MakerDAO Tool House Rock, 21 Sep 2023

Previous Meeting

Next Meeting

⏯

youtube image

►

From YouTube: Tool House Rock #15 | Hexagate

Description

MakerDAO Forum Post: https://forum.makerdao.com/t/tool-house-rock-15-hexagate-tuesday-september-19th-2023-17-00-utc/22050

Description:
Tool House Rock is a structured community call to give projects a way to showcase their tools and solutions to the growing MakerDAO Ecosystem. Tool House Rock will follow a consistent call agenda, focused on giving Ecosystem Actors a foundation for reviewing and assessing tools.

This Session's Guest:
Niv - Founder / CTO

What is Hexagate?
Hexagate is a web3 security company, providing real-time threat intelligence for protocols, bridges, chains, wallets and asset managers to protect them from exploits, fraud, phishing and scams. Hexagate offers a suite of tools designed to proactively monitor onchain threats, ensuring an automated response is triggered before an attack can be executed.

Hexagate is built by security experts with in-depth knowledge of blockchain technology and its evolving attack vectors. Hexagate is already working with the biggest names in the industry, protecting over $10B of TVL.

Hexagate is designed to:
- Detect phishing, fraud, and scams
- Detect financial attacks (such as oracle manipulation or rug pulls)
- Analyze malicious smart contracts
- Detect exploits and hacks
- Automate real-time preventative actions

Disclaimer
This communication is provided for information purposes only. The views and opinions expressed in this meeting are those of the people involved and do not reflect the official policy or position of MakerDAO or any of its contributors, Core Units, or affiliates. This communication makes no representations about the enduring accuracy of the information or its appropriateness for a given situation. This content is provided for informational purposes only and should not be relied upon as legal, business, investment, financial, or tax advice. You should consult your own advisers as to those matters. References to any digital assets and the use of finance-related terminology are for illustrative purposes only and do not constitute any recommendation for any action or an offer to provide investment, financial, or other advisory services.

MakerDAO Links:
https://makerendgame.com/toolshed
https://mips.makerdao.com
https://forum.makerdao.com
https://chat.makerdao.com

A

Hello, everyone and welcome to episode 15 of tool. Housee Rock today, we're excited to be hosting hexag gate, a security.

A

Protocol, a quick recap for any first time, viewers tool house rock, is a recurring Community call where we host exciting projects in the web, 3 space, uh with a specific focus on their relevance to maker Dow and the endgame roadmap. Just a few disclaimers before we get started, our views are our own and are not representative of maker Dow as a whole. Information moves very quickly in the space and therefore, inaccuracies are possible, especially if you're viewing this in the distant.

B

A

And finally, none of this is financial or legal advice.

A

All right, hexag, let's take a closer look after analyzing hexag gate. We feel it is especially applicable to the following Scopes stability protocol and finally, core.

A

Resiliency and looking at Improvement categories, certainly security, governance and finally, sustainability of the.

A

Protocol all right, thank you for joining us today. Neeve um I will hand it over to.

B

You awesome thank you, keter uh happy to be participating in here and showcasing our product and our capabilities just share my screen. So we have like a couple of flies in the.

C

B

Awesome so, uh as keter mentioned, uh like first of all, my name is n I'm, the CTO of hexag gate, hexag gate is Real Time threat, intelligence uh company and doing basically threat hunting for any type threat. That means we are U also helping protocols wallets asset managers. Basically anyone on the web free space to catch uh any type of threats before they happen, as they happen and after uh they took place uh primarily in order to stop it before it even impacts any digital assets.

B

But, of course, like we have different kind of stakeholders to use your platform for various uh ver of reasons also to investigate crime and so on. uh What I'm going to show just for the agenda? It's going to be relatively short, slac about. What's what? What is the problem that we're solving?

B

How we're solving it and some of U some of a closer look of what exactly we're doing and following that, I'll also show a demo where we go over specific, uh like two examples where are I think are interesting to dive in to and analyze um so we'll get to that.

A

Also, later in the demo.

B

Part so before I uh talk about hexag gate uh itself,.

B

uh Preliminar, that is uh the actual problem that we're solving so basically uh on the web three space. U what hex is solving is uh a way uh like kind of a new another approach to how smart contracts should be uh should be handled in terms of security.

B

So we've been, uh we are a team of basically coming from cyber security uh background and also specifically on auditing uh code, not necessarily smart contract, whether like different kind of verticals, also on the healthare space on any space freely and uh on web free like there is a huge market for auditing, where uh lots of audit companies auditing code, but still like the situation, is that, like lots of lots of contracts and lots of um protocols still get hacked like on on a daily basis. Even even though, like many uh security, vendors U, like.

A

Auditing companies audited the the project.

B

And we think that is true like this is the situation because of bir of prons uh primarily is because auditing is mainly uh manual and uh the problem with that is that you have like just a fixed set of eyes, looking at the code and trying to think of the potential vulnerabilities in the code, and obviously this is not a comprehensive approach, uh or at least like you, only know what auditor found and you never know what the auditor never found unless, like uh some attacker or some North Korean attacker now um targets your protocol.

B

Also auditing, like is a costly business. So normally you don't just take one auditing company, you take like a bunch of them and not every anyone has like infinite budget to have dozen, like hundreds of security researchers eyes. Looking at the at the code. That makes uh AI thing also like a costly, costly business and eventually, like uh some protocol, have to spare uh some time of auditing companies looking at the cor because they just don't have enough budget to pay for so many auditing companies.

B

uh Also auditing is something which only covers first party code and on defy, like you have basically a money Lego where one protocol relies on others such as tokens, even Bridges, uh oracles and and so on, is normally overlooked and is not covered by any auditing company. So, for example, if you're protocol aggregator h building on top of another protocol, for example that makes auditing far less uh relevant uh to you, because even if your code is like uh do.

C

Not have any uh vulnerabilities.

B

Of course, like the code that you building on top is, uh might have some vulnerabilities in it, and then uh that would make uh eventually you susceptible also like protocols building on another chain where the bridge gets hacked. For example. uh This is again a great case for uh why auditing is is not enough because the bridge can get hacked and then, if you rely on some uh wrapped tokens of that bridge, and you just assume that they will always be backed by real, like by tokens. If the bridge got hacked, then yeah.

B

That renders like the protocol also to be working with tokens, which does not have any collateral on the other side of of the bridge uh and all in all like auditing is uh is uh again only know, only looks for what the.

A

Obvious see what that.

B

Security researcher has uncovered So. Eventually you only know what you know and what we think is really missing in the web. Fre space and- and this is kind of every week- we're reminded by it- is that H, you have lots of unknowns in defi space, of course, lots of zero days, and since everything is built on on top of anything else- and it is a money Lego, then uh anything can just fall apart in a single TR transaction, and this makes the case uh for uh an ongoing protection.

A

B

You're basically like the first step in that uh in real time, proactive protection is first of all like mapping all the threats like mapping, all the possible attack vectors. That is like the governance proposals like tokens oracles, uh the first body code like any third body code that you're relying on uh I I, mean admin, keys and and so on, and then setting up monitoring on those uh on those addresses. Now we take an approach like the realtime.

B

Proactive protection approach takes a stand where we're assuming that non, not all threats are were covered in the auditing uh in the auditing phase, but whether we incorporate uh machine learning and classification algorithms to actually uncover any potential exploits before they happen and as they happen on the protocol that only like um kind of uh a machine learning algorithm or sophisticated, like security juristic, can find when it's not looking for the actual vulnerability, but rather like for the attacker itself and the actual attack.

B

So uh all in all, like a realtime, proactive protection is kind of both covering what you already know like the threats that you know of, for example, one threat could be, we might be bridged and the admin Keys might be bridged for the protocol and then possibly like upgraded and also um takes into account what is unknown like we might have a a breach or might have a vulnerability in one of our one of our contracts, which we are not aware, and this is why we need a realtime, proactive protection that actually chases down for those kind of vulnerabilities which are which weren't known uh before.

B

So when looking at the web three space, like one things that we, uh this is one mindset that we incorporate in terms of like the proactive protection when it comes to protecting protocols uh in real time.

B

uh uh Another thing that also is prominent on uh on web 3 is anything around like fishing.

B

Now, if you look at web 3 space and the crime on web 3, like eventually you see a mixture of both exploits which are normally just enormous losses of protocols and also fishing scams, which are relatively small, not all all the time, with relatively small scams of individuals, but in huge amounts of individuals. So all in all, like the whole world. Free crime is uh comprised of both uh fishing scams, fraud and exploits kind of uh threats that happen uh on.

A

That happen regular regularly.

B

Now uh we think fishing is relatively, like. Obviously, fishing is probably a 30y old kind of problem in the security space, but on web 3 fishing kind of took a new um kind of took a new uh way because uh users are not lured into sealing their uh credentials like their passwords and usernames, and all of that, but rather to sign malicious transactions. And that is also true, for uh you know, if now a whale uh or someone who has like lots of governance.

B

Tokens is now lured into a fishing campaign and eventually lose loses all of his governance tokens all at once, without even noticing so. Fishing becomes like a also a huge uh pain pain point in in web free security, because it's you're, just like users, are just like one transaction away from getting wiped and that that has like huge implication for the users, because he can lose all of his fund, but also for protocols like fishing on their governance.

B

Participants is something which is uh sometimes overlooked, and this is another thing that we think that we think is a huge problem in this space, and this is why we bring also the proactive approach approach where we are chasing down like any new fishing campaign before it impacts any type like before it impacts any user, uh whether it's like a retail user governance like we don't really.

B

We don't take an approach where we monitor specific user, but rather we monitor like new sites that come in and also like new transactions that come in it might indicate. This is uh a new onchain fishing campaign, so so that whenever uh a user of heate engages with this uh new fishing campaign, where it's like an address or a new domain, exate will know to block it uh right on time.

B

So all in all, like just cover like two main, a Avenues of uh of web three crime, one is exploits where uh Protocols are not uh protocol incorporates mainly a ating so far and we take an approach where auditing is just not not covering like the unknowns.

B

This is why you need the proactive approach to monitor for any unknowns that might impact the protocol and, second anything around like fishing and fraud, where users are lured into signing malicious transactions to eventually steal their funds and on the maker, for example, Maker case they could be like governance participants who lose their governance.

B

Tokens to fishing for any type of fishing. Of course like this is an umbrella term for many type of threats that happen on chain which include like malicious contracts, adverse.

A

B

Delous adapts and so on.

B

So when we started hex, we kind of looked at the space the space we saw like enor enormous losses, even though, like there are so many auditing companies, and so many obviously like traditional fishing tools, uh and we decided to build hexag gate uh to actually solve this case for web3 security and the way hexag gate works is on the back end. We have uh two main uh components: one is the blockchain monitoring and one is uh URL or domain monitoring where, on that infrastructure level, uh we index any.

B

We have uh multiple chains index from Genesis in a real time and also on new deps that come in. We have them index as well, and we create what we call our security data Lake, which eventually Powers our threat. Intelligence feed, which covers all of this.

B

uh The the way it covers all of these kind of threats is that we have models that detect each and every kind of threat uh that we just like talked about like it means that we have models to detect new, suspicious contracts, new exporting transactions uh and any sorts of fishing um fishing campaigns both on chain or offchain uh fraud on chain scams. We even tag we automatically tag like any fund movement, malicious, deps and so on.

B

uh So all in all, like we have this uh first intelligence feed that eventually Powers uh four main use cases of ours, uh one being the transaction security, so anything around like free transaction. This is mainly for.

A

B

Using web 3, it can be both like retail users, institutional users. We have like an API which can be used by wallets as well. We also already work with a couple of them: theator API, which uh uncovers any malicious transactions uh that users are making due to any type of fishing or scam. uh The second thing that we have is monitoring.

B

This is anything around like I have contracts, I can be a user or the protocol itself and I want to get like real time alerts whenever something is about to uh is about to attack those contracts, uh so that that is the address monitoring. It's currently used by the biggest names in the industry uh to protect uh over a few billions of dollars in the space and getting real time alerts. uh Before anything happens, so we have dozens of protocol customers and also institutional asset managers using that component of just monitoring uh just by itself.

B

Another thing that we do is address screening. This is um this allows like vas, for example, uh to screen any new address uh that they need, for example,.

A

B

We have a very popular defi aggregator that wants to comply with the us regulation, for example, even though it's like kind of blurry, but they at least know that they cannot mess with stolen funds, so they've been using aate in order to to do that. And lastly, we have the web three activity Explorer and that is uh basically anything around our onchain data uh that we collect.

B

We allow using our platform to actually do forensics and investigations whenever a new threat comes in, so that you can triage real, quick and not just rely on us saying hey. This is uh critical risk, but trust us uh withdraw pause the contract, let the users uh withdraw automatically all their funds and so on, but like we also provide the tools to actually to understand what happened uh and and so on. I'll show that briefly, uh so that's the security platform that we've been building uh eventually.

B

All of this is served via a web app uh an API and also a browser extension uh where the browser extension is free to download on Chrome Store. uh For anyone, and the we up in API is is.

A

Going to pay the.

B

Subscription based U fee uh a couple of the things that we've been doing in exate besides building the platform is uh also helping uh like finding vulnerabilities and helping protocols in in a need um whenever, like they're they're, getting attacked, and we kind of monitor that, and then we notify them before an attack happens and as it does in order to help them get a hold of that and also set up a war room and so on.

B

So some of the things we've been doing is a research on a polygon bridge where we found a major consensus bypass, which was fixed like this closed and fixed, uh which enabled to bypass the consensus on the polygon for stake. uh We've been helping oiler on the oiler case, like we notify them Discord whenever like before it happened. H whenever, like we saw the suspicious contract attacking them and alsoo like help through like war room to actually get a hold of that uh and the compound V2.

B

For compound V2 uh side, we have been helping uh other compound, V2, forks and compound to actually uh be aware of a big risk in compound V2 whenever you open new market. So we edicated kind of also some of our customer, which are compound, forks and and and the community to actually open New Market safely.

B

So we've been doing that uh and lastly, like a couple of other examples, was um detecting the one 11 million hack on year, uh we've been helping noic and the War Room whenever, like they got hacked in real time, uh both the track, like the the funding sources of that Tucker, and also where the what happened in that, where the fund sources are going and basically manage all of the wars whenever something happens in real time. uh War rooms, like maybe worth saying something like than that like are chaotic whenever they happen.

B

So this is why, uh whenever like we work with a protocol, we come up with a very con, clear and concise plan as to what to do whenever, like you get whenever you have an incident, uh so we have a very, very like thorough and uh thorough and detailed plan uh for our customers. Like both free incident and both post incident, whenever Something's Happened- and this is because, like we've, been participating in so many RS Wars by now- and we've been seeing so many uh protocols get hacked and what exactly.

A

Has to be done.

B

Whenever, like you get hacked so this is why, like we also help others whenever like they get hacked, because we know uh what what step should be taken awesome so uh a bit about uh how hexag gate works so basically go with the.

C

B

Awesome so basically uh the way that the way hexit works is uh I'll demonstrate that that, via, like a small uh schema where you have an attacker which uh wants to perform his malicious activities. So his first step, normally in the like in the kill chain, is to get funding. Since we are monitoring like any transaction on chain like we see the funding, um we tag the funding automatically and whenever we think it's is suspicious.

B

So that's like our first signal in here now whenever we see that, like it's a one signal that uh happens on our platform now normally like the hacker before he attacks like starts to prepare, and that means he's deploying potentially deploying like exploiting contracts before the he utilizes them in order to exploit protocols. The reason he needs contracts is because he needs to perform like a lot of steps all at once, so he needs uh a way to run.

B

Multiple uh multiple contract calls all at once, potentially like taking a flash taking a flash loan and then like using that flash Loan in another contract, manipulating with price and so on. So that's like the preparation. That's another like uh things that we using our models, things that we discover automatically at this part. uh We would Tri Alert in real time that would trigger something potentially bigger. So that means that we trigger that alert. The customer or the protocol gets this alert.

B

Potentially all the users of the protocol could withdraw or the protocol could pause or uh Blacklist the address or uh just pause, specific functionalities that the that might be under uh under threat, and what the uh at this part like menion, takes place, that we block the malicious activity normally by working with the protocol and sending the operational constraints whether the protocol can do anything sometimes like we work with protocol like make, which are completely decentralized, and no one can really take action real in real time in the in in terms of the protocol itself.

B

So we also come up with approaches and how to protect uh still protect the funds in the protocol uh in real time, possibly by handing over responsibility to users.

B

Now hackers normally at this point like if nothing was block, uh exploit, send the exploiting transaction using the exploiting contract now eventually like if the attacker is successful. Of course, uh he is uh possibly starting to launder the money and start to um start to move his funds uh into a way that potentially to a mixer or to an exchange that has no kyc and so on, uh but with hexade we're eliminating that uh step because we're proactive and we're actually detecting the threat before it impacts.

B

Anything so that's on the proactive exploit detection prevention right now, we've we're Al monitoring like do of customers and also um proactively preventing uh threat from specific protocols that we work with. In terms of like the actual automation, uh the then that pauses anything or pause, specific functionalities or Blacklist or withraw automatically for some of our manager, customers and so on. J go ahead.

C

Yeah my question was: uh how do you let the users uh know when they are about to uh Link in a fishing, a link or a malicious contract? Just uh it's like a popup or an extension on your wallet or how how that works.

B

So it's a great question: it really depends on uh on uh the kind of product that you are using from hexag. So uh for V users, you can definitely download our Chrome extension to keep protected. uh We also work with wallet so that it's seamlessly uh would work uh out of the wallet and also like you. You can use the web app uh our web app like uh if you are a protocol or a user, to actually get real time alerts whenever they happen now.

B

uh The alerts normally that we give whenever like an exper, is about to hit uh a position of yours like if you, if a protocol or Bridge what whatever like, if you have some funds stored in a contract, uh is either via telegram, slack, P, Duty, email or just general purpose web hook, so that you get notifications right away and you can take action uh normally, the automation takes normally. We advise taking automate Automation in real time, uh but also like we have the possibility to get those.

B

uh You know manual, pag of Duty, slack, Telegram and so on kind of uh notifications as well. So.

A

All in know, like the pre.

B

Transaction and the post transaction phases are covered.

C

B

C

uh Okay, yeah makes sense. um Well, I, guess it's very uh the automat it's more useful, maybe or more when it comes to your uh issues, yeah than say.

B

Sure, and, and by the way like on the pre transaction, of course, there's no automation that has to be done because we're preventing uh users from E EV, like ever interacting with any malicious entity on chain. So that means like it's uh just blocking right away like exploit, is uh to automatically withdraw or to pause, really takes automation to take place, because, like this, the contract itself cannot, it doesn't protect itself. Some human intervention or Auto. Automated intervention is needed to protect the contract under.

C

Threat, okay, nice and where do you see more more threats uh when it came to retail users?

C

um Where do you see more threats like when it came to Bridges or defi or any other yeah.

B

Yeah so of course, um for retail users like fishing anything around like fishing fraud and scams like it just literally anywhere you search in Google like you, metamask install, and then you get like a malware installed if you're not paying attention and uh like this is a huge problem on Twitter like you get targeted all the time, so this is huge. The thing is that with exploits like uh all it takes, is even on prominent protocols. Right. All it takes is a single transaction to wipe wipe wipe out your asset uh that, like your.

A

B

Bridges or protols doesn't really matter so uh so it's really hard to tell like uh for users and their kind of their like Risk appetite. What's what's a like? What's what would be the first thing to do, but rather like just go in and start like with whatever you can start uh in terms of like uh using the tool like as fast as possible, for example like using our anti fishing, an anti fraud kind of extension, just literally takes uh a click to install, but using our is a bit more complicated.

B

This is why, like we are a B2B uh company like we sell to businesses. Normally we don't sell to retail, and we work with, for example, asset managers or big protocols actually like maker to keep them protected H and to actually build a a very high fence before anything can threat can threaten their contracts uh so shortly again, so for retail, of course, like using an extension and any tool that helps uh to mitigate the risk, right away is obviously like the first thing to go.

B

For you know, protocols and big, bigger asset managers, and so on, like obviously incorporating a much uh a much thicker uh strategies is obviously the right way to go as Stakes are much much higher when you have like billions of dollars in a bunch of contracts or a few millions of dollars in a bunch of contracts, an asset manager and it can be just lost in a single transaction. After an attacker Expos. Those.

C

Contracts, okay, yeah, um I, guess that makes sense because also um when it came to asset managers, also the the threats are more sophisticated, so cool thanks.

B

Of course um yeah going on with the deck, so, uh regarding uh our like, we talked about exploit detection prevention, how we do that real time, and that is the same case for fishing protection, so.

A

For example, on the maker.

B

Th uh maker out, so we potentially like we would uh surface out any fishing campaign that goes onchain or offchain targeting any maker, Dow users or maker holders, so that any governance participant is secure. Just by getting, for example, real time alerts, Whenever Wherever like they want to get those alerts in like Discord telegram uh emails and so on, and also potentially like using the extension in order to keep them protected when they engage with malicious DS.

B

Now uh uh our infrastructure is robust enough to handle those two kind of both models of exploit and both of fishing. um So.

A

That's in the fishing.

B

Case now um on the on the post incident, uh workflow uh normally like uh we advise on how to Pro like to how to protect yourself, upfront, pre-incident, and that is like having all the notifications in place, having all the tools in place and so on. Just like you asked, but also having the post incident flow uh post incident kind of preparation is also important, just uh also important, of course, because in web things happen so fast.

B

So you must be pausing anything or stopping specific functionality or uh letting your users, for example, withdraw automatically their funds whenever an exploit happens uh is obviously like the first way to go, if that's possible, and normally when we work with the centralized protocol. That's our uh that's our strategy. It really depends again if the protocol wants to enable the users- or just like you know, update them.

A

B

The communication channels of the protocol- this can be Discord or Twitter or any other platform to communicate that to to their users to do automatically uh now uh the other than pausing anything. uh It's anything around like managing the war. So, uh as mentioned like, we have a very uh detailed plan as to what to do within a war.

B

When, usually it takes uh it's anything around like running a postmortem uh starting to engage with attacker, possibly uh sometimes like not all the time it's beneficial, but uh sometimes like if it is been front, run, for example, uh sometimes like the Front Runners can return some of the funds and Stu on, and also to discuss like how the community should be like how this in should be communicated to the community as fast as possible, because eventually this is user funds and also anything around like law enforcement uh to contacting law enforcement exchanges that can possibly help uh stable providers and so on.

B

To freeze assets, and also uh this is the part of thing we've been doing in war.

B

Rooms is trying to track funding sources of the attacker or where, where funding uh further goes into, and this is uh because we're trying to uncover, like the identity of that Tacker and potentially like um make like to eventually to make him return to funds now in terms of our uh White hexag Gates spend uh apart from the compet competition, because obviously there is a competition in that space, because the problem is uh kind of impossible to uh impossible to miss both like the fishing front and exploit f is mainly two three things.

B

One is the early deduction, so uh we have been monitoring like hundreds or thousands of hacks, even $100 type of hacks. That happen, you know, know just an unknown token B&B and even the the biggest one for hundreds of millions of dollars, for example like the oiler one and others, and we've been uh working very hard to improve our early detection uh capabilities, and so that is something we are constantly optimizing for like we don't want to be uh shout like. We don't want to be telling anyone hey.

B

There is a huge exploit uh happening, uh just happened like 10 minutes ago, but whether there is a huge exploit going to happen in in 10.

A

B

And we have something to do about it, so that's the early detection. uh The accuracy is another thing that we've been working really hard is the false positive rate. Of course, we incorporate like models to predict whenever an contract is an exploiting one, whenever an exploiting transaction is an exploting transaction and so on. So that's the false postive rate that we've been striving to get as closer as closest as possible to zero.

B

uh The way we calculate that is, we go contract by contract basis in terms of like the biggest pools, and then we analyze how many events we fired uh ever since, like we, this contract went, live and based on our models during the course of time like during the entire time that we like did.

B

We cover uh so that's the possible R and, and lastly, like the response time is, we've been working very intimately with customers to automate response uh whenever, like we see a threat, so that means like we provide customizable automated uh workflows to actually remediate the issue and not just like hand out alerts and let the user like let the customer you know uh deal with what what he needs to do in order like to remediate the issue like we're very much uh with with the like, with the protocol with the customer to help them uh help them protect them themselves.

B

Before anything happens now uh we think uh we have the product coverage in terms of web free threats today, and that is both exploits and fishing fraud and scams, so for maker, for example, like having hexade is, uh is actually beneficial both for maker core contracts for the Govern security like, for example, any new governance proposal that comes in is inspected by hexag gate and we could potentially uncover like any back doors, any any malicious proposal uh that will undergo uh very thorough analysis before it's even executed and, of course, like the interal Community, will benefit uh from uh alert uh so that, for example, like users are not just like targeted on the governance when, if there are a govern like there are community members or governance participants, so they can get those real time alerts by heate and keep protected so all in all like this is uh why we think uh we have the Bro coverage of we free threat, possibly covering like any type of threat uh off the maker community.

B

So that's that now another thing I wouldn't cover this time, but uh we're working on is our onchain security module. uh It's basically not something! It's not like a protocol uh by itself, but rather like uh some sort of like an inter, like uh interfaces uh that we eventually that.

A

B

Us to incorporate our onchain Intel, offchain and still in decentralized manner, in a manner that does not uh like waste too much G so on. uh It's still under, like still not available for anyone to use, but whether, like we have uh been discussing with top in the space how to um on how to uh and we're about, like to uh release a white paper on death and like before. We try to sell it to the community because it's kind of we're expecting kind of a community Buy. In of that.

C

B

Before we are going uh just commercially with nonent security model, so more on that later, of course like. If anyone is interested to hearing more about this, you can contact us at info heex comom, to hear a bit more about this onent security module and possibly like how we can collaborate if you're a protocol and so on, how you can utilize that. So uh so, that's that now, before I go into the demo, one.

C

Thing I want demo.

B

Because of like the time that we have is our extension, uh so basically, as mentioned like, we have an extension to to do pre-transaction screening uh into any transaction that you make. So this is just like a small uh screenshot from the extension. This is on the left and metamask on the right and the extension. Basically, you just install it from the store and then it seemlessly works on top of any wallet, even like mobile wallets.

B

If you connect, if you connect them with wallet connect and on the left, you see like this is a highrisk transaction. We also give a breakdown of the risks that there are in the transaction itself and so that's H kind of a demo screenshot.

B

Now we have like around 15 minutes or 10 minutes, so uh I'll jump straight into the demo and cool. So um this is our platform. uh I wouldn't demo, like all the components of the platform, but further, like just uh anything around like a specific.

B

uh Around our exploit monitoring, so basically on haate, you can Define, uh you can Define, for example, and when you define monitors, all you need to do is to provide the alerts and where you want to get those alerts in, and that can, as mentioned, can be slack telegram web hook uh and so on.

B

uh From that point on, what would happen is that you will go those alerts in real time, uh both in the like the in the channels that you configur and also like in the event Feld now for the purpose of this uh demo.

B

uh What I wanted to show is a specific uh exploit that happened and uh something called tsunami protocol, which is defi protocol, got hacked for around $2 million, and what I wanted to Showcase is how we detected this issue before it impacted any digital assets and also as it as it impacted and throughout, like the laund ring. So if we're going over the events, so this happened like a month ago and on 124 QC plus 3, and this is Israel time.

B

A new, suspicious contract was deployed where, if you were tsunami and you added the tsunami pool protocol pool address uh under monitoring as I showed you get this Alert in real time, and that means that a new like a suspicious contract, which is of a sever like critical severity, is about to impact U impact the the protocol.

B

Now uh we also give some of some info around, like you know, uh functions and so on in the contract, uh some some Road data and also some R data. That is very useful for triaging this kind of alert, but normally, whenever, like you get this alert, then you can fire off uh withdrawal, transaction or pause transaction to pause, anything uh before to pause, specific functionality or to Black specific uh actors before anything happens now, two minutes later, what happens?

B

Is the first exporting transaction took place and, as you can see right here, this is the attacker, the 54 in this case- and he benefited uh 50k uh in this particular case, and you see like the pool was hacked for 50k in here like this is a breakdown of the uh of.

C

B

Assets, of course, we also provide things like stack, traces and, and so on. That is very useful for, like devs uh protocol deaths to triage, actually what happened. uh So this is the first attack that happened 2 minutes after we detect the first exploiting contract now uh 10, it's after, like the exporting contract. What happens is this 078 transaction was detected by two of four models? One is detecting an abnormal trade and one is the general purpose.

B

Exploiting transaction model classifies transaction as exploiting ones where, just as an example, you see that the attacker now uh profited $2 million in this particular case out of the pool, so all in all like uh in this particular case, what happened is a new contract was deployed.

B

Two minutes later was the 50k uh exploit and then 10 a $2 million attack following that, like you see the laundering uh of the funds to a mixer to tornado and eventually, like the protocol engaged with the uh attacker and ask for a bounty which of course did not work.

C

H in this particular.

B

Case you see no.

A

Further movement of.

B

Funds in here uh another quick example is the curve, like the Viper incident, like the Viper compiler incident. uh As you see in here again, new suspicious cond gets deployed and then, like 12 seconds later, a potential loss of this $18 million from the Viper contract, which was the Curve pool specifically uh for the attacker.

C

B

For the attacker been around.

A

B

Million, so uh what I? Just showcase is one of the uh things that we have is the monitoring for exploits. As mentioned like, we also have like anything around like forensics analyzing addresses and monitoring fishing campaigns, uh monitoring uh uh governance attacks uh by simulating it before it even happens and so on. So this is just like a very a very specific, a very specific view of U of the hexag.

B

Platform awesome so um so before we conclude uh any uh questions to.

C

A

Them than you for that demo NE it's uh great to see the platform and how it works with, uh especially that well-known uh curve, hack, um I, just want to say, I, think it's a great approach you guys are taking to security with uh both the exploit monitoring, as well as uh fishing monitoring, especially as fishing and taxs are becoming more and more uh complex and especially with uh you know, known uh important members in the maker, Dow Community, specifically aligned delegates um who might be specifically targeted with uh comprehensive fishing attacks.

A

um So thank you for your presentation and your demo. um One question I had was with regards to I guess fishing attacks on web 2. um Is there any current way, or you know forward-looking strategy to in a way, uh mitigate search results on uh browsers of malicious uh links? Like you mentioned earlier, the uh the false uh metamask, download or or things similar to that, where user you know might type in you know a d D5 protocol that they use regularly and that false link comes up as one of the top results.

A

um I was just curious if there's any sort of way to uh like downvote or I guess flag um those types of links with uh traditional. You know web two.

B

Browsers uh so, first of all, thanks for the feedback and and I think you kind of uh right on spot in terms of like where, where we're kind of aiming so uh uh eventually like we're, aiming to protect like ecosystems and not just like uh you know, not just uh specific uh I, don't know just contract with better, like the entire ecosystem, also like any governance participants that has like uh lots of maker tokens, any community members, any Cor contracts, any third parties that use that uh that are relevant, for example, for maker.

B

If the maker is launching on other chains which are which is very susceptible to you, know, Bridge hacks that might like impact, also maker and so on. So all in know, like our platform, is Broad in the sense that we can provide uh security and safety for all of that. uh So so that was.

A

B

Spot now regarding uh protecting against like fishing campaigns of that sort. So uh this is exactly like the part of the the the kind of thing that we're solving and hexag and what we advise is obviously like to download our extension, which is blocking those fishing sites right up front, uh of course, like if a user now downloaded the marware uh which uh now installs the marware, the computer and he downloaded it via I, don't know he just like took it from someone sending him that over Discord or something and the antivirus even didn't catch.

B

That uh I mean if it's not through a regular browsing activity, then it's harder to detect because, like we don't have an an antivirus that runs uh on the the computer, but rather uh any kind of browser activity should be uh covered by our uh extension. So that means like normally today uh the way fishes work is they have kits. They just buy kits online on telegram or any other uh signal whatever, uh and then uh they deploy those gits uh those scan kits uh on many different kind of domains.

B

Then they incorporate like different strategy like, for example, Twitter they post on Twitter and they fake followers they generate. Like a fake ad on Google and so on, so the fers are lured into browsing into a malicious de.

B

Now, whenever, like we see aici that before it even hacks before it even impacts any users, then we flag it automatically, and it's all all streamlined into our uh extension so that whenever users go into that, mici I dap we're able to tell that in real time and block the block.

B

The communication, with the malicious dap that might rain the wallet uh so on that front, like I, would advise like do extension, because also it's because, like we're not expecting the entire Community to be like security, researchers, H deciphering, like transactions and so on, but rather like we want provide tools to obstruct away security so that just like, as you have an antivirus on your computer or uh that mitigates threats that this is like kind of our.

A

Mindset excellent thank you for walking through that a bit um yeah really excited to uh check out that extension, myself and certainly a powerful tool for uh you know not only the maker Community but the entire uh crypto blockchain ecosystem. So uh thank you for what you guys are building and and working on uh before we wrap up uh if you'd like to leave us with the best way to uh reach out and and find out more about hexag gate. That would be great.

B

uh For sure, so uh the best way to reach out is either uh through uh Twitter direct message to hexcore: uh that's our Twitter uh or VIA mail to info.com or nx.com.

B

That's me and, of course, like uh anyone can follow hex to see any new advancements and so on and all in all like we, we would be uh very much interested to talk with anyone who thinks uh either uh he wants to protect himself, his community, his users, wherever, like we'd, love to help like anyone and with our tools or during in a time of need. So anyone is welcome to to to actually contact.

A

Us great well, thank you again for taking time and joining us today, um yeah. We really appreciate you coming on.

B

Awesome. Thank you uh guys so much for having me in here and looking forward to be working with uh the maker ecosystem.