Building Blockchain's Emergency Response Layer w/ Bobafetador (Drosera)

**Speaker A:** Hello, and welcome back to the Strange Water podcast. Thank you for joining us for another episode. Let's imagine that you and I just founded a new protocol, maybe a dex. And let's imagine that not only did we successfully ship our code, but we got the whole community incredibly excited about what we're doing. And so, within just a few weeks, people deposit over $1 billion worth of crypto assets. Awesome. Now let's fast forward a few months and you and I are shopping for mansions in Switzerland and our phone starts blowing up. Most of the messages are just the entire community forwarding. You and I a tweet from Peckshield. Hey, Strange Water decks, you might want to take a look. The rest of the messages come with an etherscan transactions and say something to the effect of, hey, someone just withdrew 60% of your TVL. Are you guys doing something? And in that moment, you and I look at each other. Who will be the first to admit it out loud? We got hacked. In this moment, once it's too late and the hackers have already disappeared back into the ether, we ask ourselves one of those questions that seem incredibly obvious in hindsight. Why was it even possible to withdraw 60% of the TVL in one transaction? And if we're really thinking clearly, one of us might ask, there's no way a transaction with that kind of profile could be valid. Why didn't we just build our system to identify it and to mitigate it? Even just a few years ago, the answer would be pretty simple. It just wasn't feasible to build a rapid response system within the confines of the evm. But in this industry, a few years ago might as well be a lifetime. And so in 2024, not only is it feasible, but thanks to the efforts of today's guest, it's becoming almost easy. Drosera is the first decentralized incident response protocol, leveraging a deep bench of security expertise, some of the most talented builders in the industry, and the incredible magic of zero knowledge technology. Today we have the perfect guest to walk us through Drosera and all crypto security co founder and CTO Boba Fettador. Over the next hour, we go deep into the challenges and intricacies of building security systems for the world computer. Not only will you learn so much about what it means to be operating in the exciting but dangerous environment that is the evm, you'll learn just what it means to build safe and responsive systems in the blockchain environment. For anyone building a protocol that houses really any tvl, this conversation is a must Listen, one more thing before we begin. Please do not take financial advice from this or any podcast. Ethereum will change the world one day, but you can easily lose all of your money between now and then. All right, and now for Boba Fetidor. Boba, thank you so much for joining us on the Strange Water podcast. **Speaker B:** Yeah, man, it's really good to be here. **Speaker A:** Of course, man. I'm so excited to talk about Drorcera and like the work you're doing in probably the most important and least talked about aspect of like financial computing. But before we get into like the meat and potatoes of what you're working on, I'm a huge believer that the most important part of every conversation are the people in it. So with that as kind of a frame, will you tell us a little bit about yourself, how you found crypto, how you found maybe security in crypto, and maybe why you decided to build a company in it? **Speaker B:** Yeah, yeah, absolutely. Some background of myself probably come from like a bit of a different background than most people. I actually worked like a GPS company or worked on something called mg, which is an acronym. It stands for military GPS User equipment. So I basically worked on a bunch of like really crazy stuff in their weapons program where I worked on like anti jamming tech and like mime detection and stuff like that. So, you know, using ASICS and like low level tech, you know, to, to be used out in the field. And I, I basically, you know, I've worked there for a couple years and I think I basically got to a point where it was like 2017ish, right? This is like where crypto kind of starts to hit a little bit more mainstream. More people are talking about it. I start to look into it a little bit and I'm like, oh ye, I understand this blockchain stuff. But then I ended up looking a little bit further, doing some hackathons and stuff and I was like, oh, whoa. Like I actually there's a tons of stuff going on here and so I started to kind of build like little side projects and mainly like starting out making like arbitrage bots, doing mev. One of the first things I did was I made like a Flash loan bot that did some like Flash loan calculus to do arbitrage between dexes. And so this was something that I thought was like super awesome because I basically could make the software that would just like print money. And this was like during the most volatile time, kind of 2017, 2020. Lots of stuff going on in crypto space from there, kind of like moved on to doing monitoring in general. **Speaker C:** Right. **Speaker B:** It's like I'm already looking at doing like arbitrage. So the next step was looking at monitoring certain types of data in the space. So I looked at doing monitoring systems in the evm, Polkadot and Cosmos. And so I saw like a lot of different ways for how you could like see what's happening. And naturally I kind of fell into doing security because like obviously a very big part of security is like dynamically monitoring and looking at and ecosystem wide events. **Speaker C:** Right. **Speaker B:** And obviously those are some of the like the biggest things that people care about is like all these hacks like Bridges getting hacked, Dex is getting hacked and just like huge, huge events. And so yeah, I naturally kind of fell into doing security work for that because honestly it feels like if we can solve the security problem in crypto, then kind of all shifts will kind of rise. **Speaker C:** Right. **Speaker B:** Everybody will benefit from that. And I think that that's part of the space. **Speaker C:** Right. **Speaker B:** Is to make something that has a huge impact that helps everyone. Yeah. So that's where I get a lot of inspiration from as well. **Speaker A:** I think you're spot on with the insight that like if we solve security problems, it lifts the tide for all boats. And I think we hear about this a lot more frequently and a lot more directly in the MEV world where it's like, it's called maximum extractable value, being that like these people are extracting value from users and from builders and if we can solve that, then like literally everyone except for the scalpers benefits. And it's exactly the same with security where like the people that are able to take advantages of these weaknesses are not like, are not positive sum value added players in this. And so by solving these problems, it's not like we're rearranging the chairs on the, the Titanic and making sure that it looks better, but the same people are able to do the same malfeasance. It's like we're making this a better and therefore more viable system. **Speaker B:** Yeah, it's about aligning incentives. **Speaker C:** Right. **Speaker B:** I think it's all about aligning incentives to where it's like a net positive for everybody. And yeah, that's like a of why I was just interested in the space in general was it was like there's a way you can actually align all of these different like pieces in these pipelines to actually, you know, feed liquidity back into the system and help grow the ecosystem as a whole. **Speaker A:** And I think what's really cool about your background compared to like the More typical, like enter through the finance realm. Background of crypto people is that for, for many of us, myself included, we needed to like, learn what an adversarial space feels like and like, how to basically exist and thrive in a space where there are like actual villains around every corner, like, trying to trick you into doing something stupid. And your background is like, you like, forget just like military stuff. You're working on active field military stuff, like literal war stuff, which is the most adversary of adversarial. **Speaker B:** And. **Speaker A:** And I just wonder if you have any reflections or thoughts on how your time working like in and around the military really made you the right person to like, be like, founding a cybersecurity empire within crypto. **Speaker B:** Yeah, I think it gives me like, some very unique perspectives because although it may not sound like it, you know, GPS is actually like, very cryptographically heavy. Like, there is like super important cryptographic stuff happening inside of those little embedded machines that are like, running this, these, this GPS software and then getting signals from satellites and interpreting data. And so that has to be something that, like, is a major design. A major piece of the design is making sure that those keys are kept safe on those devices. And so from that perspective, it's like, I already kind of had this perspective of like, there's an adversarial piece to this. Like, when I'm writing a software, I need to make sure that it's secure. Like, I'm not just writing like some web2app and I'm trying to show like some nice dashboard or, you know, facilitate emails or work with a db. I. I'm making sure that like, secure military codes are safe and can't be captured by the adversaries. And on top of that, just from like an effectiveness perspective of like, the, the quality, the efficiency of those machines is super important. You, you'd be kind of like, surprised to know, like, in that field you tend to learn how interconnected time and space really are in GPS. In GPS world, like, I think like 1 nanosecond of time error is like, equivalent to a couple feet of like, positional error. So not only do you need to like, look at this stuff from the perspective of like, everything needs to be secure, but it needs to be like, highly, highly accurate because, well, people's lives are at stake. And I think that it's kind of similar, right, with what we're doing with security. It's the same thing. It's like we're making systems that are protecting millions and millions, billions of dollars, and we need to be Highly accurate. Deadly, deadly accurate. **Speaker C:** Right. **Speaker B:** So, yeah, I think that that's definitely the similarity that I see between those two roles. You know, what I'm doing now, and. **Speaker A:** I think I don't ever want to equate, like, the risk to real human life to, like, financial risk. There is something about the parallel between, like, in war, if something happens, there's no. Like, you can't undo that. You can't try again. Like, if someone loses their life, it's over and again. I hate to draw the parallel, but it's similar in crypto where, like, once the hack has happened, like, the carnage is over. There's nothing you can do. You can only move forward. And I think that this is about building the muscle of when you ship code. It's not that it has to work, it's that it can't fail. **Speaker C:** Right. **Speaker B:** Yeah. And I think that really with. What we're doing is. With Drosera, is about mitigation. Like, there are going to be cases where an exploit occurs, and there really is no way to prevent it. Right, but does that mean that we just kind of give up and let it go? No. We have to have systems in place that immediately take action to try to mitigate risk. **Speaker C:** Right. **Speaker B:** If a pool gets hacked, we need to do something to make sure that other pools don't get hacked. If a bridge gets hacked, we got to make sure that other systems in the ecosystem can disable that functionality so that people aren't just, like, blindly sending money into a black hole. **Speaker C:** Right. **Speaker B:** So I think that that's really the thing that we're focusing on at Drosera is that, like, prevention is absolutely something that is the. It's like the golden milestone. It's like the thing that the Holy Grail that we want to be able to achieve. But the reality is that prevention is basically impossible. I mean, it's borderline impossible to do 100% prevention. And so I think that what we're focusing on is, like, if you can do damage mitigation and you can set it up just by deploying a smart contract, why not? **Speaker C:** Right. **Speaker B:** And so I think that that's what we want to be able to show the world, is that it's possible to do damage prevention and mitigation. **Speaker C:** Right. **Speaker B:** And you can do it just with smart contracts. **Speaker A:** Yeah. Awesome. So I think this is, like, the perfect pivot point to bring us to Drorcera. But instead of going straight there and talking through, like, what it is, how these smart contracts work, what's the goal, blah, blah, blah. I Think I always like to ask, help us understand what Drosera is through the lens of the founding story. So how did you realize there's a problem? How did you realize there's an opportunity? Like, what is that moment? **Speaker B:** Yeah, I think that it came from just my experience with making monitoring systems in the kind of, like, three big ecosystems. And it kind of found, like, a very common theme when making them, which was always, like, you always felt like you had two really big jobs. One which was like, well, you need to have monitoring for the informational piece. Like, you. It's good to get alerts that tell you, oh, you have an uptick in users or volume. That's all good stuff to know. And it can help you to kind of like, be like, okay, in the next day or two, like, let's kind of look at this, or, let's change this, or maybe like, let's. Let's do something. But there's like, a whole other spectrum of monitoring, which is not only do I need to be, like, alerted about this, but, like, an immediate action needs to be taken. And building that tech, it's a challenge, but it's honestly not the biggest challenge. The biggest challenge is actually managing it. Because, like, if you're a protocol, you shouldn't be spending, like, all this time and effort managing all of this infrastructure. **Speaker C:** Right. **Speaker B:** You should be focusing on your application. You should be focusing on, like, the core value that you're providing to the ecosystem. And so that's when we kind of thought about, well, like, what if we could make a way where people could, like, delegate their security infrastructure to a network of decentralized operators that run it for them? And so he said, okay, like, is there something there? Like, let's kind of, like, look into that. Because that could really mean that a lot of smaller protocols are able to get security infrastructure that would more or less be, like, totally impossible for them to set up themselves. And how do you make it effective? How do you make sure it's, like, actually effective? And so that's when we started to look into what are the different ways that we can make this the system. Yeah. So we started to dig into it and figure out what's the most important part and what do people care about what needs to be the easiest piece of the system. So with Dracera, the way that we thought about it, with my kind of MEV background, was that it has to be something that is incentivized. And so we thought about how it can actually form itself as a security marketplace. And so this would be the security marketplace. It kind of manifests itself as what we're calling a incident response protocol, where there's like some incident defined by a protocol. A protocol is one of the players in this marketplace. They come to Drosera and they create a smart contract called a trap. And it defines what they consider to be an emergency incident, what is like an emergency condition. They, that they believe is something that's super important for them to take some emergency action. So they have this security infra that they define in a smart contract, and they basically want to delegate for operators, node operators to run the security infra. So node operators are the other player of this marketplace where they go to Drosera and they say, okay, let me look and see what are these like different traps that I can opt into and run security infra for? And how are they incentivized? You know, does one trap particularly have like a lot of incentive? **Speaker C:** Right. **Speaker B:** And maybe it's like a really big protocol. Maybe one has a smaller incentive, but it's for a smaller protocol. **Speaker C:** Right. **Speaker B:** And so there's kind of like an equilibrium there where people can kind of come and say, hey, like I need like three operators to run this, this task, or maybe I need like 2050 operators to, to run my security infra. Then they can use Drosera as like a kind of permissionless, trustless space to connect these two groups of people. Yeah. And so that's that. Once we kind of like started with that idea, we started to realize that this is actually something that's possible to do and it requires quite a few pieces of tech to accomplish it. It's definitely an ambitious goal. It's very ambitious. But I think that from all the conversations I have with people, it seems like everybody's very interested in what we're doing and they think that's actually something that can make a difference. **Speaker A:** Yeah, dude. Makes so much sense. And before we even get into it, it's obvious, like there's a need here and there's an opportunity here. But so let's, let's, let me just review everything you said and make sure that I got it. So the insight starts with, as someone who set up a lot of monitoring solutions, the realization that in order to do monitoring right, you need to hire like a, like an operations team, let's say forget about setting up all the infrastructure, you need to hire at least a guy, probably multiple guys, to be sitting there at the infrastructure waiting for all these pings in and then to make decisions based on the pings that are coming in. And that's like totally fine for someone like AAVE or Uniswap or starkware, someone with like billions of dollars. Right. But that is much more of a problem for like Stanley, the guy who just got his computer science degree and wants to build like the, an idea of a Dex or you know, some maybe like venture backed company that just raised $2 million but like just wants to run as fast as possible and doesn't want every single, you know, deployment to be like added two months just getting security rigging in there. Right. And so that's the opportunity that you guys saw. **Speaker B:** Yeah, absolutely. And I think it, it goes even further to where like I think that a really big concept that we see is just people are, you know, there's this theme I guess in, in the crypto space of devs getting an alert at like 3 or 4 in the morning and then having to like sign a multisig and take care of it. And I just think that like we have to be realistic, right? And we can't say that that's like the standard for, for the space like that. That seems like, you know, certainly you should get an alert and you should take care if there is like some really big issue to, to take care of. But like there should be systems in place, like a plan basically in place to mitigate damage already without people needing to like wake up and like scramble and figure it out. So I think that it really is just about standards, right? It's about setting a standard, something like simple and straightforward that is going to have like a net benefit and help everybody. And we're just saying, hey, like we came up with a standard. This should be like something that every serious protocol sets up because it's as easy as deploying smart contracts, which is essentially what you are already really good at. And it's what your, all of your infrastructure is already made with. **Speaker C:** Right. **Speaker B:** That kind of leads to another really important point about why we kind of did this as well. We went with this approach of like make it as easy as deploying a smart contract and like have protocols create the security infrastructure with smart contract code. That's like super important because being able to test your security infrastructure is incredibly important. You know, you need to make sure that when you set these systems up that you like run it through scenarios, you try it out against your protocol. And what better way of doing testing than testing using tools you already use? Rather than like setting up some whole other system and like combining these pieces and kind of making like a Frankenstein that you need to maintain and update constantly. **Speaker C:** Right. **Speaker B:** So, yeah, it's all about trying to make this stuff as seamless as possible for people and as testable as possible. **Speaker A:** Yeah. And I think there's, there's an insight in there that even if the tools are available, if they're not, like, easy to use and they're not like, part of your regular toolkit, it doesn't really matter if they're there, people aren't going to use them. And so, like, it sounds like what was really important as you're building, like, the. Just the basic tools of Drorcera, to make sure that they look and feel and act like just what the application, the company, or the protocol, or the developer is actually working on feels like. **Speaker B:** Yeah, totally. Yeah. At least that was my experience with making these monitoring systems, was that it felt like when you're at that EVM level, writing smart contract code, it feels so natural. Like, if I want to grab this data, I just write a line of code that goes and grabs that data. If I want to interact with the smart contract, I write a line of code that interacts with that smart contract. It's very natural and straightforward. But when you are making, like, monitoring infrastructure, you always have to end up making like a wrapper around the EVM where you're like, mapping data from the EVM to whatever language or framework that you're trying to build monitoring in. And it acts as like this severe bottleneck for how quickly you can adapt and how quickly you can evolve your software. Because you always have to keep adding this, like, mapping piece in this translation piece, and you have to keep making sure it's correct, adding tons of tests around it, and it becomes like a huge, huge hassle. The analogy that I like to use here is it's kind of like at the EVM level, when you're running solidity, it's like you got your Lego blocks right? And then in monitoring world, it feels like you're using mega blocks where it's like, well, like, yes, I can put these pieces together, but, you know, I don't get as much, like, granularity and like, it's just not as easy to use and it's honestly not as fun. And I think that that's like a really big part of this is, like, setting up security infrastructure should be enjoyable. And I think that could be a big part of why we kind of have an issue in the space. **Speaker C:** Right. **Speaker B:** Is that it's a barrier. Like, it's, it's difficult to set this stuff up just because a number of challenges. So give the people what they want, Let them use the evm, you know, to the full extent of what it provides to us. **Speaker A:** Yeah, and just to hammer home your point, like, how many times have we all written code where it's like module A, we like know it works and module C, we know it works, but for some reason like the, the whole system isn't working. And then after like 35 hours of debugging, you realize that in module B, which connects them, you just forgot to multiply by two or you've just forgot to do a negative sign or like, and, and that's exactly what you're talking about, is that before Drosera, if you wanted to set up monitoring and then like action plans against that monitoring, you're responsible for basically frankensteining together like the enough tools. And like, even if you're willing to do that, you're just introducing so many more opportunities for bugs and for issues and for latency and like all this kind of stuff. **Speaker B:** Yeah, yeah, yeah, that's so true. Yeah, it really hits home because that, that was the number one issue that I saw like right out the gate. So working on Drosera and making this feel like a natural component for developers, it makes me excited about using it because like, you know, I want to be able to set this stuff up and have like, you know, a whole host of different like, security infrastructure traps where I can just like deploy something and then I don't need to worry about making sure that I'm hosting some server somewhere, etc. I can just make sure that the trap is incentivized and then the operators in the decentralized network will pick up this trap and start running it. **Speaker C:** Right. **Speaker B:** So you kind of get to fully leverage decentralization, trust, minimized compute and EVM all in one. **Speaker A:** So I think it might be useful to kind of walk through a hypothetical here. So let's say that I just raised a bunch of money to, to develop and deploy Rex swap and sorry, VCs that just gave me money. Like all it is is just a super simple deck. It's like uni V2, but I don't even have multiple pools. I just have ETH to usdc, right? So I realized that this pool is going to have $10 billion in it very shortly. And so I'm like freaked out about security now if it's helpful, maybe talk through what I would do without Drosera. But really what I'm interested in is like, what does it look like for Drosera? So first of all do I need to do something special with my smart contracts that are just like the Dex smart contracts? Do I need to give any privilege access to like Drosera operators? **Speaker B:** Yeah, so this like really cuts to like a very important part of like how the system actually works the way that we have it set up is that essentially if you have some privileged functionality, maybe to pause your contract, freeze some part, some functionality of it, do something about a dependency you have, or just really like take any type of action that requires some type of like higher level privileges. All you really need to be able to do is make sure that you add like a require statement that that functionality can only be triggered from the Drosera TRAP contract and the Drosera TRAP contract can only trigger that action if there's been an emergency response payload that's been submitted to the contract from the operators that has at a minimum 2/3 signatures of the operators that are run your trap. And so this acts as like a threshold signature, right, to make sure that there's been, you know, if you have like 20 operators, right, you get a majority of them that say an incident has occurred and the contract will verify this, these BLS signatures that they're actually correct, that these people did a test that's saying that your emergency condition did trigger. And then once it's verified that that's true, then the emergency action, the function that has been pointed to, is allowed to be to be hit. So it's like less of an operator specifically having access to hit your functionality and it's more about the network that is opted into your trap and them have coming to consensus basically on whether this incident has occurred. Additionally inside of there we're using risk zero as a way to do fraud proofs. So basically there's like a dispute window after an emergency action has been triggered. And in this dispute window a disputer can submit a ZK proof that says I have like evidence of what really happened. **Speaker C:** Right? **Speaker B:** I can say mathematically that the incident didn't occur and that the 2/3 of operators that submitted this actually colluded. And so then they can all be slashed and removed from the network. Yet that that's like a really big aspect of the system to make sure that you have like accountability. But additionally we have functionality where even if you don't have any of these operators that are, you know, coming to consensus, you can still submit a ZK proof that an incident occurred as a validity proof rather than a fraud proof. So that validity proof means like if nobody has attested that the incident has occurred, I can generate that fraud proof and I or the validity proof and send it on chain and it'll trustlessly cause for that emergency response to trigger without there needing to be any type of social consensus. **Speaker A:** Super interesting. So I want to put a pin in this and come back to it, especially around like, what are the implications of having a challenge window for an emergency response? Right. Like those same intention, but. But let's just continue walking through this REC Swap example. So, okay, very clear on how this is architected. I deploy Rex Swap and I decide like, if I ever see more than 10% of the LP leaving the smart contract, I'm going to consider that an emergency, like that's probably a hack. If it's not a hack, I still want to treat it like a hack and then kind of go from there. So first thing I do, correct me if I'm wrong, is in my Rex Swap smart contract, I create this special pause function that is only called by whitelistable addresses. And then in there I might put myself the other multisig owners, but importantly, I put the Drosera emergency response smart contract. Correct? **Speaker B:** Yes, that's correct. Yeah, yeah. You specifically identify. Yeah. This the TRAP contract. **Speaker C:** Yep. **Speaker A:** So then I'm like, okay, so I've got everything wired up now I need to create my TRAP or my emergency condition and through solidity and however, whatever tools I'm using, I essentially through code. Right. If you see more than 10% of the LP withdrawn, trigger the emergency function. Okay. And now I give my trap template to the Drosera Smart contract. So my question now is like, what happens? Is it basically everyone in the Drosera network is now responsible for monitoring that trap. Are participants opting in and committing to that trap? Like, what's the next step in this process? **Speaker B:** Yeah, yeah, they're essentially the participants can opt in to whichever trap that they really want to support and run infra for. So these participants are running a Drosera client, and when they opt in, the client automatically picks up that they opted into the event and then it'll essentially go query for the trap information from a seed node. These seed nodes are essentially just nodes that are given this trap information from the user. The user uses like a CLI to create their trap. And so basically these operators are able to opt in, get the TRAP information and then just start running it. Just start running it for every block. And. Yeah, and so that's essentially like how they're able to opt into the system. And we've yet to do any like, benchmarking on this. But we foresee that like operators should be able to run multiple traps. And so this can actually be really, really nice because then they can get incentives from all of the different traps that they're running. The more traps you run, the more incentives you get. **Speaker A:** And so when we're talking about incentives. So I've created my trap. More than 10% of the LP trigger the emergency contract. How am I incentivizing it? And am I essentially saying if anyone ever triggers this condition, then here is the, like, you're allowed to take this bounty and then for the next one I'll just need to re up my bounty. Am I paying people just to have them constantly like monitoring the trap even if it doesn't trigger? How does incentives work? **Speaker B:** Yeah, so with incentives, basically set it up in a way where you create token streams. And these token streams is essentially like, I submit, let's say like 100 USDC. And this 100 USDC will be given out to operators on a passive basis. But then a big portion of that USDC actually goes to something that's like kind of considered a bonus pool. And this bonus pool is like the reward that gets distributed to the operator that submitted the incident and it goes to. It gets distributed to any of the signers that participated that said, yes, I saw this issue happened and committed and attested that that issue happened. So it's a mix of kind of passive and active rewards. You're paying for people to be able to run this passively. **Speaker C:** Right. **Speaker B:** Because your emergency may not happen. **Speaker C:** Right. **Speaker B:** But people are still getting paid a passive rate just for participating. And the way that this works is that, you know, let's say that you created this token stream. You know, you create this token stream over a month period and you re up on this token stream every month. That bonus pool, it will still fill up with over time and eventually kind of get you to a point where there's actually like a very large incentive for operators to perform your emergency response when it happens. Because it's kind of like this big jackpot where everyone wants to be the first person to submit that emergency response and to get those rewards. This acts as like a really nice pipeline for making sure that these emergencies get caught as soon as possible. But also they, these emergencies, these emergency like transactions can actually be included on chain by making sure that you work with like block builders to make sure they also get some part of the incentive. **Speaker C:** Right. **Speaker B:** To make sure that you could even have a emergency response happen the next block. **Speaker C:** Right. **Speaker B:** That's really what we want to shoot for with Drosera is to be able to have that emergency action happen as soon as possible to mitigate as much damage as possible. **Speaker A:** And just there's a clarification question that's much too in the weeds for a podcast like this, but are so, so we have the, like, the big bucket of money that is paid out to, like, anyone who actually catches incidents. Does that stay isolated to each trap? So, for example, like, let's say Rexland actually turns out to be pretty good code. And so even though I'm paying you in perpetuity for this monitoring service, it never gets triggered. Meanwhile, the Ronin Bridge gets hacked again. And. But fortunately they're hooked up in Drosera. And so someone is able to, like, step in and do a mitigation. Is the money that I paid in to the bounty pot going to pay out the person who stopped the Ronin Bridge hack, or does that stay isolated just to my security thing? **Speaker B:** Exactly, exactly. It would stay isolated to you. It's kind of like you, you're. You're. You're putting gas in the tank of your security infrastructure. And I think that's. It's really important to think about it that way. Where a trap is kind of. It's not like a consumable thing where it kind of has like a start time and an end time, and then it's done. It's. When you create a trap, it's yours. It's something that you own, and it's something where you can update the security conditions, you can update your emergency conditions on it. So money that gets put into that jackpot, you know, the more that fills up over time, it kind of is like this large incentive for people to continuously perform emergency response where you run your security infrastructure, whether, like, you change your emergency conditions sometime down the road, maybe you just added a new dependency on an insurance protocol or a dex. Another dex, maybe, Or a bridge like Ronin. **Speaker C:** Right. **Speaker B:** And you want to make sure that if Ronin gets hacked and it gets paused, that you take some type of emergency action to make sure that your users don't get affected. That jackpot money will then go towards the operators to make sure that they are, like, actively performing your emergency response for you. **Speaker A:** And do you foresee a world where, like, let's say, okay, I've got Rexland, I have a lot of money, but I don't really want to be paying anybody in perpetuity for something like security monitoring, but I would be interested in, let's say, dropping 30 ETH into the jackpot pool, knowing that if that swap to Stakey, then like, that could create enough revenue to pay for the streaming part of the incentives. Is there. Do you ever see construction like that? **Speaker B:** Yes, absolutely. Yeah. It's funny you bring it up because, like, that was kind of the first thing that we really started on when we started thinking of incentives. Because, like, obviously we want to be able to lower the barrier to entry for this stuff, right? So we want to be able to make sure that those costs that people have to pay are really like as small as they can be. And so we do kind of have like a plan to kind of have this idea of defi. Incentivize security, where you can have like an LST staked on the platform and then, you know, a percentage of this, the LST yield over a year is actually used to help incentivize Drosera traps. **Speaker C:** Right. **Speaker B:** So it could be something where, you know, you've been an active participant in the Drosera ecosystem, you've been running traps, and maybe there's a way for you to get some of that yield because you've been such a large participant. And this like, lowers your cost. It lowers your cost to run the infrastructure. And the way this infrastructure, this payment infrastructure is set up is also where we want to be able to whitelist native tokens for protocols. So if you're, what was it? Rex Dex? If, if you have a native token, if you have, if you have a native token, you know, perhaps as part of your emissions that your, your, your kind of like yearly emission rates, you may choose for a portion of that to go to your security trap. **Speaker C:** Right. **Speaker B:** And so those tokens would then flow down to the operators running your security infrastructure and that helps align the incentives. **Speaker C:** Right. **Speaker B:** Because now those operators really want to make sure that your protocol is doing really well and has a really good health factor because, well, they're kind of economically like attached. **Speaker C:** Right. **Speaker B:** Because they're getting paid in those incentives. **Speaker C:** Right. **Speaker B:** And so that, that also allows for people to kind of make sure that there's an alignment here. Yeah, which it kind of like leads itself a little bit into the Eigen layer piece when talking about like alignment. **Speaker C:** Right. **Speaker B:** Alignment with an application and then alignment with Ethereum itself. **Speaker C:** Right. **Speaker B:** You know, what we're talking about here is like basically with eigenlayer, you can actually make sure that validators are aligning themselves with your protocol. Validators are not only doing verification and security for consensus and execution layers on Ethereum, but now they would be doing security for an application layer like your application. **Speaker C:** Right. **Speaker B:** And so this helps to make sure that your DAPP is aligned with Ethereum itself, which is like very beneficial, right? To make sure that you have like a growing ecosystem. **Speaker A:** And I definitely want to get to Eigen layer, but I'm going to push us off to the last 10 minutes there because the last piece that I want to unpack with integrating or using Drawsera is like, you have to craft your protocol knowing that it's there. So we'll go back to Rex decks. Like we have agreed that we have this pause functionality that Drosera and maybe the, maybe a few other people are white listed on. Cool. Makes sense. But the problem is like if I don't build into my decks a, let's say five block delay between when the withdrawal command is sent and when the assets actually come out of the decks. Really doesn't matter how many people are monitoring and how many people are willing to push that button if like when you hit withdraw, the assets immediately come out. There's just not enough time for someone to like get in the way of that hack. And so I would love for you to spend some time talking a little bit about what does it mean to design protocols with one, just this kind of security in mind. But then two, like, what are the particularities about making your protocol strongly aligned with the Drosera security paradigm? **Speaker B:** Yeah, there's kind of like two pieces to that. One is actually like, certainly you can create your protocol with Drosera in mind, right? Where you maybe have certain functionality, you know, you want to be treated as emergency response functionality. But like obviously there's also updates, upgrades. Being able to upgrade and add new functionality is certainly another way that you can become like Drosera aligned. But additionally, there really is no constraint on making sure that like your emergency functionality is built into your protocol. You could set up another smart contract that has functionality that you want to be executed as well, right? So you can make new contracts and specify emergency functions to be hit on the, on those as well. Additionally, you can also have functionality where an emergency response is triggered and you could have off chain systems see that this emergency response has been triggered and you take any, any types of actions. Like maybe you're using Zapier, right? And you will have Zapier looking at, looking for like whether this emergency action is taking place. And then it does a couple of different off chain things, right? To be able to like maybe send you additional alerts or maybe do some other things off chain so you're not super pigeonholed to having to integrate it directly into your contract, you're able to kind of use it really kind of however you want to be able to use it though, obviously I think integrating with your contract is where you get the biggest punch, right? That's where you get like the strongest value, is being able to do something with like authority at your protocol level. And then I guess the second piece here is this idea of like being able to react as fast as possible. Like if there is like a drain that happens and there's like a six second withdrawal window, right. You want to be able to make sure that Drosera can act as soon as possible. **Speaker C:** Right. **Speaker B:** Like that's the thing that's the most important for us is that we want to be able to have, have this emergency action happen the next block. And so you can look at previous hacks that are multi payload, where the hack occurs over like, you know, 50 blocks, 100 blocks, multiple pools are being drained. All you really needed to do with Tracera would be able to see that one of these pools got completely drained and then taken some action the next block and saved a couple million dollars because then the other pools wouldn't have been drained if it had been paused or some action had been taken. **Speaker A:** So I, I take your answer to be like, yeah, it's important to build a smart contract with like emergency functionality built in, but that's not really that heavy of a lift. Does that sound right? **Speaker B:** Yeah, it's, I would say that, you know, if a protocol developer has created a whole protocol, then this piece of the functionality should be like very minor. I mean it should be a very small lift. **Speaker A:** Yeah, I guess like, last piece on this is as you kind of like describe some of these use cases. Like a part of me is like, yeah, this is super valuable for protocols, but also I think about like myself as a participant in DeFi and there's like so often that I just don't really want to put my assets in protocols. Not because I don't trust the protocol, but because I don't know what's going to happen. And like, even to the point where like I'm concerned with putting like Ethan Ave to take out a USDC loan, like probably the most vanilla thing you can do in this industry, but because I know that like it is very possible that something happens while I'm in, in Colorado next week without my private keys. Right. Or I'm just doing something where I can't respond. And so I guess my question for you is it makes so much sense to build Drosera as kind of like a B2B or protocol to protocol business. But how much opportunity do you think there is for just users who want to be sophisticated and safe in this space to use either Drosera or platform like that in order to just take their OPSEC to the next level? **Speaker B:** Yeah, I mean, I think that like in terms of, I suppose like your question is like how easy it is or what are the. What should they be thinking about to increase their opsec? **Speaker A:** Yeah, well, I guess my question is, as you're as an entrepreneur and as like a leader of Drosera, do you find this to be like an interesting segment of like power users and whales that have enough at stake that they're willing to pay for like protocol level security? Or is that like a little bit of a pipe dream? And really what this is about is about making protocols more secure? **Speaker B:** Yeah, I think that absolutely. It opens the gates for protocols to do B2B plays for individual whales, insurance protocols. I mean, I think that this is kind of going to open up the space for like anybody to have some type of like decentralized compute that they can have done where it's going to help potentially like protect them from really bad situations or really honestly take any type of action that they just determine that needs to be made. **Speaker C:** Right. **Speaker B:** Like a really good example is like if USDC is depegging, right, maybe you want to be able to have your funds get swapped out to a different stable. That's like a very simple use case where it's really easy to see if it's depegging or it's like depegging very heavily. **Speaker C:** Right. **Speaker B:** So that would be a case where it's like, well, I'm about to get on this plane and it looks like, it looks like the stable coin is de pegging. Like I don't know what to do, right. And then have to wait it out and just pray and hope that everything's going to be fine. With something like Drosera, it should be as easy as basically like setting up the smart contract and then deploying it. **Speaker C:** Right. **Speaker B:** And you know, you could pay, you know, like 100 USDC or 100E, right? 100, yeah, 100, yeah. You know, you should be able to essentially like pay with like any kind of token to be able to incentivize this. And I think that there's also a play there where there'll be operators that may have like a focus on particular protocols or even like for particular whale groups where it's like, hey, I'm an operator, I run under Sarah and you guys are basically saying like, you have the security infrastructure that you need me to run. We can kind of like set up a deal and we can use this marketplace to facilitate that deal. It's like, I know you, you know me, we can run this infrastructure and it can, it can allow for kind of like broader network effects where people can kind of become experts at doing a particular type of monitoring. I think FDR puts it kind of like looking at a new form of like security engineer called trappers. And so these trappers kind of like expect to see them like look at all the different unique use cases for how you can build a trap. And like who, what type of trap is the best template or framework for a particular protocol or to a particular DAO even, or to a whale. So yeah, I think that it's certainly wide reaching and the biggest goal here is really to make sure that we help like the little guys as well. **Speaker C:** Right? **Speaker B:** Because that's, I think the, the kind of like lifeblood of, of the space is, is the people that are still small but making really cool stuff and making sure that they're able to survive long enough to get out of strange waters. **Speaker C:** Right? **Speaker A:** Yes, yes. No man. And, and as you just kind of walked us through that, you made one comment that was essentially like, we're trying to build a network of computers that allows you to like take to do compute like when it's needed. And on this show we talked to so many companies that are built, essentially figured out that with ZK you can do off chain compute projected back into the EVM and like blah blah, blah, cool things from it. And we've talked to a lot of people that have essentially said we're building a network of computers to do computation and then put it back in. But with Drosera, this is the first time that I am hearing someone say we are building a network of computers to take action based on time sensitive information. And like that I think is, you know, I very much appreciate the entire framing and the focus on security and like the, that's of course what you need to do in order to raise money and to like stay focused and to build and all this stuff. But just taking a step back, like everything that you're talking about is so much bigger than security. Like for example, the USDC DPEG that you just described. Yeah, I can make a trap that says like, okay, if you start to see USDC dpeg, trade out all of my USDC for usdt. Right, but you could also do it the other Way you could say in the event of a USDC dpeg, take all my USDC and buy as to opposed much unpegged USDC as possible. And now suddenly your, your security infrastructure becomes just about time triggers and about of like seeing these like very specific, like articulated things on chain and then doing things related to that. **Speaker B:** Absolutely. Yeah. It's, it's, it's like under the umbrella of just risk management in general. **Speaker C:** Right. **Speaker B:** Because that's really what we're talking about here is it's all about risk management. And what we're not the ones saying your trap has to be this way or it has to have this functionality. Like we're saying, hey, like you, you guys are the ones that want the security infrastructure. You should be the ones to define what it looks like. And we definitely are going to give people lots of examples to take inspiration from. But yeah, we want to be able to make this be like this risk management framework, right. Where people can come and, and just set something up. And it kind of reminds me of something I've kind of talked about in some other Twitter spaces, which is like the way that I kind of see crypto right now is it's very much like, reminiscent of like, you know, your web two days where things were like still very simple. Websites kind of had maybe one or two services. **Speaker C:** Right. **Speaker B:** But, you know, now I think like with new innovations in the space, I think that we're going to see protocols that are using multiple services, similar to how Web2 is now, where there's like one website that uses like 15 different services. And I think that with Coursera, one of the really main points that is unique about it is that it should allow for people to create these security conditions where it's actually actively monitoring your services and your dependencies. Because if one of those things goes down, you want to be able to have your system react to make sure that there is no like fallout. You know, you want to like contain the damage. And I think that, you know, this space is like super complicated, right. There's just so many different pieces of a system that could break down. And as of right now, I feel like we don't have the dynamic piece built in yet. I think we're really focused on static kind of analysis of contracts, which obviously you need. But it doesn't feel like any of these, any of these protocols or contracts are like going and looking over at like what's happening over in this ecosystem that I'm like heavily attached to. **Speaker C:** Right. **Speaker B:** It feels like that part is much more social and manual. And I think it needs to be automated so that when bad things do happen, that we can like activate and we can make sure that something is done to protect users, to protect your own funds, to protect yourself, just in general. **Speaker C:** Right? **Speaker A:** Yeah. Makes a lot of sense. So I promised that we get to this with our last like five or ten minutes here. Talk about restaking and talk about how that transforms what Drosera is doing. So I with. I can imagine, without putting words in your mouth, why don't you just like walk us through, through first of all, like how at the basic level does Restaking get integrated into dra? And then maybe you can talk through why DRA is a much more powerful platform when the participants are leveraging Restaking versus basically everything that we've talked up to this point, which is really just more about people acting like, somewhat altruistically in this network for incentives, but also just because they believe in security. So can you talk through how Restaking transforms Drosera? **Speaker B:** Yeah, yeah, absolutely. Yeah. So I think that it's like a big thing in the kind of like restaking and eigenlayer ecosystem of like, we've created these systems that has tons of, tons of incentives. But we need some disincentives, right? We need some way to make sure that there's like a counterbalance. And I think with restaking, you basically can make it where people kind of have a voting power, right? They have like an amount of capital that they can use to say, you know, I am putting my money where my mouth is, like, I'm an honest actor and I'm putting my money here to say that if you catch me colluding for me to get slashed and obviously anybody else involved to be slashed. And, and, and this is like super important to make sure that you basically have this super trust minimized way of doing. COMPUTE is holding people accountable, right, with this kind of like punishment slashing mechanism. **Speaker C:** Right? **Speaker B:** And so with, with restaking, it not only gives you that ability, right, Slashing, but also comes with it. And this type of crypto economic security, the amount of restate capital that is available to be slashed or, you know, this used for accountability, acts as like a barrier for corruption, right? The higher it is, that means the harder it is to kind of have the participants collude. It kind of comes down to like really basic equation of what is it? Cost of corruption versus profit from corruption. So you always want to make sure that your cost of corruption is higher than profit from corruption. And that's how you kind of have Like a non gamble system where like people, if they wanted to collude, they would only lose. Basically they wouldn't really gain anything. And so with restaking you could make sure that with Drosera that people are a staking up to a certain threshold to where the amount of operators opted into a trap have more at stake than perhaps the amount of capital in the protocol they're protecting. **Speaker C:** Right. **Speaker B:** I think that is like definitely a longer term vision of imagining having a whole host of these operators with restate capital, you know, protecting all these like smaller protocols and kind of like lifting them up over time. **Speaker C:** Right. **Speaker B:** Then and then obviously like aligning these, these operators with Ethereum itself Right by them natively restaking versus like an lst. **Speaker C:** Right. **Speaker B:** That's also like really important to make sure that incentives are aligned between Ethereum and your application and its security in general. **Speaker C:** Right. **Speaker A:** Yeah. And, and I'm so glad you said that. Like I, I always was and still am a fan of eigenlayer, but the second that it basically became a smart contract to put your lsts in so that maybe down the road we can have some sort of delegated proof of restake thing like that is nonsense to me. Native eth. Restaking makes sense to me. And so I, I just love that distinction. But I think. So I've been like really working hard on trying to articulate why this whole restaking thing is happening at the same moment that like the ZK gold rush is happening. Because like on. On face value, they just don't seem that similar. But I think where, where I'm really getting, and I think what you just said hammers it home. Home is that with zk it. It is actual magic. But it only gives us one half of what is so cool about crypto. Right? It only gives us like perfect fidelity and like trustless trust that whatever happened was supposed to happen. What it doesn't give us is liveness. And like what. What restaking does is introduce an economic, like you said, an economic penalty that allows us to like re bring in liveness and re. Like to use consequences to like kind of re put together what crypto economic security even means. And that was like super generic big picture, like what this means for Drorcera. And like really what I've been struggling with this whole time until right now is like, how do you guarantee that the Drorcera network is going to like move on your trap? So we're at Rex decks. Somebody just came in and withdrew 50%. And like it is clearly violating the trap. And my Question to you this whole time was, well, how do we guarantee that somebody is going to actually do the work to verify, hopefully two thirds, so we get the threshold signature or maybe just one person with the validity proof. But, like, how do we guarantee it? And I think the answer is restaking. Right. And I think that Drosera is a microcosm that explains, like, what is so magic and like, explosive about the moment that we're in. **Speaker B:** Yeah, absolutely. Yeah. Liveliness is basically where this stuff shines. Right. It's where you can make sure that people are acting in accordance with like, whatever rules you've basically put in place, your slashing conditions. **Speaker C:** Right. **Speaker B:** And I think that liveliness tends to be a very hard thing to solve. I think, like in Ethereum, I think it's like fairly complex and other chains actually do it differently. And so I think we're going to see as part of like, new AVs is standing up different ways of doing liveliness checks, but they're all, like, underpinned by the idea that, like, there's this precinct capital that kind of has a hammer over its head in case it doesn't act. **Speaker C:** Right. **Speaker B:** And so I think, yeah, truly that is the other half of the coin there. ZK and restaking, they're kind of like doing different things. One is kind of optimistic and then other one is more objective. **Speaker C:** Right. **Speaker B:** And so I think that that's where. Why they're on different sides of the coin. But in general, I think using them both is how you can get some really strong applications that have strong guarantees, you know, mathematical guarantees, like objective slashing conditions. And then also like, liveliness being backed by your restate capital. **Speaker A:** Yeah. And I just. I just want to like, package that up in a bow again, because this is such the perfect kind of concept to walk out on, is that, like, Drosera was works so perfectly without restaking and without, like, the stick. **Speaker C:** Right. **Speaker A:** Except for the fact that if nobody wants to, like, run a trap, then no one has to. And so, like, why restaking is so important is because by introducing consequences, you can really have that holistic system that says, like, this is what's supposed to happen. You're rewarded if you do the right thing. This is what's not supposed to happen. You're injured if you do the right wrong thing. And like, that is kind of like the magic of like, the ZK Restaking moment that we're in. And like, you guys just put it in this beautiful, perfect package that makes it so easy to see. **Speaker B:** Yeah, no, absolutely. Yeah. That was the vision, it basically allows for blockchain applications to exist in, like, new forms that you haven't seen before. And so that's. That's definitely what we're seeing with this. We're not sure what to really call it. It's not really like an app chain, but it's kind of. We've been calling it like a utility chain. **Speaker C:** Right. **Speaker B:** So, yeah. **Speaker A:** Very cool. All right, Man, I could go for so much longer, especially now that you just opened up this whole conversation about app chain, utility chain, maybe like infra chain. Zk. **Speaker B:** Yeah. **Speaker A:** Oh, man, there's so much. But just for the sake of your time and all of our attention spans, I'll cut it here. So, first of all, Boba, just thank you so much. I've been so excited for this for so long. First, since I heard FDR on the Flywheel podcast, which I highly recommend to the audience. Please check out. But also since, like, your incredible news about this most recent funding round. So, first of all, I just want to say congratulations and thank you for making this space just, like, a little bit calmer, a little bit safer, a little bit less hectic. **Speaker B:** Yeah, it's awesome to be on here, man. Thank you. I'll be on anytime. Just let me know. **Speaker A:** Of course, of course. We'll definitely have you back. But before I let you go, can you please just share with the audience where they can find you, where they can find Drosera? And maybe if they're hearing all this and thinking, like, maybe I could use for some emergency monitoring and planning, like, what's the best way to get started? **Speaker B:** Yeah, I mean, reach out to us. Drosera IO, you can find the dev docs there. And we just started some dev docs. You can check them out, get in contact with us in the discord and on Twitter as well. And I think that that should, like, give you some good headway to basically figure out how you could create a trap and how you could create security infrastructure with native solidity code. **Speaker A:** Awesome. And are you looking for Drosera node operators yet, or are we still a little early in that process? **Speaker B:** Actually, we've got quite a few groups that we've talked to a little bit over subscribed for upcoming testnet, but we're certainly still, like, reaching out to as many as possible, because I think that those are. That's like the lifeblood of Drosera is having these operators, having a really large set of them. **Speaker A:** Okay, so node operators, maybe wait your turn. But what that means for app builders is that there's already a very, like, wide and deep bench of people that are ready to be running your traps for you. So good news. Even if it means a little time, if you want to run one of these. **Speaker B:** Yep. Absolutely. **Speaker A:** Cool, man. Well, once again, Boba, thank you so much. Much appreciated. And have a great rest of your day. **Speaker B:** See you, man. Have a good one. **Speaker C:** Sam.