Your content goes here. Edit or remove this text inline or in the module Content settings. You can also style every aspect of this content in the module Design settings and even apply custom CSS to this text in the module Advanced settings.

Speaker:

Phillip Kemper

Abstract:

Sequencer-Level Security” is a concept that can prevent hacks on L2s. A sequencer enabled with this architecture analyzes transactions before their inclusion in blocks, and actively blocks those that are malicious. In this talk, we share learnings and experiences with building and operating such a sequencer from the Zircuit network. We will discuss challenges, design choices, successes, as well as failures, and focus on the practical impact on the L2 equipped with such a sequencer.

View presentation

Speaker:

Jota Carpanelli

Abstract:

In this session, we’ll dive into Uniswap v4 hooks, focusing on the key security considerations developers need to keep in mind. We’ll discuss common mistakes, explore potential attack vectors, and share tips on how to avoid scams and vulnerabilities. Whether you’re building or auditing, this talk will give developers with practical knowledge to enhance the security of their projects using that integrate with Uniswap v4.

Speaker:

Arbaz Hussain

Abstract:

The agenda of the talk is to guide whitehats in submitting better bug reports by enhancing the quality and impact of bug submissions in bug bounty programs. We’ll draw on real-life examples from our Immunefi platform to learn how to create detailed reports that facilitate faster triage and higher rewards.

Speaker:

samczsun

View presentation

Speaker:

Kelsie Nabben & Isaac Patka

Abstract:

Hear from SEAL’s Wargame team with a year’s worth of hands-on experience and ethnographic observation wargaming cyber attacks on cryptocurrency and blockchain projects. Our incident response experts will share critical insights into the vulnerabilities and defensive strategies that have emerged through rigorous simulated attacks. We’ll combine a technical perspective with a unique lens on the human and organizational dynamics observed during these exercises, highlighting the interplay between technology and culture in crypto. You’ll get a comprehensive analysis of the lessons learned and actionable recommendations to enhance resilience for crypto and blockchain security.

Speakers:

 Yannis, Josselin & Mehdi Zerouali.

Moderator:

Michael Lewellen.

Abstract:

This panel brings together seasoned smart contract auditors for an unvarnished look at the realities of blockchain security reviews. Moving beyond polite audit reports, our speakers will address persistent issues they encounter: from developers pushing unrealistic timelines that compromise security, to projects treating audits as marketing checkboxes rather than crucial security processes. The discussion will explore how incomplete specifications and documentation create hidden vulnerabilities, why some common architectural patterns are fundamentally risky despite their popularity, and what actually keeps auditors up at night about the projects they review. Through specific examples, panelists will illustrate how communication gaps and misaligned incentives contribute to security failures, and propose practical ways to improve the audit process. Join us for an honest (and maybe spicy!) conversation about strengthening the relationship between development teams and their auditors.

Speakers:

Taylor Monahan, Robert, Alice Charm.

Moderator:

Hudson Jameson

Abstract:

Among the many initiatives spearheaded by the cross-ecosystem Security Alliance (SEAL), one of the most ambitious has been the White Hat Safe Harbor. SEAL worked for over 24 months with dozens of lawyers and security experts from across the ecosystem to create a legal document that aims to protect white hat hackers from legal repercussions from white hat rescues and allows for projects to quickly and verifiably recover rescued funds. This panel consists of those who were deeply involved in the legal, technical, and implementation work of the White Hat Safe Harbor.

 

Speaker:

Dmitry Zakharov

View presentation

Speaker:

0xmonsoon

Abstract:

Defi has slowly been moving towards pull oracles like Pyth, RedStone and more innovative solutions like Oval. These oracles provide more recent price for a whole lot more pairs. But is it all roses and butterflies?What additional risks do these oracles bring for the integrating protocols, from integration errors, price manipulation or bad data altogether. This talk will dive deep into it. And can push oracles be simply replaced by pull oracles in old protocols like Compound without code change?

View presentation

Speaker:

Victor Petrenko, Eugene Kolpakov

 

Abstract:

Off-chain oracles pose risks due to permissions, trust and security. ZK-based oracles provide a solution, but they are complex and costly.

Solving this problem required efforts from Lido contributors, ZK Oracle providers and independent developers. Finally, the mainnet launch of the first ZK Oracle for the Lido protocol is scheduled for November 2024.

This talk explores the potential of ZK Oracles to be trustless, permissionless, robust, and cost-effective — the hiking challenges in the search for improving protocol security and the road ahead (using Lido’s oracle as an example).

View presentation

Speaker:

Peter Kacherginsky

Abstract:

Despite the wider adoption of code audits, 2024 saw a staggering increase in security breaches, with four times as many compromises and twice as many losses compared to the previous year. To address this alarming trend, we will explore how the DeFi threat landscape evolved in 2024, focusing on the most dangerous threat actors and their successful exploitation techniques. Next, we will adopt an intelligence-driven approach to build a resilient DeFi security program that extends beyond traditional code security measures. DeFi developers and security practitioners will gain not only practical advice they can implement immediately but also insights into the future of DeFi security over the next 5-10 years.

Speaker:

Pablo Sabbatella

Abstract:

80% of the funds lost during the last twelve months was not due to hacking smart contracts. It was about hacking people. A wave of web2 criminals are coming to Web3 and we are not prepared to deal with it. I will show how Web3 projects are being hacked using web2 hacking techniques and how this attacks can be avoided. I will talk about attack surface, social engineering, 0-day exploits, dns hijacking, simswaps, malware, private keys leakage and much more. I will show real cases and stats.

View presentation

Speakers:

Sara Reynolds, Ernesto Boado, Erik Arfvidson, Merlin Egalite

Moderator:

Hari Mulackal

Abstract:

Building and maintaining a successful DeFi protocol is incredibly challenging. Billions of dollars are on the line with absolutely zero tolerance for mistakes. The panel will bring 4 security-minded engineers from top DeFi protocols to share their thoughts on building and securing a successful crypto protocol. They’ll be asked to share practical tips and challenges they faced.

Speaker:

Jack Sanford

Abstract:

The audit contest space looks very different than it did one year ago. Conditional pots are the norm instead of the exception. Many different approaches to judging are taking place. And two distinct types of contests have emerged.

Speakers:

Hari Mulackal, Wolfgang Grieskamp, Dave Grantham

Moderator:

Mehdi Zerouali

Speaker:

Qi Su

Abstract:

This talk will describe the attack-defense game in the MEV world. First it will briefly discuss MEV transactions and how it can protect projects from hackers. Then it will delve into attack-defense games between MEV bots. Finally it will discuss our latest observations and direction in this cat-and-mouse game.

View presentation

Panel with:

Sara Reynolds

Abstract:

Well not really 500 days… As we end 6 months of intense security work on Uniswap v4, we plan to do an overview of the security processes we used to secure Uniswap v4 (we hope), and the bugs that we uncovered at each stage.

Including: community contributions, fuzzing, ffi testing, SEAL wargames, formal verification, 8 audits, a competition, and a bug bounty.

Panel with:

Michael Lewellen

Abstract:

In this talk, I’ll speak about the security processes being utilized in securely passing proposals on multiple DAOs including Compound and Arbitrum. We’ll cover the types of proposals that require security review, how each type of proposal should be reviewed and the different strategies employed to enforce a QA process while maintaining decentralization throughout the lifecycle of a proposal.

This is a follow-up to a prior talk from DSS 2022 that covered DAO security. This talk will cover more recent updates and dive deeper into the technical processes that are utilized and can be used by others: https://www.youtube.com/watch?v=RGhedegBejE&t=23s

View presentation

Speaker:

Viktor Yurov

Abstract:

In this presentation, I will discuss the complex mechanisms of liquidations in various decentralized finance (DeFi) protocols. Liquidations play a crucial role in maintaining the stability and solvency of DeFi platforms. I will address challenges such as market liquidity constraints, cascading liquidations, and high market volatility. Additionally, the focus will be on cross-chain swaps, different oracle architectures (Chainlink, PYTH network), transaction execution delays during network congestion, and the handling of bad debt.

Using well-established protocols like AAVE, Compound, and Gearbox as examples, I will first examine typical liquidation module architectures, before moving on to modern innovative approaches. I will start by discussing the partial liquidation mechanism of Curve’s crvUSD and then delve into the architecture of Fluid Vault, which implements position grouping into ticks and bad debt absorption.

In the final part of the presentation, participants will be introduced to some of the most interesting vulnerabilities identified in real-world audits.

This session will be valuable for auditors, developers, and DeFi enthusiasts.

Speaker:

Merlin Egalite

Abstract:

This talk will explore strategies for isolating risk in decentralized finance, focusing on both architectural and code-level approaches to managing smart contract and economic risks.

In the first part, we’ll delve into protocol architecture: simplifying design, separating components, and externalizing risk management to improve resilience. We’ll analyze examples from protocols like Symbiotic and Morpho, highlighting their approaches to mitigating risk.

The second part will cover secure coding practices, such as scoping variables, managing external interactions, applying timelocks, and structuring roles to limit edge cases. Using examples from Morpho vaults, we’ll discuss practical ways to reduce vulnerabilities at the code level.

Speaker:

Heidi Wilder

Abstract:

Join us for a practical session on using blockchain analysis to:

• Detect and investigate exploits – Strengthen preventative measures
• Improve incident response
• Protect your users and your project
• Safeguard your own security

Speaker:

Kirk Baird

Abstract:

The talk is aimed to explore commonly found bugs in bridges. This would include bridge implementations themselves as well as protocols which utilise bridges. The focus of the talk would be on the solidity /smart contracts side of the bridge but may be expanded to include offchain code if there is sufficient time. The talk would cover iterate through bugs in a sufficient level of detail for listeners to fully understand and hopefully identify in the wild. Therefore, the target audience would be proficient in programming with a preference of solidity. Some examples of vulnerability classes are

• message replay attacks
• message validation
• signature issues
• access controls
• external function calls
• token manipulation
• DoS vectors

Speaker:

Garand Tyson

Abstract:

State Bloat, the uncontrollable growth of on-chain data, is one of the major hurdles for long term sustainability of blockchains. State Archival is the solution to this issue, where arbitrary ledger state is automatically deleted from validators. Many major networks are already either planning to or have made steps towards the implementation of State Archival, such as Solana, Ethereum, and Stellar. In this talk Garand, a senior protocol engineer at the Stellar Development Foundation, will present the State Bloat problem, the novel attack surface introduced by State Archival, and the solutions being implemented on Stellar. The risks discussed will include double create, double restore and malicious non-restore of deleted state.

View presentation

Speaker:

Robert Reith

Speaker:

Thibault de Lacheze-Murel

Abstract:

As web3 adoption grows, integrating embedded wallets into dApps streamlines user onboarding. These wallets offer web2-like ease of use with one-click account creation and recovery options while upholding web3 principles of ownership, trust minimization and decentralization. However, designing such wallets introduces novel security challenges and attack vectors.

This talk explores these challenges and mitigation strategies for wallet providers and dApps to safeguard against key security risks.

View presentation

Speaker:

Carlos Salort Sanchez

Abstract:

To stop exploits from happening, we need to detect automatically when a transaction is malicious. We will present a couple of AI approaches to tackle this problem: Using deep learning to analyze the traces of a transaction, and using unsupervised learning to identify anomalous transactions within a protocol. These methods, when paired with a transaction delaying mechanism, are fast enough not to disrupt the normal operational flow of the blockchain, and can stop protocol exploits.

Speaker:

Tarun Chitra

Abstract:

As restaking networks grow and generate fees, a natural question is how their dynamics evolve. Recent research from Durvasula and Roughgarden, as well as from Chitra and Pai, demonstrates that there is a natural graph structure between restaking services (such as EigenLayer AVSs or Symbiotic Networks) that controls the security of the network. This talk will demonstrate an empirical analysis of the true amount of security held within live restaking networks and compare live network security parameters to theoretical bounds. Our work will demonstrate how active rebalancing from node operators is crucial to practical restaking security.

Speaker:

Hudson Jameson

Abstract:

The Shanghai Attacks were a series of attacks against the Ethereum network during Devcon2 in Shanghai. I will retell a first hand account of those harrowing nights where the power of client diversity saved the Ethereum network from halting. I will go over a timeline of the attacks and explain the technical details of the exploits and the 2 network upgrades that had to be executed to remedy the damage.

Note: I was coordinating the response to these attacks in-person and co-running Devcon2 in China during the attacks so I have special insights and resources I can offer to provide a very entertaining and informative talk on this subject 🙂

Speaker:

Ernesto Boado

Abstract:

DeFi systems are ever-changing, including the infrastructure they live in (L1s, rollups). However, the size of financial software living in them like Aave, seem to require slower pace of progress.

In this talk, from our perspective as core maintainers of the Aave protocol, will present practical examples on how decision-making is done in a daily basis, touching aspects like:

• When/how new features are added into a multi-billion production system? Practical examples.
• Balance security considerations (and development) with time-to-market.
• Redirect innovation to “boring” parts of the tech, with underlying quality as an important target.
• Defense-in-depth on the application layer, with Aave virtual accounting as an example

Speaker:

Emilio Frangella

Abstract:

The talk will highlight security practices adopted with the development of Aave V4 and provide comphrensive development update on the new protocol iteration.

Speaker:

Igor Konnov

Abstract:

This talk presents a joint effort by Matter Labs and Igor Konnov to formally verify the ZKsync Governance Protocol, which is central to the decentralized management of ZKsync. Alongside traditional security audits, we developed a formal specification using the Quint language to model key governance elements, ensuring protocol security through methodical threat modeling and compliance with governance procedures.

We’ll discuss our approach to validating critical mechanisms like multi-sig operations and cryptographic signatures with model checking and SMT solvers. Real-world examples will illustrate how governance rules, from emergency upgrades to protocol freezes, were captured in formal invariants to detect and resolve vulnerabilities.

View presentation

Speaker:

Andrew MacPherson

Abstract:

The explosive growth of Web3 has brought about innovation, decentralization, and financial opportunity. But let’s be honest—Web3 security is a disaster.

From drainer attacks to wallets that force users to bear the burden of near-impossible security practices, we are failing the very users we aim to protect. And worse, the barrier to exploitation is so low that attackers are beating us with the dumbest attacks!

In this talk, I will look at some of the most embarrassing aspects of Web3 security today, from how wallets should protect users to the infrastructure that enables attacks. I’ll walk through real-world examples of the flaws in the system—like the widespread use of seed phrases, the dangers of lookalike addresses, and the gaps in social media and domain takedowns. But I won’t just point fingers. I’ll offer actionable solutions for developers, security engineers, and the broader crypto community.

From WebAuthn/Passkeys to eliminate phishing attacks, holding wallets accountable and ways to strengthen dApp validation with modern security practices.

If we are serious about bringing the next billion users into the decentralized world, we need to create safer systems that are intuitive and defend against low-effort but high-impact attacks. This talk will challenge Web3 builders to stop accepting the status quo and embrace the tools we already have to make a real difference in user security.

View presentation

Speaker:

Nat Chin

Abstract:

Instead of debating between formal verification or fuzzing, this talk introduces a paradigm shift: building invariant-focused codebases to streamline the integration of both methods. While each approach has strengths—formal verification for rigor and fuzzing for speed—the real goal is maximizing bug discovery, minimizing attack surface, and reducing vulnerability to exploits.

I’ll share insights from building robust invariant-driven testing suites, such as a 216-invariant fuzzing suite for Curvance and a 50+ suite for Primitive Finance, drawn from over four years of experience. This talk covers practical guidelines for embedding invariants from the beginning of the software lifecycle, ensuring a smooth transition to comprehensive testing that combines the best of both worlds. Together, we’ll explore how the industry can reduce friction around testing tool debates and instead make testing a seamless and powerful part of code design.

Speakers:

Mehdi Zerouali, Pablo Sabbatella, Peter Kacherginsky, Anto, Andrew MacPherson

Moderator: 

0xRajeev

Abstract:

Web3 security is typically associated with smart contract security. The biggest Web3 hacks have however involved traditional Web2 vulnerabilities and attack vectors. So is Web3 security really a revolution or repackaging of Web2 security principles? This panel proposes to debate on the similarities and differences between Web3 vs Web2 security with some leaders in this space towards the goal of highlighting the current status, historical lessons from Web2 security and future challenges for a safer Ethereum ecosystem.

Speaker:

Luis Quispe Gonzales

Abstract:

In this talk, we’ll explore how hackers approach Rust-based blockchains, the common vulnerabilities they target, and the surprising ways things can go wrong.

If you’ve ever wondered how even the most robust code can be broken, this session will shed light on that… and what can be done to stop it. It’s a journey into the hacker mindset, packed with real-world insights and stories!

Speaker:

Denisa Diaconescu

Abstract:

INTMAX2 is a blockchain scaling solution for payments that uses a fixed 4-6 bytes of data on-chain, giving an upper limit of 7500 transactions batches per second on Ethereum, where each transaction batch can transfer an unlimited number of tokens to an unlimited number of recipients. INTMAX2 enables stateless and permissionless block production, and provides privacy properties using zk-proofs. The censorship problem is solved intrinsically by INTMAX2 as any user can be an aggregator. In this talk we discuss how we formalised the INTMAX2 protocol in the Lean proof assistant and mechanically proved the security theorem that guarantees the key economic safety property of the protocol.

Speaker:

Anto

Abstract:

AVSs, or Actively Validated Services, use crypto-economic networks like EigenLayer to establish credible commitments. In this talk, we will explore the following topics that will help you build a Secure AVS:

1. What are credible commitments, and how do they work?
2. The roles of stakers, operators, and AVSs in credible commitments.
3. What is slashing, How does it work and how to secure your slashing logic.
4. Crypto-economic attacks against AVSs
5. Essential Web2 security for your AVSs.

Speaker:

Assaf Eli

Abstract:

We will present findings from a study that examined how execution layer protection can prevent financial losses in decentralized systems. The study analyzed 60 incidents from the Ethereum mainnet, reflecting diverse financial impacts and project types. Each attack was simulated to replicate blockchain states at the time of exploitation, assessing the system’s capacity to block malicious transactions without interfering with normal operations. The experiments, repeated under varying conditions, offer insights into how combining off-chain detection with on-chain intervention enhances security by addressing vulnerabilities in real-time without disrupting system

Speaker:

Markella Gioka

Abstract:

We discuss how we use off-the-shelf large language models for various smart contract analysis and automated comprehension tasks. An important element concerns the level of abstraction of the LLM input. We have found that excellent results can be achieved (for tasks such as public function similarity) by normalizing the input through decompilation up to an almost-Solidity-like level, together with simple tree-shaking algorithms. The resulting normalized code can be used both as training input and as input for computing embeddings.

Speaker:

Shahar Madar

Abstract:

Speaker:

Haim Krasniker

Abstract:

Drawing upon two decades as a cybersecurity leader—including many years in Web2 Security and the past two years navigating the “”crypto-sphere””—I share personal insights into the challenges that make securing organizations in the decentralized era anything but a “”block party.”” This presentation explores the strategic and tactical tasks essential for a CISO in the blockchain-powered world of Web3.

Speaker:

Joran Honig

Abstract:

You’ve probably read about bounty hunters becoming millionaires on Immunefi, the billions of dollars secured. The millions of $$$ whitehat rescued. This is just half of the story!

In this talk we’ll avoid those successes and look at what can and will go wrong in crowdsourced security. After this talk you’ll walk away with some of the hard lessons learned by both security researchers and product teams.

Speaker:

Valerian Callens

Abstract:

EIP-1153 introduced a new form of storage to the EVM: transient storage. Any update to this storage persists until the end of the current transaction. Also, using it costs less gas than the standard storage. It has been live since the Dencun Upgrade. We present use cases, adoption metrics, and security considerations, especially with the current rise of Account Abstraction. We will also suggest security design patterns leveraging transient storage.