Securing Web3 Through Proactive Threat Prevention

Transcript

okay thanks thanks for our instruction uh my name is Andy I'm the CEO of block set today I'm going to talk about um uh the way to secure in Laboratories through um proactive threat prevention so our blockchain was uh founded in 2021 backed by some top investors and customers and we have a couple of products you know to available to the community and like the Falcon I think most of the security researchers we already use our Falcon Explorer you know to victimize the transactions and we have the metadoc medicine which are free to the community um so why security matters in Webster right so even in this uh poor Market sorry even in the cycle of the board and bear

markets the north is caused by the uh D5 hacks and device scams are really increasing and it is not just the numbers right we receiving the emails every day from the victims of the attackers and scams saying that they have been attacked and lose they lose all the money as they want us to help them so this is just a lot of the numbers they represent the individuals who who are facing the bankruptcy after being attacked right we have to help them so why D5 hacks are very uh common today I think there are a couple reasons one reason is that we have the attackers they have the economic incentives to you know to perform the Divine hacks because by performing The Divide hacks they can

get paid they can get paid by a larger a lot of money right so and we also we do not have enough security qualified developers some developers they are focusing on the functionalities of the protocol right they do not have enough security trainings and the universities they do not teach the product a blockchain security uh causes we do not have too many courses are currently available in the community in the universities and also you know some some hackers are performed by the Countrywide organizations I I do not need to talk too much about this I think most of them will understand that so um when talking about the security of the protocol most of most people will

think about the code audience yes and then karate is the most common way you know to solve uh the security issues in the D5 protocols I we think the code already helps but the code audit is not enough right that's because the qualified auditing services are very expensive and also time consuming right you need to like within two months or three months even half year to be audited by a top audit firm so you can some protocols they do not have enough time to wait right and also we do not have enough qualified Auditors in this space right so if if one audio firm they just issue this the auditor certificate case and this certificate were

eventually we are no longer being transferred by the community right so some because of these reasons the protocols have to go live without some better tested threat program changing and attack operating solutions they just go knife without any security measures in their hands so we because of this we need to have a more proactive approach right so the more proactive approach means that a protocol needs to know what is currently happening to their protocol they cannot just put the protocol online then go to sleep right they need to know what what's what is currently happening who is interacting with the protocol then something bad happens the protocol needs

to know how to automatically respond to such attack translation to to respond to such bad scenes right so why the proactive approach is much important in web 3 right because we also have the web 2 security and some guys saying that why do we need that in Webster because we do not have that in web 2 why do we need to have this inventory that's because the web3 introduced this much more attack vectors and the openness the openness in the production makes the attack much easier than in the web 2 because everyone can looking on the smart contract on a blockchain most of the smart contract on

a blockchain are open source so the the good guys and the better guys they can see all the same source code right you can find the availability in the source code then if the is7 opinions and they can attack the vulnerability to gain a large number of profits and also because the blockchain is anonymous it's very hard if not impossible you know to check the final flow of an attacker right so when an attacker happens to the D5 protocol we always saying that the protocol asking who can help us to contact Beyond who can help us to contact some exchanges because it's very very hard you know to track the phone flows for the attackers and also the flash loan

helps to enlarge the money that an attacker can have right so in the web 2 if you find out vulnerability and in order to launch this attack you need to have too many US dollars but most of people you know they do not have such uh such a such a big money to launch attack but in production you have the fresh loan right you can borrow a very large number of money from inflation and also some private transaction Services it can be abused you know to launcher attack we have seen so many attacks they are abuse they will abuse in the flash Party Services you know to or issue the attack transaction from being observed uh in the memory pool

so because all of this unique properties in the web series The attackers happens happen in Webster space cause more damages to the protocols cost more damage to the users right and it's much easier much harder to track the attackers in the F3 so because of all these reasons so in blockchain we have um developed a prototype system uh since last year since February 2022 we are thinking about how to solve these issues besides the code origin right so we've seen commit can we take a more proactive solutions to definitive High hex So based on this uh Source inside the

Block Set we have developed a system called Falcon block so second block the basic idea of effect block is that we can listen to the transaction inside the memory pool we can listen to the transaction on the production we also listen to the reverted transactions right so why do we need to listen to reverse transaction that's because the attackers they may make mistake and the attack transaction can be reverted right so if we can capture such reverted attack transaction which is also automatically make some response after that we can reconstruct right we can reconstruct the technologic by replaying the attack transactions and copy the essential logic Technologic of the attack contract

to synthesize a new Rescue smart contract and the lane issues that rescue transactions through some flashbacks or through or by giving a higher Gatsby something like that to to make sure that our rescue transaction can be much quicker or can be on a blockchain behind the attack transactions so by doing so right we can unblock we can even block the attack transactions right so because we are much faster and we are before we are we are in the header of the attack transaction inside the block so how the so the the the the essential part of this mechanism or this system is

how to automatically reconstruct the attacker transaction and the attacker contract so I think the basic idea is think about it attack transactions and and attacks my contract what what matters most in this attack contract right so what matters most is the attack logic inside this smart contract and also some the attackers we will do perform some authentications to the colors of this attacks micronium because they do not want their attacks my conscience being called by others so you need to bypass all these checks automatically right so what do you what would you do so we replace this attack

transaction inside the memory pool we can get a change of the basic blocks or the trace of this uh uh attack transactions right of a change of the basic block so in this uh in this in this chain of the basic plus we can replace the jump I instructions we call the Frozen the jump height instructions into the jump instruction jump to the uh attack logic instead of the reverted basic block that because of the value of the authentication of the attack contract so we can simply replace right replace the jumper instructions to the jumping instructions so this is the

basic idea of the how the methodologies but when we use it but when we are just simply replacing the the instruction does not work in all cases because we have some technical challenges one of that when we replace one of that is uh how to deal with reuse the basic block inside the smart contract so we use the basic block is a very common um uh usage by the byte code generated by the compiler to to reduce the size to reduce the code size so suppose we have like are two different uh jump targets are a one and I zero and we have some new Jump targets right so we need to

have a mapping between this uh old jump Target and the new Jump targets so we use a sampling uh basically for this purpose so the basic idea is it's just it's just similar with the uh is a binary code rewriting which we have for the codery written techniques so we follow the similar ideas and used into the byte code uh Rewritten and by using this system we have a couple of successful stories to um to execute the funds to block the attack

transaction for a couple of protocols like we are rescued 500 million US Dollars this year for the power space and uh 3.8 million US dollars for the sale of Finance last year and a couple of others so in the following I'm going to talk about a couple of Representative examples of how we block these transactions so for the Paris space which happened the attack happened this March right the attacker made some mistakes right so they did not give enough gas cash to perform the attack so the attack transaction reverted as I just said we listened to the reverted transaction on blockchain and we found it it's even the the transaction was

reverted and the refund is a and it's an attack transactions and then we automatically synthesize a similar attack contract but replace the profit addresses with our own addresses and we issue these transactions and the challenge exhausted on a production to you know to rescue the 5 million US dollars for perispace and we uh and another example is a is a purpose which was attacked in this February the the smart contract has availability and the attackers uh they attack this this device protocol but the attackers he or she made a mistake there is no logic to withdraw the funds inside the attacks my contract

so the question becomes how to withdraw the remaining 2.4 million US Dollars inside the attack conscious inside the attack contract because there is no logic you know to waste all these are remaining funds inside the attack contract so because we have an internal system to automatically disassemble the attacks my contract and we have some heuristic you know to analyze these attacks my contract and we found a couple interesting five interesting facts about this attacks my contract first the financial callback of the contract is open second the usdc approved to the Platypus poor contract so what can we do we can upgrade the

poor contract and use the approved privilege by the attack contract to which your remaining usdc right inside this attack contract and we shared the approval concept to the protocol and protocol successful and you know with your 2.4 million US dollars from just my con from Attack contract so another is the transit swap Transit swap was attacked and the front round by emiway bot so we found the addresses of the enemy part was generated by a vulnerable profanity tool right prevented tour because the availability we can calculate the product key of this mua bot and we can you know uh with the other funds and return to the protocol

so how to make this system more effective I think we have some insights you need to active fast right you need to know fast and you need to active fast and accuracy is the key you need to you cannot introduce too much false positives as we have a panel last uh yesterday and we are talking about the false positive and monitoring tool if we are moving to a report too much alarms to your customers then the product cannot be used right and we can take a systematic way to act not just from around the attackers we have some tools to analyze the contracts which is a similar country we have some uh heuristic you know to to perform more analysis on the body code we we take all these measures into to build a to build

a system to build a product and we saw armrest between the attackers and the security researchers we see some attackers they are using obfuscating some income runtime measures you know to to defend all these things so so based on this we build a fair complex system and we have within this so that if you are you guys are interested you can join our witness you know to um get updated information of the Falcon block system and we also have a teacher group some uh under the tweeters you guys if you're interested you can follow us thanks Anna uh I'm free to take a question if you have thanks very much thank you Andy so I think we have two

three minutes for questions um Heidi's here hey um I don't want to show their tools too much but they're really badass thanks second off um the one question I have is you guys do a lot of hackbacks let's just call them that right how do you guys protect yourselves from the liability of doing that and all of the legal garbage that comes along with doing that uh yeah this is a very good question yes I know the the secure Asics is um we are taking very seriously so for the hacking back or for the blocking attack transactions we only perform these actions uh after we saw an attack transaction in place we do not perform such attack transaction you know without using otherwise it's

doing that yeah so I think because we had you know protecting users and we take a proactive approach if we do not take action then the better guys they will take action they will take all the moneys right any other questions we got a bit of time nope well ah we got one over there the follow-up uh to a question but like so that means that if let's say somebody finds a vulnerability that has not been exploited and there is no attack transaction you are legally prevented from acting like on a like do like a white hat hack and save the user's funds um so we are not uh uh so let me uh

refuse so we are not hacking of hacking the the user funds so we just automatically reconstruct the contract by the attackers and the name uh move the funds inside another wallet then we will return back to all these funds to the uh protocol and to the users so yeah I think it's it's you know it's debatable for the uh S6 issue but um if we only do these things uh with the heart of protecting users I think we are good here got time for one more don't be shy yep so so it you know it's clear you're

doing the right thing do you have any actual legal protection in place do you have a lawyer sitting there Uh current innovate we do not actually yeah but uh we will considering you know hire a new one yeah all right cool thank you Andy thanks so much thanks for your time give it up for Andy thank you