Web3 Infrastructure, Security and Beyond | Eugene Aseev Chainstack | Token Talks EP 08

0:00 controversial statement is that you should hire a security person before you hire your first developer think about it security was always un seexy thing and people hate building boring things here you can build a new Oracle you can launch a new chain yeah we we build all this pieces of infrastructure and who's going to be using it I'm personally extremely passionate about boring use cases as you see payment for me is the most boring but the most compelling use

0:24 case we need to start building these boring middle Wares and present it to the end user I would without mentioning blockchain unfortunately for us I guess as soon as you use the word infrastructure that's what people think right but actually I do think what you guys do is very sexy and very cool particularly in the space hello and welcome to another episode of token talks brought to you as ever from our Sunny Studio here in Singapore where the airon is always set

0:51 to hyp Eugene welcome to the show it's great to have you here thank you very much thanks for having me today so my background is largely in engineering research and cyber security so I started my career in a cyber security company where I spent quite a lot of years and then I worked in a couple of smaller startups also related to cyber security in different countries I moved to Beijing at some point I lived there for a couple of years so I have a

1:15 peace in my heart for Asia so that's why I'm based in Singapore for the last seven years as well I lived in Israel for for a year where I explored a lot of like cyber security landscape and you know the startup scene which is amazing in in Tel Aviv an amazing city as well and then basically I moved to Singapore to build the R&D for a company called the chronis which is also a data protection cyber security company

1:39 where I basically bootstrapped the team from 0 to 30 and during the time basically we build a product around blockchain on ethereum and that's where I was like super interested in the blockchain tech it was I think year 2016 so quite early even though I was touching Bitcoin before in the cyber security space because we were exploring our products around you know securing Bitcoin wallets and all this kind of stuff but what really sparkled my interest is ethereum in 2016 where we

2:07 build a product on top of ethereum and it was a mess to build because there was no tools it was ridiculously unstable so we basically said okay somebody should fix this and basically we started working on a product called chain stack which is basically a reliable affordable and fast API suite for all sorts of you know blockchain applications and developers and since then basic we are fulltime building it at Full Steam amazing and since then you've moved to Singapore build out

2:35 a team here where is the change chain stack team where are you guys based So currently we are based in around 35 countries so we originally started from Singapore we were very small and Nimble team around 10 people in like 2016 17 and then basically we started to grow a little bit and the market start picking up in like 2020 2021 and we started growing pretty dramatically but that time there was covid already so there was sort of no

3:03 point in hiring people just in Singapore because the talent was everywhere and everybody was like migrating from one country to another so we decided okay we will build a a remote team and since then we are completely remote which is very good for our business because our business's core pillar is reliability so we need to offer coverage for our customers 247 across the globe non-stop so we basically leverage this big time because we have people in Latin America

3:30 Europe Asia so multiple locations and people can work during the days which is amazing because there are some companies and I was like that in my early days I basically worked night shifts it was horrible because you basically cannot you know properly sleep it was very nice because I was doing you know my university studies at the same time so it was nice because you can you could combine but your health is going to get cut like big time if you do this so I

3:56 decided deliberately so if we do a 24/7 shift set up we should do it in a way that basically is not disruptive for health of people so that's why our like dist distributed nature that we build it during the covid times helped us a lot because we didn't have you know to feel roles with like people working like you know after midnight and all this kind of stuff so we're very distributed right now yeah sounds great and I love the

4:19 fact that your business now came out of a real life problem that you had right you saw that the infrastructure in in web 2 as we were progressing into web 3 just wasn't that how's that evolved so like coming from a I guess originally a web 2 background and now seeing the Challen challenges you are helping people solve in web 3 how's that Evolution progress so I would say that it's actually not so bad now I think that tooling wise there's

4:47 been a lot of tools Built For This like last six years so it's been evolved pretty dramatically now it's not very hard to find you know reliable API sources of data you name it but I still there's still a lot of to build like for instance in if you think about like web to development there's so many verticals like starting with you know observability to monitoring to logging to you know simulations to like QA to deployment to like Integrations

5:19 and so on and so forth so there's so many different areas and if you like Google something like you know ecosystem map for like web to Dev tools you will find like probably thousands of tens of thousands of companies solving this problems in web 2 today and many of them are very popular many and like widely used such as let's say AWS with all the you know Suite of tools that they have and some of them are very Niche and like

5:45 they just solve a particular problem in in web to you know development space but there is like tens of thousands of companies that are basically solving different problems in the development so I believe we're still quite early I think that if you're you you know bootstrapping a business in web 3 you already can find a suite of tools for yourself to be relatively comfortable and like having all your bases covered but there's still a lot of

6:10 pieces that are missing and I'm sure will be built within the next 10 years for sure yeah great so so let's take that as an example if I'm if I'm a builder looking to get started in web 3 or you know build my first project what are the special considerations that I need to have in mind for web 3 versus building a web two project oh that's a great topic so basically it's it's the same sort of

6:34 thing in general right you build code right so from very high level perspective you basically need people who build code you need the same kind of people like product managers and like product designers and like marketeers and so on so it's a product right in the end but the way the code is being built and the approach and like the way you basically apply certain perspectives on like how you're building a code is dramatically different right

7:03 so basically what you have in web2 development you have some piece of code which is usually running on like some centralized servers which you have access to and then you basically can choose like where to deploy when to deploy and like when to open source either open source at all or not or maybe like never open source all right so you basically have quite a lot of control over product over your code that you're shipping to the public so you

7:32 can be relatively you know I when I say relatively depends on your like you know rese that you can be relatively relaxed with regards to okay what you ship how you ship when you ship especially if you start building an MVP and usually MVPs are very quick and dirty and they are hosted by you know a couple of guys on some you know very easy to use you know like a platform as a service kind of tool like versel or

7:55 like netlify something like that and then basically all the rest is is is depending on like how you get traction whether you get traction and then you're going to invest more into like building better products having more observability reliability etc etc with web 3 it's a bit different because it's very hard especially in dii space whenever you basically touch the money because first time you start touching the money you're going to extend your basically landscape and

8:24 like your security posture quite a bit and hence you can not really focus on you know just shipping the MVP with whatever quality possible and then suddenly it's skyrockets and then you're very popular because basically if you apply some unreasonable practices when you are very early and then your app is suddenly popular you basically have an app that is a by Design public because that's how we build it in a public blockchain space basically all the code

8:52 is public and there are so many people who are hunting for basically all sorts of vulnerabilities in this code and around this code as well which is like front ends and deployment pipelines etc etc so we become much easier victim rather than you deploy you know applications and you build products in web tool space which is much more controlled because you control where you give out you know certain visibility to your process to your code Etc so I

9:20 would say that even though code here code there but very different from you know like like design thinking okay how do I build my app how do I secure my app how do I deploy my app and like because the security posture from day one after you deploy is dramatically different and it's probably like few years behind if you were building like a web to app and you deploy it like on day Zero yeah yeah makes sense you you mentioned AWS and

9:46 I don't want to make the comparison but but for chain stack are you you know is the vision to become similar type of company for web three services so the types of I guess Services you providing would be things like hosting whatever else else it might be is that is that the vision for chain stack or yeah so originally chain stack started as a a contol panel for blockchains that's basically was our tagline in 2018 when we launched the the

10:12 first version of the product we were originally focused on like institutional blockchains like Enterprise blockchains build on protocols like high PL of fabric CA some of the people still remember these protocols because they're not as popular and not as hyped today as they were like a few years ago so we basically were focused on this part of the market which at that point of time was extremely you know popular everybody was thinking about it and everybody was at least like promoting

10:39 the projects that they were building on it and like all the interbank transfers and like supply chain Finance all this kind of use cases were very popular so they never realized themselves so we switched to you know more of a public chain side of blockchains and that's that's the part that got really successful over the last few years but originally like our vision on chain stack was a a multi-chain multic cloud platform right so it's still in the

11:07 place up to date so we basically have Now supported like more than 25 different public chains we still by the way support private chain deployment so we have a bunch of customers running on this private Enterprise chains as well but the majority of the businesses on the public chains and the original Vision of chain stack was basically to provide this like complete Suite of services so that people can build on a multitude of block chains that we were

11:29 sure in 2018 will be there so there was actually no notation of like multi-chain back then so multichain appeared probably around you know when first side chains and l2s appeared which was probably like in 2020 2021 so nobody really talked about the fact that okay we will have actually like you know lot of chains which will be used for different purposes which will have different advantages disadvantages so at that point of time for me it was already

11:54 super clear that we will have multiple chains and probably this Enterprise blockchain narrative helped a lot because basically they are all you know Silo chains that people deploy and they work together on but there will be never like one chain such as ethereum and everybody will work on ethereum so this shaping of our product helped a lot because we were basically very agnostic towards what kind of chains we support what kind of hosting options we support

12:20 so we were building with this like platformization in mind so that we will plug in necessary you know features when time comes when there's demand and we had pretty broke vision from day one on like how chain stch would look like I would say that in terms of like a comparison we're trying to be sort of Underdog of you know of the web three Cloud our original inspiration came from I think companies like digital ocean which are like small in size much

12:45 friendlier towards developers and like you know much easier to use much more affordable much more transparent in terms of like pricing and feature set so we were probably looking at becoming you know sort of digital ocean of web three infrastructure structure than a of web infrastructure because we didn't really wanted like to become a like gigantic company that will serve you know like U 60% of the market because with this comes a lot of responsibility and you

13:12 cannot move as fast as you want so we deliberately decided okay we're going to be you know very fast very agile we're going to you know Implement and ship features pretty quickly so that's our vision we wanted to be a you know a progressive you know kind of web train infrastructure web cloud provider in the early days and it's still the case as of today got it got it and then past couple of years well year

13:36 and a half we've been in a kind of bare cycle you more than anybody have been interacting with I guess the Builders of web 3 what are you observing in terms of what people are building at the moment the way that you're interacting with your customers is there anything that's changed during the bare market and what's your outlook I guess for the next year or so right it's a very hot topic I I guess so I will not spread

13:59 much predictions here because I mean I'm very bad in predicting stuff but of course yeah we touch we have a lot of touch points with Builders for us the Outlook is pretty simple we see Builders building still so the growth is of course not as dramatic as it was in the in the bull market in like 2021 beginning of 2022 the customer base is still there so we're not losing money we're not losing customers which is great news and

14:27 I think it's quite unique in this space because there are many businesses you know running out of money you know closing down so I think that our choice of you know business model where we basically service core needs and when we basically cover the you know super base you know necessary you know services for people who are building anything on the blockchain such as like RPC nodes you know indexers subgraphs this is this is kind of Baseline thing

14:54 that you would use when you build anything on a blockchain so I think this Choice was pretty good and it's pretty robust from from this perspective because we still have a lot of customers that survived the market our offering is very compelling to them because it's very fair and we actually see a lot of people switching to chain stack from competition because their pricing was was great for the bull market when people just you know spend cash on

15:19 whatever and they just use like you know five providers at the same time didn't really look into the bills and our offering now which will basically explain very clearly how we differentiate in terms of price that we are you know very liable and we provide extremely you know good performance it plays very well in the bar in the bar Market because people understand value prop now much more because they now you know take care about how much they cost which was not

15:42 really the case on on the bull market so which which plays in a very positive fashion for for us in terms of the you know what we will see in one year time I mean there are lot of perspective you know directions this space is exploring I would say I don't think there's a you know definite growth driver as at the moment we don't see it there are some signals you know a bit of social you know friend Tech farcaster

16:11 lens a bit of here and there not really mainstream there are a lot of interesting movement in the payment space I'm personally extremely passionate about boring use cases as you see chain is extremely boring company we don't do exciting you know defi you know new kind of you know strategies or like new kind of tokenomics you know Etc so we have very boring business which is also a plus for us because it's very stable from this perspective and

16:40 basically I love other boring use cases in crypto and like payment for me is the most boring but the most compelling use case because I deal with it every day we have a bit of payroll on crypto we are the first web3 infrastructure company that started accepting crypto for payments so I'm having you know fun of it with the team every week because people tend to pay with like Dodge Coin for web3 apis and like other interesting

17:06 currencies which I would never expect them to pay for but if you open this Avenue people are paying with whatever you know tokens they have so I'm very passionate about you know boring use cases and I've seen a lot of traction by talking to I went to Bay Area last week for the Stanford blockchain week and there was a lot of people you know building not very obvious use cases not just like okay let's build a random

17:31 you know app to you know send money from wallet to wallet but they say okay we see the necessity in like Philippines to offramp crypto to the local Payment Systems because it's a pain in the ass so we basically want to solve just this use case and we're very F like laser focused on this and or I saw like I I met with a person who is building you know very very simple smartphone app where you can basically also do local

18:01 onramp local offramp and do very very simple transfers in like usdt usdc that's pretty much it so it's very simple use case but I think it's very very compelling by traveling to other countries like such as you know Georgia turkey Serbia you can see that there are a lot of people who have crypto they like it or not and there are no you know good streamlined ways to let's say offramp from this crypto to you know local payment providers or

18:32 local banks so I think this amazing use case and I'm very happy to see more people building in this space I'm very fanatical about you know crypto cards so I try to or order any crypto cards that I see in the market and I try to test them how they work what are the fees because for me that's the probably most compelling mainstream this case for crypto and I really hope this will realize in the next year or so

18:56 because there are so many benefits for crossb payments badge payments basically you can send 100 payments in one transaction that's what blockchain enables you which is never possible with something like Swift or any other traditional payment methods but of course there's so many things to be built on top so that it's compelling for the mainstream such as on ramp of ramp which is convenient which doesn't take 10% of your you know transaction which is very inexpensive and all the all this you

19:27 know like Ing and tooling around just sending stuff on the blockchain is very important so I'm very excited about you know payments but of course yeah we have social we have a bit of gaming traction we have a lot of you know Trading still and I think realistically in the current market it's sort of number one use case you know what I'm you know what I'm saying like people still trade institutional institutions they enter the market as well so they're

19:55 very interested in like trading or providing trading you know facilities to their customers so I think that's still compelling use case and the more you know stuff we have on the blockchain the more things are happening the more we have trading volumes and so on and so forth so I think that's basically already you know popular use case even in these markets which are not very exciting and I'm I'm I'm interested to see more boring use cases pop up and

20:24 more people actually start using blockchain hopefully without even knowing they're using blockchain yeah yeah well exactly and interesting you say that you don't think chain stack is is a sexy company or this boring company because I guess as soon as you use the word infrastructure that's what people think right but actually I do think what you guys do is very is very sexy and very cool particularly in the space I I totally agree with your point

20:44 on payments you know it's it's almost the original use case right that everybody came to and it's still not been solved which is is kind of I think every time there is a cycle it gets set back and then we kind of reset a little bit right especially in the payment space and but interested to see that you know even companies like MasterCard and Visa committed pretty pretty seriously to to to the space right so I guess in terms

21:08 of your customers or Partners what what kind of like use cases are you working on who you working with that that you think is really interesting yeah I think largely we have three types of you know customers who we're working with first is other pieces of infrastructure on right so we have amazing customers such as like chain link layer zero and other you know protocol based infrastructure projects that help to

21:40 realize all these amazing use cases and Lego building blocks on the blockchains because you cannot just have you know just RPC for your Noe you need to have other pieces of infrastructure that is running all together and that enables you different things like the price feeds or bridging between different chains which are very very necessary for Di it's a must so we cannot really do anything without some of these components so first piece is basically other infrastructure projects

22:10 which are building together with us to make the developer experience much more seamless and so that there are more ready to use blocks in the space for people to build the second group is very very broad is all sorts of Builders and we have a lot of different verticals there we have a lot of interest from institutions as I mentioned because they are now exploring pretty seriously you know trading use cases for themselves or for the for the

22:39 customers all sorts of of course defi projects like you know 1 in you name it all the all the projects you can see on our website as well if if you can go we have a lot of customer Stories We like to you know showcase our customers and show what they're building so that other other people can also get inspiration for there you know development and their products like we have a bunch of Tri play games

23:03 building on you know Avalanche subnets and like on other chains like salana and polygon zkm so we have a lot of gaming which is using chain stack as well and really like it's very very horizontal product so you don't have one vertical that stands out because it's very very you know broad need for you know it's like okay who is the major you know AWS customer you know segment it's like everybody like literally

23:33 everybody who has a web app they're using either AWS or gcp or like aure or similar kind of platform so it's very very broad what's unique about our business I think and our platform in general is that we have third category which is Traders I'll explain why so basically we originally I mentioned that our strategy was to build a multi chain multic Cloud API service what it means is that basically we deployed our services everywhere so in all sorts of

24:01 different Cloud providers now we have very sophisticated network of cloud providers including what we call chain Cloud which is a bare metal based provider that we build ourselves from scratch and we have around I think 12 regions as of today where you can basically deploy your apis which is a no-brainer for Traders to choose because let's say we have a big trading firm in Singapore that is trading on like five Networks like of course they want to

24:29 have the least latency possible for their operations so why would they use something like you know INF fura which provides you know services in us for the for sending the transactions or getting you know transactions from mempool Etc so we kind of looked this use case organically we didn't really like try to build for Traders because for us it was always like the Builder Market is the primary one we wanted to car developers that's what we are

24:55 passionate about genuinely that's what we they have skin in the game as well so they really understand like all the considerations of building an API business so like talking to builders is our sweet spot for sure and like working with them together but Traders was a big use case early on because of this like geographical diversity and also the features that we provided for instance you can have a private network connection between your let's say AWS

25:20 account to your nose that running in chain stack and get basically local network latency which is the same thing as running the node yourself in your own like cloud and and it's amazing because people really enjoy this like you know througho that they get and like speed that they get for for reads and wres on the blockchain so it's been pretty you know interesting category for us of course all these guys are quite volatile so basically when you know

25:48 the markets go up we have big uptake of people who are like you know starting to trade immediately when the market is down is getting you know a bit lower for us it's of course hurting sometimes and especially in the early days we have amazing customer let's say it's like 10,000 Mr customer and they suddenly like like stop running everything and they say okay they like cancel the subscription and we come and say okay what's wrong I mean what can we

26:14 fix for you like let's work together we have like a telegram chat and I say guys the the platform is is mindblowing is amazing but we just decided you know to switch to some other strategies like outside of crypto because the markets are not so good so it's it's very interesting category I'd say it's there is a lot of you know funding there's a lot of money there there's a lot on stake there it's a very

26:36 volatile industry and we're trying to harness it because we really see the value for these people and like what kind of problem we solving for them so it's a big category for us on top of Builders and other infrastructure players yeah I can totally understand why and I mean you mentioned themes that like you know speed throughput up time and reliability I guess I would imagine that in the world of web 3 especially when we're talking about apis

27:02 there is there are so many additional complications what is it exactly that you guys kind of work on I guess in the API space that that is particularly of Interest yeah it's a great question because people they tend to think about certain you know business models as loow hanging fruits I was actually the same so when we started to build chain stack I was very naive because I was like okay so we running our nose ourselves currently it's bad but we can

27:30 probably you know if we build a service we can make it better because we will just focus on that and not do all other things when we're building a like a web threee app and then basically you start running it and then you have absolutely you know smooth operations when you have zero customers it's like very smooth nothing breaks you know it's like you have no issues nobody's calling you nobody's like writing to you at support

27:53 Etc but things starting to get interesting when I actually start to have customer customers and we were scaling together with like bull Mark like defi summer like polygon launch BC launch we were the first provider on both and like the the growth was just crazy and we were like 15 people at that point of time and we started suddenly to have like thousands of people willing to use our services and that's basically when you okay so that's how you build an

28:17 infrastructure you know product that's when you start to care and that's basically how and what kind of problems you need to solve so and still people are very naive as of today especially like new entrepreneurs oh you know like it's very easy to disrupt you know infrastructure space it's not complicated just run a note like expose it to the internet and just sell requests right like pretty straightforward but then there's like that's just tip of the iceberg because

28:43 the rest is like okay things break all the time like maybe ethereum and Bitcoin are relatively stable today they don't break like on a weekly basis but all the like newest protocols it's just is is just crazy unstable because they're all trying to capture the market I will not you know name things but like there is a big race now for all sorts of ZK evm and like people try to ship as fast as they can and try to go to market as

29:14 quickly as they can and basically they ship like very raw product that is very very complicated to operate which is in in a in a good sense you know positive for us because we basically abstract away our users from this complexity from this instability so we basic our promise is that you will not need to care about you know reliability performance of your core web3 infrastructure so you can just rely on us but of course it's very very complex

29:44 problem to solve internally because you don't just need to run stable software in a reliable fashion you basically need to run very very early stage software which is yeah people call it better I think us usually what they mean is Alpha but they cannot ship anything in Alpha so they say okay it's better so it's very very raar and very very complex to operate so there's so many you know things to care about and I'm not even

30:11 talking about you know typical infrastructure challenges because currently we are processing more than two billion requests per day it's quite a lot of requests across all the networks to support and basically you need to process you know there thousands of requests per second in a way that that doesn't break so basically people will enjoy it they will not have errors here and there they have no timeouts here and there and it's a problem per se with like high load

30:39 Services which is quite notorious problem even in web to space where you basically need to offer like very high load services with people of course expect like 100% reliability which is fair I as a consumer in this space I also expect 100% reliability from our partners and vendors that we use of course we understand the reality of it so let's say that's why we also started with a multic cloud approach because we say okay any given you know hosting

31:05 provider cannot give us har Cent so we will need to distribute this infrastructure across different providers different data centers different regions because that's basically the ultimate way to build it and that's basically what we are you know building on right now like the latest product that we shipped a few months ago is global elastic node which is basically geol balanced infrastructure very simple it's like one end point you use it for let's say ethereum and it routes you know

31:31 intelligently all your queries towards this node that node if this node breaks in this region it re to that node in that region so it's all automatic and it also gives you like the least latency for your locations let's say if I'm talking to this endpoint from Singapore it will always give me like Singapore node which will be a fast previously we had a product called Regional elastic node where you can actually choose the location explicitly which again is still

31:57 has has some Merit and a lot of value for certain customers like Traders but for majority like developers you know Builders infrastructure providers it's very important to have you know simple setup so that you don't need to like switch and points and all this kind of stuff and that's basically what we what we shipped recently which is getting a lot of popularity because people basically don't want to talk to you as an infrastructure provider ideally so

32:20 they don't want to write to your support they don't want to interact with you they just want things to work all the time and basically like with 100% you know success rate no timeouts no problems like no down times you you always get the latest block you always get the latest Block in time and so on and so forth so that's what people expect and it's very fair because we expect the same from our low level you

32:43 know vendors that we use just like hosting providers clouds bare metal other tools Etc yeah and I mean at the end of the day customer experience is in everybody's interests right so we have to get that right one one theme that we didn't touch upon which I know is very close to your heart is security maybe we can talk about that a little bit so what what are the specific challenges you see with when it comes to

33:07 Security in the web 3 and defi space of course so I I touched a bit upon on this when I said basically that the life cycle of an application in web 3 is radically different from web to so let's let's roll back to this idea right so what you have in web 3 let's say if you build a even simple you know def application you deploy it and then you want people to use it when you

33:35 deploy it the first you know second it's deployed it's already being scanned by like you know thousands of crawlers that are looking for new contracts that are trying to like decompile a contract try to find bugs immediately and try to hack you like 24/7 and I'm sure there's a whole scene for that and it's not even like there are like Elite hackers that just you know like manually try to hack all this like contracts of course there are

34:02 but I'm sure that there is like some gigantic infrastructure that is just basically scanning whatever is being deployed because money is on stake immediately of course you might not have traction or your project might die or maybe you will have zero tvl but if you don't have zero tvl then you are immediately you know at it's like even before you thought about this you're immedi immediately under attack so which a very big difference with like web two

34:28 projects where you can and where people postponed you know security at later stages you know yeah we build an MVP we're going to see if we have traction and then if it's popular we're going to hire a security person and they will take care about all this like security and also I guess where you know money is not at the heart of everything in web 2 quite often right there are different experiences deployed that can be anything whereas in web 3 more often

34:51 than not there is a a financial yeah because like defi has been you know the primary use case of blockchain as of today right so my sort of controversial statement is that basically you're building a new def app you should hire a security person before you hire your first developer and I mean that like your first hire in the engineering team should be a security engineer why because you have so much at stake and you cannot really risk it

35:21 because if you start building things you know worst case scenario you you hire some like freelance devel velers and like they build some contracts for you you don't even understand what's going in the smart contract you start deploying it it's like a it's clear path to disaster so my like controversial statement is that guys like before you of course it's compelling and like all the Lean Startup you know methodology tells us okay we should like ship as

35:43 fast as we can the C should be dirty like it should barely work you know and like then only if you have traction you should like ramp up and build it better and like stabilize it Etc and this approach doesn't work at all in three because then people tend to ship all sorts of things and of course I mean we don't need to provide examples right so we have examples on all this sort of you know score Boards of like people getting

36:07 hacks like every week or like companies getting hacked or smart getting hacked so so I think that's very important and we should basically change the mindset of people building apps because now they still approach it oh that's just another app it's just you know we don't you know deploy to AWS we deploy to ethereum so what's the difference and there's a big difference in this like approach the second thought is that people always talk about you know audits all right so the

36:35 audit is like a pinnacle of security in we space and say oh you have like this audit stamps the more audit stamps you have on the website the better and like if you have one you kind of so so trustworthy if you have three it's it's pretty good if you have five like it's is bulletproof right basically you have five stamps in the footer of your website your security is amazing the problem with audits is that they

36:59 point in time and that's kind of the biggest problem of audits not only in web 3 necessarily but also in web 2 when you have like pentests and all this kind of stuff they're always point in time so let's say you make a pentest and the report is ready by 1st September like on the second September you start shipping code you start shipping updates you change everything you change sit up here and there you hire new people you fire

37:22 people you forget to delete credentials you forget to create credentials you get to configure things and basically like it becomes outdated the next day so it's good reference for you to oh yeah I had this issues in the past but it's absolutely not a way you know for you know consistent security approach so unfortunately in web Tre space these audits are being taken as you know okay I I finally I have three audits so now basically I'm secure so my funds are

37:51 safe and unfortunately it's misleading for users too because they go on the websites they see oh oh it's like three Auditors stamp this website it's amazing I can use it without absolutely no you know risks so there is a big space I believe in like continuous security approach in web 3 we have a lot of tools like that in web two which basically are integrated in your you know cicd pipelines where you ship new version it's getting scanned when you make a

38:17 change it's getting scanned I think the quality of you know auditing or like rather scanning Tools in web 3 are pretty poor still so we still need like better tools that are more actionable and of course more people that know how to use these tools because it's again it's kind of un sexy thing if you think about it security was always un seexy thing let's say you have a security person in your company and aren't you pissed off when they come and

38:44 say oh you know you need to install this you know like antivir software on your PC you say oh why do I need it it will just bloat my PC it will make it run slower it's like so security is like nobody likes security in general right so that's why this field is like so unsexy here as well because like people yeah I would rather build a new you know like a new defi app rather than I

39:05 build a security tool or I make because it's also kind of boring thing on on one hand and there's still a lot of money that are being put in the ecosystem and say yeah I mean plus minus like 10 mil here and there yeah you know it's just it's just risks you know it's fine so basically there is this big space I think big design space for like consistent continuous Security in the web three space we are also looking into

39:31 it because again I have a lot of you know background in security we have a lot of people in the team who are you know very passionate about security and they are interested into solving this so we are also looking into this working with a lot of other folks in the space who are building amazing tools like one of our custom is for instance hyper native it's a startup from Israel and they're building proactive detection of

39:53 exploits on chain so they basically can tell you okay there are signs that this dap will be exploited in like two hours because there are some shady deployments happening here and there including this you know like contract addresses so basically like okay we know like two hours in advance that this might be exploited not necessarily going to be exploited but there are early signs so you guys might have a look at it because usually when security firms are talking

40:19 about this oh you know this funds have been drained already so you might have a look at it yeah it's cool thank you for noticing us it's very it's very interesting information but rather we should look at proactive stuff right like how do we prevent these hacks how do we prevent them as early as possible of course again the the complexity is very high so it's very hard to predict every kind of hack and attack and so on

40:41 and so forth but I'm sure we are not nearly as good as you know as 5% or 10% in potential for this space to be build and there are a lot of references in like Web Two security tools that we can take on like on like consistent continuous you know security scanning and like prevention of attacks because that's that's what's what's most important of course it's it's interesting you know to do a postmortem of an attack or maybe you know send

41:07 onchain messages to people to you know return funds for the white hack Bounty what not it's kind of interesting cool sexy but you know we need to work more on the proactiveness of this approach and so that basically you know people are hunting for bux all the time either internally or externally like one of the you know best security decisions we have taken for our product is is run back bouny because basically you organically create this interest for people to

41:36 you know to hack you for a bounty like what could be better because all of these people are like white hats and if the Bounty is reasonable for what you are building let's say you build a d app giving a bounty of like 500 bucks for critical vulnerability doesn't make any sense giving a bount of like 100k it's quite interesting because because people will actually start you know trying your dep and like trying to see whether you

42:01 have you know necessary protection Etc and basically yeah you pay 100K and you had maybe 100 Mil at risk so it's a reasonable payoff all right so this is another you know good and very well-known approach for you know continuous security which is like bu Bounty I'm sure like again whenever you go life on a main net you should have back Bounty launched the same second because then basically you not have only this like dark net you know North

42:29 China kind of you know infrastructures hunting for your money but also like good people hunting for for the bounties so it's it's very good approach so I believe tldr that the audits are important as you know like pentests are it's important to have a snapshot of your you know posture it's good we recently did a pent test it was useful for for us as a as a web tool you know infrastructure company because we are not touching smart contracts we're

43:00 just running you know like web to literally we're running web to infrastructure for the web3 folks who are building on web3 so it's very useful for us we found a couple of interesting you know problems in our systems we we fix them so it's very reasonable thing to do but you can never rely on that and you should definitely not mislead you know your users that this is like okay we have three audit is bulletproof and

43:24 that's unfortunately what we see you know many projects in the space are doing okay they put a stamp and and they think that okay they are they are bulletproof yeah so it's really interesting as as a as a non-technical end user of a decentralized application then audits are according to you kind of good they show some diligence from the company but if we want to reassure ourselves that an application is doing things the right way H what

43:51 can we do to look out for that kind of like continuous transaction monitoring continuous sec approach to security is it just looking out for communications from the company or is that stuff that we can look for on chain to kind of that's a great questiony right I thought about this recently when when the Viper compiler was was compromised because it's it's it's a it's a bit off track but like people basically said okay blockchain is a trust

44:17 machine in reality I think it's a wrong statement because in the end we have people who are building code on the blockchain so we have to trust them it's inevitable the only way not to trust them is to read line by line everything that's being deployed on chain which is not feasible so I think blockchain is not a trust machine is rather like transparency machine because you basically see visibility of all sorts of things happening on chain

44:45 mostly if you know you if people don't use you know mixers and all this kind of stuff you still can figure it out and companies like chalis and others are very very advanced in that but in general you you see most of the things happening on chain and sometimes it's it's very interesting to observe because let's say after you know curve was hacked you could see what Michael was doing like every second basically you could track his wallet easily they're

45:11 like amazing portfolio tracking tools now and you could see what he's doing like how he's you know selling his you know CRV to like Justin Tron ET so it's very fascinating because it's super open can you imagine like this hack happened in like some B bank and then basically you can observe everything that the board of the bank is doing like in real time it's impossible right it's impossible to track but in web3 in blockchains it's it's possible because

45:34 they're all transparency machines so I think we slightly need to change also the perception about blockchains that they are trust machines because in the end yeah you can trust Bitcoin highly likely because it's been like OG off the chain like more than 10 years in the making never been hacked okay we can assume that it's it's a trust machine but what can you do with Bitcoin not much right so you can transfer f it's good it's trustworthy

45:58 it's ble tested but when we talk about the code it's still written by people so you have to trust these people so this is this is an idea that that came to my my mind recently that we should you know switch the perceptions of how we you know approach blockchains as systems and then again like in terms of what we should do for continuous security ideally we should read every contract we interact with every person that interacts with a contract on chain

46:25 should read and comprehend it and basically at least try to understand what's going on there which of course doesn't anyhow prevent you know hacks of this because most of the hacks nowadays are pretty sophisticated already so you know you cannot really understand you know whether this code is vulnerable or Not by reading the code but at least you can see some obvious patterns like I know fishing and stuff when you have some arbitrary controls over the smart

46:52 contracts all this kind of stuff right and there are amazing tools now for this you have you know Char GPT you can go to char GPT and say oh Char GPT please explain me this contract so it's kind of funny Edge case but in reality it's not so funny because if let's say you want to ape with like you know 100K to some contract it makes sense to spend an hour to kind of try to understand what the

47:12 smart contract is doing right not relying on you know some Twitter post from the founder of this company say yeah yeah you know we did like three audits because how trust for that is just a tweet right so ultimate solution is yeah everybody should read the smart contract right if it's not it's not possible hence there are a lot of tools that help people to to understand like this the security posture there are amazing tools that help you you know

47:35 show what this transaction will do which is notorious not being transparent because wallets like metamask in the early days they also focused on like you know just core use case and this is more of a like auxiliary feature but now it's getting more and more you know all these interactions are getting more and more sophisticated so we need more tools that will actually help user to understand okay I click this button now like what actually will happen am I giving like

48:00 approval for all my e or actually am I just you know getting minted in nft or like what exactly I'm doing right because people are seeing this like hex code and they see oh you know it's everywhere it's like it's like lightning it's oh mint now you know expiring in one hour so people oh you're like formal we need to me and nobody really think so we need to have better tools all right and and we see a lot of you know tools

48:23 being in the making for consumers as well which is very important but we are still you know way to go until we have something that you know we can rely on and say okay this is good enough you know even if these contracts are buggy and they are trying to compromise people we have you know reliable ways to you know protect the end user because the end user is the ultimate you know risk taker right so we need to help end users

48:48 right so Builders need to help and users from securing their own code as much as they can in a continuous fashion and also like building tools that will help and user to understand what they're doing when they're interacting with the blockchains yeah yeah couldn't agree M for me it's the ultimate conundrum right that we we it always comes back to do your own research but then for most people doing a a carrying out a level of research that is actually

49:13 valuable is more or less impossible right yes it it that's kind of where we are right now so like we say like you know verified don't trust but often it's quite difficult of course you can look at things like Merle trees right but I mean you know what I mean it's kind of yeah yeah unless you're a highly experienced person or quite technical it's you're always going to be putting your trust in somebody else at some point for most of so that's that's

49:38 what confuses me about blockchains yeah that we were like okay this this thing is like robust Financial system and it's kind of worse now because you don't have anywhere to go if you're yeah like you cannot call vitalic really I mean you can you kind of can if you you can find his number and such but yeah he will not roll back the chain now likely no like he did like with a DA right so so you have nobody to call I

50:07 mean at least if we're in the real world you can call somebody yeah you mean like police like try calling police say oh I've been scammed for this nft drop on this website and like somebody stole 0.3 E from me yeah it's like good luck yeah well even even for even for Builders right I mean I think the the PA of the course is if if you're hacked you have to file a police report and I mean most police forces

50:32 probably aren't equipped to handle something this yet right it's people need to catch up yeah and even in web two we see that this pops up all the time it's like I mean the most notorious one would be probably like last pass compromise so so basically people like you have a password manager and the whole promise of the password manager is to secure your passwords and that's pretty much the only thing it should do right and then it doesn't deliver on

50:59 this promise and like you know okay all my passwords are gone it's like okay it's like it's not unique it's not very unique to web3 it's just web3 is so complicated now for user that it's even harder to get to any level of you know Security in in the reasonable time but also we can observe everything that's happening on the Chain we have a chance to see like what is actually going on by reading a code by looking at

51:30 the you know at the previous transactions and so on but the attackers are so sophisticated that basically even for advanced users I think it's it's pretty hard and you have to be literally paranoid to to have zero exposure I think you have to be paranoid today it's impossible to have zero exposure if you're not paranoid bottom line so I think that what is important is to have this like levels of

52:02 abstractions eventually on top of chains that will give people you know the necessary Assurance what could it be for instance I think that it's quite smart to provide users insurance or options to buy insurance right because basically if they use Bank their money are insured by default correct like by some governmental you know organizations Etc so when they are on chain the funds are not insured by

52:32 default because again you cannot call vitalic and claim your policy so you have to do it yourself or you have to basically use something that gives you this out of the box which brings us back to this idea that you know blockchain is just a a machine to basically record transactions and it's not necessarily trustworthy but it's very good way to record

53:02 transactions it's very liable it's very secure way of recording transactions because they immutable Etc but all the auxiliary tools that will bring you know crypto rails to mass adoption are yet to be built and they are again pretty boring like you have to package Insurance in your product and maybe don't even you know sell it to the user separately because that's now what def5 products are doing they say oh so we are audited by this five firms but

53:34 also if you're not sure you can buy like I know insure A's plan for this you know particular ad or any other like insurance provider and this is good start but then as a user you have to figure out okay which plan do I need for this dab which plan do I need for that dab and like can I have coverage for all dabs for unlimited you know cas app Etc you need to you know di on insurance

53:59 like do you really di on insurance when you're banking now not really right you're just like yeah I mean I'm going to DBS office and I'm just you know putting funds and I'm withdrawing funds and it all works I I do like you know paying out transfers yeah somebody stole you know my credit card I can go and like roll back the transaction so I think that we are still yet to build this you know this auxiliary tools which

54:25 are again very boring for people in this space to build which is a bit unfortunate because I've been on a few events over the last three months and people hate building boring things here because there's so many you know exciting stuff to build you can build a new Oracle you can launch a new chain it will be like parallelized evm so amazing so cool and I as a technologist I really understand that but then okay guys like

54:51 yeah we we build all this pieces of infrastructure and who's going to be using it currently we are the only users again so like yeah I mean all this boring stuff all this like wiring how do we basically make sure the users are safe and they actually trust this you know things that are build on top of blockchain crypto Etc that's a big question still and again there are some movements into this direction like you know selling Insurance on your da

55:16 interface it's good but I think it's still far from whatever people expect yeah you want everything in one package you want some service and that's why I think it's kind of you know ridiculous to say oh you know banks are dead banks are not providing the payment Trails payment trails are provided by you know Swift or other you know rail rail providers banks are providing you the service so that you can sleep at night and don't worry that in the

55:46 morning you will wake up and all your funds are gone that's basically what they do they don't offer you the you know some sophistic you know payment system that will be robust and fast Etc they provide you the service so can Banks work on crypto they can definitely do that would it be good probably yes because you know these rails are arguably more efficient than Swift for instance should they do that depends on whether they can benefit from doing that

56:14 right because whether they because again for users the value proposition is usually so simple because we tend to as a technologist we tend to think about value proposition in a very nuanced format it's like oh you know we need decentralized games or one of my favorite examples from recent weeks is that basically all this narrative about gaming is that yeah you know you are like in Steam universe and you have a helmet in some steam game but you

56:46 cannot sell it outside of steam right so if this helmet is on the blockchain you can just go and trade it anywhere so cool you can move it from Steam to some other universe or you can sell it on open C and then the interesting point is that you talk to Gamers and say we don't we don't give a damn about this do we don't care it's like we love steam steam is the best platform you know it's so

57:10 cool we have so many games It's So interoperable within the ecosystem so they don't care about this like oh we can take this helmet from Steam elsewhere right so like users are very straightforward people they see they need Simplicity they need ease of use they need low cost they need like high speed they don't think about this and oh is this game decentralized enough or is this like you know or is this app providing me you know self-

57:39 custodial options for my funds you know it's like a dream that everybody will be you know taking care of their custody I we have an we have a team internally which is doing finance and yeah we have some operations on the blockchain and they couldn't care less about like you know installing a new wallet to sign transactions or something like that they're very happy with banks and the interfaces they provide today as users and they don't really want to mess up

58:10 with all this like you know scary you know unclear area where you go and you can mess up immediately and because you don't understand it and like they need to reconcile transactions using either scan it took us like I don't know six months to get to the level where I can basically like explain okay here's what's on the transaction page of either scan like here's what's what's happening because people don't want to care about this right so I think

58:39 that we need to build this like ultimately if we want mainstream ad because maybe we don't it's another question right so if we do want mainstream adoption we need to start building these boring middle Wares and like layers of abstraction and like packaging of all amazing stuff that is happening on a core layer and present it to the end user without mentioning blockchain unfortunately for us because we we like mentioning blockchain so much yeah oh so it's a new type of app it's

59:08 now not not just game it's a crypto game so cool sounds so cool it's like it's not just a you know website it's it's website built on tcpip Amazing so cool sounds amazing right yeah it makes total sense that I mean I think you said it right at the beginning of the conversation that we need to that for mainstream option to happen people almost don't need to real need to not make the realization that they're interacting with the blockchain right

59:36 they just needs to feel like any other website or application without that that yeah the blockchain complication Eugene I really enjoyed today's episode thank you so much for coming on the show I think before you bid goodbye to everybody it would be great if you could share a little bit more about where people can learn about you and maybe connect with you online and also learn a little bit more about chain stack of course thanks again for amazing

59:58 conversation in Sun Singapore I can be found anywhere in Singapore honestly on hooker centers in the office on the events so please reach out to me in Twitter in telegram I'm very very responsive so I will be happy to talk to fellow Builders chain stack is happy to host you for any needs that you have for your projects we have tools from you know RPC nodes up to subgraphs up to

60:30 facets and anything that you really need to build an amazing user experience an amazing application in in web3 across all the protocols that you can think about currently we support more than 25 and adding more so you have absolute flexibility in what you want to use and how you want to build it and very complete Suite of services and tools to build your web Tree application today amazing thanks so

61:02 much if like me you learned a whole lot today then please do subscribe to our show and don't forget to like and share it with your friends the more likes the more shares the better guests will be able to get on to the show thank you