What should governments consider when getting involved with blockchain?
Last September, Principal Security Engineer Dr. Evan Sultanik was on a panel hosted by the Naval Postgraduate School’s Distributed Consensus: Blockchain & Beyond (DC:BB) movement, where faculty and students there are seeking opportunities to learn and share knowledge, research, funding, and events focused on distributed consensus technologies.
The panel of nine government, academia, and industry experts discussed how blockchains, digital assets, and other Web3 technologies intersect with national security challenges. Dr. Sultanik discussed how the U.S. could help push global adoption and take a broader strategic outlook toward blockchain and Web3 technologies.
He talked about the inherent limitations of blockchain technologies and the Web3 movement and also offered suggestions from a training perspective that could lead to a more robust ecosystem. We’ve summarized the most important parts of that discussion here.
What are the some important things to consider when using blockchain technologies for a project?
It’s fundamental to better understand the tradeoffs one must make when using a blockchain and its security implications. Everyone at this point is aware that using a blockchain has significant additional overhead in terms of deployment and the cost of interacting with smart contracts. The cost gradually decreases with the transitions to the new forms of consensus and higher-level protocols, but there’s still a significant difference.
You have to realize that all data stored on a public blockchain is publicly available. Anyone can look through the entire history of each account or contract and understand the implications of those actions. You need to do something additional to ensure its privacy if that’s a requirement of your system.
The majority of participants in a public blockchain are untrusted. You are shifting trust from what would otherwise be a central authority to other entities that you may or may not have control over. You’re not only trusting the developers of the smart contracts that your system is interacting with, but you’re also inherently trusting the developers of the technology stack running that particular blockchain. You’re trusting the node software, the mining hardware, the mining software, the mining pool protocol, and everything else down the line. A bug in any one piece of that stack can cause the whole thing to collapse.
Blockchains allow developers to prototype new ideas quickly. You don’t have to worry about things like setting up infrastructure, and you don’t have to worry much about DevOps because that’s all handled by the blockchain itself. That allows you to significantly reduce the time between when an idea is created and when it is in the users’ hands. But that cycle also comes with risk because a tight development cycle can lead to poorly tested or designed protocols or sloppy development, leading to bugs with significant consequences, like being a big target for attackers.
Another thing that makes DeFi, blockchain, and Web3 so appealing is that you can prototype quickly and instantly connect your application to the whole ecosystem. Since the blockchain acts as a huge shared database, contracts and assets created by competitors can be made to interact with each other in ways that would be disincentivized if implemented on a traditional centralized platform.
This composition does come at a price. It’s difficult to reason about the system because you suddenly must understand all the different contracts that created these tokens. It’s different code in each case. And your code suddenly interacts with the whole universe of code on the blockchain. So, you must be mindful of all these other externalities and third-party components your app might interact with.
We’ve seen this complexity play out recently with new types of financial instruments and technology that have become available, particularly on Ethereum, such as flash loans or maximum extractable value, which are really deep technical concepts. Still, millions of dollars have been lost because a bunch of different DeFi apps are composed in a single transaction in a way that none intended to be composed.
Computer scientist Leslie Lamport wrote in 1987, “A distributed system is one in which the failure of a computer you didn’t even know existed can render your computer unusable.” This is still true today and will always be true in blockchains.
Should the U.S. care about blockchain technologies, and if so, what’s the best application for the government?
It’s a matter of national security that the U.S. government gets involved with blockchains: Other than perhaps lost tax revenue, Uncle Sam doesn’t really care if you lose your Bitcoin. But Uncle Sam should care if North Korea steals it. U.S. adversaries are already exploiting these technologies to circumvent sanctions and undermine our markets.
It’s more productive to ask, “Can blockchain and Web3 technologies ever be made secure? If so, how?” The U.S. government needs to foster research and innovation to answer this question to stay relevant and remain a world leader in distributed ledger technology.
How should the U.S. handle the training regimen needed in the Web3 space?
There is a large need to change how we educate the incoming workforce because traditional software development expertise does not directly translate into Web3. I have friends who don’t have a background in computer science, yet they learned one programming language, wrote a mobile app, and are now millionaires. They don’t have any technical knowledge of what a phone is doing, how iOS or Android is running, or how the hardware works. They just needed to know that one programming language, and that was sufficient for them to build something very popular and effective.
That isn’t true for Web3. Knowing the entire stack is helpful when creating smart contracts, because you need to understand the compiler that you’re using. You need to understand the virtual machine that’s running. You need to understand byzantine, fault-tolerant, and consensus protocols. You should understand zero-knowledge proofs or zk-SNARKs. You should understand all of these esoteric technologies, and very few experts know any of them, let alone all of them. You need to be an expert in them to avoid all the pitfalls and footguns.
We need policies incentivizing people to enter the workforce with these necessary skills. At Trail of Bits, we’ve developed a blockchain security apprenticeship because finding people with all the necessary skills is difficult in this competitive market. Some security people know how to analyze a C++ program or a mobile app, but they have no idea about blockchain. And then you have blockchain people who have no background in security. So we developed this in-house program.
For mobile app stores, there has always been a low barrier to entry for people looking to get involved in the app economy. With Web3, that doesn’t seem to be the case, yet there is a lot of activity in this space. What more needs to be done to bring developers to a level where blockchain is mature from a security perspective, and what entities or organizations should lead that effort?
The barrier to entry is surprisingly low for Web3, too, which is part of the problem: Web3 development toolchains have been modeled after familiar toolchains from traditional app development. Developer friendliness has been prioritized at the expense of security. We need to modernize and improve the tooling to flip the balance of that prioritization.
Conclusion
It’s not enough for governments to only express interest in securing blockchain technologies. Real, purposeful investments need to be made. Beyond the design of secure architectures, languages, compilers, and protocols, these investments should also include educating a robust workforce to meet tomorrow’s Web3 demands.
If you’re considering whether a blockchain might be the solution to a problem you’re trying to solve, we recommend our operational risk assessment titled, “Do You Really Need a Blockchain?” This will give you a thorough look into the advantages and risks you may be taking.
Finally, if you would like to hear more from the other experts on the panel about blockchain technologies and national security, you can view the discussion in its entirety at: https://nps.edu/web/nps-video-portal/-/blockchain-research-opportunities-for-nps-students-and-faculty.
*** This is a Security Bloggers Network syndicated blog from Trail of Bits Blog authored by Trail of Bits. Read the original post at: https://blog.trailofbits.com/2023/04/25/loose-code-sinks-nodes/
