Paul Schulte, Advisor, Banking and Financial Services
August 22nd, 2019
Paul Schulte is the Founder and Managing Editor of Shulte Research based in Singapore. Paul's roles[...]
Category Archives: Fintech Interviews and Podcasts
A major UK lender just launched a digital bank to compete with Monzo and Revolut | Interview with Bó CEO
CNBC | Chloe Taylor | Nov 28, 2019
British lender NatWest has launched a digital bank to compete in the U.K.’s thriving fintech space.
NatWest — a subsidiary of RBS — launched cloud-based bank Bo on Wednesday, with the service going live on both Apple’s App store and Google Play.
Those who sign up to the digital bank will be sent a bright yellow Visa card and access their account via Bo’s mobile app.
Bo was designed to help people manage their money, according to NatWest, and includes features to help users budget, set savings goals and access “great Visa exchange rates” when using their card abroad. Users will also be instantly alerted whenever they use their card.
“As we’re part of NatWest, people can rely on Bo to keep their money safe,” Bo CEO Mark Bailie said in a press release Wednesday. “But as a digital bank, built entirely on a separate cloud-based technology, Bo is also able to harness new technology and develop rapidly in line with our customers’ needs and expectations.”
While banks are under increased pressure to innovate, they’re not facing an existential crisis, Raman Bhatia, HSBC’s head of digital for the U.K. and Europe told CNBC earlier this year. The lenders that will win in the long run, he says, are those that people trust.
See: Lagging regulation, consumer trust inhibiting FinTech adoption in Canada
“I think one thing which remains a truism is customers do have a very high degree of trust when it comes to money, their deposits and their identity with respect to established banks,” Bhatia said. “And banks need to work harder than ever to preserve that trust.”
Fintech competitors
But in spite of that advantage, Britain’s challenger banks are continuing to gain both subscribers and investment in droves.
Online-only bank Monzo is valued at $2.5 billion, while its rival Revolut is valued at $1.7 billion, making the companies some of the most valuable unicorn firms in Europe. Elsewhere, SoftBank-backed OakNorth was valued at $2.8 billion in February, while money transfer start-up TransferWise was valued at $3.5 billion this year.
Both banks are setting their sights on global expansion. In October, Revolut struck a deal with Mastercard to help it expand into the U.S., while Monzo launched in the U.S. in June. Meanwhile, U.S. fintech unicorn Plaid has expanded its service across the Atlantic into the U.K., Ireland, France and Spain.
One major lender that has already made some progress in offering a standalone digital service is HSBC, which in 2018 launched a money management app in the U.K. and signed 300,000 people up to the service in the first year.
Continue to the full article --> here
Oliver Wyman | Nov 2019
Interview With Mark Bailie, Former Group COO Of Royal Bank Of Scotland And Current CEO Of Bó
Many people in the UK have no savings. They are one misfortune away from being pushed into a debt problem from which they might struggle to return. A large proportion of consumers are either under- or over-insured.
Their financial struggles aren’t being addressed by the existing financial system. RBS concluded that its current attempts to digitize may not be enough, on their own, to address these needs. With the support of Oliver Wyman, RBS decided on taking a new path with a new offering, with a new brand, built on a new technology stack.
Bó represents a new breed of financial institution – a greenfield digital bank owned by an existing incumbent.
Oliver Wyman: What started the journey that led to RBS building Bó?
Mark Bailie: When he became RBS CEO in 2014, Ross McEwan made clear we had to start putting the customer at the heart of everything we do, and become customer, rather than product, centric.
From that foundation, there have been two key enablers we’ve needed to help us build Bó; first, having our customer data in one place and really analyzing our customers’ situations in depth. This has allowed us to see some of the issues our customers’ face – and what could be done to help them.
See: Inflection point:Seven transformative shifts in US retail banking
The second enabler came from the growing potential to deliver technology and services at scale, and the rapid development of machine learning, AI, and cloud computing capacity.
When you put these together you see the potential for major changes, and opportunities. We can see a combination of customer need and the potential for highly personalized financial services.
What was the thinking behind taking a greenfield approach to the build?
We knew the kind of outcome we wanted would be a long and hard journey for an incumbent bank to deliver, with product-centric legacy infrastructure. So, for us, the question we discussed was, “how long have we got?”
If it's 10 years, you can probably transition the existing core into a truly customer-centric business, because you can do almost anything in 10 years if you're good and you can execute - and we still have a Plan A around this.
But if customers start accelerating their move toward new offerings, and you’re not already operating in that market, then the downside risk is asymmetric. If you don't know the timing, and you can see the potential for a material impact, then you need to cover the risk, so long as the cost is sensible.
See: Big Tech takes aim at the low-profit retail-banking industry
Greenfield lets you sidestep the challenge of legacy infrastructure and get to a truly customer-centric offering faster — it’s the pragmatic solution. However, greenfield isn’t a cost-free strategy. It creates other issues, which we’ve got to learn to manage: we will have two tech stacks, and two brands. That has taken a lot of thinking through, and in the end you have to make your choice.
How did you reach the decision to build Bó?
We didn’t wake up one morning and decide, "let's build a new greenfield bank," or, “we're going to spend X, go away and come back when it's done.” This was done in measured but quick, incremental steps.
We took a very small amount of money and gave ourselves three months to see if we could put together a proof of concept, using enough of the components, and make it work. Having done that, we went to the next step, to see if we could make it work in a real-time environment with live connection to payment rails. Once we got there in the time period we’d set, the next step was to put it into a production environment, and then into beta.
How much did the threat of new challenger banks motivate Bó?
So far, we don’t think anyone is managing to deliver truly customer-centric financial services, and no-one's yet proven that you can disintermediate the existing banks. This has led to a relatively common response: “The challengers are never going to make any money, their business model is unsustainable.”
I think that misses the point; it's still a very young sector. Customers are using the new services and capital markets are funding them. The product isn't perfect, but some customers clearly like it, which is why you can see the adoption levels increasing. Although what they're doing today isn't yet the full answer, these business models will evolve and develop over the next five years.
What customer needs is Bó focused on?
RBS is a large bank, with just under 20 percent of the current account market in the UK. We serve everybody and are able to put together quite a detailed view of how people deal with their finances.
See: How AI may help solve banks’ customer relationship issues
We know that 40 percent of working-age adults in the UK – that’s just under 17 million people – have less than 100 pounds of savings. That’s not just down to incomes – relationships with, and understanding of, money are also factors. So, we see a clear need for services that can help those millions of people to manage their money better, but crucially, delivered in a way they are willing to engage with.
What is the secret to building a new digital bank within a large existing bank?
For me, there are three things we have found to be most important.
Number one is having full support from the chief executive and the chairman. Unless the CEO is driving the vision, there’s no point in starting, and the board needs to be willing to back the CEO. If these elements hadn’t been in place, we wouldn’t have started.
The second is, you have to separate it out from the core business, but still ensure the new business has Exco-level sponsorship.
The third thing, when you are a large existing bank, is that you have to build it within your existing risk appetite framework, and it must be aligned with your existing policies. You have to build these things so they can co-exist together in the long term.
See:
Continue to the full interview --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
 |  |  |
  |
Fintech Innovation: Sandboxes as a Tool (Presentation by Randee Pavalow)
The Toronto Centre | Nov 1, 2019
In this webinar, Randee Pavalow, a long-time TC Program Leader, shares her expertise in securities regulation and supervision. The webinar features issues such as the ecosystem and importance of regulatory flexibility, challenges for innovators due to regulation, and challenges for regulators dealing with Fintech solutions with a special focus on sandboxes.
Continue to the video on Vimeo --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
Interested in a High Interest Bitcoin Saving’s Account? Interview with Ledn CEO, Adam Reeds
NCFA | Craig Asano | Nov 1, 2019
NCFA recently sat down with Toronto-based Ledn's CEO and Co-Founder Adam Reeds (LinkedIn) to learn more about the rise of Decentralized Finance (DeFi) and the company's tremendous growth in Latin America.
There are a number of growing DeFi use cases based around blockchain technologies and decentralized networks from the issuance of stablecoins as a means to create monetary banking type services, peer to peer or aggregate lending and borrowing products as well as tokenized platforms all of which are providing underserviced markets with alternative solutions to traditional financial services with fewer intermediaries, lower costs and arguably improved security.
Q1. What’s the story behind the launch and ultimate vision of Ledn?
Adam Reeds: Ledn was conceptualized in 2016 after we, as founders, experienced a gap in the market for accessing financing for our bitcoin assets. Bitcoin has several fundamentals that make it very attractive for financing. Bitcoin is non-jurisdictional (it is the same everywhere, globally), has
established market value and trades 24/7, has strong liquidity and is divisible. Yet despite these strong attributes, at the time of conceptualizing Ledn, as still today, there are limited options for financing bitcoin.
Listen: Bitcoin Backed Loans and 2x Credit – Putting Your Crypto to Work
From inception, we wanted to be sure that Ledn was accessible to everyone globally. To do so we knew that we had to build a platform that was simple and secure with a strong focus on compliance. We assembled an experienced team of technology, finance, legal and regulatory professionals and set out to build an online platform where individuals and businesses can access financial services for bitcoin.
Ledn’s mission is to help more people save in bitcoin, while standardizing rates and service for financial products globally.
Q2. We see that Ledn has a growing list of products, can you give us a brief run-down and talk about the markets and traction to date?
Adam Reeds: Launching from Canada, Ledn now active in 51 countries and has launched 3 products to date.
Its first product is Borrow - a bitcoin-backed loan which allows people to borrow dollars without selling their bitcoin. The second product is Save - a interest-bearing savings account that pays interest on bitcoin, in bitcoin. Its most recent product is B2X - a product that allows customers to instantly double their bitcoin holding by tying the purchase of bitcoin together with a dollar loan.
Given the need for improved financial products in the region, and the background of Ledn’s team, Ledn’s focus market (outside of Canada) has been Latin America and is seeing very strong traction of its products in the region to date. Over 51% of Ledn’s customers are now from Latin America.
Q3. Are all borrowers/loans considered equal or are there restrictions on who can borrow, use of funds, liquidity?
Adam Reeds: The great thing about dealing only in bitcoin is that we can treat all of the assets of our customers equally. Given our loans are asset-backed, we do not consider the credit quality of our borrowers in our underwriting. Our qualification in considering who we interact with is completely tied to ensuring we follow Canadian and local laws.
The great thing about dealing only in bitcoin is that we can treat all of the assets of our customers equally.
We abide by the Financial Transactions and Reports Analysis Centre of Canada (“FINTRAC”) regulations with respect to know your customer (“KYC”) and anti-money laundering procedures. We require all of our customers to complete KYC documentation regardless of the amounts we deal with, and consider strong compliance a key factor of our success to date.
See: Living on Defi: How I Survive Argentina’s 50% Inflation
Q4. A high interest bitcoin savings account is interesting given the low rate that consumers and businesses generally earn in traditional savings accounts. How does this work and has there been a lot of interest to date in the service?
Adam Reeds: The economics of the savings account relies on a market demand for borrowing bitcoin. Typically, there are three main use cases for borrowing bitcoin; (1) providing working capital for an exchange that needs to keep a float of bitcoin to facilitate buy-orders, but does want to take bitcoin price risk, (2) facilitating short positions, for proprietary trading firms to bet a price decline in bitcoin or (3) facilitating trading arbitrage opportunities such as differences that exist in the price of bitcoin on various futures markets or exchanges.
The interest rate that Ledn is able to pay on its Savings account is dependent on the demand for the various activities above.
Ledn has had strong uptake in its savings account as it is a complementary product to the loan portfolio - providing a way for users to earn more bitcoin with their bitcoin.
Q5. What kind of Canadian regulations govern the Ledn platform and services?
Adam Reeds: Canada’s FINTRAC rules related to AML and KYC were recently updated to include dealers in virtual currency. However, FINTRAC has not yet opened up registration for this activity, as the requirement to register as a Money Service Business (“MSB”) will not come in place until June 1, 2020. Despite the registration not yet being available, we have taken a proactive approach and have built KYC requirements into our technology platform from day one. All of our customers are required to complete KYC documentation to access any of our products.
We also follow and abide by regulations related to consumer protection and private lending activities both in Canada, as well as the local laws for which its customers are resident. On top of it all, we abide by a simple concept - there’s what you have to do, and what you should do - we do what we should do and have enforced strong compliance in all of our technology and processes. We treat our customers fairly, and focus on keeping our products simple and transparent.
Q6. Tell us what inspires you the most these days?
Adam Reeds: Most of the world does not have the savings tools that Canadians benefit from. In Canada, we have the luxury of stable real estate and capital markets, and have many options for investing and storing our wealth. For those that lack these savings tools, bitcoin is proving to be an incredible alternative. Ledn is excited by the potential to work with an asset that can unify standards for financial products, and deliver a better experience to people around the globe.
Most of the world does not have the savings tools that Canadians benefit from.
Q7. Do you have any insights or lessons that you’d like to offer the community on founding a fintech startup in Canada?
Adam Reeds: The most important thing in a start-up is to start. Great ideas are 10%, execution is 90%. Surround yourself with people that bring diverse skill sets and motivate each other. Each person you add to the team at the beginning of the company will make or break your success. Choose wisely, and for those that agree to join you on the journey, treat them well and align them with what you want to build - as a team.
See: Lock BTC, Get DAI: Lending Firm Bridges Bitcoin-DeFi Divide in Latin America
Along the way, make sure tasks are solved in this order.
- What do we want to do
- Why are we doing it
- How do we do it
Most people forget about the why - it is the most important part.
Canada’s diversity is definitely its strength. Albeit all Canadian citizens, Ledn’s team consists of only one born and raised Canadian, with the rest of our full team originally from Venezuela, Panama, Cuba, Croatia, Egypt and Hong Kong. We are proud to have built Ledn in Canada and to bring our company to the world stage.
Thanks Adam - wishing you and the entire Ledn team all the success at scaling Ledn's model globally!
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
Globalizing Fintech In Action: A Discussion With Harinder Takhar of Paytm
Forbes | Alex Lazarow | Oct 27, 2019
Fintech used to be a local game. Increasingly, fintechs are taking a global stance. In my recent op-ed, I covered some of the drivers of this phenomenon, including an evolution towards regulatory openness, the rise of fintech enablers and a shift towards a more global outlook.
To dig deeper into this growing trend, I sat down with founders of leading fintechs who have successfully navigated multi-market expansions. The first in the series was with David Vélez, Founder and CEO of Nubank, an emerging markets financial services provider. Today, I sat down with Harinder Takhar, the CEO of Paytm Labs Inc., and former CEO of Paytm India.
Below we discuss Paytm’s multi-market lens, from starting out in India, to expanding across Canada, Australia, Japan and beyond.
Alex Lazarow: Could you tell us about your business?
Harinder Takhar: Paytm was founded in 2010 and is one of the first digital payment platforms in India. Not only does the company offer individual transactions, merchant payments and point-of-sale systems. It now also offers financial products such as credit cards and the first mobile-first bank with zero online transaction charges and no minimum balance requirement. Paytm has also invaded the ecommerce space with Paytm Mall, event ticketing services, wealth management, insurance and digital gold services.
See: India Challenges China in Global Fintech Fundraising
In 2014 we expanded to Toronto, Canada and started Paytm Labs Inc. We began as a research and development division of Paytm where we’ve applied big data, artificial intelligence and machine learning to Paytm’s data assets to provide optimal financial products to over 420 million consumers and over 12 million merchants in India.
In 2017, the Paytm Canada application launched and offers a consumer-facing mobile app allowing Canadians to pay their bills using multiple payment options and the ability to earn rewards via their smartphone. We are a registered Money Services Business (MSB), which is regulated by FINTRAC. As we continue to grow our operations in Canada, we opened an office in Montreal in the summer of 2019.
In 2018, we embarked in a joint venture between Paytm, Softbank and Yahoo! Japan; known as PayPay. Teams from three different countries came together to launch a QR-based smartphone payment settlement service in Japan offered to both merchants and customers.
Lazarow: How did you choose your first market?
Takhar: It was a tough personal decision to relocate to Canada. However, once I officially received an invitation to immigrate to Canada, I could not pass on the opportunity for myself and my family.
Upon settling into Canada, both myself and Vijay Shekhar Sharma (Paytm Founder) agreed that opening a research and development division in Toronto, Canada would be in the company’s best interest. With the some of the world’s best educational institutions located within the province of Ontario, offering the best computer science engineering programs, it was a quick and easy decision for both of us.
See: India Challenges China in Global Fintech Fundraising
Lazarow: What factors went into the decision to expand? How did you know it was the right time?
Takhar: Back in 2014, big data, machine learning and AI were still gaining traction. At that time, the Paytm app had ~22 million registered customers. While we were able to identify the problem, in our case fraudulent transactions, finding a solution was trickier. This is when we knew that we must develop a system internally.
And, we did just that! We built an in-house anti-fraud platform that uses machine learning to identify fraudulent transactions. It provides real-time streaming data processing engine that allows small business owners and larger retail merchants with the ability to build customer risk profiles. The profiles can be used to create rules and render a fraud action recommendation.
Today, this platform makes up to 50 million decision points per day, and over 130 billion in transaction volume per year.
Lazarow: How did you prioritize your next couple markets?
Takhar: We prioritized by the individual opportunity in the market, and the readily resources that are available to us.
Lazarow: What was required to expand in the new market?
Takhar: Whenever we enter into a new market, we start with looking at the infrastructure. We focus on getting to the core of the problem, building a solution that works for that market, and then using technology to solve that problem.
Team perspective is also very important to us. We look for and hire individuals that have passion and ambition. So, whether we are looking for buy-in internally, or building a new team in a that market, it’s important for the team to emotionally connect with the cause, so that they can help build the best solution.
See: Fintech Investor Interview: Karim Gillani, General Partner, Luge Capital
Lazarow: What were some of the biggest challenges in expanding to new markets?
Takhar: Naturally, each market has faced its own challenges. The key is to not get discouraged, but to look to the end-user and solve the problem that you know will help to simplify their lives.
Lazarow: How do you work with regulators in your new markets?
Takhar: It is important to work with the regulators in any new market. We make a point to get to know the key stakeholders, build a trusting relationship with them, finding out what it is that they require from us, and showing them what it is that we are trying to build.
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
Omer Ismail — Head of Marcus U.S. (Goldman Sachs’ Consumer Business)
Wharton Fintech via Medium | Peter Jankovsky | Sep 15, 2019
In our latest podcast, Peter Jankovsky (WG’20) is joined by Omer Ismail, the head of Goldman Sachs’ US consumer business.
In this role, Omer oversees the Marcus by Goldman Sachs and Clarity Money businesses as well as the Goldman Sachs/Apple credit card partnership.
Omer was originally the consumer business’ first employee, and under his leadership, Goldman Sachs’ US business has grown to over 4 million customers, $5 B in loan balances, $50 B in deposits, and 1,300 employees.
See:
-
Goldman Sachs is slashing employee pay as it ramps up new tech ventures like the Apple Card
-
Inflection point:Seven transformative shifts in US retail banking
-
What does the future of banking look like, according to the experts?
In this extensive interview, Omer dives into:
- The story behind Goldman’s decision to enter consumer banking and how it went about understanding consumer pain points to deliver a unique value proposition
- How the consumer business operates as a distinct business within the broader Goldman umbrella, and how its focus on constant iteration of design and UX delivers a differentiated customer experience
- Surprises and challenges that Goldman tackled as it scaled its consumer business
- Thoughts on what’s next for Goldman in the consumer banking space, as well as Omer’s view on opportunities/challenges in the market
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
Expert Roundup: DeFi Smart Contract Audits
DeFiprime | Nick Sawinyh | Sep 19, 2019
When it comes to “being your own bank,” having the ability to evaluate the security of the tools at your disposal becomes a necessity.
A software audit is a process where an individual or team examines the code that lies behind a piece of software with the goal of uncovering any bugs, security breaches, or violations of programming conventions before the code gets deployed. Smart contract audits play a critical role in evaluating the technical risks associated with a dApp but as a relatively new form of code, the standards for software audits of smart contracts remain in their infancy.
Companies like ChainSecurity, Trail of Bits, and Certik provide smart contract audits and have adopted their own standards for how a proper audit should be conducted. Until the industry adopts its own standard, however, customers have to rely on the reputation of these companies and the team members conducting the audit to evaluate the quality of a potential audit. To help you understand the current state of smart contract security, we’ve gathered insights from a number of industry experts.
See: Robocop vs. Terminator in Fintech; Comparing DeFi originations to Digital Lenders in the early years
Q1: What is the smart contract audit exactly
There is a lot of misconceptions in the space, like many of DeFi users thinking that smart contract audit is a sort of silver bullet and sign of security (or lack of) of the dApp.
Hubert Ritzdorf, ChainSecurity:
A smart contract audit is an independent review that assesses the security and correctness of the code. This provides the following advantages. First, users obtain an independent opinion on how the smart contract behaves, which can alert them about potential threats. Project managers receive valuable feedback about their projects and can take the necessary steps to mitigate security risks. Finally, developers receive important security advice and concrete security bug reports. However, not all audits are the same. The value provided by an audit depends on the technology used to conduct it and the expertise of the audit team.
Dan Guido, Trail of Bits:
Think of security assessments like getting your car inspected: If you do it early enough, the mechanic can recommend parts to replace and preventative maintenance that can avert leaving you stranded at the side of the road later. If you wait until 300,000 miles to get your first service, the damage might be irreparable.
The amount of time you allot for inspection also makes a big difference: Give the mechanic 30 minutes, and they might only have time to use an automated scanner to determine that your spark plugs are bad. Give the mechanic a day, and they might have time to diagnose the underlying cause of why the spark plugs became bad (failed sensors? wiring? engine running rich?).
Scope also matters: Request that the mechanic only diagnose problems with the alternator, and the car may drive away with a repaired alternator as well as a latent, undiagnosed issue with the transmission.
It is the mechanic’s job to provide advice, but it is ultimately up to the owner to decide if, when, and how to implement the recommendations.
See: Fintech, decentralization pose risks: Report
Daryl Hok, CertiK:
In the simplest sense, a smart contract audit is a third-party review of the source code of a smart contract. Although a completed audit means that the code was reviewed, the rigorousness of the audit may vary substantially - and this rigor is really what matters for security, not merely the presence of an audit. For instance, a dApp may flaunt that no errors were found during the audit process, but it’s difficult to determine whether this means that the code quality was extremely high or whether the auditor was really bad.
At CertiK, we specialize in using Formal Verification to prove or disprove the correctness of source code; we apply mathematical proofs to compute source code outcomes and prove the absence of bugs, meaning that, if there are no bugs found, it is not possible for the specified vulnerabilities to exist.
Q2: Are there degrees of “approval”?
Are there some contracts where you’re more confident they are solid vs. others where you can’t find a problem, but you are less confident?
Hubert Ritzdorf, ChainSecurity:
A limited audit scope affects confidence levels. Before the audit begins, we determine the scope together with the customer. It can be decided not to review certain dependencies or components due to time or budget constraints. To clarify this, our audit reports always precisely state the scope of the audit.
Dan Guido, Trail of Bits:
We try to make it easy to understand what happened on a security review. If you’re investigating the health of a project, then pay attention to these sections in our reports:
- Executive Summary. This section includes a brief review of what we did, what we found, and what we recommend as next steps. It should make clear how much work is ahead of the project to remediate the risks we identified.
- Project Dashboard. This easy-to-read table summarizes the level of effort applied to review the codebase and what was found. Did we identify systemic issues? Was every bug identified high severity? Get a visual indicator by glancing at this table.
- Engagement Goals. This section describes our scope, or, what we set out to do on the project. Did we seek to identify risks that you care about? You’ll find out by reviewing our own goals for the project.
- Coverage. This section discusses our ability to achieve our engagement goals within the constraints of the project. You’ll find information on specific contracts and techniques we used to review them here, as well as pointers for future review.
It’s no accident that these are the top four sections in all our reports.
See: The future of finance: Insights into tomorrow’s financial system
Daryl Hok, CertiK:
In the case of Formal Verification, the results are binary - when the mathematical model runs, it either identifies an example of the vulnerability in the code, or it does find anything, which means that it’s secure. As a result, our confidence is tied to the output of these results in these instances. When it is not feasible for Formal Verification to be applied, we utilize various tools to test the security, while also performing thorough manual examination.
Our confidence level is a collective consideration of the usage of commonly accepted best practices, patterns, libraries, as well as the quality of documentation and test cases. Rare, complex patterns typically reduce our confidence or require more customized review of whether the output is consistent with the intention. Overall, we work with projects to correct all critical vulnerabilities and antipatterns before publishing any passing audit scores.
Q3: What are the five most common things people miss in smart contracts that make them vulnerable?
Hubert Ritzdorf, ChainSecurity:
- Improper access control: granting access to unauthorized parties or denying access to authorized ones
- Front-running or back-running: No enforcement of execution order
- Improper input sanitization: insufficient filtering of untrusted user inputs
- Logical errors: logical flaws in the code due to faults in the code
- Numerical errors: rounding errors and incorrect arithmetic calculations
Dan Guido, Trail of Bits:
It has everything to do with development process rather than awareness, or not, of individual security issues.
- Developers are simply not using security tools. Ask any developer about unit tests, and they’ll say they won’t ship without 100% test coverage. Yet, many of those same people will have never used, or even tried to use, security testing or verification tools. Don’t leave it for the security consultants – nearly all the best tools are free.
- Developers still look at security as the last step before production. I’m writing this interview about a month ahead of DevCon, and my schedule has never been so busy. Developers should seek guidance earlier, including developer training, architectural review, and brief checkins over the lifetime of the project.
- Developers are writing too much code without a clear idea of its purpose or whether it is needed at all. Developers should start with a specification and then write the minimum amount of code to meet it. Our best-performing clients have documented security requirements in their spec. Complexity breeds insecurity; keep it simple.
- Developers rush to use bleeding-edge third-party dependencies that increase complexity and reduce the safety of their project. Examples include low-level optimizations, delegatecall proxy upgrades, ABIEncoderV2, and even the latest version of the Solidity compiler. Be judicious about inherited risks.
I don’t think there is a step five. You’ll be ahead of nearly every other project if you can do these four.
See: Bakkt’s Bitcoin Futures Already Open to Retail Investors, COO Says
Daryl Hok, CertiK:
- Integer overflow/underflow
- Not updating the balance first before further operations. (reentrancy vulnerability)
- Writing loops without considering the gas cost. (DoS vulnerability)
- Lack of balance checking for value transfer operations.
- Lack of permission settings and permission check for public/external functions.
- Use of
block.timestampandblock.numberwithout considering their drawbacks (block.timestampcan be modified by miners; time between two consecutive block numbers is dynamic soblock.numberis not ideal for a stable time delta estimation).
Continue to the full article --> here
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
Toronto Centre Podcast: Industry and Regulatory Perspectives of the Distributed Ledger Technology ASX Implementation
The Toronto Centre | Podcast | Sep 28, 2019
In this podcast, Ilana Singer, Chair of the Securities Advisory Board, Toronto Centre interviews Katie McDermott General Manager for Equity Post-Trade Services, Australian Securities Exchange.
In this podcast, Ilana Singer, Chair of the Securities Advisory Board, Toronto Centre interviews Oliver Harvey, Chief Supervisory Officer, Australian Securities and Investments Commission (ASIC).
You may like:
-
Your Complete Guide to Security Token Exchanges
-
UK and World Economic Forum to lead regulation revolution to foster industries of the future
-
A Regulation Revolution In Financial Services
The National Crowdfunding & Fintech Association (NCFA Canada) is a financial innovation ecosystem that provides education, market intelligence, industry stewardship, networking and funding opportunities and services to thousands of community members and works closely with industry, government, partners and affiliates to create a vibrant and innovative fintech and funding industry in Canada. Decentralized and distributed, NCFA is engaged with global stakeholders and helps incubate projects and investment in fintech, alternative finance, crowdfunding, peer-to-peer finance, payments, digital assets and tokens, blockchain, cryptocurrency, regtech, and insurtech sectors. Join Canada's Fintech & Funding Community today FREE! Or become a contributing member and get perks. For more information, please visit: www.ncfacanada.org
| | |
|
