DeFi development is becoming more and more popular, with developers transferring from established traditional organizations to crypto startups. However, security remains a big concern in the blockchain space – and the DeFi industry in particular – regardless of the protocol stage, be it before public launch of application or after releasing new features in a more established protocol.
Keeping this in mind, we’d like to provide best practices and suggestions for strengthening overall protocol security.
Focusing on DeFi security
While developing a DeFi application, most developers concentrate on existing limitations and vulnerabilities related to the application’s type and use case. To create a safe codebase, they must know by heart how the code works and what attacks might be used against it, as well as research comparable apps and any hacks that have happened to them in the past.
With that in mind, let’s take a look at the most common attack vectors and risks that developers can face while creating a DeFi application.
Reentrancy attack
The reentrancy attack is one of the most сommon exploit types happening in the DeFi space. It is based on the DAO hack that happened back in 2016 and created a big turmoil in the blockchain community. The exploit itself is an easy one, with a smart contract receiving data from an external contract before updating its status.
Smart contracts’ security is crucial since they are a vital component of any DeFi application. Tampering with smart contract during a reentrancy attack leads to funds being withdrawn to the hacker’s wallet without the authorization of the application or the user.
The suggested solution here is to ensure that any changes to the smart contract’s state occur before calling unrelated external contracts. Another tip is to use function modifiers that prevent reentry.
Oracle manipulation
Oracle vulnerabilities are next in line, with hackers leveraging AMM and/or DEX reserves as the price oracle of DeFi application. When the DeFi protocol employs a centralized price oracle and gathers market data from a single source, it introduces an exploitable weakness in the system as bad actors may influence the market or oracle price via flashloans or their own funds.
In such cases, the best approach would be to use a decentralized oracle network and TWAPs to increase the cost of the hacker’s attack while still collecting reliable market data.
Audits & Risk Management Solutions
When attempting to exploit a protocol, a bad actor may employ a variety of attack methods and channels. Even the best engineers and in-house security experts might overlook little loopholes in code that can lead to an attack – code lines blur with time, something is missed during testing or it is insufficiently thorough, a new patch opens up a simple exploit path, and so on.
In such cases, best approach would be to conduct an external audit prior to mainnet deployment (be it an application launch or just a new feature). Auditors look at the code with fresh eyes, discovering tiny inconsistencies and backdoors and offering a more comprehensive review of the code.
Another security point would be to use risk management tools and platforms (such as Apostro https://www.apostro.xyz/ ) to defend the protocol against economic and technological threats. Such systems filter and analyze both blockchain and market data in order to give a comprehensive analysis of the protocol status and to alert developers if anything goes wrong.
Doomsday Plan
We’d like to conclude this article with the most practical advice that any DeFi developer should take to heart: a disaster recovery strategy. No matter how confident you are in the security of the DeFi application, you must have a backup plan in place if exploit happens.
The most common suggestions are to incorporate an emergency pause in the protocol’s smart contracts, as well as to have well-defined upgrade and development pipelines. Another strategy would be to partner with insurance protocols to give financial protection to both users and protocol itself – or have an emergency recovery fund in-house.
