Why Crypto Protocols Need Preventative Tools to Mitigate Attacks

On June 2, Velocore’s protocol on Ethereum layer-2 community Linea was hacked, leading to losses of $6.8 million price of ETH. The assault, which leveraged a charge overflow bug, resulted in Linea halting operations for an hour in an try and mitigate the fallout, and prompted an intensive postmortem.

Whereas the Velocore hack will go down as June’s first main on-chain exploit, it was on no account its final. One other six protocol hacks occurred within the month as recorded by DefiLlama, bringing June’s complete losses to over $140 million, whereas July’s losses totaled $277 million. And Might was even worse, with $373 million pocketed by attackers leveraging every thing from flash mortgage exploits to compromised personal keys.

The crypto trade has grown accustomed to hacks, which have exfiltrated $6 billion from DeFi protocols alone. This may be regular in crypto, but it surely isn’t in mainstream society. For so long as this drawback stays unchecked, speak of Web3 mass adoption will stay a pipe dream.

Whereas the specifics of every exploit differ, there’s a widespread motif that runs by way of the foremost on-chain incidents: Most of those protocols have been audited, and sometimes by a number of third-parties. Velocore was audited by Zokyo, Scalebit, and Hacken, for instance, and was additionally being monitored on the time of the hack.

Whereas audits and monitoring options have their place, they danger lulling customers and initiatives into unrealistic expectations of safety. If a number of audits and monitoring can’t cease subtle hackers from breaking in, then it’s clear {that a} rethink is required.

Hackers are all the time gonna hack. However this doesn’t imply that DeFi initiatives are powerless to cease them. What it does imply is that they should arm themselves with higher preventative instruments, and implement methods to mitigate the harm ought to a breach happen.

Studying from hackers

DeFi initiatives may be taught quite a bit from hackers, not least of their willingness to assume exterior the field by adopting unorthodox problem-solving approaches.

Step one is to be taught the attackers’ ways. One of many issues with audits is that they are usually inward-looking, specializing in fortifying inner code slightly than assessing the enemy’s capabilities. To quote however one instance, compromised personal keys account for 20% of all assault vectors; in Might, Alex Labs misplaced $29 million on this method.

Regardless of a panoply of cybersecurity corporations touting crypto monitoring instruments, these are largely restricted to alerting protocol operators of suspicious exercise. If a protocol does get hacked, then the staff shall be alerted to the dangerous information and that’s it: no makes an attempt at mitigation, attacker identification, or counter-offensive technique. Monitoring firms notified Velocore instantly when it was hacked, but it surely took Linea pausing on-chain operations for the assault to be halted.

DeFi initiatives shouldn’t merely depend on third-parties to resolve all their safety challenges both. Slightly, they need to be proactively educating staff members on widespread phishing strategies and indicators of suspicious exercise. Technical members, in the meantime, must be schooled on the newest assault vectors, together with entry management exploits and proof verifier bugs.

Slightly than expressing gratitude that the newest exploit befell a rival protocol, initiatives ought to examine intently and apply the inevitable postmortem to their very own safety regime. Keep humble and examine hackers.

Rewriting the playbook

However there are additionally extra sensible measures protocols can take to make sure they’re not the newest casualty. Simply as people can’t management the climate, solely their preparation for it, the identical holds true of hacks.

Groups must have higher options in place for risk prevention and tighter management of their sensible contracts. Safety options perceive that it’s higher to revert malicious transactions on-chain slightly than warn of an occurring assault. Prevention is an answer that stops the assault earlier than the transaction(s) are finalized on-chain—and people are the preventative measures we want within the ecosystem.

Regardless of ostensibly doing every thing proper from a safety perspective, Linea had just one recourse when Velocore didn’t reply to alerts: to pause operations. Higher tooling is required to thwart hacks earlier than they’ll escalate into multi-million-dollar exploits.

This a lot is evident: The present method to crypto protocol safety isn’t working, and a radical rethink is required. The market is in want of extra safety options that block malicious exercise whereas sustaining enterprise continuity, as a result of it’s time that protocols have higher proactive capabilities, improved risk prevention, and a willingness to be taught from the opposition.

As Solar Tzu put it, “If you already know the enemy and know your self, you needn’t worry the results of 100 battles.”

Edited by Andrew Hayward