This computer scientist who tracks down costly bugs in cryptocurrency code

In the spring of 2022, prior to some of the more volatile events to hit the crypto world in the past year, an NFT artist named Micah Johnson held another auction of his drawings. Mika Johnson is well known in crypto circles for photos featuring his character Aku. The latter is a black boy who dreams of becoming an astronaut. Collectors rushed to share this new edition. On the day of the auction, in total, they spent $34 million buying these NFTs.

Then tragedy struck. The “smart contract” code written by Micah Johnson’s software team to run the cryptocurrency auction contained a fatal error. All of the artist’s $34 million in sales are locked on the Ethereum blockchain. Consequences: Micah Johnson could not withdraw the money. He also could not refund people who bid on one of his NFTs without winning them. Virtual funds are frozen, untouchable, “locked in chain” as they say.

>> Discover 21 Million, a cryptocurrency newsletter from Capital. Full profile each week to understand everything about the crypto revolution and price analytics to support you with your investments. Now, with the promo code CAPITAL30J, you can take advantage of a month’s free trial.

Mika Johnson may regret not hiring Rongwe Gu. The latter is the co-founder of CertiK, the largest smart contract validator in the glittering and unpredictable world of cryptocurrency and Web3. Ronghui Gu, a friendly and talkative computer science professor at Columbia University, leads a team of more than 250 people who audit cryptocurrency code to ensure it is not riddled with errors.

The encrypted code is more severe than traditional software

CertiK’s work will not prevent you from losing your money when the cryptocurrency crashes. The company will not prevent cryptocurrency exchanges from misusing your funds. But CertiK can help prevent software glitches from causing irreparable damage. Among its clients, the company is some of the biggest players in cryptocurrencies such as Bored Ape Yacht Club and Ronin Network. The latter runs the blockchain used in the games. Customers sometimes come to Ronghui Gu after losing hundreds of millions of dollars, hoping that this computer scientist can make sure that this misfortune does not happen again.

“It’s really a wild world,” Rongui Guo says with a laugh.

The encrypted code is more severe than traditional software. Silicon Valley engineers usually try to make their software as bug-free as possible before they ship, but if a problem or bug is discovered later, the code may be updated.

This is not possible with many cryptocurrency projects. They operate using smart contracts, i.e. computer code that governs transactions. Let’s say you want to pay an artist 1 ETH for an NFT, a smart contract can be encoded to automatically send you an NFT token once the funds reach the artist’s wallet. The problem is that once the smart contract code is embedded in the blockchain, you cannot update it. If you catch a bug later, it’s too late: the benefit of blockchains is that you can’t modify what’s written on them. Even worse, the code hosted on the blockchain is visible to all: thus hackers can study it at their leisure and look for bugs to exploit.

Ronin Network loses over $600 million in hack

The number of these hacks is amazing and they are very profitable. At the beginning of 2022, Wormhole stole more than $320 million in cryptocurrency. After that, Ronin Network lost more than $600 million in crypto.

“It is the most expensive breakthrough in history,” said Rongui Gu, shaking his head in semi-disbelief. “They say Web3 is eating the world, but hackers are eating Web3.”

In recent years, many listeners have appeared. CertiK, co-founded by Ronghui Gu, is the most important of these: the company, valued at $2 billion, is estimated to have performed 70% of all audits related to smart contracts in order to detect in real time whether one has been hacked.

Not bad for someone who got into this universe somewhat by accident. Ronghui Gu didn’t start with coding, he spent his PhD in verifiable software, exploring ways to write code that behaves mathematically and predictably. But it turns out that this topic is very applicable to the world of smart contracts. He co-founded CertiK with his thesis supervisor in 2018. Ronghui Gu is now spreading into the worlds of academia and cryptocurrency. He continues to teach courses at Columbia on compilers and formal verification of systems software, and supervises several graduate students (one of whom is researching compilers for quantum computing), while he heads off to Davos and Morgan Stanley events, in his usual black T-shirt and dark jacket, to try to impress the bigwigs at The crypto and finance industry takes blockchain hackers seriously.

Cryptocurrency is known for its boom and bust cycles. The November FTX stock market crash is just a recent example of a hit. Ronghui Gu thought he would have a business to do for years. Major companies, such as banks, and “a major search engine,” he says, are starting to launch their own blockchain products and hiring CertiK to help keep their ships in tip-top shape. If established companies start injecting more code into the blockchain, it will attract more and more hackers, including government agencies. “The threats we face are getting tougher,” he analyzes.

Article by Clive Thompson, translated from English by Cozy Bastakia.

4tech

Rechercher dans ce blog