NewsFlash Articles Data Fundraising BlockBeats Pro

Reflection on the Curve Incident: Why We Need Runtime Protection and Aspect.

Read this article in 5 Minutes

In Web3, DeFi applications require the same high reliability as Web2 software.

Original author: Carl Hua, Partner and CTO at Shima Capital

After the recent Curve reentrancy vulnerability exploit, I reflected on my experience at JPL NASA where I learned key principles for developing reliable and resilient software. These insights are now more important than ever for the cryptocurrency industry, for the following reasons:

At the end of the day, people only really care about two types of software: the ones that can kill you and the ones that can make you lose money.

In the critical software of any aerospace machine, the majority of the budget (80%+) is not allocated to development itself, but to integration and testing. If the software fails, the aircraft will fall from the sky - fighter jets, drones, spacecraft, and so on.

Most of the code in aerospace software (if classified as a critical module) follows extremely strict testing/development standards, such as DO-178B Level A. Not only is every line of code tested, but if there is nested logic, each logical condition is also specifically tested.

At JPL NASA, the concept of writing advanced space software is not about writing the most beautiful and clean code, but about writing code that is easy to execute unit tests. Why? It's simple: when you send a spacecraft into space, you only have one chance, and no one wants to take risks when the probability of failure is high. This is similar to the logic of blockchain, as immutable code is one of its important features. We also only have one chance to correctly use our funds in each transaction, so why not take the development of dApps more seriously?

Despite strict development, testing, and code auditing processes, these measures are clearly insufficient to mitigate all errors and attacks, as it is virtually impossible to eliminate all runtime errors through testing and auditing. So how do we protect our software from failure?

Runtime Protection

Runtime protection is a security technology that can protect software applications from malicious attacks during runtime. Its principle is to perform real-time detection during the actual execution of the code, analyze the actual behavior of the program to protect it from the impact of malicious data and attacks.

The runtime protection of high-reliability software requires a significant investment in design, as it is the last line of defense to ensure that the software does not enter an unknown state or fail. This is not just an argument, but a verified practice over several decades.

Today in Web3, I believe that DeFi applications need the same level of high reliability and should consider the same methods. However, due to its potential limitations, EVM is not designed for handling complex tasks such as runtime protection. So, how do we provide runtime protection?

One way is through Aspect programming, which is designed by Artela blockchain network. Aspects can switch execution context during the lifecycle of any smart contract transaction to perform advanced checks on the program's real-time state. Artela provides a unique design for runtime protection through Aspect and EVM compatibility, which has the potential to become the future foundation of secure cryptographic smart contracts.

Artela has announced the specific usage of Aspects in preventing Curve re-entry attacks in the following article. Let's discuss together!

"Eliminating Reentrancy Attacks Completely - On-Chain Runtime Protection for DeFi Risk Control"