Perhaps no one expected that Defi would have so many hacking incidents this year that people began to wonder whether Defi was able to take responsibility for the future of traditional finance and even sparked a debate about the boundaries between centralization and decentralization. The Defi hack had a far bigger impact than the Ethereum crash.
The first to be discussed was the flash loan in February, when a leverage agreement called bZx was found to be flawed, allowing a large amount of money to be loaned without a review, with no risk as long as the money was returned within 15 seconds of ethereum. The hackers used the vulnerability to drive up the price of WBTC and cash in $350,000.
The Defi security topic came to a head in April with the theft of the Lenf.me protocol for the dForce platform, when the team failed to notice that the feature was incompatible with the crude oil logic, resulting in the theft of $25 million. This is the biggest capital loss in Defi's history. This directly leads users to question the security of Defi: can we trust Defi when it speaks in code?
There seem to be two ways around this problem: Defi reduces the Lego-style scaffolding mix and raises the bar on code auditing.
Reducing the lego combo is really about trying to keep Defi simple. The combination of several platforms seems to have a lot of imagination, but it's like a wooden bucket made up of several planks. When the bucket is placed vertically, the "short board theory" determines how much the bucket can hold. The same is true for Defi combinations.
Several platforms and protocols come together, and as long as one platform or protocol fails, the combination becomes ineffective and even risky. So Defi's rationale for simplicity stems from the fact that the platforms are no longer composed, and each provides the most basic services to the user, which seems to solve the composition vulnerability problem to some extent.
Code audit has not been a good way, the normal operation in the industry is to find a third party security company audit, audit results published after the code online. The problem is that the industry hasn't been around for a long time, there's no consensus on branding, and a spate of hacking attacks can make people lose confidence, and it's not easy to get people to believe 100 percent of the audit results of security agencies.
This reminds me of a way the Internet operates on security.
360 marketing
If you were asked to name the biggest Internet companies in the field of security, which one would you think of first?
A lot of people will probably mention 360, and indeed, the word security is the biggest label 360 holds. If you look at the products launched by 360, from routers to smart homes, security must be the biggest selling point. So what efforts has 360 made to reinforce this feature?
In addition to the products and technology pass, 360 have been launched on the market marketing challenge "hacker", in 360, for example, the router are recognized in the industry's most influential global hackers technology conference, 360 of their 4 router before hackers, 3 days by hackers, the router to crack under the condition of without touching the router. The hackers bring their own devices and will receive a $50,000 prize if the router is breached.
At the end of 3 days, the 360 router is intact. 360's $50,000 didn't cost a penny, but all the users covered by this message know that 360's router is extremely secure and can't be cracked by hundreds of hackers, so it shouldn't be a problem to use at home.
This idea can actually be replicated in the industry. BlockBeats' recent discovery of AELF has replicated 360's idea.
Aelf offers rewards for hackers
Not long ago, aelf successively issued across the chain transfer standard protocols CCTP and "centralized asset management security chain solution" CAM, can support different chain system transfer of assets, the difference between the block chain system application scenario for the exchange between assets, solve a series of problems, such as exchange security future aelf has reportedly will be held in test online lock warehouse map and a series of activities, users in the test Token can earn online.
The question is, what is the most important question that users care about when they lock up, transfer assets, or exchange assets? Nature is a safety issue. In cross - chain transfer and exchange, the quality of the contract is not good, it is likely to be hacked. The lock - up contracts are broken, and user confidence in AELF is bound to suffer.
So, to reassure its customers, AELF did the same thing as 360 did: it held a "hacker challenge" and released one million ELF as a reward, worth nearly $100,000.
Aelf will 1 million the ELF's locked ⼊ contracts, generate Merkle tree, and by 1 million CCTP mapping test Token the ELF to aelf test network. Any ⿊ guest can damage CCTP and mapped successfully during the activity, will test Token ELF steal to your account address, is aelf base ⾦ will issue an equal Erc20 ELF Token ⾦.
The event was open to all around the world and hackers were free to team up and aELF would get the money back if no hackers were able to break aELF's standard protocol for cross chain transfer by the end of the event. In fact, the form is the same as 360's idea, as long as the hacker can break the contract, the assets in the contract can be taken at will.
The significance of safety marketing activities
Actually more than Defi field this year, in the industry security issues, such as Sun Yuchen with Steem community dispute is a security incident, Sun Yuchen combined fire currency, COINS, and vote Poloniex platform using user assets to help you, that in itself is the biggest user assets security problems, if the transaction platform to divert the user assets, security is impossible.
So, to some extent, activities like hacker rewards are needed right now. All the teams talk about their project safety, people are numb, and the audit reports of security companies are hard for ordinary users to understand. It's better to break the rules and express your characteristics in a way that everyone can understand.
Of course, the fly in the sky is that AELF's activities are held by itself, while 360's hacker challenge is held in the hacker technology conference with the most recognized influence in the world, so the difference in the influence of the activities will inevitably affect the effect. Aelf may be able to continue to optimize such activities in the future and make an impact on the brand, which may yield more results with less effort.
Welcome to join the official BlockBeats community:
Telegram Subscription Group: https://t.me/theblockbeats
Telegram Discussion Group: https://t.me/BlockBeats_App
Official Twitter Account: https://twitter.com/BlockBeatsAsia