Blockchain Security @ Empire Hacking

Trail of Bits

On December 12, please join us at Buzzfeed’s NYC offices to hear 10 excellent speakers share their knowledge of blockchain security in an event that will assuredly expand your abilities.
Talks will include:
<H2>Anatomy of an Unsafe Smart Contract Programming Language</H2>
This talk dissects Solidity: the most popular smart contract programming language. Various examples of its unsafe behavior are discussed, demonstrating that even an experienced, competent programmer can easily shoot themselves in the foot. These serve as a cautionary tale of how not to create a programming language and toolchain, particularly one that shall be trusted with hundreds of millions of dollars in cryptocurrency. The talk is concluded with a retrospective of how some of these issues could have been avoided, and what we can do to make smart contract development more secure moving forward.
Evan Sultanik is a security engineer from Trail of Bits.
<H2>Asset Insecurities: Evaluating Digital Asset Security Fundamentals</H2>
Spend a couple minutes learning about digital asset security ecosystem problems as faced at Coinbase scale. This will be a jaunt through insecure supply chain, the difference between a protocol white paper and the actual implementation, and a couple other things that’ll bite you if you’re not paying attention. 
Shamiq herds cryptokitties, security engineers and developers at Coinbase as Head of Application Security. In his spare time, he loves to eat cheese and chocolate.
<H2>Designing the Gemini dollar: a regulated, upgradeable, transparent stablecoin</H2>
A regulated stablecoin requires important design decisions. How can you make your contracts upgradeable when many rely on them? How can you manage keys that protect the underlying assets? And how can you do this all completely transparently? In this talk, we explain the design decisions that went into the Gemini dollar, and compare and contrast with other possible implementations.
Brandon Arvanaghi is a security engineer at Gemini Trust.
<H2>Property testing with Echidna and Manticore for secure smart contracts</H2>
Property-based testing is an incredibly simple and powerful tool for bug discovery, but despite its efficacy, it's almost unheard of in the smart contract development community. This talk will introduce the concept of property-based testing, discuss strategies for picking good properties and testing them thoroughly, then go into how to apply these ideas to smart contracts specifically. We'll discuss the use of both Manticore and Echidna for testing, and look at real bugs these tools can find  in production code.
JP Smith is a security engineer from Trail of Bits.
<H2>Contract upgrade risks and remediations</H2>
A popular trend in smart contract design is to promote the development of upgradable contracts. Existing techniques to upgrade contracts have flaws, increase the complexity of the contract significantly, and ultimately introduce bugs. We will detail our analysis of existing smart contract upgrade strategies, describe the weaknesses we have observed in practice, and provide recommendations for contracts that require upgrades.
Josselin Feist is a security engineer at Trail of Bits.
<H2>Failures in On-Chain Privacy</H2>
Many, including Satoshi, believed cryptocurrencies provided privacy for payments. In reality, cryptocurrency is Twitter for your bank account. Worse, the current set of decoy transaction–based approaches commonly believed to provide privacy—including coinjoin and cryptonote/Monero—provide fundamentally flawed privacy protections. Where did we go wrong? This talk covers how to critically evaluate the privacy provided by any proposed protocol for payment privacy. Through a series of thought experiments, it outlines three plausible attacks on existing decoy-based schemes. These issues show the unintuitive nature of privacy protections, as well as the need to both evaluate protocols in the context of real world threats, and use approaches with formal and peer reviewed privacy guarantees such as Zcash.
Ian Miers is a post-doctoral associate at Cornell Tech.
<H2>Secure Micropayment Protocols</H2>
Sending cryptocurrency micropayment transactions that must be confirmed on a blockchain is impractical today due to transaction fees that can exceed the value being sent. Instead, we can use micropayment protocols that only rely on the blockchain for settlement and disputes to minimize on-chain fees. In this talk, we will describe and compare different approaches to constructing secure micropayment protocols on top of Ethereum including probabilistic micropayments and payment channels. Furthermore, we will highlight the difficulties and considerations in implementing these types of protocols given the increased reliance on correct and timely client behavior to prevent the loss of funds.
Yondon Fu is a software engineer and researcher at Livepeer.
<H2>How To Build an Enterprise-Grade Mainnet Ethereum Client</H2>
The byzantine environment of the Ethereum mainnet is fraught with challenges for aspiring hackers seeking to publish a compatible client. This talk highlights the trials and tribulations of implementing a client capable of handily dispatching the adversarial events and actors of the sprawling P2P ecosystem that comprises the Ethereum blockchain’s world-wide compute network. The uniquely modular nature of the Pantheon codebase and it’s suitability for enterprise application will be treated in detail. The session will conclude with a brief sketch of the road ahead for Pantheon with an eye towards the Ethereum Enterprise Alliance and the forthcoming updates that comprise the broad strokes of the Ethereum 2.0 specification.
S. Matthew English is a PegaSys protocol engineer and Pantheon core dev.
<H2>Simple is hard: Making your awesome security thing usable</H2>
If the security assumptions of blockchain systems fail even a little, they provide very little value. They also have a high barrier to entry and are hard to use. But wait, people already don’t use security tools — how isn’t this the worst of all possible worlds? We’ll talk about some precedents from infosec history and how we might be able to avoid “Your elections are fine as long as you use The New PGP on The Blockchain” in favor of helping people build cool things that really do solve longstanding problems in novel ways.
Patrick Nielsen and Amber Baldet are founders of Clovyr.
<H2>Like it or not, blockchain voting is here to stay</H2>
I’m going to talk about how blockchain voting apps received serious pushback from academics who study voting security, but that West Virginia used the Voatz app for some counties during primaries, used it in almost half the state in the midterm election, and is pleased with how it went. Voatz is already in talks with other states and is hoping for up to 20 states to use it by 2020. And several other countries are testing different blockchain voting apps.
Kevin Collier is the cybersecurity correspondent at BuzzFeed News, where he covers cyberwar, hackers, election security, disinformation efforts, tech companies, and hacking laws. Prior to BuzzFeed, Kevin covered cybersecurity at Vocativ and the Daily Dot, and has written for Politico, Gizmodo, The Daily Beast, and NY Mag. A native of West Virginia, he lives in Brooklyn.
-----
Dinner will be served. We will congregate at The Mercy Bar afterwards to continue the conversation and for some holiday cheer. 
Due the the nature of this event, there will be a $2.00 prepaid charge via PayPal. Only registered guests will be permitted to attend.
Look forward to seeing you there! 
-- Dan Guido CEO, Trail of Bits
 
<H2>Workshop: Smart-Contract Security Analysis</H2>
On December 11th, the day prior to Empire Hacking, Trail of Bits will host a security training for Ethereum smart contract developers. You must register separately if you want to attend this workshop.
In this day-long training, JP Smith will share how we conduct our security reviews; not just our tools or tricks, but the whole approach. In addition to that knowledge, we’ll share our school of thought regarding assessments. Far too often, we encounter the belief that audits deliver a list of bugs and, consequently, the ability to say “Our code has been audited!” (and therefore “Our code is safe!”). That’s just part of the picture. Audits should also deliver an assessment of total project risk, guidance on architectural and development lifecycle, and someone to talk to. That’s the framework attendees will come away with.

Blockchain Security @ Empire Hacking

More events from Trail of Bits

Follow organizers to get events picked for you

Still looking for the right event?

Explore all events in New York and filter by date, category, and more to find the perfect fit.

Blockchain Security @ Empire Hacking

More events from Trail of Bits

Follow organizers to get events picked for you

You might also like...

Browse more events with different dates, prices, and formats to find your next great experience.

Still looking for the right event?

Explore all events in New York and filter by date, category, and more to find the perfect fit.