Aaron Leibowitz on CertiK’s smart contract auditing services

0:01i'm ashton addison from event chain for investmentpitch media in the crypto coin show and today on blockchain interviews we have aaron leibowitz the product manager of certik erin welcome to the show and thanks for taking the time to be here hey ashton great to be here thank you for having me you're very welcome i'm excited to dive into sertic there's been

0:18a lot of uh things going on in the cryptocurrency industry that zurich is deeply involved in and i think that it's great to have you on the show at this time so if we could just kick it off by understanding more of an overview of what is certic and what are the solutions that you're providing that would be great absolutely so sordik we are best known as a blockchain

0:40security firm known for audits we've audited a bunch of top projects recently been pretty deep in d5 and especially the bsc ecosystem beyond just auditing and you know manual code reviews and penetration testing we do have a few other products we have an insurance alternative called certix shield that is a reimbursement protection for digital assets

1:05we open those up with the projects themselves and offer them to their communities we also have our skynet tool chain which is a on-chain uh smart contract security monitor it monitors after a code has been deployed which is a big point of pain for audits themselves you know audits are a snapshot in time they are not constant ongoing after code has been

1:30deployed so this tool chain monitors actually when it is uh in the wild interacting with other smart contracts and known vulnerabilities that's great and yeah it's great to see that you have a variety of products um and i have seen a lot of these defy startups you know being audited by sirtic so maybe you could just give me a walkthrough of let's just say

1:52i'm a company that is i have a d5 project and i'm just starting i've reached out to certic to get assistance you know how exactly are you there to help my d5 startup absolutely so auditing has become pretty much an industry standard over the last few years that's a big shift that we pride ourselves on being a part of at zurdik having really changed the

2:15landscape from you know audits used to be above and beyond now they're the standard for being listed on exchanges of course verdict is here to provide auditing penetration testing manual code review for those blockchain startups uh one big tip i would like to give to blockchain companies is if you're working on a project reach out ahead of time not day or two before uh you're going live

2:36asking for an audit it's a really big help definitely definitely and i know that uh in the deep fight space ave which is one of the largest uh d5 platforms i think the largest and also kava who we've had on the show a few times are secured by surtik and i'm guessing that you've done the audits for those contracts but maybe you're also working with them on a

2:56continuous basis and maybe could touch on that um yeah absolutely so as you mentioned those are two awesome projects huge teams uh committed to security for sure from our point of view uh cava they have an active certificate with us which is that reimbursement protection i was mentioning before i mean if you do hold kava tokens you can come to certik

3:19you can purchase protection uh in the event of a hack or theft um some on-chain activity that's covered you can submit a claim and potentially get reimbursed for your loss oh that's really interesting so just as a you know as just an investor in the project not necessarily being a part of the project you can come to certic as well is that right exactly that uh retail investors

3:41institutional investors alike uh project owners can all come and use the certix shield ecosystem that's really interesting and uh because i don't think a lot of investors are aware of that you know they they by the they think that oh uh you know kava is protected by certix so that's good enough for me and uh so for sure um definitely something that we've been

4:04trying to get more investors to understand is that they do have options to protect themselves beyond trusting just the project itself um that is a relatively newer product from us so people that know us from years past we wouldn't have offered that solution at the time and then you also mentioned ave uh another great product project product2 actually so those guys

4:28as well have been audited by us and they actually use that skynet tool chain to monitor their smart contracts as they're uh in use that's great and yeah they have like billions of dollars uh you know in involved with ave so obviously you're going to need that high level of protection and and speaking of billions of dollars do you have the same amount of security for a

4:50project that has you know billions of dollars being protected to whereas there's you know a d5 startup might have a few hundred thousand or a million in liquidity uh you know if uh any project comes and gets audited by us uses our tool chain or uh sort of shield it's going to be the same process regardless of who you are we are committed to security with all of the

5:10projects we work with there's no um differentiated treatment that's great and you know even with audits um there are still you know potentially flaws in in smart contracts uh that some sometimes things happen right and there have been hacks in some of these d5 projects you know wifey had some vulnerabilities alpha and most recently paid network uh had a vulnerability in

5:35their smart contract or at least you know somehow the private keys or access was was given to a party that shouldn't have had it um and maybe you can talk about those situations and what happens when a project does get hacked or or penetrated somehow and and how certic is there to help for sure um you know those are three really good examples of different types of exploits um you

6:02mentioned sort of smart contract failure in the paid network instance that's actually not the case uh you started talking to private key mismanagement it's unclear exactly um how that happened at this time but the private keys to the minting contract seem to have been handed over to a third party or accessed by a third party um i think they're still doing some

6:24internal investigations trying to figure out what exactly happened there lies are known as a pretty reputable team so definitely um something that we're keeping an eye on we've actually put out a little uh post-mortem on the incident uh however not all of the information is available at this time so hard to say uh but as for how sortic helps how we can step in

6:46where we can be useful um i think that you've got you know you mentioned this auditing is obviously an important first step it's by no means a perfect solution i think you talk to any of the top auditors they'll be the first to tell you hey like we did a really strong audit we pen tested this it everything looks good from our side that doesn't mean we're going to guarantee

7:11that it's perfect this is um you know code can be changed before deployment which actually seems to be the case when we looked at the code and paid network versus what we had audited there was something injected after the audit before deployment um that was not there during the audit you know as i said it's a snapshot a point in time it's pretty impossible for an auditor to deal

7:33with that or to mitigate that the potential for that solution um you know going back to that guy net tool chain i was talking about that is one of the reasons that we have these on-chain monitoring and even after attack reimbursement protection uh options because we realize that it's not a perfect solution so we're trying to get to this point of having end-to-end security for

7:55everyone in d5 definitely and d5 has been growing so quickly and you know the nft space as well but specifically in d5 there's a lot of retail investors that you know they see the hype surrounding projects and you know it looks to be a really strong project and the in their minds they don't really have you know that auditing process as uh you know one of the things that

8:15they find necessary you know they they still invest in projects that aren't audited and sometimes they fall into scams or rug pulls and you know exit scams things like that and it seems like it's pretty common you know i find these retail investors in groups that i'm in they they just go in anyway right um so do you have any advice for retail investors and people that are

8:39just everyday investors looking at projects um and to to avoid you know getting scammed or getting rug pulled yeah i mean absolutely there are some great tips that at the end of the day it does come down to a do your own research um everyone has heard that phrase before from you know anyone in defile tell you dyor is the key to the space however what that entails can be

9:03different for a lot of people so when doing your research looking for things like has the project been audited has it been audited by a reputable firm there are some uh you know companies out there that will they print audit certificates more than they actually audit the code maybe they use some automated chain to review the code um it's it's not the same as getting

9:27audited by a reputable firm and there are many great auditors out there uh we are in a space where you know you really have some great security options so looking at that looking at um you know in key storage and token management uh hardware wallets are the sort of standard recommended security protocol for holding your tokens um avoiding rug pulls though it's

9:52it can be difficult um it's no small thing there's a reason they've been a successful type of scam uh projects can take all the right steps do a you know a fair launch have gotten audited and at the end of the day if they hold the keys to some of these contracts they can choose to do whatever they'd like uh if they're gonna exit scam rug poll it's it's a difficult one to avoid it

10:19really does come down to looking at reputation of founders and with and on dev teams even behind some great projects it makes it only more difficult so definitely a tough question yeah yeah and especially because it's at early you know an early stage project usually uh the exit scams aren't happening you know for well-established companies years in it's something that

10:40you know has only had weeks or months of of history and there's only so much you can base your decision off of when you're investing in those projects so i understand what you're saying there aaron now i know that zurtic is partnered with you know a lot of different companies in the space maybe you can mention some of the partnerships that you're working with

10:59and if there's any partnerships ideally that you're looking to work with in the future as the d5 space grows so uh we've had some great partnerships over the last few months uh you know duck dao kaila network bsc and that last one is really where we're focused recently we've been uh diving into the bsc community really trying to secure all of these projects that we can

11:24uh there are tons of new ones popping up there every day so it's been very busy for us in that space um that was a nice partnership for us to make with the binance smart chain team in order to you know really get behind and secure as many of these projects that are working with them as possible that are building on there definitely it seems like there's been a huge

11:47uptick with binance smart chain projects and in part because you know the ethereum transaction fees and the clogged network is just not doing very well especially when there is a popular you know initial uh launch of a coin and then the network gets clogged and people are paying you know the same if they're putting in 200 into an investment and the transaction fees 200

12:11that's obviously not feasible for uh retail investors you know paying double um and do you foresee this trend to continue where you're going to be working with even more projects um on finance smart chain just d5 projects throughout the rest of the year yeah i believe so i think that we're you know it feels like we've been in this bull run for a while now it's

12:33been a pretty short couple months so far uh i personally foresee the bull market continuing and if it's any indication history is any indication that means we're going to see tons of new projects cropping up lots and lots of innovation investment in space so assuming that's the case absolutely we will be uh looking to work with as many of these new projects as we can

12:56yeah great and do you and your team have any uh road map milestones in terms of potentially new products or new pathways as you continue to grow insertic you know that's a it's a good question what are our milestones for 2021 i think that we are we've experienced some very big growth so far this year and we're hoping to continue that um you know some internal targets for

13:25a number of projects audited things like that as far as new products on the horizon i think that we're really trying to fine-tune our product suite in order to sort of create this end-to-end protection that i was talking about and as you mentioned let retail investors know about the ability for them to protect themselves in that way totally a lot of the audits that we

13:47actually have seen recently are community driven we go into these telegram channels and we see the communities are really getting strong on their research asking hey have you guys been audited who audited you uh when's the audit going to be finished all these types of questions that make me personally happy to see that's great to hear and and on the flip side you know there

14:06are other challenges or obstacles that you anticipate overcoming uh as you work towards you know mainstream adoption of these auditing processes absolutely um you know we mentioned before retail investors taking the certic or other top uh firm even just that we're onboarding a new project haven't even gotten to review the code yet they take that as a uh

14:32you know a blue check mark to go ahead and invest in the project and we've seen and we're wary of the possibility of seeing other projects or potential scams use that as a way to make investors more comfortable these people who are starting to do their own research so we're being more we're doing more internal research on the teams before we're starting these audits and are making

14:59sure that we're comfortable um putting our seal of approval not just on the code but trying to look into the people behind it definitely and i could see how you know a d5 start might reach out to you and all of a sudden you're like this is not you know a good project you know you're the ones auditing it and all of a sudden there's a hundred red flags

15:17uh you know that would be interesting to see okay certic puts out the audit and the audit is horrible right um so yeah so you know there are a lot of d5 projects that are coming out that will need your services and also just with the certix shield um for retail investors to get involved with certic as well what's the best way for all these parties to learn more

15:41and to get involved with the certa community it's a good question i think that the number one thing that retail investors should do is go and visit zertik.org it's our security leaderboard you'll see all the projects we've audited the ones that have shield the ones that have skynet our full auditing reports are all listed on there you can uh you know click through and

16:04get to the shield and start protecting your own tokens but just as much use that as a resource for your own research great well thank you so much for your time erin uh all the best with zertik moving forward in this space at this time and let's follow up in the near future great thank you so much ashton