Jack Sanford

Each year, two of the world's largest cybersecurity events happen back to back in Las Vegas. Black Hat is more corporate-facing, while DEF CON has a distinct hacker ethos, with about 30k participants across dozens of “villages.” I focus primarily on blockchain security which doesn’t have much presence at these conferences. However, the lines between traditional finance (TradFi) and decentralized finance (DeFi) are starting to blur, so I thought I’d spend some time at DEF CON this year. I noticed a huge chasm between the Web3 security world and the world of Web2 cybersecurity. To give some perspective, the two most common impacts of Critical and High severity vulnerabilities in the Web3 world are: 1. Loss of funds 2. Permanent freezing of capital These two impacts have resulted in billions of dollars of cryptocurrency being lost in the past year or so. Whereas in Web2 cybersecurity, the most common impacts are: 1. Broken access control leading to data theft 2. Remote code execution leading to data theft 3. Privilege escalation leading to data theft As you can see, one world is about stealing money. The other is about stealing data (and sometimes money indirectly through ransomware). That’s why a CISO is a Chief Information Security Officer. The job is securing data in Web2. In Web3, it’s securing money. Because of this, security standards in the Web2 cybersecurity world dictate very different response times. Over the weekend, multiple institutional teams noted that an ideal resolution time for vulnerabilities in production is between 5 to 15 days, and many High severity vulnerabilities go unfixed for weeks. These timelines are unheard of in Web3 security. In our field, if an issue is left in production for any period of time, hundreds of millions of dollars can be drained in a 12-second Ethereum block. Which is why so much time and effort is poured into prevention in the Web3 world. Another key difference between the Web2 and Web3 security worlds comes down to mutability. In TradFi, ledgers are centralized and even if a bad actor shifts funds into their own accounts, banks can simply claw back or reverse the transactions. For decentralized blockchains, the money-stealing transactions are near instantaneous and recoverability is substantially more difficult (and in many cases impossible). As institutions adopt blockchain technology, security teams must adapt to their new reality. In many cases, small Web3 teams have higher security standards than the biggest institutions in the world, especially when it comes to prevention and shifting left. Because they have to. What’s at stake in the Web3 world is more valuable and easier to steal. As institutions make greater forays into the blockchain world, CISOs and security leaders must lead the way by putting plans in place to increase the rigor of their internal and external security practices to prepare for this more adversarial environment. We are helping some of them already.

Ethereum sets a great example when it comes to security. For all the security measures they take, they still put $2,000,000 on the line in a Sherlock audit contest. And their approach was completely vindicated. 4 High-severity vulnerabilities were found in the contest! These weren't Highs in clients that control 1% of the network. In order to meet the criteria for High, it has to slash, bring down, or split at least 33% of the network. Yes, the Ethereum network. The one with over 100 billion dollars in it. Credit to Ethereum for going the extra mile with a $2,000,000 audit contest. Congrats to the ~500 participants and especially to those who earned some of the $500,000 payout and contributed to Ethereum's security. Audit contests are still the gold standard for security🏅

Security is the bottleneck that constrains the speed of development in Web3. As long as we're stuck in the "point-in-time" mindset, the industry will stay slow and insecure. Complete lifecycle security is finally here to fix this.

Come hang with Sherlock, Ethereum Foundation and Gnosis at an awesome venue in Buenos Aires next week.

Great chatting with Jeroen Offerijns here in New York. Quick tips on achieving world-class protocol security: 1) Keep it simple 2) Make only necessary changes 3) Take every finding seriously

Honored to have one of the blockchain security OGs Bernhard Mueller join Sherlock to do research at the intersection of AI and blockchain security.

Sherlock AI just uncovered and helped fix a $2.4M vulnerability in a live lending protocol. It’s the first time (to our knowledge) that an AI system has surfaced a multi-million-dollar exploit on mainnet. To me, this is a turning point. Security in Web3 has always been defined by human review. Now we’re seeing proof that AI can meaningfully shape production outcomes, and it’s happening faster than even I expected.

Sherlock AI is now live. Find vulnerabilities in blockchain code in 1% of the time at 1% of the cost. For years, audits have been the foundation of smart contract security, but they’ve also revealed a consistent problem: too many vulnerabilities surfaced at the last minute, driving up costs and delaying launches. Sherlock AI is built to change that. By bringing auditor-level insight directly into development, it gives teams the ability to catch issues earlier, prepare better for audits, and ship code with confidence. I believe Sherlock AI can redefine how security fits into the workflow of shipping code onchain and ultimately make the crypto space much safer.

Ethereum upgrades are inflection points for the entire ecosystem. With the Fusaka upgrade, the stakes are higher than ever: scaling data, performance, and throughput for the next generation of builders. Security has to rise to meet that moment. The $2M Fusaka Upgrade Audit Contest shows what’s possible when the best researchers come together to protect the settlement layer of crypto. Proud of the Sherlock team and community for pushing the standard forward.