Firewalling Decentralized Protocols

Transcript

hey everyone I'm Asaf from iron blocks co-founder and CTO and also from V and we are going to talk about the V the ne the first V Network the first decentralized firewall for DBS and for chains H I'm also a former corc creator of benor if you remember H since 2017 ER faced the first defi hack that happened on 2018 then we could Block H and saved more than 3500 million dollar uh the biggest act at that moment and uh for the last eight

years researcher and web three security architecture and and what the talk is about we are talking we are going to talk about the missing block by our point of view in the web 3 security the concept of onchain firewall and security networks and the test that we conducted for the security network uh so just a little bit about the evolution of security in a web 3 ER in the left side we see the vulnerability Zone this is the all the wide area that the exploiters H can use to exploit protocols h on in in

2015 2016 we didn't have a standard for security 2017 the audits becomes a standard and then the vulnerability Zone becomes a narrower and uh but we still have a lot of ax happening 2021 the boom of defi we have still a lot of value added to the blockchain but but a lot of Hax also but when we have more tools like fuzzing formal verifications and more automated tools like static analysis H then the vulnerability Zone becomes

narrower and in 2023 last year something like that we starting to have a monitoring and incident response tooling as a standard for protocols we see a lot of protocols taking these measures to reduce the damage to their uh protocols and as we see it 20 2025 and onwards going to be the onion firewall the decentralized firewalls that actually going to prevent hacks from happening to that uh to these protocols and this is the the state the life cycle of a protocol when it's deploying to the blockchain of course we have the build the test deploy and then

maintain in each phase we have uh the primary tools that use to protect the that phasee the build and the test that the Audits and the formal verification and fuzzing and so on are used primarily for the build and the test phases and we have front running back running as incident response as monitoring H in the state of after the deployment and the maintenance and uh of course we have a incident immediate incident response and late incident response immediate incident respon means that moving the funds and the liquidity from the exchanges and later incident of SPS is trying to track the funds and to get

back some of them maybe negotiate with the attackers H and we see that in very specific window which is still open for the attackers to exploit it still has no measures to to prevent that it's after the smart contract is deployed and until the ACT actually uh change the state on chain this is where we still have a window which is not protected h and a little bit about the life cycle of an exploit funding of the address that going to perform the the exploit preparation deploying a smart contract that is going to to help with

that execution and of course running away and hide all of that can happen H in one transaction one atomic transaction and can and can be from a private Meo so the assumption that we take that it's going to surprise us and happen just like that in one moment in one transaction and we want to fill the Gap that we saw previously the Gap this window that the exploiters can take advantage of and H and block it from to uh for him the option to change the state so what is Onan firewall Onan

firewall is H some middleware we call it a middle world that's actually implemented inside the smart contract of the protocol it's very simple one it just add a modifiers for example to the functions with the hooks before uh pre-execution Hooks and post execution hook and each one of the hooks runs goes to the firewall and runs the policies each policy uh Define a specific checks that going into one and the protocol can decide what logic he wants H to use with that uh policies if he wants to use that policy and that policy to work together or that policy or that policy to work together

and so on and this way it can perform each kind of logic he wants to for each kind of a transaction so each call that goes to the firewall will go to that and it can decide which function it wants to enforce that on them and which or not H but we have still limitations in that uh approach also H we have a very limit limited H context with the call function H we have only the parameters that the call got we have the the general group Global uh parameters that we have with the

transaction but we don't have the TR that we got before that we don't have General data that we need and so on and so on so we're limited with the data that we have on chain we also have another limitation which is very important it's that if a detection system sits entirely on chain then the attacker can see that and of course try to bypass that to think of a way how to go around that l IC and also to Fork the the chain to his computer and run as much as test as he want we can't and the DB can't H know about it anything and when he finds a way to slip in then it

again will H H surprise us and surprise the protocol so it's very critical uh limitation and H A lot of the detection logic is not feasible to sit on chain for example AI models or if we need some data that sits uh outside the chain or if we need another states of a lot of other smart contracts on chain H then it will cost a lot to the user and some of that we just can't do onchain and this is where we combine offchain capabilities with onchain chain

ER enforcement so on the offchain component and we see a more decentralized approach that we take that each security logic connects to other security Logics and sign their own H voting about if the transaction is okay or not so the transaction will go first to security validation with all of other operators checking with their own logic if the transac is okay then it will go onchain or then it will go to the sequencer of the chain if the chain decides to implement it h in the chain level or any RPC that can implement it

also this is how the node itself the offchain part actually works the transaction goes into the inspection H flow uh then it can use for the assessment external detectors it can connect any detector sector any logic every operator on the network can add their own logic use other Logics to check the transaction he also send the transaction to the other operators that sign their vote and then aggregate all of that together with their his own H signature we using BLS for that and sending the transaction we will see that H in this case he will send the result to the user that sent the transaction in

the beginning and and if it's connected to the sequencer it will just go to the sequencer H this is how it looks on the client side on the web application side the user sends the transaction data getting back a secured payload actually the approval payload with is transaction data connected together and uh then he signed all of that together and send it to the blockchain if he wants Pro to send it for a private mle or for a regular node it can do whatever it likes and er we can see that H the user when he send the transaction it it works just like estimate gas when a user want to

send transaction to the blockchain it s first send to the node the transaction data the node does estimate gas tell him if he has enough balance if the transaction is not reverting return the transaction to the user the user sign it and send it to the note so it works exactly the the same the user send the transaction data to the security network and then gets the transaction that he needs to sign uh we conducted the test H that it's kind of a PC but more of a proven before go to production PC ER we took uh something like 22 months of ethereum ER and in in the

future it's going to be a lot more months and not just ethereum but also other chains H we took 22 months of ethereum since January uh 2023 to September uh 2024 uh it has something like 60 or 70 x inside the time frame and the goals that we have for that test is to to see that we actually can do prevention which is the first one most important thing H we need to keep the user experience ER if it's total disruption the user experience then we didn't do nothing because no one would use it and of course decentralization it must stay

decentralized and uh without that atos in our uh test and in in this system and approach no one will use it so H let's start with the what everything means prevention means that the false negatives and false negative means when a malicious transactions comes to the network we need to detect and decide that this is a malicious transactions if we miss that then the transaction will slip away so the false negatives means that a malicious transaction comes and H we didn't recognize that so false negatives needs to be for this test that we conducted less than 10% we need we don't

uh think that at the beginning all the acts will be prevented but most of them we try to prevent user experience achieved by false positive means by false positives and response time forse positives mean that a if a legitimate transaction goes to the network the network approve that and let it h continue as usual and not blocking that so false positives needs to be below 1% and response time needs to be below 500 milliseconds so the user won't feel h any difference when he's trying to send a transaction and the centralization achieved by multiple actors that each one of them will run a

different logic and vote by himself and so on and modularity the modularity is very important the protocol should be able to decide which logic he wants to add to the to his firewall he needs to decide if he wants to he need to be able to Define if the f is working out or not working out or networking now it's very important H just a small H introduction about what the acts are what the variety of hacks that this system needs to detect and a protect form so we have of course a protocol Logics like calculations that are going wrong or

something in the formula that it's not right and cause a someone to take advantage of that price orical attacks infrastructure means like a something that happen in the front end of the application it calls ER the protocol to be hacked access control and codeb like reentrancy and so on a lot of uh things that the system needs to uh detect um so and this is the result that we got er from our uh ER test that be conducted false negatives below 5% all of that is going to be public by the way it's not just in our close

system you will see all the tests and all the results and everything can be tested by anyone H everywhere H false negatives below 5% false positives way below 1% it's a 0.004% of false positives which is very low and response time below 200 milliseconds most of the time way below 200 milliseconds so uh we actually achieved most of the all of the things that we wanted to achieve and we will talk about the decentralization also in a moment H so we proved that most of the exploits are preventable we we not just

notify about the hack after it happened and not just H responsing to what happened and reducing the D damage we can H prevent the damage in most of the cases H the minimum Interruption to the user experience very important in most of the case it would be totally transparent to the users you won't even H notice that there is a firewall behind that a protocol integration which is also very important is very smooth we have automated tools CIS and everything that help him in a few seconds H to implement the firewall and add it to its p and decentralization we have a lot of security operators working with

us to secure the network ER top firms top security audit firms and top monitoring firms and so on uh that work together to create a decentralized network to protect the protocols and um that's it h feel free to ask anything and um uh jump to the of course to to the website and we have a playground over there and you can see all the all the documentation [Applause] there Hi I wonder um do you think

there's any Prospect for using this to detect transactions from drainers well I didn't do you think there's any um potential to use this to detect transactions not from exploits but from drainers yeah so we did that to demonstrate H exploits for protocols some of the transaction there are actually H fishing uh campaigns so we also added them to the to the detection system and to the to uh detect them so it's also against drainers and any logic that the security operators can provide to their operators to detect fishing we have chain p over here for example uh to

detect fishing campaigns and so on are also provided to the security network and the protocols and the users can use that to protects any any more questions excellent all right thank you for the talk [Applause]