COBO Security Team: Bull Market DEFI Interactive Guide

Although DEFI can bring considerable benefits to users, but capital security is the core of steady asset growth.COBThe O security team sorted out the common safety risks and corresponding security precautions in DEFI interaction, hoping to inspire and help everyone in the bull market’s DEFI security interaction.

Since the opening of DEFI Summer in 2019, led by Ethereum, more and more creative decentralized financial agreements have appeared, which greatly enriches the availability of the assets on the chain, so that blockchain users can better better wayUse the assets on the chain to conduct more financial activities and create generous benefits for this.But with the rise of more and more DEFI protocols, security challenges have followed.According to incomplete statistics, in 2023, asset losses caused by blockchain attacks have reached US $ 2.61 billion.It can be seen that in the process of participating in the DEFI protocol, in addition to evaluating the corresponding income expectations, the assessment of the protocol security cannot be ignored, otherwise it will bring great losses to users.

Generally speaking, the mainstream definition of the protocol security assessment is currently defined as the security assessment of the code. The dimension of this definition is relatively single. The problem here is that the evaluation itself only considers the security of the agreement under the static process, and the evaluation itself, andDuring the DEFI interaction, security is often dynamic, including multiple stages such as account management, preparation before agreement interaction, asset management, data monitoring, and self -rescue after the loss of assets.

As a user who is about to enter the Defi Novice Village, how can we maximize the security of funds while earning benefits?The COBO security team sorted out the common security risks and corresponding security prevention measures in DEFI interaction, hoping that it can inspire and help everyone in the bull market’s DEFI security interaction.

DEFI have common safety risks and preventive measures in interaction

1. Account private key leak

The private key leakage of the account is one of the more prone to recruitment of novice users. Due to the current types of wallets on the market, novice users lack their own ability to judge the safety of their wallets. Many novice users will download some unsafe wallets and use them.To generate a private key, which causes the private key to be maliciously passed back to the attacker, causing the private key to leak.Many senior users found that their main account was transferred to all assets one day, and analyzing that it was normal for all behaviors to find that all behaviors were found in half a day. Most of the cases under this case were that early accounts used unsafe wallets to generate their own private keys and caused their private keys to cause their private keys to cause their private keys to cause their own keys to cause their own keys to cause their own key to cause their own key to cause their own keys to cause their private keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own keys to cause their own key to cause their own key to cause their own key to cause their own key to cause their own key to cause their own key to cause their private key to cause their own key to cause their private keys to cause their own key to cause their own key to cause their own key to cause their own key to cause their own key to cause their private keys to lead to their own keys.The private key has been leaked.

At the same time, due to the wealth effect caused by blockchain air investment, many novice users will blindly click on some so -called airdrop websites. These airdrop websites package themselves as very serious project web pages and tell users that there are a large number of unsolved currency.Driven by interests, many novice users will fill in their account private keys under the induction of web pages, causing private keys to leak.

In order to prevent the private key from leakage, users need to prevent the following points to prevent:

• Use a well -known blockchain wallet and download the wallet from the corresponding official website.Conditioners are recommended to use hardware wallets.

• Never expose your private key to the network environment, and do not enter your private key into any webpage at will.

Second, signature fishing risk

Signature fishing risks, just like the leakage of private keys, are also the hardest hit areas for novice users.Different from allowing users to fill in the private key directly, such fishing attacks are to induce users to initiate a transaction or signature, so as to obtain the authorization of user -related assets. It has the characteristics of high concealment, difficult to analyze, and difficult to detect.

Generally, the attacker will first induce users to the fishing webpage to allow users to initiate signatures in the name of receiving airdrops and verification login. At this time, the user’s browser wallet prompts the user to complete the signature.

There may be many types of fishing transactions:

• Direct transfer type.Directly transfer ETH or perform ERC20 Transfer call to transfer the wallet asset to the attacker address.

• APPROVE type.Call the ERC20 APPROVE method to authorize the attacker wallet.Asset transfer will not occur when the user signatures.But the attacker wallet can transfer user assets by calling Transferfrom.

• EIP712 message signature.Such as ERC20 Permit method; Permit2 authorization; NFT hanging single signature.Such signatures are usually displayed in the wallet as JSON data or a better tree -like data.When the user signatures, it will not initiate a transaction, and there will be no GAS consumption.However, the signature results will be recorded by the fishing website, and the attacker can use the signature result to transfer the victim’s ERC20 or NFT assets.

• Primitive hash signature.The signature data is hexadecimal Hash data, which cannot infer the specific signature content from the signature data itself.Behind HASH may be the above-mentioned 1-3 types of data.Signatures are likely to cause asset loss.However, the mainstream wallet is currently prohibited from such signature methods or obvious risk prompts.

Recently, some cases have also been found that some fishing websites will require users to conduct multiple signatures in a row, and the first few strokes are normal signatures that are harmless.Then mix a malicious signature content.Use the user’s operation inertia to induce users to complete the signature operation.

In order to prevent the loss of funds caused by fishing,The core is to refuse to sign blindly.Each signature is carefully reviewed, and the transaction of uncertain content refuses to sign.Specifically, you can pay attention to the following in the process of signature:

• Confirm that the interactive website is the official website of the DEFI project to check the full domain name.

• Check the method of call calls, and check the TRANSFER, APPROVE method.

• Check the ETH transfers attached to the transaction.Some fishing websites will try to construct a way to see a safe method (such as Claim), but they will actually bring ETH transfers to cause losses in the original generation currency such as ETH when calling.

• Not signature primitive hash contentEssence

Third, transfer address poison

The poisoning of the transfer address is a more novel attack method recently. Its attack method is to initiate a transfer (ERC20, Native token, etc.) in the user.The transaction, or the same but the corresponding but the corresponding token is Fake token.

Example:

Alice is fixed every month and transferred 1 ETH to BOB as salary.Charlie monitored this transaction, and sends 0.001 ETH to Alice with the address similar to BOB (the first 8 digits and 8 digits of the address).After this operation, when Alice is transferred to BOB next time, the address of Charlie is likely to be used as a transaction address.The reason for this situation is that the length of the blockchain address is long and irregular. It is difficult for users to remember. As a result, many times users will be eager to copy the address directly from the previous transaction record.Because the address of Charlie and Bob is extremely similar, it is difficult for Alice to distinguish, and eventually leads to asset loss.

In order to prevent Zhongzhao transfer address poisoning, users can take the following means to prevent:

• Each transaction is checked for the transfer address, and it is necessary to check the full content rather than the only bytes of the front and rear.

• Set the commonly used address in the address whitelist (address book), and try to use the address in the address book for transfer.

• Avoid the replication address from the chain channel (including blockchain browser, wallet transaction records, etc.) as the transfer target.

Fourth, tokens over authorization

Tokens authorization is almost the first step in Defi interaction.When performing DEFI operation, because the transaction data is constructed through the project party webpage rather than the user structure. Under normal circumstances, in order to facilitate the user’s multiple interactions without repeated authorization, the project party webpage usually constructs an infinitely authorized transaction to allow users to allow users to allow userssign.The starting point is to save GAS for users, but this also laid hidden dangers for subsequent funds.Assuming that the subsequent project code occurs, if an unauthorized interface or the vulnerability is called at will, the user’s unlimited authorization of the contract will lead to the use of the attacker and cause user assets to be transferred.This attack scene is more common in cross -chain bridge and DEX protocol.

In order to prevent subsequent projects from introducing risk code or the project code itself, there is no discovery loopholes.Users should adopt the principle of minimum authorization and try to authorize the amount used in this transaction as much as possible, Prevent the risk of subsequent projects, cause your asset loss.

5. Unsafe Defi operation

In addition to preparations before interaction, there are also many risks that are easy to ignore during the interaction.These risks are usually caused by the user’s inadequate understanding of the project itself.The specific example is:

• When the tokens are exchanged through the chain exchange protocol, the sliding point is set too large or the writing script for SWAP does not set the minimum number of receiving (it is convenient for writing to 0), causing the transaction to be attacked by the “sandwiches” of the MEV robot.

• When the lending operation was performed through the borrowing agreement on the chain, the health degree of the position was not managed in a timely manner, resulting in the liquidation of the position in the large fluctuation market.

• When interacting with certain projects, there is no good storage of the project provisions, such as the NFT certificate of the Uniswap V3 as an ordinary NFT to the OpenSea for sale.

In order to prevent these risks, users must do a good job of project research, clarify the project mechanism and relevant characteristics, and prevent asset loss.

New paradigm of DEFI security transaction – Cobo ARGUS

The above introduces the common interaction risks for DEFI activities in blockchain.If the user accidentally recruit one of them, it may cause years of hard work to lose, and it is a little careless.So, is there a risk control solution that is safe and effective and easy to manage?A new choice scheme is Cobo Argus.

Cobo ARGUS is a chain risk control product developed by the Cobo team based on the GNOSIS SAFE.The main role is to analyze the user transaction by building different ACL strategies, intercept transactions that do not meet the risk control rules, thereby ensuring the security of user funds.

How does Cobo Argus respond to security risks in the Defi environment?

1. Sign more on the bottom layer, and the upper single signing authorization: Avoid leakage of single -point risks of private keys, slow down the risk of fishing, while ensuring operational efficiency

Cobo ARGUS is a product built by SAFE {Wallet}. The foundation and core are the multi -signing contract wallet.So Cobo Argus naturally inherits the security of SAFE {Wallet}.

By changing funds from a single private key to multiple private keys to maintain, the asset loss/lock risk of leakage by a single private key can be eliminated.Signing more wallet itself requires multiple signatures to trigger the execution of the transaction. The leakage of a single address private key will not affect the security of overall funds.In addition, you can initiate multiple signing transactions to replace the lost or risk single -signing address to ensure the security of the multiple wallets.

In addition, since the single -sign address is switched to the multiple -sign address, when the transaction is signed, each user needs to sign a transaction, which is conducive to cross -audit transaction content, which greatly reduces the possibility of being fishing.

Due to the need for multiple people to review, it has a certain impact on the efficiency of operation.Cobo Argus allows users to configure flexible authorization rules, allowing some low -frequency operations (such as regular CLAIM income operations) to a certain EOA address.This address can be replaced by signing multiple wallets to improve work efficiency.At the same time, because the address permissions are strictly limited, the overall security of the wallet will not be significantly affected.

2. Custom robot: 7*24 hours automatic risk monitoring and response

By configured Cobo ARGUS monitoring robots, operations that need to be monitored and operations that require monitoring and trigger conditions can be performed.

Taking the leverage management of the lending project as an example, users can monitor their Health Factor by configuring the ARGUS robot. When the position is close to the liquidation, the robot can be supplemented by the robot to reduce leverage.

3. Custom ACL Strategy

In addition to custom monitoring robots, users with certain development capabilities can also achieve more flexible permissions management by developing custom ACL (Access Control List) contracts.This is one of the core functions of Cobo Argus.The charm of the function is to feel the charm of this function through several examples:

1. Attack on address poisoningYou can write the ACL contract. Users can specify the commonly used address in the ACL contract as a white list. During the transaction, the ACL contract will analyze the receiving address in the transaction (ERC20 / Native token) and the white set by the user settingsThe list address is compared. If the receiving address is not in the corresponding address, the transaction cannot be successfully completed.

2. Aiming at excessive authorization issuesThe user can analyze the authorized quota in the APPROVE transaction by writing the ACL strategic contract, and the APPROVE authorization limit of the token is limited to the user’s preset value.Or 1 can be configured with custom robots, and regularly authorize the relevant tokens to clear the zero.

3. For unsafe Defi operationIf the SWAP transaction without a sliding point check, you can write the minimum slip that can be accepted by redeeming transactions by writing the ARGUS ACL strategic contract. After the setting is completed, the ACL strategy contract can be based on the set sliding point to different SWAP transactions.Perform analysis, if the exchange point is not satisfied, the transaction can be intercepted.

Summarize

There are many difficult risks in DEFI interaction. Although the content mentioned in the article involves many common scenarios, it cannot completely cover all risk points.Users need to carefully handle each transaction.

Cobo Argus can provide users with reliable and easy -to -configure means to prevent some common security risks.ACL can complete flexible and secure authorization management, and improve operational efficiency under the premise of ensuring security; custom robots can reduce manual operations. At the same time, real -time monitoring capabilities can ensure user funds for 7*24 hours.

Although DEFI can bring considerable benefits to users, but capital security is the core of steady asset growth.Cobo Argus will protect each DEFI Farmer to help everyone create more value in the bull market.