How We Can Predict Crypto Exploits Minutes before They Occur on the Blockchain

Transcript

feeling good ready for our first Speaker amazing so give a huge round of applause for Alexander cnv thank you okay thanks everyone for coming thank you to organizing organizers for inviting me and uh my today's talk will be about the predictive security monitoring and uh I work in I have been working in this area for more than half of year for now and I'm still excited about the concept so but let me start with a short introduction so my name is

Alexander I'm CEO of pessimistic and uh I've been working in web security since 2017 and uh I built two blockchain security teams uh first was smart DEC and the second is pessimistic and with pessimistic we aside from performing hundreds of security audits we developed several popular open- source security tools for web tree including slytherine Smart Check and uh and others and uh those of you who speak Russian might be already know my voice because I am the host of basic block radio uh I would say that basic block radio is the most prominent blockchain podcast about blockchain tech in the e

Europe check us out if we speak Russian um okay and uh I want to say thank you to my team at pessimistic without their work without their research this talk would be impossible uh in pessimistic we do audits for top tier web three companies we perform a lot of research and publish them in our blog go check it out and we also of course we develop security tooling for web tree developers so if you develop something in web tree check our GitHub repository also uh so okay a couple of words about the problem that we're trying to solve uh so uh the problem that we're trying to solve is the crypto hacks crypto hacks are a huge problem it's a 4

billion problem it's because almost 4 billion USD were either stolen or lost uh last year and the number of security incidents has been growing with a crazy Pace uh with the same crazy Pace as our industry grows itself and uh the most common way to deal with smart contract hacked risks is to perform one or two or three security audits but security audits are good I do not want to say anything bad but uh security audits are significantly manual work and because of this they cannot neither guarantee the absence of the hack and nor um nor you know move with the same speed

as the industry industry does from the point of view of management M of schedule management and all this and all this stuff and also there is a simple lack of technical Talent on the market so in 2023 it's obvious that web tree needs scalable automated Security Solutions so let's uh take a brief glance back at web 2 Security in web 2 security everything is automated so you can see a list of uh list of abbreviation mysterious abbreviations uh which stand for different kinds of automated uh Security Solutions in web in web3 we are not even close to this uh so what automated tools do we have in

web tree I would say what useful automated tools do we have in web tree because most of the uh web Tre security tools are either very early or they are I would say completely rubbish so from the auditor point of view uh uh all web Tre security can be classified in the measures that can be done before deployment then security audit and then uh after the deployment uh so before deployment uh web developer uh what can he do or she or they can do to avoid security risks uh to lower the security risk they uh must prepare uh extensive

specification they must uh do they must uh cover their code with a test suit uh they must use static analysis tool uh fuzzing and formal verification and you can see that uh only three uh last items in this list are automated to some extent and after deployment uh whaty developer needs to set up bu bount here uh prepare incident response Playbook uh manage uh find out how to manage the keys and decentralize the management of the protocol uh set up insurance coverage and set up monitoring and you can see that only last two of these measures are automated to some extent

so as I work in security monitoring mostly I will from now on I will tell you more about the monitoring automation of security so and the most exciting part of the monitoring in web tree is predictive monitoring which uh was born in late 2022 when several independent security teams starting work in this direction so the basic concept behind this is that according to recent studies more than half of all hacks and most of the most de devastating hacks are performed in several steps uh which include funding of the hack it's when hacker takes their funds from some shady place like tornado cash or some already

blacklisted address uh then uh the second step is the preparation for the hack it's when the hacker deploys the specific attacking smart contract that contains all the logic of the attack all the logic of the exploits like you know flesh loan etc etc uh third step is the hack itself it's when the hacker calls to the specific method of this attacking smart contract to actually uh perform the hack and the fourth step is the manual laundering so we want to detect hacks on the early stages during the funding and the preparation for the hack so we can react before the actual loss of funds

happened so let's consider the use case earlier hack uh in case of earlier uh the script was exactly as I described in the previous slide so hacker took took uh their money from a mixer uh deployed a attacking smart contract with a flash loan and some signatures of a function that uh were used by earlier Finance protocol and then hacker performed the hack and uh run away with money they return them uh never mind uh so if erer were integrated with uh some predictive monitoring solution uh we could detect the deployment transactions uh seconds after it got to mle and we

could notify the protocol uh we could notify the wallets of the uh liquidity providers which hold held money in in earlier finance and node operators and everyone on the web basically so automatically we could pose the protocol uh ear could post the protocol uh the wallets could automatically withdraw the money the liquidity providers held in their in earlier and on on on behalf of these liquidity providers etc etc uh so to me this looks really promising and um so now I will tell you a bit more uh about how we actually can predict the

hacks uh you know so we will dive a bit more into the actual technologies that are used during the hack detections so the first one is a static analysis approach uh it is the fastest of them all and it get generates a bit more false positive but uh the speed uh no it it's really invaluable the speed of this approach so uh with static analysis we can extract high level information about the smart the potentially malicious smart contract from the bite code from its bite code and then we can feed these information to the machine learning model to capture the statistical differences uh in the bite code between

this smart contract and the normal smart contract and if this smart contract is highly abnormal then we could uh throw the red flag the next approach is the D is the dynamic analysis simulation uh so with Dynamic analysis what we can do first is we can simulate any transaction that we see in the mol and check the cash flow and if we see significant movements of money or or liquidity pool drainage after this transaction we could also throw an alert uh the problem of this approach is that uh there are basically too many transactions in the mol to do it effectively um the second approach is

we can uh consider any uh newly deployed smart contract and fuz uh any suspicious smart contracts to um verify whether they could be attacking contracts or not uh with fuzzing the problem is the same uh the fuzzing is very slow operation and uh with the number of uh newly deploying smart contracts of about 2,000 day it's a bit too slow to do it directly uh third approach is a dump machine learning so you could uh take all the information you have about all the transactions and contracts uh to produce risk score uh but with this

approach there is a problem that um that training pool of attacks is still small it's like several hundreds of uh actual attacks so uh so those of you who are familiar with machine learning must understand that it's just too small training pool so another approach is address risk scoring um it's something that is used in contemporary banking system uh so uh we could Blacklist all the sanction addresses all the addresses that are somehow related to previous illegal activity and we could also use a machine learning based analysis of the transaction graphs between uh all the

addresses uh on the blockchain to build some kind of scoring model uh now I will talk tell you more about uh the problems that this approach has so the problems are pretty big for now but uh I hope that we will solve them very soon in the future so the first problem is that obviously most defi Protocols are decentralized to some extent at least they have multi signature wallets at Le at least they have multi signature uh um accounts set up or uh they have Dow in place so they are basically unable to react quickly and automatically to an impeding hack so uh they need to set up some kind of so

they need to integrate such Solutions uh on Smart contract uh on some smart contract level in order to react in time uh the second problem is that once hikers understand that we watching them they will try to hide their actions they will either try to obfuscate what they are doing in the smart contracts or they will try to hide the transactions into for example private pools um in this case uh I think that we will try to solve these problems one by one uh there are there are ideas and approaches on how to solve this problem in the future and I think uh I I bet that due to the limitations of solidity

and due to compliance limitations uh we will eventually plug all the holes uh third problem is lack of trust to centralized closed sourced project uh so most of the uh most of the security monitoring systems uh which are uh which react quickly are of course centralized and close sourced and um this is the main property uh to actually to to be able to provide quick reaction so um uh so this problem can be solved uh uh

using several providers of security data so any protocol could use several Pro uh providers for example hyper native hexag gate spotter Etc and uh and react only in case for only in case two of three uh emit an alert uh and the last problem to solve is finding The Sweet Spot between a lot of false positive false positive alerts and a lot of false negative alerts so we do not want to you know to uh fire an alert twice a day and we also do not want to miss potential attacks so we

need to find something in between in order to to provide the most value to to people who use such Solutions so um I had a video demo here yeah I think I'll skip it for now because I think that the concept is pretty clear and the video will just repeat it so um as I said we are building such solution and uh now it's ready in it it is in production and you could try right now so if you want you can set up the security response uh using our telegram bot so go and try it it's insanely easy to set up it takes

like 5 to 10 minutes and uh we will be happy to hear your feedback one minute um thank you um and uh let's proceed to the question [Applause] questions please what's your opinion on circuit breakers like serum sorry what's your opinion on cirquit breakers like serum I I never heard this uh actually

let's talk more about this off stage I will be M hi um related to address monitoring in your opinion uh what is the best tool right now because I know that some company work with eliptic and also with escort risk yeah just to hear the opinion which is the best to to uh we honestly speaking we didn't do a lot of research in this area we are now partners with purify with AML Bots and we take their data in order to you know to get risk

score data for the addresses but there are several data providers in the field and honestly I'm I don't think that uh they are you know significantly different I think that the difference is in the details and you know it's not like orders of magnitude oh I see questions here what are the some warning signs of an attack I would say that if I would um if someone asked me to uh build the simplest the simplest possible attack detector uh with a valuable output I

would say that I would check whether the smart whether the particular smart contract was deployed using the money taken from mixers like tornado cache and this would be the biggest uh the biggest red flag for any smart contract that this is an attack on some def5 protocol um the second uh the second warning sign would be this contract using flesh loan this this is like you know being a big uh Bell on the church that is ringing that you must stop the protocol immediately someone just deployed obvious attack on your

protocol did did I answer the question uh another question um do you offer also some kind of SDK that instead of just alerting you are able to like trigger you know transaction on chain to house given protocol or like based on this data like on chain basically on on the yeah yeah obviously obviously protocols need some complete Solutions and right now at the moment we decided not to build it uh on our side so we decided to instead integrate into open Zeppelin Defender uh so it's a like no code re reaction tool that someone can use to set up for example pose uh

without even programming anything I think we're good thank [Applause] you