the melon security approach hello
everyone my name is Rita drinkler I'm
the chairman and co-founder together it
Mona Lisa of melon port and we are doing
technology regulated investment funds
completely with ESC 20 tokens and
obviously Securities Parliament for us
so I'd like to talk a bit about the man
approach to security and I'm hope you're
all going to see that we try to have a
really holistic approach to security so
holistic means or like to give to give a
short overview I'm going to talk shortly
about what is melon but what are our
values then a bit theoretical part of it
like how we designed the protocol after
that we go into court so how we develop
our code like from smart contracts to
front end how we approach the auditing
process and how we go in even current
technology and try to shape regulation
so Marlin port we're doing technology
regulated investment funds so this
concept of technology regulation it's
really this concept of contracts
enforced by technology so if you're
doing a smart contracts then you don't
necessarily need to need to have a
lawyer or an auditor or an enforcer the
technology is actually sufficient the
technology enforces itself so we're
using this concept of technology
regulated regulation and build
investment funds on top of it so
investment funds is really just a set of
assets usually from a set of people the
investors given to a manager and are
holding in one place the custodian
the manager then can take those assets
and trade them against other assets
preferably in a way that is beneficial
to the investors so what are our values
how do we want to design this we want to
design it in a way that is reliable
reliable really means that it can't be
undone so so since we're doing an
alternative way of asset management I
think it's important to build it in a
way where it can't be undone so it's
arguably what made Bitcoin to what it is
today
the fact that it couldn't be undone the
second aspect of reliability is that
it's secure so obviously if it isn't
secure then it's not very useful that's
I think that's why we're all here today
as well so at the second value is it
should be permissionless so
permissionless really means that it's
not for us to decide who can and cannot
use Mellon the same it wasn't up for Tim
berners-lee to decide who can use
introduced the Internet and the third
one is it should be ownerless so unless
just means you know not controlled by a
central party Mellon should be a common
good the same way the internet is a
common good so Malan this is a short
overview of the design of the protocol
in the middle you see a Mellon fund a
Mellon fund or like the core aspect of
it is really just a set of smart
contracts this set of smart contracts
acts as the fund custodian so as I'm
sure you all know smart contracts don't
have private keys so they can spend
assets themselves they need to have
custom code on how to spend those assets
again it's really a core aspect of our
security approach the second thing those
more contracts act for is or they are
supposed to be or they are the fund
accountant
meaning they calculate the performance
of the manager they calculate the share
price they calculate the management fees
the performance fees like the incentive
layer for the manager and to do so they
need to have data so they need to have
data of the prices of the assets and
that's where the data feed model comes
in so the data feed model is essentially
just another set of smart contracts
which deliver data to the blockchain so
we were very lucky with having Oracle
eyes together with crypto compare
building in a data feed model for us
that uses native proofs to validate the
data which means that data from its
source to the blockchain is almost
impossible to manipulate another great
data feed module just recently announced
is the one from Thomson Reuters so you
can have you can have your your melon
phone now evaluated against data
delivered from Thomson Reuters great so
we have fun custodian we have fun
accountant if you look at what fund
administration does then we see fund
administration does fund custodian from
the content kyc AML and risk management
so we just seen we can solve two of them
one custodian and from the accountant
with more contracts so how do we tackle
kyc AML and risk management so that's
where the participation model comes in
and there is management module so for
those that don't know like fund
administration they handle a trillion
dollar it's a trillion dollar industry
so okay so participation so the way
participation works is really if someone
wants to invest in a melon fund on smart
contract level it's like a phone call to
another set of smart contracts with a
Widow's set of parameters and
essentially asks the participation model
is this person allowed to invest or not
so for example we are working with the
government of took that essentially then
you know they work with you port who
have like to register citizens so so
this participation module will be then
like Carlson smart contract level to the
government of Truman asks is this person
registered with us
if yes this person is allowed to invest
if not and not so but this really
extends to just government of - like
it's essentially every jurisdiction or
every certain need can be implemented in
such a module and the fourth aspect of
fund administration is risk management
so risk management is similar so if the
manager wants to make a trade it's like
calling the risk management module
before the trade happens is this trade
allowed yes or no so for example one one
example for risk management is only
trades are allowed that are above the
current market price so that trading
that is not beneficial for investor
becomes really hard and really leads to
a system where the manager and investor
they don't actually have to know each
other the same way if you make a Bitcoin
transaction you don't actually need to
know who's behind the public key it's
efficient to just trust in the
technology does technology regulated
funds
okay so what what happens if if this set
of smart contracts now needs to be
upgraded so essentially we have this
concept of version which is like
protocol version similar to a serial all
of the Tamlyn phones are identical in
each version and if if a version now
needs to be upgraded and it's
essentially just the governance layer
that will be most likely just a set of
people that are kind of voted in by that
token holder so it's a small set of
people thus they can act efficiently and
fast if needed yet they're still
legitimized by by all of the token
holders so yeah those set of people then
can add or remove versions effectively
operating right so now a bit about how
we actually caught these things so we
currently use step so for those that
don't know taps suite is really a great
tool it's it's really nice for solidity
unit unit tests and they have like a
Haskell implementation of the EVM so it
allows developers to really dig deep
into the lowest level of the EVM to see
where where the park is for example a
second great tool that we use is Oriente
so we're currently funding the
development of int it's essentially a
smart contract analyzing tool it allows
to test your contracts against certain
properties so for example re-entrance e
can be checked automatically with this
tool another really really great tool is
you can build in custom assertions so
for example you know assert that the
accounting checks out after each
function call then you can apply int and
try to violate that assertion so if that
evaluation isn't if that assertion isn't
violated that's a good sign it's
actually not possible to ever violate
that assertion
and we integrated that now with Travis
CI so every time you make a commit
re-enter gets wrong then we use trust
man tests Chazz Montez is really useful
for us for this holistic approach so we
with Jasmin we can build like
expectation sets and then share them
across github repositories so for
example we have the same expectation
sets and more contract level as we have
in balance is our JavaScript library and
we also just recently switched to parity
checker so we have the parity deaf chain
instead of test RPC so how do we
approach fronting so maybe a short
explanation like if you build smart
contracts and if like 99% of your users
end up using a front-end those contracts
then arguably the front-end is similar
as important as what the security of the
front-end is similar to as important as
the smart contracts itself so that's why
we use ipfs IVFs is really great for
security because it has this content
addressed nature so content addressed
really means that the content that you
view on ipfs is addressed by its hash so
you can verify on our key top that in
our you know built folder that the hash
that we create it's actually the hash
that you access on ipfs so there's no
way to build in any malicious code you
know what that for example tracks you or
you know tries to steal your private
keys or yeah collect some data so it's
really transparent and really reliable
as well because you know it's hosted on
essentially a BitTorrent swarm so yeah
makes it really reliable obviously
permissionless and nonetheless as well
then we have melon male so melon male is
is is essentially a messaging service
this as secure as your crypto by the way
if you want to see the front end its
melon dot font if you
see that the mail service it's Mallen
dot email it uses your private key to
encrypt your communication and then
starts it on ipfs so the reason why this
is important so imagine you work for
Jamie Dimon and you know he threatens
you to fire you if you ever trade with
crypto but with melon man you still can
use you still can have a melon font and
you know having having essentially just
your public he exposed your investors
can still communicate with you and you
never share anything more than your
public key so how we approach audits and
park bounties so we start with audits
from well-known and well-respected
individuals and companies and then open
it up to a general Park bounty so that
everyone can participate and eventually
we deploy live melon fund that is funded
and whoever got whoever can hack it can
have the amount that it was funded with
by the way we always incentivize
people's if you found a vulnerability in
our codes no matter if the bug bounty
started already you will get
incentivized for it so so as as
technologists we love what we do and
technology is really important for us
but I think a holistic approach to
security goes beyond just technology so
that's why we created mama
it's the multi chain asset managers
association which is essentially a trade
body that tries to get innovative
companies together at a table and allows
them to give her voice so that the
conversation isn't just dominated by the
big banks or the traditional asset
managers but that you know what if
people and companies actually can
organize and after voice as well in
order to shape legislation and
regulation
great so lastly I check out melon not
fund it's it's a complete line i PF s as
a beautiful interface to it
check out melon dot email got I entered
at Milan dot fund checkout github.com
slash melon project I will of requests
will of issues for us on Twitter at
melon port and join mama if you're here
representing an institution maybe just
lastly there is my it's good to go to an
endowed fund and and start practicing a
little bit is that we just recently
announced that we're going to issue
500,000 melon I think it's worth like
thirty thirty five million right now
just in the context of fund management
competitions so if so you can
participate those and if you're good at
it you got a lot of melons if you're not
so good you'll get still a little but
not that much
so that's that's essentially how we're
gonna issue those those remaining
balance yeah and by the way also on key
top like we have if you're an arbitrator
as developers we already have like an
open source trading bot that you can use
a modify and you know why trade manually
if you can build a trading bot
we have time time for one or two your
questions any any questions question
hello first of all congratulations about
mama you know just working on
Switzerland legislation or working with
other countries like us or Singapore so
so we would like to make this available
for everyone but obviously our time is
very limited and we can't like we can't
make this compliant to every single
jurisdiction so we kind of start a bit
government of - just to have like you
know I guess a signal effect a signaling
effect that this is actually possible
that the governance and covenant
governments and jurisdictions actually
want this but actually like with the
participation module anyone can build
those and we intend to incentivize like
the people that build good participation
modules and good risk management modules
you'll get incentivize for it yeah I I
was so concentrated on my own question
that probably this was a me question but
the requirements to come I see whose
requirement is it is it the fund manager
who is only allowed to serve kyc
customers or is it you as a software
developer oh no it's it's the investors
essentially like it's its requirements
that are like what is required for an
investor to invest okay so if you want
to attract regular investors they need
to prove to their I mean the people
watch of them that then they left and
money managed by identifying managers is
that requirement so it's because I
thought okay I see requirements for the
investors so the investors need to be
kyc and it's not their requirement so
it's not their need that there is
because I mean I can be an investor
I mean there are investors who want to
remain anonymous right right but you
know that in a similar way that there
might are probably a lot of managers
that don't want to have anonymous
investors okay yeah yeah sure
I read the initial roadmap was the
product to be delivered in two years but
it was early one year why was that yeah
so we're we're well ahead of schedule so
we are aiming to have this life with the
basic form of governance next February
2018 so that's one year ahead yeah but
what happened that you could make it so
fast faster than you plan so we really
like like I think in all our
communications we're really not hyping
it's just in the same concept like we
didn't we didn't want to hype and say
okay we have this in two weeks but you
want to be we wanted to be very
conservative if you're faster and it's
great for everyone if you're a bit
slower then we still have some cushions
you know Thanks okay one last question
hi I'm wondering how how mature is the
integration with the exchanges so far
and what's your roadmap on on
integrating with them yeah that's a
great question so for now we're using
the exchange of YC stacks which is like
a fully decentralized exchange but we're
working hard on integrating other
exchanges as well but also this like
it's all it's all a matter of time
resources and we want to have like a
working product as a live working
product as soon as possible and from
then on continue like integrating other
exchanges
[Music]