Subscribe to Officer's Blog
>4.5K subscribers
We will gradually expand the capabilities of our Pessimistic Spotter on-chain monitoring & defense service and provide additional details in the subsequent digest piece!
Cover Image: St Elmo Bridge by George Rex X Photomosh
So today, in the following digest piece, we’ll talk about the most recent news, how it affects (and will affect) industry and our Spotter project, and, of course, we’ll explain our Pessimistic Spotter on-chain monitoring & defense service functionality in a more detailed way!
According to the questions, the audience has several points that need to be discussed further. That’s exactly what we’ll do next!
spotter.pessimistic.io — Sign-up!
pessimistic_spotter_public — Spotter Public Alerts Channel (Telegram)
blog.pessimistic.io — Follow our blog!
https://officercia.mirror.xyz/pMIiK5hDL16YF4phXr2uPmIATUPjfWHNpeN1NTs5Otk
https://officercia.mirror.xyz/X6diACabI-hfoyoIuhaPBjADfBx_dYmEE-uoTylVzbU
https://officercia.mirror.xyz/mHwaLUUjxSRODvMfhT9YmEbDsN9z6i87Xb4IPwfCvCs
https://officercia.mirror.xyz/W-SUbkTf18b3RuPL9DykXQmpexWBZxbp4P1xfCfXo4Y
We are pleased to announce that, in the near future, we intend to pitch Spotter at a significant number of conferences and turn on monitoring & protection for a couple of our cordial DeFi protocols & web3 projects!
Check out the presentation of the Spotter by our CEO Alexander at the ETHDubai:
The audience has two points that require further discussion, judging by the questions. We’ll move on to that next!
Many have legitimately questioned whether our system’s implementation will result in more security issues. Will someone be able to trick Spotter and stop/pause the protocol, in other words?
This is a very good and accurate question, and our response is that the only things we do on our end are: monitoring, transaction delaying via validators/pools (described in detail in earlier articles), and (in the future) using MEV bots to counter-attack bad actors.
We actually need a deep integration into the smart contracts in order to effectively pause a protocol, and it is planned to build on the side of the protocol to avoid security-origin issues in the event that someone decides to manipulate/gamble our system or even compromise/abuse our Spotter.
Race Conditions and Front Running Vulnerabilities in Smart Contracts: A Comprehensive Overview Smart contracts are an innovative technology that has revolutionized the way we conduct transactions ...
To put it another way, only components related to monitoring are created on our end, and entire active defense part is created by the protocol team (following our recommendations!) and configured as they see fit (to avoid false-positive and false-negative results which can affect the entire protocol ecosystem) on their end.
The flexibility of the Spotter system will allow teams to respond only to incidents marked High or Medium, or they can make the system work in standby mode.
It is very important for us not to let our Spotter project itself become a “point of failure/denial” in the security system of the project, so we, following threat modeling, share the system between ourselves and the protocol team as much as possible.
Here we collect and discuss the best DeFi, Blockchain and crypto-related OpSec researches and data terminals - contributions are welcome. - OffcierCia/Crypto-OpSec-SelfGuard-RoadMap
Spotter eventually acts as a bridge of sorts between us and the project, which we guard together. After all, the final goal of early warning is to give project owners/admins enough time to react and take action to prevent or stop hacks, based on highly accurate alerts!
It is intended to use an Oracle-like solution specifically for the contract pause system (keep in mind, this is only 1 of 4 potential protection methods). Check out this article.
Need to expand coverage or reconfigure the Spotter? No problem, simply reach out to the Spotter team for assistance!
We will also give users the option to use our system either in monitoring mode, “combat mode,” or partial active protection/defense mode, making it more flexible, in result.
Here is the technology that I described in 2020, and it is similar to the implementation of roughly the same web2-origin thing but in blockchain. This is exactly the idea we want to convey — there are already working bundles, you just need to properly adapt them to the data-layer.
At the same time, we will not forget about regular users — our system can act as a personal monitoring & defense system!
There are more specific things in our distant plans: for example, if the Health Factor of the certain collateral changes (for lending protocols — examples), or if the protocol you are using is hacked (that’s a custom thing), it can alert the active protection system located either on your own or on our server (and built under our control), which will then make an emergency withdrawal and save your position/assets.
Simultaneously, we intend to make it the most convenient for both projects & average users and will adhere to this paradigm!
Spotter Digest №3 We will gradually expand the capabilities of our Pessimistic Spotter on-chain monitoring & defense service and provide additional details in the subsequent digest ...
After a few months of development, we already have a working prototype; you can evaluate the speed at which the alert is triggered by watching the video recorded by Pessimistic.io’s CEO, Alexander:
Spotter is running in a public mode, and you can see what transactions it outputs to the result. We believe this beta will be of interest to both protocol and security researchers:
pessimistic_spotter_public — Spotter Public Alerts Channel (Telegram)
We’ll be glad to see you on our channel, please follow!
So, returning to the topic at hand, our vision is to develop a top-tier next-generation monitoring and protection system, but we also aim to be compatible with other tools and services, and we prefer to collaborate rather compete because we believe that multiple monitoring solutions will complement one another, resulting in greater ecosystem security!
Some news from our ‘‘parent’’ auditing company that we think is important enough to mention:
In particular, article about ChainLink’s Сhainlink VRF has been published and endorsed as we continue our research:
In this article, we present tips that we have acquired over the years of auditing similar integrations. We also intend to discuss the…
Several security audits have been successfully performed! By the way, here are some vacant slots so if your project needs an audit — feel free to write to us, visit our public reports page here!
Audit link: github.com/pessimistic-io…
We are currently doing some research — including exploring new tools, researches, methods and their possible use in our Spotter project, for example: ERC4626 security tips (also this link), governance counter-attacks, and, of course, new (1,2)
We are also actively researching several new tools which can be used for smart contract fuzzing & testing. This week, we also discovered this amazing resource about smart contract bytecode obfuscation techniques — be sure to check it out as well. This work will serve as the foundation for some of upcoming Spotter modules.
We are investigating an interesting incident: 26864890 has only 2 transactions and the real exploiter’s transaction was not included into it properly. Usually, the front-running happens in the same block, however the transaction of the real attacker is at the block 26864891 (transaction of the MevBot that
To make sure you don’t miss anything, subscribe to our blog! All articles are also posted on my (Officer’s Notes) personal Mirror blog:
https://officercia.mirror.xyz/Uc1sf64yUCb0uo1DxR_nuif5EmMPs-RAshDyoAGEZZY
spotter.pessimistic.io — Sign-up!
pessimistic_spotter_public — Spotter Public Alerts Channel (Telegram)
blog.pessimistic.io — Follow our blog!
twitter.com/sadspotter — Follow us on Twitter!
We also hope for your support because we think this market is crucial, first and foremost for the overall security of our industry!
Brought to you by Pessimistic Security https://pessimistic.io/
You can subscribe to our blog to make sure you don’t miss any of the regular news and updates we plan to publish on the project in a special digest!
In the following articles we will gradually expand the functionality of our service and provide an opportunity to test it on your system. We’ll let you know the release date soon, stay tuned! 🙂
Support is very important to me, with it I can do what I love — educating users!
If you want to support my work, you can send me a donation to the address:
SupportMe. Contribute to OffcierCia/support development by creating an account on GitHub.
0xB25C5E8fA1E53eEb9bE3421C59F6A66B786ED77A or officercia.eth — ETH, BSC, Polygon, Optimism, Zk, Fantom, etc
4AhpUrDtfVSWZMJcRMJkZoPwDSdVG6puYBE3ajQABQo6T533cVvx5vJRc5fX7sktJe67mXu1CcDmr7orn1CrGrqsT3ptfds — Monero XMR
Stay Safe!
Officer's Blog
12
No comments yet