Why Crypto Protocols Need Preventative Tools to Mitigate Attacks

On June 2, Velocore’s protocol on Ethereum layer-2 community Linea was hacked, leading to losses of $6.8 million value of ETH. The assault, which leveraged a price overflow bug, resulted in Linea halting operations for an hour in an try to mitigate the fallout, and prompted an intensive postmortem.

Whereas the Velocore hack will go down as June’s first main on-chain exploit, it was certainly not its final. One other six protocol hacks occurred within the month as recorded by DefiLlama, bringing June’s complete losses to over $140 million, whereas July’s losses totaled $277 million. And Could was even worse, with $373 million pocketed by attackers leveraging the whole lot from flash mortgage exploits to compromised personal keys.

The crypto trade has grown accustomed to hacks, which have exfiltrated $6 billion from DeFi protocols alone. This may be regular in crypto, however it isn’t in mainstream society. For so long as this downside stays unchecked, speak of Web3 mass adoption will stay a pipe dream.

Whereas the specifics of every exploit differ, there’s a widespread motif that runs by means of the most important on-chain incidents: Most of those protocols have been audited, and sometimes by a number of third-parties. Velocore was audited by Zokyo, Scalebit, and Hacken, for instance, and was additionally being monitored on the time of the hack.

Whereas audits and monitoring options have their place, they threat lulling customers and tasks into unrealistic expectations of safety. If a number of audits and monitoring can’t cease subtle hackers from breaking in, then it’s clear {that a} rethink is required.

Hackers are at all times gonna hack. However this doesn’t imply that DeFi tasks are powerless to cease them. What it does imply is that they should arm themselves with higher preventative instruments, and implement methods to mitigate the harm ought to a breach happen.

Studying from hackers

DeFi tasks may study rather a lot from hackers, not least of their willingness to suppose exterior the field by adopting unorthodox problem-solving approaches.

Step one is to study the attackers’ techniques. One of many issues with audits is that they are typically inward-looking, specializing in fortifying inner code relatively than assessing the enemy’s capabilities. To quote however one instance, compromised personal keys account for 20% of all assault vectors; in Could, Alex Labs misplaced $29 million on this method.

Regardless of a panoply of cybersecurity corporations touting crypto monitoring instruments, these are largely restricted to alerting protocol operators of suspicious exercise. If a protocol does get hacked, then the crew might be alerted to the unhealthy information and that’s it: no makes an attempt at mitigation, attacker identification, or counter-offensive technique. Monitoring firms notified Velocore instantly when it was hacked, however it took Linea pausing on-chain operations for the assault to be halted.

DeFi tasks shouldn’t merely depend on third-parties to resolve all their safety challenges both. Somewhat, they need to be proactively educating crew members on widespread phishing strategies and indicators of suspicious exercise. Technical members, in the meantime, must be schooled on the newest assault vectors, together with entry management exploits and proof verifier bugs.

Somewhat than expressing gratitude that the newest exploit befell a rival protocol, tasks ought to research intently and apply the inevitable postmortem to their very own safety regime. Keep humble and research hackers.

Rewriting the playbook

However there are additionally extra sensible measures protocols can take to make sure they’re not the newest casualty. Simply as people can not management the climate, solely their preparation for it, the identical holds true of hacks.

Groups have to have higher options in place for risk prevention and tighter management of their good contracts. Safety options perceive that it’s higher to revert malicious transactions on-chain relatively than warn of an occurring assault. Prevention is an answer that stops the assault earlier than the transaction(s) are finalized on-chain—and people are the preventative measures we want within the ecosystem.

Regardless of ostensibly doing the whole lot proper from a safety perspective, Linea had just one recourse when Velocore didn’t reply to alerts: to pause operations. Higher tooling is required to thwart hacks earlier than they will escalate into multi-million-dollar exploits.

This a lot is obvious: The present strategy to crypto protocol safety isn’t working, and a radical rethink is required. The market is in want of extra safety options that block malicious exercise whereas sustaining enterprise continuity, as a result of it’s time that protocols have higher proactive capabilities, improved risk prevention, and a willingness to study from the opposition.

As Solar Tzu put it, “If you understand the enemy and know your self, you needn’t concern the results of 100 battles.”

Edited by Andrew Hayward