there meeting with people on the Hill yesterday. And I think there's a general openness and a recognition that actually not having privacy is actually a bigger problem. That if all of us citizens are able to be exposed to foreign powers and hackers and that kind of thing, it's actually a massive, massive economic risk. We saw this with the early days of the Internet, right? So the early days of the Internet, the government fought encryption on the Internet using the same kind of jargon. Not jargon, but language of like we need to protect the children, we need to protect against terrorists and that kind of thing. But the reality is we couldn't do commerce on the Internet. The Internet could not exist as, as it exists today without encryption, without HTTPs. And so because, because of that, economic forces change things with the government where now the, that same government that was trying to kill encryption on the Internet now says it's mandated and should be mandated. And I think we are headed to that, to that kind of world. I think that's possible. But at the same time we need to, where there are governments that are more dystopian or they're more authoritarian, we need access to things like defi and things like that where it's just quite frankly outside their control.
- [11:34]
B
I want to come back to the vulnerability we started this conversation on. I can only Imagine that you're there in the war room, you're trying to figure out what happened and how to fix it and what happens next. How are you thinking about finding other vulnerabilities or protecting against other issues of this magnitude not being discovered? Because you want to discover, discover these things. But how are you thinking about protecting the ecosystem and finding vulnerabilities and avoiding them?
- [12:03]
A
Yeah, there's two things. There's. One is simplification. The other is something called formal verification. So historically, something like Orchard, it uses a thing called a circuit, which is kind of a rule book for how things get managed within the, within the protocol. And that rule book is very complicated and historically it's hand checked. And so you have cryptographers that kind of understand zero knowledge cryptography that are in there looking at it. You get multiple parties to look at it. You get third party audits to kind of certify everything, all the rules are correct and everything like that. And that's what's been happening for the last four years. And because it's so complicated in so many edge cases, computers historically have not been able to, to do that rule checking to make sure everything is right. And so what that means is that now we have, with, with, with AI tools we have the ability to formally verify. So that means the AI tool can look at those rules and verify that they're, they're accurate. And it's doing exactly what it is supposed to do, exactly what you want it to do, essentially. And you can have multiple people that are, that are doing that. And the code is all open source, so anybody can go formally verify work on that. Now there are multiple groups that are formally verifying it created like this big because of the news, like I'm sure lots of people were hammering it with AI to see if they could find anything else. And so that will help. The formal verification will help. And then you know that a computer has verified that everything is sound. And then the second thing is just to simplify that rulebook, and there's a project called Project Tachyon. So the first thing we're doing is with the Orchard pool, which is the current one we're formally verifying, and we'll have an update called Ironwood. The target is the end of July or mid to end of July. And then Tachyon, which is the next generation, which will be out some months from now, is a simpler rulebook. And so by both simplifying and formally verifying, I think we can get pretty rock solid.
- [14:07]
B
Okay. And lastly, what can other protocols Learn from this experience. How would you advise folks who are running other protocols to operate when it comes to security and finding vulnerabilities?
- [14:22]
A
It's like patting my teams on the back a little bit. But it was a masterclass in how to handle a security incident. And if you don't, and we have again a very type process that's well documented. We use tools that are encrypted for how we exchange certain information that gets exchanged. We're not posting information on Google Docs or something like that that's on somebody's cloud somewhere. Information gets passed very privately as well. And, and so we have this process of, of how we handle security incident and I think anybody that is working on a protocol or any software like this needs to have a very tight security process, needs to be auditing their code and hammering it with these AI tools. Not just by like bug bounty programs where you have random people just looking to, to cash in, but people that really kind of understand the underlying protocol that can ask very targeted and specific questions. And so I, I, I think, I, I don't know that, that a lot of, of groups in the industry have like this kind of security process set up in such a way that, that will allow them to kind of effectively remediate and then be able to kind of fully disclose kind of what happened and in the way that we did. But maybe there are, but I, but I think if they don't, they should.
- [15:40]
B
Yeah. My hope is, you know, after they see instances like this that people are reevaluating their systems and taking action before it happens again. But I think we've seen that maybe, maybe if it doesn't hit home, people just kind of feel like they're safe.
- [15:58]
A
I think they kind of assume safety. You have a tendency to kind of get lazy if something's not happened over some period of time. We've seen like with Litecoin got exploited, that you know, there's all these Bitcoin back in the day got exploited. There is just inherently going to be bugs in software that are created by humans. It's just going to happen. So if you building software, there's a bug, there a question of how, how it can be exploited, how severe it is. I mean those, it depends but, but now we have these tools that we should be formally verifying our software before we kind of, there's, there's no reason not to anymore.
- [16:41]
B
Josh, thanks so much for joining Margit's Outlook today. As always, it was a pleasure, thank you so much.