►
Description
Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.
https://archive.devcon.org/archive/watch/6/hunting-and-monitoring-for-on-chain-attacks/
Web3 security requires a comprehensive security approach from reuse of secure, audited libraries, audits, threat modeling and security assessments to bug bounties, monitoring, and incident response.
In this workshop, we will dissect a real world on-chain attack, categorize each step the attacker took into four distinct stages (funding, preparation, exploitation, and money laundering) and walk through the development of a heuristic/ ML approach to identify these attacks using the Forta Network.
Speaker(s): Christian Seifert, Dmitry Gusakov
Track: Security
Keywords: security,monitoring,incidentresponse
Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/
Devcon is the Ethereum conference for developers, researchers, thinkers, and makers.
Devcon 6 was held in Bogotá, Colombia on Oct 11 - 14, 2022.
Devcon is organized and presented by the Ethereum Foundation, with the support of our sponsors. To find out more, please visit https://ethereum.foundation/
A
A
Thanks
for
coming
to
the
workshop
on
hunting
and
monitoring
for
on-chain
attacks,
I'm
Christian
Seifert
I'm,
a
researcher
in
Residence
at
the
Florida
Foundation
I,
primarily
work
with
the
Florida
Community
to
analyze
attacks,
as
well
as
develop
strategies
to
strengthen
the
detection
and
protection
value
of
the
Florida
Network
prior
to
coming
to
the
Florida.
Foundation
I
worked
for
many
years
in
the
web.
2
security
space
on
anti-malware,
anti-fission
and
intrusion
detection
systems,
both
on
the
brief
reach
and
the
post
breach
side.
B
Hey
and
I'm
Dmitry
I'm
from
lidar
and
I'm,
the
leader
of
the
automation
team,
and
this
weird
name-
is
hiding
a
lot
of
things
that
we
are
working
on:
security
on
monitoring
on
protection
on
code
analysis.
That's
all
what
we
are
doing
in
Lida
and
prior
to
lighter
I've,
been
working
as
the
quality
automation
engineer
for
a
lot
of
years
and
got
a
lot
of
experience
in
both
security
and
quality
and
I
will
join
this
Workshop
after
the
part
of
the
Christian.
So
yeah.
A
So
the
the
way
the
workshop
is
structured,
there's
there's
two
parts,
so
the
first
part
is
really
around
a
more
kind
of
security.
Research
focused
on
how
you
can
use
monitoring,
to
identify
attacks
on
chain
and
so
we'll
dive
into
some
attacks,
and
then
the
second
part
Dimitri
will
more
work.
Look
at
kind
of
how
protocols
can
use
monitoring
to
secure
that
protocol.
A
So
we
all
know
that
web
free
is
is
getting
hacked
chain
analysis
last
year,
estimated
that
it
was
2
billion
dollars
this
year.
We
already
far
exceeded
that
that
number
now
that
does
not
mean
that
all
hope
is
lost
now.
One
thing
that
is
maybe
a
little
bit
of
a
misconception
is
that
on-chain
attacks
are
Atomic
and
that,
once
the
transaction
is
mined,
there's
nothing
you
can
do
about
it,
but
that
is
really
not
the
case.
With
the
majority
of
the
attacks
that
we
observed.
A
A
So
let's
look
at
one
particular
example
of
an
attack
on
kind
of
how
these
stages
manifest
themselves
on
change
on
chain.
So
we'll
look
at
the
inverse
Finance
attack.
That
was
an
attack
a
little
earlier
this
year,
1.2
million
dollars
were
lost.
Inverts
Finance
is
a
a
lending
protocol,
a
collateralized
lending
protocol,
and
so
the
attack
was
essentially
a
price
manipulation
attack
that
allowed
the
attacker
to
a
lend
or
a
bar,
essentially
in
an
uncollateralized
fashion.
A
So
let's
look
at
each
of
the
stages
so
first
of
all
tornado
cash
funding.
So
what
we
see
here
is
essentially
that
the
first
transaction
to
that
the
attacker
account
so
we're
looking
at
ether
scan
here.
One
thing
to
keep
in
mind
is
that
tornado
cash
funding
is
an
internal
transaction,
so
you
don't
see
it
on
the
main
transaction
tab,
so
that's
kind
of
the
first
First
Signal.
Now,
obviously
tornado
cash
is
utilized.
A
A
A
few
blocks
later,
the
attacker
deployed
a
contract
that
then
was
utilized
to
execute
the
attack.
Of
course,
the
contract
on
etherscan
was
not
verified,
and
so
that
is
again
another
suspicious
signal
here.
So
this
is.
This
is
essentially
the
action
that
they
took
in
the
preparation
stage.
Again,
it's
it's.
A
It
was
directly
picked
up
from
from
the
flashbot
network
by
the
miners,
so
it
was
essentially
a
private
transaction
until
it
was
mined,
and
then
you
also
see
that
flash
loan
was
used
in
in
the
transaction
to
essentially
obtain
a
large
amount
of
wrapped
Bitcoin.
In
order
to
then
manipulate
the
price
that
the
inverse
Finance
protocol
relied
on.
A
Essentially
all
the
ERC
20
tokens
that
they
have
into
native
tokens,
and
that
is
probably
a
step
that
is
being
taken
because
erc20,
depending
on
the
implementation,
can
be
blocked.
I've
mentioned
usdt
as
an
example.
They
have
a
a
block
list
mechanism
in
in
the
contract,
whereas,
if
you
have
native
tokens
ether,
that
possibility
does
not
exist.
A
And
then
once
they
have
essentially
native
tokens-
and
they
use
in
this
particular
example-
tornado
cash
to
launder
the
funds
and
at
that
point
in
time
the
attack
is
over
and,
as
I
mentioned,
there's
these
four
stages:
funding,
preparation,
exploitation
and
money
laundering
for
this
particular
attack.
It
took
about
eight
minutes
end
to
end
now.
That
is
very
quick,
so
a
manual
incident
response
is
probably
not
sufficient,
but
if
you're
thinking
about
automated
incident
response
now
it
comes
into
the
realm
of
possibility
to
mitigate
this
particular
attack.
A
C
D
C
Of
times
with
the
the
like
exploit
transaction
itself,
it
opens
up
like
Arbitrage,
so
the
the
Mev
Bots
like
pick
it
up
and
then
back
run
it
as
part
of
a
bundle
like.
How
is
there
a
way
to
tell
if
it's
being
submitted
itself
via
flashbots
I.E
like
not
showing
up
in
the
mempool
at
all
or
if
it's
being
in
the
mempool
and
then
a
bot
picks
it
up
and
puts.
A
A
Most
of
the
attacks
that
I
have
analyzed:
it's
tornado
cash,
Usage
Now,
given
that
now
tornado
caches
and
on
the
ofax
sanctioned
sanctions
list,
I,
don't
know
whether
that's
going
to
change
anything.
It
certainly
will
reduce
overall
liquidity
in
in
the
tornado,
cache
protocol,
which
may
make
tracing
a
little
bit
easier.
F
Thanks
so
much
is
it
more
common
patterns
and
people
deploy
these
smart
contracts
and
do
they
use
address
obsfocating?
Because
if
we
can
monitor
that
someone
deploys
this
contract
and
this
contract
was
funded
from
tornado
cash
and
it
has
our
addresses
it's
red
flag
and
we
should
at
least
be
warning
about,
or
there
are
some
tactics
when
they
use
some
optification.
A
I
have
not
seen
obfuscation,
so
they
get
funded
by
tornado
cash
and
then
they
just
deploy
the
contract
and
and
kind
of
this
detection
logic
that
you're
just
talking
about
where
you're
saying
oh
did.
The
tornado
cash
funded
account
deploy
a
smart
contract
that
is
actually
something
that
we
monitor
for,
but
now
I
I
seen
like,
for
instance,
Ronan
attacker
what
they
did
in
the
in
the
money
laundering
stage
they
had.
A
You
know
the
exploit
account
that
again
was
put
on
the
sanctions
list,
so
they
couldn't
go
through
tornado
cash
because
that
honors
it
they
just
transferred
it
to
a
different
account
and
then
laundered
the
money
through
tornado
cash.
So
there's
a
little
bit
of
kind
of
like
hopping
across
accounts
that
happens
at
times
to
kind
of
break.
The
link
yeah.
F
A
G
I
J
A
If
we're
thinking
about
defy
protocol
attacks
about
over
half
are
not
atomic,
whereas
you
know
about
45
percent
are
Atomic
I
think
in
the
45
case
at
this
point
in
time,
that
would
be
very
difficult
to
solve
in
terms
of
being
having
some
time
to
respond
to
it.
But
I
think
there
are
some
things
that
Protocols
are
able
to
do
such
that
the
attacker
is
no
longer
able
to
execute
an
atomic
transaction
so
think
of
the
binance
hack
last
week.
A
So
basically
there
the
attacker
was
able
to
Mint
one
one
billion
tokens
or
1
million
tokens
right.
Should
you
be
able
to
Mint
1
million
tokens
in
in
one
transaction?
Could
there
be
a
time
lock
that
kind
of
delays
it
where
maybe
hey?
You
meant
10
000
that
goes
instantaneous,
whereas
if
it's
a
large
amount,
you
time
lock
it
so
you're
kind
of
forcing
the
attacker
to
span
their
attack
over
multiple
transactions,
and
then
that
potentially
brings
those
attacks
into
scope
for
mitigation.
A
K
Sorry,
no
I
love
the
questions.
That's
great.
Have
you
seen
like
an
increase
in
attacks
that
end
up
in
a
different
type
of
money
laundering
schemes
like
I've
seen
stuff
like
since
what
happened
with
tornado
cash
I've
seen
some
some
of
the
hacks
end
up
in
depositing
to
curve
pools
and
stuff
like
that.
A
A
A
So,
if
you're
thinking
about
a
protocol
protocol
security
strategy,
there's
activity
that
that
needs
to
happen
in
the
pre-deployment
stage,
that
many
of
you
probably
are
familiar
with,
like
utilizing
template
contracts
like
the
open,
sepulene
Library
conducting
smart
contract
audits,
but
but
that
is
not
not
enough.
You
also
need
to
think
about
what
happens
after
you
deploy
your
protocol
and,
as
it
attracts
more
tvl
and
becomes
more
attractive
for
attackers
to
attack.
So
in
the
post-deployment
stage.
A
Think
about
bug,
bounties
fortnite
network
is
is:
has
their
Buck
bounty
on
immunify,
very
effective
program,
real-time
monitoring
and
alerting,
and
that's
really
where
the
fortnite
network
comes
in
and
then
kind
of
relate
it
to
monitoring.
Of
course,
you
also
have
to
think
about
incident
response
and
Dimitri
will
will
talk
about
incident
response
on
the
Lido
protocol
and
how
they
managing
that,
because
if
you
are
getting
alerted
about
an
attack
and
don't
take
any
action
well,
the
attack
will
just
proceed.
A
So
forta
is
is
a
decentralized
think
of
it
as
a
security
and
alarm
system
for
web
free.
So
it's
a
decentralized
network
that
allows
you
to
monitor
on-chain
activity
in
a
decentralized
way,
and
it
consists
of
of
Florida
scan
nodes
and
these
scan
nodes
run.
Community,
developed,
detection,
Bots
and
I'll
talk
about
detection
Bots
here
in
a
second
and
the
scan
notes.
They
are
hooked
up
to
a
a
chain
either
through
a
node
or
an
infrastructure
provider
and
they
forward
transactions
and
blocks
to
these
detection
Bots.
A
The
nice
thing
about
this,
this
decentralized
architecture,
is
that
you
get
a
lot
of
redundancy
right
like
as
as
I,
develop
a
detection
bot
and
deploy
that
onto
the
foreign
Network.
It
gets
automatically
deployed
on
multiple
scan
nodes
at
the
same
time
such
that,
if
one
scale
node
goes
down,
you
still
have
plenty
of
coverage,
and
so
it
creates
some
redundancy
and
reliability.
A
So
the
fortnite
network,
you
anybody,
can
develop
a
detection,
bot
and
we'll
go
through
an
example
on
how
that
looks
like
we'll
also
go
through
some
some
existing
bot
examples.
So
you
get
an
idea
of
kind
of
the
capabilities
that
you
have
as
a
bot
developer
and
as
these
Bots
raise
alerts,
they
can
be
viewed
through
the
photo
Explorer
so
think
of
the
photo
Explorer.
A
All
right,
so
this
is
the
the
four
let
me
sit
down.
This
is
the
Florida
app
app.forter.network
and
up
here
you
have
the
link
that
takes
you
to
the
Ford
Explorer,
and
this
is
how
the
fortnite
Explorer
looks
like.
So
you
basically
able
to
see
all
the
alerts
that
were
erased.
You
know
in
the
last
hour
or
so
for
that
support
supports
seven
evm,
compatible
chains.
I'll
see
my
network
is
not
not
good.
A
Oh
seven,
seven
Wi-Fi
yeah,
it's
okay,
I
have
some
screenshots,
so
I
can
show
you,
but
thanks
for
for
the
tip.
So
so,
as
you
click
on
an
alert,
you
get
alert
detail.
So
here
we
have
tornado
cash
withdrawal,
alert,
you're,
able
to
see
information
like
the
transaction
that
is
associated
with
this
alert,
the
bot
that
is
associated
with
the
alert
and
then
a
whole
bunch
of
metadata,
which
essentially
contains
all
the
addresses
that
were
touched
in
the
transaction
and
then
down
here.
A
On
the
bot
search,
page
you're
able
to
kind
of
search
for
the
the
Bots
that
are
deployed,
so
let's
assume
you
want
to
create
a
bot
that
monitors
a
flatbot
attacks.
Well
before
you
dive
into
the
developing
a
bot.
Take
a
look
at
what's
already
deployed
on
the
network.
There's
there's
hundreds
of
bots
deployed
on
the
network
today,
then
from
there
you're
able
to
jump
into
the
bot
stats
page
again.
That
gives
you
information
around.
How
many
nodes
is.
A
It's
deployed
historical
information
about
how
many
transactions
had
it
has
it
processed.
You
see
the
link
to
the
source
code,
the
documentation
and
then,
if
the
the
bot
generates
some
log
data.
That's
also
available
on
this
page,
and
let
me
see
here
so
here
we
have
another
alert,
flashbot
transactions.
You
can
then
jump
directly
into
etherscan
to
examine
the
transaction.
So
here
you
see
that
it's
a
private
transactions
with
flashbots
here's
the
network
activity
page.
A
A
It
makes
sense,
and
so
I'll
talk
a
little
bit
about
a
layered
approach
to
a
monitoring
that
builds
on
top
of
noisy
Bots
and
then
combines
the
alerts
into
highly
precise
alerts
in
terms
of
statistics,
I
want
to
say
that
that
that
kind
of
combiner
Bot
that
I'm
mentioning
I,
think
it
had
a
Precision
of
80,
some
percent
and
a
recall
of
maybe
50.
But
don't
quote
me
on.
A
So
anybody
can
can
run
a
node.
Now,
however,
the
the
four
day
network
is
secured
by
the
fourth
token.
So,
as
you
are,
if
you
want
to
set
up
a
scan
node,
you
have
to
stake
for
token,
and
if
you
misbehave,
then
your
your
fort
gets
slashed,
but
also
keep
in
mind
that
there's
some
redundancy
in
the
network,
and
so
you
could
have
let's
say
six
nodes
that
run
your
your
Bot
one
behaves
maliciously
and
just
outputs
garbage.
L
A
There's
a
variety
of
options
that
you
have:
you
can
either
obfuscate
your
code
and
encrypt
your
alert
and
deploy
it
on
the
for
that
Network
now
obfuscation,
is
you
know,
security
by
obfuscation
is
is
probably
not
not
the
best
approach.
You
can
also
run
a
private
scale
node
and
deploy
your
Bot.
Just
on
that
note,
but
but
then
you
kind
of
trading
off
the
redundancy
that
the
network
provides.
M
A
A
A
Are
there
more
nuanced
mitigation
techniques
that
you
can
Implement
that
again
kind
of
slow
down
the
attacker
or
mitigates
the
attack,
while
at
the
same
time
leaving
your
users
still
being
faced
with
a
usable
protocol
in
like
time,
locks
could
be
an
Avenue
there,
but
I
think
that
is
something
that
that
still
needs
to
be
better
defined,
and
so
you
know
we
have
a
large
audience
here.
If
you
have
ideas,
we'd
love
to
hear.
H
N
A
F
Ely,
but
can
you
tell
me
more
about
timing?
For
example,
you
detect
some
malicious
activity.
Basically,
we
have
some
developed
system
monitoring
system,
but
we
definitely
consider
that
if
you
find
something
you
should
action,
maybe
next
block,
so
you
should
be
pretty
fast
in
terms
you
have
a
decentralized
network.
It
means
that
you
need
some
consensus
between
notes
and
so
on.
So
what's
your
common
scenarios
of
using
forta?
Should
we
manually
check
what's
going
on
so
hire?
A
It
takes
about
40
seconds
from
mind,
block
or
mind
transaction
to
alert
being
consume.
Essentially,
so
there
is
some
some
delay
in
terms
of
your
other
part
of
your
question.
Should
there
be
a
person
that
monitors
I
I
believe
no,
but
because,
just
because
the
attacks
are
too
fast,
you
need
to
have
some
automated
incident
response
now.
Does
that
make
your
incident
Response
Team
obsolete?
Absolutely
not
right
like?
Even
if
there
is
an
automated
incident
response,
you
still
need
to
have
a
team
that
then
kind
of
analyzes.
A
B
Yeah,
so
let
me
add
something
on
this
side,
so,
first
of
all,
yeah,
so
speaking
about
detecting
something
and
reacting
on
the
next
block
is
usually
not
the
case.
The
case
is
detecting
something
not
in
a
week
like
Christian
said,
and
the
second
thing
is
that
we
will
talk
about
the
how
to
react
on
alerts,
what
to
do
and
how
to
make
it
really
fast.
And
yes,
you
need
people
here
for
sure
and
the
details
about
it
will
be
at
the
second
part
of
the
workshop
perfect.
Let.
A
Where
are
you
I'm
here
us
sorry
mempool
currently
not,
however,
is
the
bot
framework.
The
bot
development
framework
is
very
powerful.
It's
essentially
think
of
it.
As
you
know,
a
Docker
container
that
either
runs
a
JavaScript,
typescript
or
python.
So
there's
a
lot
of
things
that
you
are
able
to
do
so.
Your
Bot
is
certainly
able
to
inspect
the
mempool
and
generate
alerts
based
on
the
mempool,
but
it
is
not
a
native
interface.
H
A
Excellent
question,
so
some
some
Bots,
yes,
are-
are
developed
by
Builders
and
then
deployed
on
the
on
the
network,
but
you
can
also
create
templates
that
provide
you
know,
parameters
that
you
can
configure
and
on
the
Ford
app.
There
is
a
bot
wizard
that
allows
you
then,
to
essentially
instantiate
and
deploy
about
with
your
specific
parameters.
A
Absolutely
I,
like
you,
can
you
can
within
the
bot,
have
different
thresholds
and
emit
different
types
of
alerts?
It's
not
a
one-to-one
mapping
where
one
bot
is
only
able
to
emit
one
type
of
alert
able
it
is
or
after
deployment
well
after
deployment.
No,
then
you
kind
of
have
one
snapshot
of
the
bot,
so
you
would
have
to
you
can
upgrade
your
Bot
or
deploy
a
second
instance
with
other
parameters.
Yeah.
B
So
really
it's
that's,
not
a
big
deal.
We've
been
doing
it
for
a
while
in
Lido,
so
yeah
that
if
you
want
to
update
the
values,
the
constants,
you
need
to
do
a
redeploy,
but
it
is
done
in
such
a
simple
way.
So
you
don't
need
to
worry
about
it
on
one
hand
and
on
the
other
hand,
you
are
100
sure
that
the
bot
is
running
on
the
actual
values
and
there
can
be
no
changes
made
by
either
the
photo
Network
or
the
malicious
software,
or
something
like
that.
A
Requires
that
the
the
protocol
teams
consume
Zoom
the
alerts
now
and
and
then
kind
of
take
actions
quick
enough
and
I
think
that
is
still
still
a
problem,
but
we
certainly
have
many
examples
where
an
attack
occurred
and
the
fortnite
network
emitted
a
highly
confident
alert
and
so
I
I
would
reference
kind
of
our
blog
or
or
Twitter
handle
not
prevent?
No
okay,
not
yet,
but
hopefully
I
come
back
next
year
and
I
can
talk
about
some
prevention
stories.
Okay,.
P
Good
thing
here:
yes,
sir,
how
is
Ford
decentralized?
How
do
you
manage
to
to
have
a
decentralized
because
it
says
there
that
the
centralized
but
to
detect
attacks?
The
first
second
is
that
why
is
important
to
take
an
attack
after
it
happens?
If
it
already
happened,
and
in
blockchain,
you
don't
have
a
way
to
revert
anything
awesome.
A
Well
you
you
have
independent
node
operators
right
that
that
set
up
a
scan,
node
right,
so
so
some
of
the
security
Auditors,
some
of
the
infrastructure
providers,
are
running,
scan
notes,
and
so
then
your
Bot
is
essentially
deployed
on
multiple
scale
nodes
at
the
same
time.
So
it's
decentralized
that
way,
who's
running
those
notes.
Well,
as
I
said,
like
smart
contract
Auditors
infrastructure
providers,
you
can
run
a
scale
node
if
you
want
to
and
then
your
second
question
is
like.
A
A
We
still
need
to
to
work
on
that
in
terms
of
identifying
what
are
good,
mitigative
actions
and
then
so,
that's
one
part
and
then
the
second
part
is
to
create
alerts
that
are
highly
precise,
so
that
the
number
of
false
positives
are
low.
In
order
to
increase
the
confidence
of
protocols
to
then
essentially
hook
up
automated
actions,
foreign.
A
So
you
know
tornado
cash
funding,
Bridge
funding,
sleep
minting
attack,
contract
creation,
also
looking
at
whether
the
eoa
that
created
the
contract
was
funded
by
tornado
cash,
the
fortnite
network
is
not
only
looking
at
protocol
attacks,
but
also
looking
at
end
user
attacks.
So
there's
a
few
Bots
that
are
deployed
that
identify
activity
like
ice
fishing
or
somebody
deploying
a
token
impersonation
contracts,
then
a
whole
slew
of
of
bots,
around
exploitation
and
then
money
laundering.
A
But
as
I
mentioned
earlier,
if,
let's
say
the
tornado
cash
funding
bot
emits
an
alert
that
is
not
sufficient
evidence
to
call
this
an
attack
right
and
many
of
the
the
individual
Bots
that
I
have
listed
here
have
the
same
problem
by
themselves.
They
nearly
give
you
a
signal,
but
it
is
not
sufficient
to
then
raise
essentially
saying
that
that
this
is
an
attack,
and
so,
as
I
mentioned
earlier,
what
we
do
we
have
kind
of
like
a
hierarchical
system.
A
A
There
were
essentially
two
alerts
fired
one
after
the
preparation
stage
and
one
after
the
money
laundering
stage.
They
were
both
highly
confident
and
so
inverse
could
have
if
they
would
have
hooked
up
to
the
Ford
assistant
could
have
taken
some
mitigative
action,
so
this
is
kind
of
encoded
in
a
bot
now
for
security,
researchers
that
want
to
hunt
for
attacks,
there
is
actually
a
discover
new
attack
Explorer
that
a
Community
member
has
created
that
is
deployed
on
on
this
link
right
here.
A
That
basically
allows
you
to
explore
attacks
that
are
happening
on
chain.
That
may
not
have
resulted
in
an
alert,
and
let
me
see
oh
dang,
it
I,
don't
have
it
oh
there.
It
is
so
this
is
how
that
looks
like.
So,
basically,
it
says,
hey
give
me
all
the
alerts
over
the
last
couple
of
weeks
and
then
it
essentially
ranks
it
based
on
the
confidence
that
we
have
on
on
some
heuristic
or
some
some
anomaly
model.
A
That
then
allows
you
to
explore
those,
so
this,
for
instance,
four
stages
fired.
So
this
was
the
the
winter
mute
attack
and
an
alert
was
emitted.
But
as
you
kind
of
scroll
to
the
right
here,
then
you
basically
see
attacks
where
maybe
that
threshold
wasn't
met
of
of
four
stages
being
triggered,
but
maybe
only
three
so
that
Bob
did
not
raise
an
alert.
A
Q
Hi
is
there
any
metrics
for
the
performance
of
the
scanning
node,
because
if
we're
talking
about
the
real
times
monitoring-
and
we
may
have
a
very
complicated
rules
to
scan,
also,
you
should
email
reference,
the
historical
data
as
well.
So
how
do
we
know
whether
a
node
is
the
hardware
is
compatible
for
such
a
complicated
task.
A
Well,
there's
there's
certain
so
the
the
scanners.
They
have
certain
capabilities
right
and
your
Bot
May
kind
of
have
requirements
that
exceed
those
capabilities
right
and
so
then,
as
a
bot
developer,
you
you
need
to
kind
of
incorporate
logging
that
allows
you
to
identify
whether
whether
the
scandals
have
have
issues
processing.
What
what
you're
trying
to
do.
A
Q
G
A
The
photo
network
does
not
not
natively
provide
that,
but,
as
you
subscribe
to
a
bot,
there
is
a
variety
of
mechanisms
that
you
you
can
kind
of
hook
up.
Webhook
is
one
of
it.
The
open,
Zeppelin
Defender
product
integrates
with
photo
so
kind
of
the
logic
that
you're
describing
alert
was
raised.
Take
some
action
on
chain
is
supported
by
open
Zeppelin's
Defender.
I
I
was
just
curious
if
you're
aware
of
any
contract
reputation
systems,
because
we
talked
about
like
there's
the
attack
of
what's
actually
happening,
but
also
something
suspicious.
We've
talked
about.
If
it's
funded
by
tornado
is
there
anything
out
there?
That's
actually
tracking
that
that
you
know
of.
A
No
I
mean
the
block
Explorer
have
some
tagging
and
source
code
verification.
That's
kind
of
the
only
mechanism
that
that
I
know
about
now
before
the
community
is
working
on
machine
learning.
Models
to
essentially
predict
whether
a
contract
is
malicious
or
not,
so
that
would
be
kind
of
a
way
of
reputation
system
for
contracts,
but
there's
probably
more
you
can
do
if
you
think
about
kind
of
the
deployer.
Who
is
the
deployer
right,
you
could
assign
reputation
to
that
and
kind
of
propagate
that
to
the
contract.
R
S
S
So
if
you
meet
a
certain
SLA
every
week
at
this
point
across
the
seven
networks
that
we
monitor,
there's
different
sort
of
reward
allocations
for
each
each
of
the
seven
networks,
but
if
you
hit
a
certain
SLA,
so
let's
say
like
you're
95
uptime
you're
going
to
earn
the
maximum
rewards
that
week.
So
those
are
coming
from
the
Florida
Foundation
right
now
it
is
free
to
publish
a
bot.
It
is
free
to
subscribe
to
that
bot
right
now
as
well.
S
We
are
introducing
bot
staking
as
well
as
a
lever
to
reduce
spam.
We
don't
have
two.
We
haven't
experienced
too
much
spam
on
the
network,
but
it
is
a
it's
a
risk
so
that
that
will
that
will
happen
soon
in
terms
of
paying
to
actually
get
the
alerts.
It
is
something
we
will
Implement
it'll
likely
be
some
sort
of
subscription
model.
S
So
if
you
wanna
so,
for
example,
like
the
the
attack
detector
feed,
that
Christian
was
talking
about
right,
that
Aggregates
a
bunch
of
these
other
alerts,
there's
a
lot
of
effort
that
a
lot
of
people
put
into
that,
so
that
one
would
probably
be
more
expensive
to
subscribe
to
than
like.
If
you
were
just
monitoring
for
like
high
gas
transactions
right,
that
bot
maybe
took
30
minutes
to
build
right.
So.
S
Eventually,
yes,
and
right
now,
the
Florida
Foundation
is
sort
of
coordinating
a
lot
of
this.
What
I'll
call
like
more
advanced
spot
development
that
uses
data
science
and
machine
learning,
but
there
are
other
like
there
are
other
audit
teams
that
have
approached
us
and
want
to
put
really
valuable
IP
on
the
network,
but
they
need
to
be
incentivized
to
do
that
right.
So
yes,
so
we
need
to.
We
need
to
enable
that,
and
we
will
it's
probably
more
of
a
q1
2023
thing.
Yep.
A
And
so
let
me
let
me
walk
through
a
few
examples,
so
this
is
The
Flash
loan
bot,
so
flash
loan
right.
You
can
kind
of
temporarily
get
some
tokens
as
long
as
you
pay
them
back
in
the
same
transaction,
primarily
used
for
Arbitrage,
but
also
used
for
Price
manipulation
attacks.
So
there
is
a
attack,
a
bot
right
now
that
is
deployed
on
the
network
that
monitors
for
Flash
loans,
but
then
has
some
additional
heuristics
that
basically
say
well.
A
A
This
one
is,
is
a
rock
pull
a
bot
that
basically
monitors
token
prices
over
time,
and
this
is
actually
about
that
utilizes
time
series
analysis
using
metas
profit
Library,
where
it
essentially
learns
based
on
historical
price
information,
to
alert
on
deviations
from
normal
behavior.
The
time
series
essentially
is
able
to
take
into
account
volatility
as
well
as
seasonality
of
any
sort
of
Time
series
data.
A
A
Now
it
is
utilizing
very
simple
fuzzing,
it's
basically
just
looking
at
you
know
the
functions
that
are
exposed
and
kind
of
guesses
parameters.
If
any
of
you
work
on
a
fast
Black,
Box,
fuzzer
I
would
love
to
talk
to
you
after
this.
This
presentation,
because
I
think
that
would
be
extremely
valuable
because
then
you're
able
to
you
know,
exhibit
the
attack,
behavior,
probably
with
higher
recall,
all
right,
so
custom
bot
development,
so
down
here
is
essentially
the
quick
start.
A
Url
anybody
can
develop
a
button.
It
is
extremely
easy
and
I
will
walk
through
using
some
screenshots
to
kind
of
show
you
how
that
looks
like,
as
I
said,
Bots
can
develop
in
Python,
JavaScript
and
typescript.
My
background
is
data
science,
so
I'm
partial
to
python.
So
all
the
examples
that
you
see
here
are
python,
so
you
need
to
set
up
your
Dev
environment,
so
obviously
not
something
that
we're
able
to
do
here
right
now.
A
A
A
Readme
contains
the
documentation.
This
is
essentially
the
documentation
that
is
exposed
on
the
bot
stats
page
I
personally,
when
I
develop
a
bot,
I
start
with
a
documentation,
because
it
creates
a
lot
of
clarity
for
me
in
terms
of
what
what
do
I
need
to
do
in.
In
the
bot
code,
what
chains
are
supported?
What
sort
of
alerts
am
I
planning
to
emit
under
what
condition
so
I
start
with
the
documentation?
Also
at
the
bottom
here
you
see
test
data.
What
is
really
neat
about
the
the
development
framework.
A
The
SDK
is
that
you're
always
able
to
back
test
your
Bot,
so
you
may
have
encountered
an
attack.
Let's
say
you
know
that
the
binance
attack
last
week
you
identify
a
technique,
that's
not
covered
by
a
bot,
you
develop
the
bot,
and
then
you
can
basically
just
back
test
and
make
sure
hey.
It
actually
detects
that
particular
attack,
which
is
super
powerful.
A
In
the
agent
code.
There
is
the
main
function,
which
is
essentially
the
handle
transaction
function
that
passes
in
the
transaction
event,
and
that
is
well
essentially
the
transaction
object.
All
the
the
usual
properties
of
a
transaction
are
contained
in
that
object,
and
your
job
as
a
bot
developer
is
to
essentially
analyze
the
transaction
event
and
then
emit
a
list
of
findings,
AKA
alerts.
So
basically
this
function
gets
invoked
and
you
return
a
list
of
alerts
based
on
your
logic,.
A
So
the
the
logic
that
I
quickly
walk
through
is
a
bot
that
basically
alerts
on
large
ustd,
usdt
transfer
events,
and
this
is
essentially
the
the
stuff
that
gets
created
so
in
the
bot.
You
basically
have
handled
transactions
and
then
you
admit,
an
alert,
so
here's
the
alert,
it's
basically
a
findings
append
creating
a
findings,
object
with
information
about
the
alert
like
the
name,
description,
severity,
type
and
any
metadata
that
you
want
to
provide
in
this
case
the
to
and
from
now
of
course,
that
does
not
have
the
logic
yet.
A
That,
basically,
then,
can
be
assured
that
you're
dealing
with
ustt
transfer
events
from
that
event,
you're
able
to
extract
information
to
from
and
value
you
normalize
that
value,
and
then
you
essentially
just
have
a
conditional
based
on
on
your
logic:
hey
if
it's
over
ten
thousand
dollars
now
I
want
to
emit
an
alert.
So
super
simple
but
I,
know
I've
been
speeding
up
a
little
bit.
I
want
to
make
sure
that
we're
not
running
out
of
time
for
the
second
part,
and
then
you
append
the
finding.
A
Now
when
you
develop
a
bot,
there
is
a
variety
of
ways
you
can
test
it:
unit
tests,
I
love
unit
tests,
back
tests,
I
love
back
tests
and
then
live
tests.
You
should
do
just
because
there's
a
lot
of
you
know
crazy
transactions
on
chain,
and
you
want
to
make
sure
that
your
Bot
doesn't
error
out
so
best
to
do
a
live
test
locally.
A
And
then
you
you
deploy
and
deploy
a
deployment
of
the
bot
is
permissionless,
so
you
basically
just
run
in
npm,
run,
publish
you
need
to
have
somatic,
because
basically,
what
you're
doing
is
you're
signing
a
transaction
that
registers
the
bot
on
the
Ford
F
smart
contracts.
Essentially
that
then
the
scale
notes
Monitor
and
pick
up
on
it
takes
a
minute
or
two.
It
basically
builds
the
docker
container
uploads
it
to
ipfs
signs
the
transaction
to
register
your
Bot
and
then
a
minute
later.
A
We
don't
have
exercises
that
we
do
live
here,
but
we
have
set
up
a
few
exercises
on
on
this
GitHub
right
here
that
get
you
familiar
with
the
general
bot
development
process,
and
so
one
is
is
kind
of
similar
large
USD
C
transfers,
the
other
is
detecting
load
balances
and
the
last
one
is
is
more:
security
focused
around
flashlight
flash
loan
resulting
in
losses
of
the
urine,
die
vault
and
then,
lastly,
what
I
want
to
call
out.
We
currently
are
running
a
contest
bot
development
contest.
A
A
Let
me
give
you
some
context
here.
Often
the
the
Bots
basically
just
say:
hey,
this
transaction
is
an
attack,
but
it
does
not
necessarily
give
you
context
around
which
protocol
was
attacked.
It
contains
all
the
addresses,
but
it
would
be
nice
if
it
could
say,
hey
inverse,
Finance
was
attacked,
and
so
this
particular
bot
contest
is
all
about
analyzing,
the
transaction
in
more
detail,
so
we're
able
to
identify
what
protocol
specifically
got
attacked.
B
Yeah,
thank
you
Christian
folks.
Just
let
me
leave
all
the
questions
to
the
end.
We
will
have
enough
time
and
we
will
answer
them
all
so
just
to
make
sure
that
the
core
features
that
we
want
to
describe
here
will
be
covered.
So
first
of
all
haven't
depart.
That
Christian
just
talked
about
was
really
excited.
B
Are
you
excited
so
like
you
can
create
a
detection
bot,
a
decentralized
detection
bond
with
a
really
limited
skills
in
coding
and
that's
great
and
that's
really
cool
and
that's
what
I
like
about
the
Florida
and
that's
what
we
like
in
lighter
about
the
Ford
and
Christian,
tell
us
a
lot
about
generic
attacks
detection
so
like
with
the
all
the
steps
this
attack.
Oh
yeah,.
S
H
B
You
go.
Oh
everything
was
such
so
fragile,
so
yeah,
the
Christian
told
us
about
the
generic
attacks
about
steps
of
the
generic
attack
about
the
early
stages
of
detection,
and
it
is
really
cool
that
everything
that
is
developed
in
forta
is
available
on
public.
So
having
this
bots
on
Fort
each
one
of
you
can
subscribe,
select
addresses
of
your
protocol
and
give
get
the
alerts
about
like
some
kind
of
this
attacks
related
to
your
protocol
and
that's
really
cool,
but
what
about
the
protocol
alerts?
So
what
I
mean
speaking
the
protocol
alerts?
B
Next
is
the
confidence
of
your
prodigal
security
so,
like
let's
say
you
have
a
number
of
generic
Bots
that
are
precisely
tailored
for
well-known
attacks.
Are
you
sure
that
your
protocol
is
secured
so
like?
Let's
imagine
we
have
tons
of
histories
about
attacks
and
if
we
cover
them
all
with
the
Bots,
are
we
sure
that
our
protocol
is
safe?
B
No,
not
at
all.
Why?
Because
new
attack
can
appear,
and
it
can
be
some
modifications
inside
the
attack
so
that
we
are
not
100
secure
and
actually
we
cannot
be
100
confident
about
the
security,
but
we
can
increase
this
level
and
we
can
increase
this
with
the
protocol
Bots
and
why
we
will
discuss
it
just
a
bit
later.
But
since
the
protocol
Bots
will
be
tailored
around
our
protocol,
it
will
watch
over
the
everything
happening
with
our
protocol.
Okay,
let's
move
on.
B
Are
not
detecting
attacks
itself?
They
are
detecting
some
strange
changes
or
some
critical
events
inside
your
protocol.
So
you
might
not
know
about
the
this
Vector
of
attack,
but
you
will
definitely
know
that
something
is
going
wrong
with
your
protocol
and
you
can
react
and
that's
cool
about
the
protocol.
Bus
and
the
last
thing
is
setup.
So
again,
what
is
cool
about
the
generic
Bots
is
that
you
basically
do
not
need
to
write
them.
If
you
are
satisfied
with
the
Bots
exists
that
already
exist
on
the
for
the
network,
while
with
the
protocol
Bots.
B
Unfortunately,
you
should
do
it
by
yourself,
but
it's
it's
very
very
interesting
and
you
will
definitely
do
it
after
the
workshop
I
100
sure.
So
we
have
the
generic
Bots.
We
have
product
robots.
Do
we
need
to
choose
between
them?
No,
we
don't.
We
need
them
all,
because
in
combination
protocol
Bots
and
generic
Bots
will
increase
our
level
of
confidence.
B
So
let's
discuss
the
typical
protocol
alerts
and
we
will
start
with
the
things
not
related
to
our
Tech
to
any
attacks
directly.
We
will
start
with
really
boring
operational
stuff,
but
which
is
also
very
useful
for
us.
So
first
of
all
is
the
repetitive
events.
What
repetitive
events
do
we
have
in
protocols
like
in
light
or
protocol?
We
have
Oracle
reports,
we
have
rewards
distributions.
We
have
funds
deposits
from
the
let's
say
the
lighter
contract
to
the.
If
2.0
deposit
contract
we
have
Dow
votings
and
some
others.
B
B
B
B
It
is
that
if
we
know
that
they
should
happen,
we
should
monitor
that
they
are
happening
and
if
they
are
not
happening,
it
means
that
there
are
some
problems
or
maybe
even
an
attack,
so
we
can
watch
over
the
Oracle
reports
and
so
on
and
so
forth,
but
the
one
thing
that
we
can
do
on
top
of
just
watching
over
the
events
and
alerting
you.
Oh
no,
there's
no
Oracle
report
here,
that's
a
problem.
B
We
can
do
these
same
things
with
the
other
words.
So,
with
the
operational
stuff,
we
are
watching
over
the
repetitive
events
and
trying
to
predict
issues
with
them,
but
that's
not
about
the
attacks.
Yes
and
our
Workshop
is
about
attacks.
So,
let's
start
speaking
about
the
security
and
from
the
security
point
of
view,
the
first
thing
that
we
definitely
should
watch
over
is
the
protocol
invariants.
We
will
talk
about
executive
invariance
in
details
a
bit
later,
but
what
I
want
to
say
right
now
is
that
there
are.
B
There
can
be
like
multiple
invariants
in
protocol
that
should
be
always
met,
and
if
they
are
not
met,
it
means
that
something
goes
wrong
and
it
can
indicate
that
there
is
an
attack.
So
simple
examples
here
is
Bridge
balance
difference,
so
any
hack
of
the
bridge
will
will
broke
this
invariance,
so
some
tokens
will
be
minted
on
one
side
or
too
much
tokens
will
be
withdrawn.
On
the
other
side,
okay,
we
can
watch
over
it.
B
The
issuing
of
the
tokens
without
actual
backup
is
also
the
cool
example
of
the
invariant,
also
minting
nfts,
unexpected
transfers
and
so
on.
The
second
thing
about
the
security
is,
first
of
all
the
events
that
should
never
happened
at
all
yeah.
So
can
you
spot
something,
except
for
one,
on
the
slide,
so
roles
and
ownerships
transfers
to
the
eoa?
So
you
have
a
huge
protocol
with
a
large
tvl,
and
then
you
see
that
okay,
the
ownership
of
the
main
contract
was
transferred
to
some
unknown
eoa.
B
Is
that
because
we
want
to
know
about
such
events
happening
as
soon
as
possible
and
do
not
sit
here
on
the
S
and
after
that,
like
okay,
one
week
ago,
one
of
our
main
contracts
was
self-destructed,
so
we
want
to
know
about
it
as
soon
as
possible
to
have
the
ability
to
take
some
actions.
Can
you
spot
some
other
events
that
should
definitely
never
happen
with
the
protocol?
B
B
Yeah
and
that's
even
can
be
a
protocol
invariant,
you
know
and
yeah
changing
value
from
positive
to
negative,
where
it
should
never
happen
also
can
be
the
case
okay,
except
for
the
events
that
should
never
happen
at
all.
There
are
some
events
that
might
happen,
but
should
never
happen
silently,
let's
say
yo.
You
have
some
protocol
that
that
the
part
of
this
protocol
is
depositing
funds,
so
folks,
again,
deposit
funds
and
withdraw
them
and
again
you're
a
happy
guy
sitting
on
a
beach.
B
And
after
that,
you
understand
that,
oh,
my
God,
my
prodigal
tvl
got
down
by
50
and
I
didn't
notice
it.
So
that's
the
example
of
the
huge
withdrawals
and
that's
the
event
that
could
happen.
That's
not
a
problem,
that's
probably
even
not
an
attack
that
can
happen,
but
it
definitely
shouldn't
happen
silently
and
you
can
also
have
the
alerting
setup
for
it.
Also
a
huge
balance,
challenge
changes
and
the
other
thing
is
the
ACL
changes.
B
So
if
we
have
a
truly
decentralized
protocol-
and
we
control
it's
not
by
only
one
person
or
like
even
a
multi-seek,
so
we
have
the
precisely
designed
ACL
system.
We
also
need
to
know
about
each
change
in
the
ACL.
Let's
move
on
and
since
we've
already
already
discussed
the
main
ideas
and
the
main
types
of
the
protocol
orders,
we
can
move
to
the
Practical
parts
and
dive
into
the
examples,
and
we
start
with
the
idea
of
overall
bot
development.
B
So,
since
I'm,
a
former
quality
engineer
in
traditional
software
development,
there
is
a
term
called
shift
left.
The
idea
of
the
term
is
that
you
should
start
testing
as
soon
as
possible,
like
on
on
the
stage
of
the
requirements,
so
no
actual
software
is
provided,
and
you
also
already
start
testing.
The
same
goes
for
the
alerting.
B
So
if
you
are
one
who
is
responsible
for
the
alerting
in
your
company
in
your
team
or
just
just
want
to
make
cool
alerts,
you
should
start
at
the
very
first
stage,
so
they
ate
the
ADR
at
the
architecture,
description
record
and,
first
of
all,
do
a
review
of
the
overall
architecture
of
the
of
the
overall
idea
and
identify
like
some
issues,
maybe
known,
hacks
and
so
on.
After
that,
on
the
development
stage,
you
should
be
also
involved
to
make
sure
that
all
the
events
view
functions
and
other
stuff
is
in
the
protocol.
B
So
once
you
will
start
building
the
alerting
system,
you
will
not
get
into
the
situation
when
okay
I
got
this
invariant
I
get
it
in
mind,
but
I
have
no
way
or
like
a
weird
way
of
getting
it.
Okay,
cool
on
the
review
stage,
you
should
confirm
that
everything
described
on
the
previous
stages
is
in
the
protocol
and
on
the
deployment
stage.
It
is
time
for
you
to
either
start
or
even
finalize
the
development
of
the
alerting,
and
once
the
contracts
are
deployed
on
chain,
the
alerting
for
them
should
be
deployed
as
soon
as
possible.
B
Okay,
now,
let's
talk
about
the
critical
Advance
about
the
things
like
we
mentioned
in
the
things
that
should
never
happen
or
the
things
that
are
really
really
important
for
us.
So
the
first
thing
is
the
ACL
changes.
We've
talked
about
it
a
bit
late
earlier,
and
the
first
thing
that
I
want
to
say
here
is
each
ACL
change
should
be
alerted,
even
though
you
can
might
think
that.
Okay,
that's
not
a
critical
thing,
or
that
would
that
would
that
ACL
would
never
change.
B
You
should
definitely
have
alerts
for
it
because
you
never
know
the
exact
Vector
of
the
attack
and
the
ACL
changes
are
usually
involved
in
attacks.
So
all
all,
and
also
granting
and
revoking
permissions
for
some
critical
stuff
should
be
alerted
with
the
critical
alerts,
and
we
will
talk
about
the
alert
severity
in
just
a
few
minutes.
The
second
thing
is
ownership
transfers
and
it's
basically
the
simplified
version
of
the
ACL.
B
When
you
do
not
have
a
separate
ACLS
you
just
have
the
owner
and
for
sure
the
ownership
of
your
protocol
should
be
never
transferred
to
eoa.
It
should
never
be
transferred
to
the
unknown
address
and
it
should
be
never
transferred
to
the
null
address.
And
the
last
thing
is
this
stage
changes.
So
it
is
it's
common
practice
for
the
protocols
to
have
functions
that
changes
the
state
and
does
not
emit
event,
but
that's
a
critical
change
or
the
changes
that
just
might
happen.
So,
like,
let's
say
you're.
B
The
commission
of
your
protocol
is
set
on
one
of
the
contracts
and
it
somehow
gets
changed.
You
definitely
want
to
have
alert
about
it,
so
if
it
is
the
case
when
it
was
done
by
intent,
it
is
your
team
it
is.
Was
it
was
done
over
the
voting?
That's
okay!
So
you
just
see
the
alert
and
say:
yeah
I
know
that
that
should
happen.
But
if
it
happens
without
any
contest
you
you
should
definitely
react
on
it.
Okay
and
so
some
examples
of
the
ACL
contracts
have
no
idea
where
I've
put
it
on
the
slide.
B
So
let's
speak
about
the
protocol
invariance
in
bit
more
details.
I
have
three
basic
examples
here
and
I
think
that
we
can
spot
several
others.
So,
first
of
all
yeah.
If
we
speak
about
the
protocols
that
are
about
depositing
funds,
then
for
sure
the
amount
of
the
tokens
of
something
minted
should
be
equal
to
the
amount
of
the
dep
to
the
amount
of
the
funds
deposited
for
sure.
The
bridge
balance
the
source
Bridge
balance
should
be
always
higher
or
equal
than
the
target.
B
Bridge
balance-
and
you
know
the
difference
here
so
in
the
first
invariant
we
have
the
equality
and
in
the
second
we
have
not
the
not
the
equality
but
inequality
and
invariance
of
both
types.
Why?
With
the
bridges
we
are
using
not
as
strict
equality,
because
in
most
cases
the
funds
can
move
from
one
part
of
the
bridge
to
another
and
it
might
take
time
and
the
movement
like
on
one
side
and
on
the
other
side
can
take
different
time.
B
But
you
definitely
should
keep
in
mind
that
if
you
deposit
funds
on
one
part
of
the
bridge,
the
amount
of
the
funds
here
should
always
be
higher
than
amount
of
the
ones
printed
on
the
other
side,
and
the
third
example
is
the
collateral
value.
So
collateral
always
should
be
larger
than
law.
Can,
you
spot
any
other
examples.
Maybe
something
is
in
your
mind
right
now,
so.
B
B
But
you
definitely
know:
oh
you,
I
I,
I'm,
quite
sure
that
you
know:
okay,
let's
leave
it
as
this
I
think
that
in
course
of
time
you
will
have
some
ideas
about
it
and,
let's
say,
let's
begin
the
details
about
the
repetitive
events.
So,
as
we've
talked
earlier,
there
are
several
repetitive
events
and
there
are
ways
to
there
are
possible
issues
with
this.
So
for
the
Oracle
report,
it
can
be
Quorum
not
reached
or
something
like
that.
B
That's
why
the
Oracle
report
is
not
in
time
and
we
can
predict
it
by
monitoring
the
Quorum
with
the
rewards
distribution
again
rewards
are
not
distributed
in
time,
and
how
can
we
predict
it?
We
cannot
predict
it
on
chain,
unfortunately,
but
we
can
predict
it
with
the
off
chain,
executor
monitoring.
So
let's
say
we
have
sum
of
chain
tooling.
That
is
calling
it
function
once
in
24
hours
and
over
the
next
24
hours
there
were
no
rewards
distribution,
then
we
should
definitely
have
the
monitoring
for
the
off
chain
executor
here
and
possibly
some
other
things.
B
B
So
at
the
architecture
decision
record
at
the
development
stage,
we
should
identify
that
in
our
protocol
there
is
no
things
that
are
well
known
in
the
attacks
in
the
hacks
or
a
well-known
vulnerabilities
where
to
search
for
these
things.
So,
first
of
all,
if
you
are
working
in
the
web
3
for
a
while,
you
like
you,
you
live
in
the
space
and
you
you.
B
You
definitely
heard
about
some
hacks,
but
you
most
likely
you
heard
only
about
the
the
hugest
hex
so
do
like
to
to
make
a
created
database
in
your
mind,
of
the
hacks
and
of
the
things
that
you
should
watch
over.
You
should
definitely
follow
Twitter
of
the
main
Protocols
of
the
main,
like
folks
tweeting,
about
some
security
issues,
and
you
should
redirect
you
can
do
it
in
the
two
ways.
So
the
first
way
is
on
the
design
steps
of
the
protocol.
You
confirm
that
there
is
no
hacks
in
the
protocol.
B
B
Okay.
So,
as
Christian
said,
no
alert
should
be
left
unacted.
Why?
So?
Because
if
you
create
an
alert,
it
means
that
something
bad
had
happened,
and
you
should
definitely
take
the
action
and
if
you
create
the
alert
that
does
not
require
an
action,
then
such
alert
should
never
exist
and
speaking
about
forta,
all
for
sure,
everything
that
is
produced
by
the
Bots
is
called
alerts,
but
there
is
different
alert
severities.
B
So,
in
my
mind,
I
separate
two
things
so
like
high
and
critical
stuff,
that's
the
alert
and
that's
the
things
that
should
be
acted
while
the
law
and
info
stuff,
it's
kind
of
feed
news
feed
that
you
should
not
for
sure
take
actions.
But
you
want
to
be
aware
of
So
speaking
about
the
critical
alerts
once
the
critical
or
high
alert
is
fired
as
we
as
we
said,
there
should
be
some
actions,
but
how
you
can
be
sure
that
these
actions
will
be
taken.
B
So
this
is
the
simplest
option
here
is
to
set
up
the
on-call
system
that
will
ensure
that
either
the
the
person
on
duty
or
the
other
folks
in
the
team
or
even
the
CTO
of
the
company,
will
eventually
know
about
the
alert
and
we'll
take
some
actions
in
so
there's.
Basically,
two
examples
of
the
most
famous
Ops
give
me
a
second
of
the
uncle
systems
that
you
can
use.
B
But
if
your
protocol
is
not
that
large
or
you're
just
a
part
of
a
small
team,
you
should
you
you.
There
might
be
a
situation
when
you
will
first
start
with
the
simple
chats
so
like
we
did
previously
before
we
got
the
on-call
system
and
the
the
interesting
thing
about
the
chats
is
that
you
should
also
separate
the
critical
feed
into
the
chat.
That
should
definitely
should
never
be
muted.
B
What
what
gonna,
what
what
I
gonna
do
in
this
case
do
avoid
such
situations.
You
can
have
the
thing
called
runbook,
so
basically
round
book
will
consider,
can
should
contain
sorry,
several
parts,
the
description
of
the
alert
itself,
so
the
person
who
is
not
aware
of
the
alert
can
dive
into
the
details,
the
definition
of
the
severity.
B
So
if
it
is
a
critical
alert
or
high
alert,
it's
for
sure
it
will
be
in
the
alert
itself,
but
there
can
be
some
modifications
and
some
conditions
the
confirmation
of
the
alert,
because
there
is
a
chance
that
this
alert
was
was
just
a
fluke
and
you
shouldn't
take
any
actions
on
it.
Also,
the
resolution,
the
escalation
process
and
some
notes
and
links,
and
if
you
really
wanted
to
use,
run
books
in
your
company
go
check
out.
B
B
The
actions
on
alerts,
one
more
time
as
Christian
mentioned
and
I
think
that
someone
from
the
audience
asked
this
question
is
okay:
there
is
a
critical
hack
in
the
protocol.
We
got
the
alert
about
it.
We
know
that
the
hack
is
happening
and
we
don't
want
to
be
like
a
ronin
Bridge
hack,
no,
not
like
our
own
Enbridge,
but
winter
me
and
Tech,
where
the
folks
detected
the
hack
and
they
sit
and
look
the
on
the
attack
happening
and
basically
have
no
ability
to
pre
to
stop
it.
Why?
B
Because
there
were
no
emergency
brakes
in
their
protocol.
So
if
you
are
designing
a
smart
contract
and
you
sh,
like
you
care
about
the
security-
and
you
assume
that
there
might
be,
there
is
a
little
chance,
but
there
is
a
chance
that
there
will
be
an
attack
on
your
protocol.
Please
at
least
add
the
ability
to
pause
your
protocol.
Yes,
it's
not
that
good
for
for
the
people
for
the
users,
but
it
might
save
you
tons
of
money
and
be
a
like
an
the
factor
that
will
save
your
protocol.
B
Okay
and
the
last
thing
speaking
about
the
alerts,
is
that
one
alert
is
good.
One
alerting
system
is
good
and
Forte
is
amazing,
alerting
system,
but
for
the
critical
alerts
I'm
highly
recommending
to
have
a
redundancy.
So
if
you
let's
say
have
the
own,
the
alert
for
the
ownership
changes
in
your
protocol
then
take
your
time
and
not
only
implement
the
photo
bot
but
also
consider
some
other
alerting
system.
It
might
be
self-tailored
by
you
or
some
other
solution,
but
having
a
redundancy
for
the
critical
alerts
also
helps
you
increase
the
confidence
and
yeah.
B
B
There
is
a
there's,
a
chat.
The
telegram
chat
that
you
can
join
and
in
this
chat
me
Christian
and
other
guys
from
forta
will
help.
You
will
give
you
the
consultations
about
okay,
I
cannot
deploy
the
bot.
Please,
can
you
help
me
or
how
can
I
detect
this
particular
case
or
anything
like
that
and
for
the
tasks
about
the
protocol?
Bots?
Maybe
someone
of
you
are
does
not
have
a
protocol
yet
then
you
can
take
the
lighter.
B
No,
you
can
look
first
at
the
existing
light
of
lighter
Bots
and
also
here's
the
alerting
checklist.
That's
the
important
thing
and
it
follows
the
idea
of
the
early
stages
of
alert
creation,
so
I
think
that's
all
from
my
side.
That's
all
about
the
protocol
alerts,
and
now
we
can
move
to
the
questions.
U
Yeah
I
just
want
to
add
something
about
the
photobots
configuration,
so
isn't
that
the
person
that
made
the
question
related
to
that
already
left,
but
I
think
that
is
worth
sharing
with
everyone.
So
let
me
start
by
introducing
myself:
I
am
Lazaro
from
nevermind
and
I
have
been
working
with
vorta
for
a
long
time.
So
I
have
been
facing
this
configuration.
Let's
say
problem
that
once
your
Bot
is
deployed
and
you
cannot
configure
your
Bot
anymore,
so
you
cannot
change
anything
and
you
will
need
to
pre-deploy
your
Bot
to
do
some
changes.
U
But
this
is
only
true.
It's
your
Bot
is
the
one
that
knows
the
the
configuration
details
you
can
have
and
your
configuration
in
a
deployed
smart
contract
on
the
blockchain.
So
you
can
you
can
change
any
value
on
the
blockchain
and
you
will
notice
that
so
you
will
be
able
to
change
the
configuration.
Maybe
this
is
not
worth
on
the
ethereum
maintenance,
because
changing
that
values
and
will
be
more
costly
than
replaying
your
Bot,
but
probably
on
polyun.
U
This
is
fine
for
you,
and
this
can
also
allow
you
to
do
interesting
stuff
like,
for
example,
I.
Don't
know
if
there
is
something
already
on
there,
someone
already
on
the
photo
network
doing
this,
but
you
can
create
a
community,
but
something
like
you
have
your
project
and
your
community
is
interested
in
monitoring
something.
So
you
can
create
a
bot.
The
body
is
consuming
the
configuration
from
the
blockchain
and
you
can
let
the
community
change
the
the
configuration
by
governance
or
whatever
else.
U
So.
This
is
one
of
the
approach
I
want
to
share
like
having
your
configuration
on
the
blockchain
and
the
other.
One
is
like
if
what
you
are
looking
for
is
Simply
Having,
different
configurations
in
different
networks
like
if
your
Bot
is
meant
to
be
around
on
ethereum
maintenance
on
polygon
on
BSC,
and
things
like
that,
you
can
have
an
approach.
U
The
initialize
function
of
the
Bots
was
not
covered
in
this
Workshop,
but
you
can
check
the
photo
augmentation
for
that
and
you
can
use
the
initialize
function
to
detect
in
one
blockchain
in
what
network
your
Bot
is
being
executed,
and
given
that
you
can
use
a
different
configuration
for
you,
but
by
only
checking
what
network
your
Bot
is
being
executed.
So
this
is
our.
These
are
the
two
approaches
that
it
was
I
want
to
share.
Yeah.
B
B
Yeah
sure
it
is
so
in
the
example
of
the
in
the
fourth
example
in
the
example
wrapper-
and
you
know
the
lighter
Bots-
you
will
see
that
there
like
give
me
a
second
yeah
for
sure
you
can.
When
you
run
the
boat
on
life
on
notes,
it
will
start
from
the
latest
block.
But
if
you
want
to
test
your
Bot
against
the
given
block
against
the
given
transaction
against
the
given
block
range,
you
should
you
you
can
do
it
simply
by
using
Forte
SDK,
and
it
is
mentioned
in
the
readme's
of
all
Bots.
A
N
N
N
Applied
I
filter
it
with
inside
them.
Okay
and
the
other
question
is
in
our
protocol.
We
we're
sort
of
a
factory
thing,
so
we
instantiate
a
bunch
of
contracts,
I'm,
not
sure
if
templates
is
a
solution,
but
is
it
possible
to
create
Bots
that
people
can
then,
when
they
deploy
their
own
instance
of
all
these
contracts
to
just
reuse
it
easily
like
without
needing
to
rewrite
it?
You
know
like
because
the
addresses
will
change.
Imagine
like
instantiation,
multiple
instances
of
a.
A
N
A
N
S
It's
intended
to
be
used
by
people
that
you
know
are,
are
creating
safes
right
and
so,
but
you'll
have
to
like
you'll,
have
to
configure
it
for
your
you're
multisig
right
right,
but
yeah,
but
the
template
exists.
So
if
you
have
a
similar
product
or
protocol
where
your
users
are
just
taking
like
a
template,
contract
yeah,
sorry.
S
W
B
G
A
A
Don't
think
so?
Okay,
so
all
notes
run
all
the
Bots,
not
all
the
Bots,
like
think
of,
like
you
know,
Bots
get
deployed
on
scan
six
or
seven
scare
notes
at
the
same
time,
and
then
that
is
satisfied
right.
So
these
seven
scale
notes
run
these
sort
of
parts,
and
these
seven
scanners
run
different
types
of
bots.
F
Thanks
for
this
great
and
interesting
Workshop,
My
question
is
related
about
some
fundamental
question
about
disclosing
information,
how
our
bot
works,
because
if
the
hacker
is
not
very
stupid,
it's
pretty
cool
to
go
to
Fourth
check
how
it
works
test.
This
unit
tests
that
no
Bots
even
meant
an
alert
because
I
can
absolute.
My
addresses
I
can
really
make
some
pretty
complex
logic
not
to
be
detected,
and
after
that
I
run.
The
hack
and
I
could
be
succeed
without
zero,
alerting
as
opposite.
F
B
Just
let
me
start
and
then
Christian
will
add
his
thoughts.
So
that's
a
great
question
and
this
idea
on
the
first
glance
sounds
like
yeah:
why
the
hell?
Do
we
make
these
Bots
public,
but
on
the
other
hand,
since
the
all
the
photo
network
is
public,
and
since
there
are
many
numbers
of
the
bot
developers
as
much
as
like
the
more
for
the
developers
and
the
more
Bots,
we
have
the
less
the
ability
to
even
try
to
execute
your
attack
against
all
these
Bots.
B
Since
the
network
is
watching
over
the
mainnet
and
you
have
no
ability,
like
let's
say,
to
run
all
the
bots
in
the
photo
Network
at
home
I,
don't
think
that
any
hacker
would
ever
do
it
due
to
the
fact
that
the
amount
of
the
Bots
watching
over
the
mainnet
on
the
photo
Network
right
now
is
really
huge
and
it
will
increase
in
time.
So
that's
my
point
here:
Christian
yeah.
A
I
mean
I,
think
it's
it's
it's
a
strategy
right,
you
could
say:
hey
private
and
I,
developed
them
in
house,
and
you
got
coverage
contests
at
the
Florida
which
which
I'm
personally
super
excited
about.
Is
that
that
it
is
a
Community,
Driven
project
right,
and
so
you
have
hundreds
of
developers,
security,
researchers,
data
scientists
that
basically
look
at
attacks
and
then
essentially
develop
Bots
that
identify
this
attack
from
different
approaches,
different
angles.
A
So
you
get
a
lot
of
diversity
in
the
detection
approach
that
makes
it
harder
and
harder
for
an
attacker
to
evade,
and
so
I
personally
think
that
that
is
the
better
approach.
But
I
I
can
see
that
that
there
are
maybe
instances
where
you're
not
comfortable
to
have
the
bot
public
and
the
alert
public
and
there's
options
on
the
photo
Network.
That
would
allow
you
to
do
that,
either
through
obfuscation
and
encryption
of
the
alerts
or
running
your
private
scanner.
A
D
A
A
I
think
the
next
step
is
really
to
use
anomaly
detection
to
combine
alerts
together
where
you're,
basically
looking
at
each
of
the
stage
and
say
how
anomalous
is
this
particular
alert?
And
then
you
combine
essentially
anomaly
scores
together
to
create
one
overarching
anomaly
score
that
you
can
then
rank
in
the
Middle
Road.
B
Yeah
and
probably
I
will
ask
you
a
question
from
the
technical
point
of
view.
There
is
a
graphql
API,
a
wonderful
API,
so
that
you,
the
the
combiner
bot,
is
actually
not
watching
over
the
chain.
It
is
fetching
the
graphql
API
and
consumes
the
alerts
from
other
Bots
and
after
that,
creates
a
decision.
So
as
we
speaked
about
the
salon
example
so
on
the
photo
Bots,
you
should
not
you.
B
You
cannot
only
watch
over
the
things
happening
on
chain,
but
you
should
do
some
other
stuff
so
like
fetching
external
apis
or
fetching
defort
API
itself
and
as
far
as
I
remember,
there's
even
an
example
of
the
combiner
bots
so
that
you
can
do
it
pretty
easy.
So
let's
say
you
have
developed
several
Bots
and
then
you
want
to
have
a
combiner
on
top.
On
the
fourth
examples
you
you
can
find
the
example
of
how
to
do
it
really
simple
yeah
and
currently
it
answers
your
question.
A
Let
me
add
one
more
comment:
there
So.
Currently
the
two
main
interfaces
on
the
bot
is
handled
transaction
and
handle
a
block.
There
is
going
to
be
a
new
handle
alert
that
allows
you
to
build
hierarchical
alerts,
currently
the
way
it's
implemented
in
the
bot,
it
basically
Triggers
on
handle,
block
and
then
queries
all
the
past
alerts
and
then
kind
of
Aggregates
and
combines
them,
but
handle
alert
would
be
a
cleaner
way
to
do
it.
So
we're
moving
into
that
direction.
A
The
Precision
of
the
alerts
need
to
be
increased,
such
that
you
know
this.
This
mitigation
mechanism
doesn't
fire
on
false
positives
and
then
also
the
mitigative
actions.
Currently,
it's
pause
a
big
hammer.
There
needs
to
be
more
nuanced
actions
that
that
mitigate
the
attack,
while
not
negatively
impacting
the
users
of
the
protocol.
A
B
Yeah,
so
if
you
want
your
protocol
to
be
protected
and
not
to
get
in
the
situation
when
it
was
hacked,
and
then
you
go
to
the
foreign,
so
what
you
should
do
right
now
is
go
to
the
photo
app
And
subscribe
to
the
threat
detection
kits,
and
then
you
can.
You
will
have
time
to
take
actions
gay
folks,
any
other
questions.