DeFirewall: Combatting Attacks and Putting an End to “Blind Signing” on DeFi Transactions

Transcript

we have Jesse Tasman Jesse is the head of products that redefine and he's going to do a presentation called the firewall combatic attacks and putting an end to Blind signing on defy transaction it's actually a demo awesome [Music] hello everyone thank you for sticking around for this um so we're gonna attempt a live demo just now uh hopefully things go right there but just wanted to briefly talk about the issue of blind signing so changing the perspective a little bit

now looking at issues that users are facing when interacting with defy in general so what I got over here is a screenshot of some wallets that you know all in all are doing a fantastic job allowing users to interact in a very simple way and allowing them to be involved uh in in what D5 has to offer however as we've seen recently with uh web 3 attacks that have been taking place and there are many other cases where ultimately a user will unknowingly sign on a transaction that could ultimately result in them using funds what we have in the current

solutions that offer that wallets offer there is a way to improve on that to help bring additional visibility and transparency to the user and actually what you see on all of these wallets over here if any one of these transactions would be signed uh you would lose all your funds so what is replicated here is in the most recent Bridge attack that I'm aware of sorry not Bridge attack um front-end attack on the seller Network the the front end was compromised on a malicious data payload was injected into the user's wallet this is an example of that data payload and we can see that there's not

sufficient visibility for the user to understand that what they're signing on would result in them losing funds so I want to show you what we are building at redefine that can help improve on this and and assist the user so I'm going to do two transactions now I've just brought up uni swap I hope you can hear me I need two hands um and I'm just going to do a simple transaction so in this case I've got a metamask wallet connected and I've got my D firewall Chrome extension installed so I'm going to go ahead and allow the the uni swap protocol to spend my Ave and we can see in this case on

metamask I'm you know signing an approved transaction with some hexadecimal blob and the firewall is letting me know that there are no issues in this case so that's good I'd be happy proceeding now what I'm going to do is I'm gonna hit F12 and inject a little something um let's go okay and what I've injected let me just do that again is actually the exact same payload that um I showed you in the previous screenshot that was injected during the seller front end attack and ultimately if you have control over the domain you

can inject any payload you want into any user's wallet that connects to the site obviously I have control over my own machine so I can do that to myself but now you know as a user I'm on the correct uni swap URL everything looks legitimate as far as I can tell so I'm going to go ahead and try to do the exact same transaction and as you can see as far as metamask is concerned you know it's an approved function it kind of looks similar to how it did in a legitimate transaction where there were no risks involved but in this case we are able to understand that if you would go and sign on this transaction you would ultimately be losing your funds

and this is done by understanding the different signatures of attacks so taking raw transaction data simulating those transactions and running them through insights policies to go through the call stack and really try and understand if there are any flags being raised from a risk point of view and in this case we are able to identify that this transaction is uh you know not one you you want to sign on so to um keep it fairly brief that's that's what I'm going to end on but um ultimately you know the security that's being worked on is incredible in this industry and we're trying to take

it from a user's point of view to try and protect the the institutions that are deploying capital in the D5 space so we're running an early adopters program so if anyone's interested in finding out more happy to chat um but yeah gonna wrap it up there thank you so much Jesse any questions right here in the back [Music] thanks um for the Firefox or the Chrome extension we just demoed um I saw from far you said that basically the the sender is not a recognized um address are you running a sort of a wireless

list of uh well-known smart contracts or are you running on some sort of uh I don't know um analyze on the pedal itself yeah so so obviously you know a blacklist and and white list of contract addresses is something that we check against of like known malicious contracts um but what we do is go a little bit further down so simulate the transaction even look at uh you know any internal calls or delegate calls that are being made to understand the full effect and and the full trace of that transaction and try to identify in an automated way if um they're gonna be any state changes that would ultimately result in you

losing funds that you didn't intend on losing uh so we've tried to generalize it as much as possible yeah another question yeah two more okay we'll take two more hey uh I think that was a really cool demo um I wonder if you've talked to wallet providers directly like metamask for example um to get this integrated with them directly yeah so it's definitely a route that makes sense because we view ourselves ultimately as a complementary layer on top of wallet providers um you know it's it's great that we can operate Standalone but I think from the demo it it would be a much better user experience if you know that was in one screen so that you know is a direction

that we're looking in in terms of Partnerships and whatnot all right too many smart people in the room it was the same question so we're gonna move on to the next speaker thank you so much