The GameFi Gold Rush

GameFi represents a seismic shift in the gaming paradigm. By leveraging blockchain technology, cryptocurrencies, and non-fungible tokens (NFTs), these games allow players to truly own their in-game assets and monetize their time and skills. The potential is staggering — some players in developing countries have even managed to earn more than their local minimum wage by participating in these digital economies.

Investors have taken notice. In 2021 alone, the blockchain games and infrastructure industry received over $4 billion in venture capital funding. Major players like Gala Games, Solana Ventures, and Griffin Gaming Partners have launched dedicated funds worth hundreds of millions of dollars to fuel the growth of this sector.

The numbers speak for themselves. According to Footprint Analytics, by March 2022, there were 1,406 GameFi projects spread across 35 blockchains, with a monthly trading volume of $129 million. Some projects have seen user growth rates exceeding 25,000% in just 30 days.

A Double-Edged Sword

However, this rapid growth and influx of capital have made GameFi projects prime targets for cybercriminals. The complexity of these games, which often combine elements of DeFi, DAOs, NFTs, and metaverse concepts, creates a multitude of potential attack vectors.

The stakes are high. In March 2022, Axie Infinity, the poster child of the GameFi movement, suffered a devastating hack resulting in the loss of approximately $620 million. This incident not only highlighted the vulnerabilities present in even the most prominent projects but also sent shockwaves through the entire industry.

Other notable incidents include the WonderHero exploit, where attackers minted and sold $300,000 worth of the game’s native token, and the suspected rug pull of the Beast Masters protocol, which vanished with $500,000 of investor funds.

These attacks erode user trust, deter potential players and investors, and threaten the long-term viability of the GameFi ecosystem. As the industry matures, it’s clear that cybersecurity can no longer be an afterthought — it must be a fundamental pillar of any GameFi project.

Common Vulnerabilities in GameFi

Understanding the threats is the first step in combating them. GameFi projects face a variety of potential security risks:

1. Smart Contract Flaws: The backbone of any blockchain game, smart contracts are often the primary target for attackers. Vulnerabilities can range from reentrancy attacks to issues with price oracles or excessive admin rights.

2. Protocol-Level Weaknesses: The underlying blockchain infrastructure itself can be vulnerable to attacks such as 51% attacks, DDoS attacks, or Sybil attacks.

3. Zero-Day Exploits: These previously unknown vulnerabilities are particularly dangerous, as projects have no time to prepare defenses.

4. Social Engineering and Scams: From phishing attacks to elaborate rug pulls, human error and malicious intent remain significant threats.

5. Insider Threats: Developers and team members with access to critical systems can be targeted or compromised, potentially leading to catastrophic breaches.

The Path Forward: Comprehensive Security Solutions

To address these multifaceted threats, GameFi projects need comprehensive, ongoing security measures. This is where specialized blockchain security firms like MetaTrust come into play.

MetaTrust, along with other leading firms in the space, offers a range of services designed to secure blockchain and crypto projects. These AI-powered security-as-a-service offerings are becoming increasingly popular and essential for projects looking to build trust and protect their users.

Here are some key security measures that GameFi projects should consider:

1. Smart Contract Audits: A thorough review of a game’s smart contract code is essential. MetaTrust’s auditing services can identify vulnerabilities before they can be exploited, ranging from focused function tests to comprehensive project-wide reviews.

2. Continuous Monitoring: The threat landscape is constantly evolving. MetaTrust offers ongoing threat monitoring services called MetaScout to catch potential vulnerabilities as they emerge.

3. Penetration Testing: Simulated attacks can help identify weaknesses in a project’s defenses. MetaTrust’s team of experts can conduct these tests to ensure robustness against common attack vectors.

4. Bug Bounty Programs: Engaging the wider security community can be invaluable. MetaTrust, together its ecosystem project AGIS Network, can help set up and manage bug bounty programs, incentivizing white hat hackers to find and report vulnerabilities responsibly.

5. Security Certifications: Passing a rigorous audit from a reputable firm like MetaTrust can provide a stamp of approval that builds user trust and attracts investors.

6. Team Security Training: Many attacks exploit human error. MetaTrust can provide security awareness training for project teams to mitigate insider threats and improve overall security posture.

7. Incident Response Planning: In the event of a breach, having a clear response plan is crucial. MetaTrust can help develop and test these plans to ensure swift and effective action when needed.

A Call to Action

As the GameFi industry continues to grow and evolve, the importance of robust cybersecurity measures cannot be overstated. Project developers must prioritize security from the outset, integrating it into every aspect of their game’s design and operation.

Investors and players, too, have a role to play. They should demand transparency about security measures and favor projects that have undergone thorough audits and obtained certifications from reputable firms like MetaTrust.

The future of GameFi is bright, but only if we can ensure its security. By working together — developers, security firms, and users alike — we can build a resilient ecosystem that can withstand the challenges of tomorrow. The play-to-earn revolution is here; let’s make sure it’s here to stay.

In this new digital frontier, security isn’t just a feature — it’s the foundation upon which the entire GameFi industry must be built. The games may be virtual, but the stakes are very real. It’s time for all stakeholders to level up their security game.

As a crypto security expert from MetaTrust, let me assure you — the threats are real, and they’re evolving faster than a speedrunner in a platformer. We’re not just talking about someone hacking your password here. The vulnerabilities in GameFi projects can be as complex as the games themselves.

Imagine you’re playing your favorite blockchain game, battling monsters and collecting rare NFT items. Suddenly, a “glitch” occurs, and poof! Your hard-earned digital loot vanishes into thin air. This isn’t just a game crash — it could be a sophisticated attack exploiting a flaw in the game’s smart contract.

Or picture this: You’ve spent months building up your in-game empire, amassing a fortune in the game’s cryptocurrency. One day, you log in to find your entire wealth has been drained. It turns out the game’s cross-chain bridge — the system that lets you move assets between different blockchains — had a vulnerability that hackers exploited.

These aren’t just hypothetical scenarios. We’ve seen real-world examples of massive hacks in the GameFi space. The Ronin Network hack in March 2022 cost players a staggering $600 million — more than the GDP of some small countries! More recently, in early August 2024, the Ronin bridge faced another security challenge, resulting in the withdrawal of about 4,000 ETH and 2 million USDC, valued at approximately $12 million.

These incidents serve as stark wake-up calls for the entire GameFi industry. Such security breaches erode trust in the entire GameFi ecosystem. And in a world built on the promise of decentralization and player ownership, trust is everything.

So, what’s the solution? Enter MetaTrust, the new sheriff in town.

Think of MetaTrust as your personal security guardian in the wild frontier of Web3 gaming. It’s not just a single tool, but a whole posse of security measures working together to keep your digital assets safe.

First up, we have MetaScan, which is like a super-powered metal detector for code. It scans through smart contracts and decentralized apps, sniffing out potential vulnerabilities before they can be exploited by bad actors.

But the protection doesn’t stop once the game goes live. MetaScout acts like a vigilant night watchman, constantly patrolling the perimeter of deployed apps, ready to raise the alarm at the first sign of trouble.

Finally, we have AGIS, an industry-first crypto security AI Agent. This cutting-edge tool utilizes compound AI foundation models, particularly our proprietary TrustLLM security-focused foundation models, for comprehensive smart contract audits. AGIS supports multiple programming languages including Solidity, Rust, Move, Go, Func, Clarity, and Cairo — covering almost all mainstream languages used for smart contracts.

What sets AGIS apart is its unique capabilities in detecting logical flaws and risks related to economic models, representing a significant advancement in blockchain security.

Now, you might be thinking, “That all sounds great, but can it really keep up with the clever tricks of determined hackers?” Well, that’s where the real magic of MetaTrust comes in. It’s not just a set of tools — it’s backed by a team of top-notch security researchers and professionals. These are the folks who eat, sleep, and breathe Web3 security. They’re constantly updating and improving the system to stay one step ahead of the bad guys.

In the end, platforms like MetaTrust are more than just a nice-to-have. They’re essential for the long-term success and adoption of GameFi and Web3 gaming. After all, what good is a digital gold rush if players are too scared of bandits to stake their claim?

So next time you’re gearing up for an epic gaming session in the blockchain universe, remember — it’s not just about having the fastest fingers or the cleverest strategy. In this new frontier, the smartest players are the ones who saddle up with the right security partner. Happy gaming, and stay safe out there in the wild, wild Web3!

Vitalik Buterin’s recent tweet underscores the significance of AI-assisted formal verification of code in enhancing smart contract security. He emphasizes the critical need to address bugs in code, recognizing them as Ethereum’s biggest technical risk. The potential for AI to revolutionize formal verification processes presents an exciting opportunity to mitigate these risks and elevate the security standards of the Web3 ecosystem. An AI security tool called PropertyGPT of MetaTrust Labs stands poised to offer a promising solution to address the challenges.

Formal Verification Challenges for Smart Contracts

Amidst blockchain’s rapid evolution, smart contracts have emerged as a vital application, widely integrated into decentralized platforms across finance, gaming, and supply chain management. However, their increasing usage brings forth security concerns, posing a significant challenge to blockchain’s sustainable growth. Smart contract vulnerabilities not only risk substantial financial losses but also erode user trust in blockchain tech. Consequently, ensuring smart contract security has become a central focus in blockchain research and application. While various automated verification tools aim to enhance smart contract security, their efficacy hinges on crafting robust security rules. Yet, formulating these rules demands significant time and expertise due to the intricate nature of smart contract logic. This complexity not only incurs high costs but also limits the widespread use and efficiency of automated verification tools.

Empowering Web3 Security with PropertyGPT

PropertyGPT offers a groundbreaking solution to the challenges of smart contract security. Powered by advanced natural language processing, particularly leveraging GPT models, PropertyGPT automates the generation of robust security verification rules for smart contracts. Its core strength lies in understanding complex code features and transferring knowledge, enabling the automatic creation of efficient, widely applicable rules while diminishing reliance on security experts, thus reducing costs and time associated with rule formulation.

This approach enables PropertyGPT to swiftly produce a plethora of effective invariant verification rules adaptable to the diverse and intricate nature of smart contracts, meeting stringent security standards. By automating rule generation, it not only streamlines smart contract security audits but also cuts overall costs, empowering more projects to secure their smart contracts early on and fortifying the security framework of the entire blockchain ecosystem.

• Vector Database Construction: Data undergoes vectorization, transforming it into mathematical vectors to represent smart contract code and execution rules. PropertyGPT constructs a Vector Database (Vector DB), forming the basis for subsequent analysis and comparison.
• Similarity Comparison and Rule Selection: PropertyGPT compares contract code vectors with those in the database to select top similar rules, laying the groundwork for generating verification specifications.
• Verification Specification Generation: PropertyGPT inputs contract code and selected rules into the GPT model, which autonomously generates specifications or properties for the Prover, guiding security verification to ensure smart contract safety.

Check how it works on YouTube: https://youtu.be/SCWfvEL_VSQ

In echoing Vitalik Buterin’s insights, AI-driven formal verification emerges as pivotal for smart contract security. With innovations like PropertyGPT, poised to reshape this landscape, anticipation builds for AI’s forthcoming impact on Web3. As these advancements streamline security practices, we foresee a future where AI not only safeguards but also propels innovation within decentralized ecosystems.

Looking ahead, AI’s integration promises a transformative shift in Web3 security. With tools like PropertyGPT automating verification, vulnerabilities will be swiftly identified and mitigated. Beyond security, AI stands to optimize governance and finance protocols. This convergence propels us toward a more resilient and inclusive Web3, driven by AI’s limitless potential.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

Current Security Challenges in Web3

The Web3 industry faces numerous security challenges, from smart contract vulnerabilities to exploit attacks. Coding errors in smart contracts can lead to fund loss or manipulation of DeFi protocols.

Detecting vulnerabilities in DeFi smart contracts, especially involving financial logic, remains a challenge. Tools like SciviK, DeFiRanger, and methodologies by Wang et al. offer insights but overlook nuanced financial operations like price manipulation and token operations. This oversight poses obstacles in pinpointing DeFi-specific vulnerabilities. Contemporary detection tools like symbolic execution and fuzzing face limitations in extracting DeFi-specific insights due to their general approach.

DeFi contracts’ unique parameters demand advanced mutation techniques for uncovering concealed vulnerabilities. Leveraging generative AI models like ChatGPT shows promise in bridging this gap, offering advantages in aligning business scenarios with detection tool rules, albeit requiring further exploration for implementation.

Read more about <LLM4Vuln: A Unified Evaluation Framework for Decoupling and Enhancing LLMs’ Vulnerability Reasoning>

AegisAI: Empowering Web3 Security

AegisAI represents a significant leap forward in Web3 AI security, boasting several key features that empower developers and users alike:

1. Comprehensive Security Audits: AegisAI prioritizes thorough smart contract auditing, identifying complex vulnerabilities that may have previously gone undetected.
2. Expansion of Rule Library: With its rule library expanded to 4500 rules, AegisAI enhances vulnerability detection capabilities, providing developers with more customization options.
3. Achievements in Bounty Challenges: AegisAI has demonstrated outstanding performance in recent bounty hunter challenges, earning bounties and industry recognition.
4. Improvement in Audit Effectiveness: AegisAI has made significant strides in audit effectiveness, reducing the time and resources required to address security vulnerabilities.
5. Integration of Advanced Machine Learning Techniques: AegisAI combines machine learning algorithms to adapt to new security threats and improve detection accuracy continuously.

AegisAI Bug Findings from DeFi Project

AegisAI’s practical application is evident in bug findings from a DeFi platform. To illustrate AegisAI’s capabilities, let’s delve into specific examples of bug findings.

1. Vulnerability in ArrakisMath.pairTokensAndValue function

Application rule “Correct decimal processing errors in the square root price ratio calculation in the liquidity pool.” This is because incorrect decimal processing can result in inaccurate price ratio calculations, which in turn affect other calculations that rely on this value.

The flaw discovered: The function did not properly handle token decimals when calculating the square root price ratio in the liquidity pool, causing the price of some token pairs to be overvalued.

Audit results: The audit confirmed the existence of this vulnerability.

Project feedback: The project acknowledges the problem and adds relevant reminders to the code comments. While this is a good reminder of needing to use a TWAP for on-chain calculations. Through its meticulous analysis and cutting-edge technology, AegisAI empowers developers to enhance the security and integrity of their Web3 applications. These real-world examples underscore the critical role of AI-powered security solutions in safeguarding decentralized systems against emerging threats.

2. SoulZap_UniV2 Vulnerabilities in _zap Function

Application rule: “Improve the token amount calculation mechanism when adding liquidity to the pool.” This is to prevent users from inadvertently donating too many tokens to the liquidity pool due to inaccurate token amount calculation.

Exploited loopholes: When adding liquidity, the token amount was inaccurately calculated, potentially causing users to inadvertently donate too many tokens to the liquidity pool.

Audit results: The audit confirmed the existence of this vulnerability.

Project feedback: The project acknowledges this finding and states that due to current limitations, no updates will be available in this version. Acknowledged, This is a great find. Thanks for reporting. Due to our current limitations we won’t be providing an update for this in this version.

Tracking here: https://github.com/SoulSolidity/SoulZapV1/issues/13

AegisAI: Pioneering Web3 Security with AI Innovation

As the Web3 ecosystem continues to evolve, AegisAI stands as a beacon of hope in the ongoing battle against cybersecurity threats. By harnessing the power of AI, AegisAI not only identifies vulnerabilities but also empowers developers and users to navigate the decentralized landscape with confidence. With its comprehensive auditing capabilities and integration of advanced machine learning techniques, AegisAI sets a new standard for Web3 security, offering promising solutions to mitigate emerging threats.

With AegisAI leading the charge, we anticipate further advancements in Web3 security. The emergence of secure AI agents and agent marketplaces holds the promise of a more robust and dynamic cybersecurity landscape. By embracing these innovations, we are poised to create a safer and more inclusive digital environment for all participants in the Web3 ecosystem. As we look ahead, let us remain optimistic about the transformative potential of AI-powered solutions in safeguarding decentralized systems and ensuring the trust and security of users worldwide.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

Hooks contract is one of the main features of Uniswap V4. The execution of a pool can be split into multiple phases, such as: before and after the creation, or the swap of the pool, we can execute the predefined life cycle functions of the Hooks contract in the various phases of the execution of the pool, therefore, the developer can write a variety of Hooks contract, using its life cycle function to achieve a variety of new features, which is very conducive to the development of a variety of businesses based on the Hooks extension, such as: limit orders, dynamic tariffs, TWAMM, Yield interest generation and so on. This is the Hooks chapter of the Uniswap V4 series, which analyses Hooks contracts from the perspectives of their implementation principles and interaction flow.

Core Contract of the Hooks

The core code of the Hooks contract is in the repository v4-core, and the PoolManager contract manages the pools and stores the state of all the pools. Let’s start by analyzing the initialize function of the PoolManager contract, which creates the pool.

The initialize function

The initialize function Initialises the specified pool:

• The first parameter of the initialize function is PoolKey, which determines the uniqueness of the Pool. PoolKey is defined as follows:

• Compared to Uniswap V3, a new field hooks is added to the pool’s unique index, which indicates that even if the pair(currency0,currency1), fee, and tickSpacing are the same, once the hooks are different, it is still a different pool.
• The onlyByLocker modifier, which only allows calls from any address other than the current Locker or the most recently invoked pre-licensed hook.

• The main steps of the initialize function include:
• Whether static costs are out of bounds;
• Whether tickSpacing is out of bounds. The larger the tickSpacing is, the more gas is saved, and at the same time, the larger the slippage is, which is good for coins with high price fluctuations;
• The currency0 must be smaller than the currency1 to avoid creating duplicate pairs of coins;
• Check on the hooks contract address
• If NoOp is allowed, at least one of beforeModifyPosition, beforeSwap and beforeDonate should be allowed;
• If no Hooks contract is set, the fee cannot be set to dynamic;
• If a Hooks contract is set, at least 1 flag must be set, or a dynamic fee must be set.

a. The PoolKey specifies the hooks contract to be used for the callback;

b. The PoolMananger contract calls back the beforeInitialize() and afterInitialize() functions of the hooks contract when it initialises the pool using the initialize function.

The lock function

As mentioned above, only the Locker role can call the intialize function, and to become a Locker you need to call the lock function, as shown below:

• Add lockTarger as a Locker;
• Callback to the lockAcquired function of the Hooks contract(lockTarger);
• Check on and set the Lockers array. If the length of Lockers is 1, the nonzeroDeltaCount() of Lockers must be 0. Therefore, we can get the main interaction flow between Hooks contract and PoolManager as follows:

The modifyPosition function

The modifyPosition function is used for liquidity changes. Note: In the new commit, the modifyPosition is renamed to modifyLiquidity function, and beforeModifyPosition and afterModifyPosition are renamed to beforeModifyLiquidity and afterModifyLiquidity, but the main logic remains the same, and this article is based on commit 835571.

• Unlike the initialize function, there is an extra noDelegateCall modifier, which disables delegate calls;
• Verify whether the pool is initialised or not;
• The beforeModifyPosition function and afterModifyPosition function of Hooks are called back successively;
• Modify liquidity:
• The owner represents the owner of the position;
• The tickLower is the lower bound of the position interval, the tickUpper is the upper bound of the position interval (when the spot price is lower than the lower bound or higher than the upper bound of the position interval, there will be only one token left in the position);
• The liquidityDelta can be positive or negative, representing additions or removals to the liquidity pool;
• The tickSpacing is interpreted in the initialize function. (The modifyPosition function is similar to liquidity management in Uniswap V3, and will not be discussed further in this article)
• Update the token balance, and nonzeroDeltaCount`(), which is checked in the lock function mentioned above, and when hooks exit, nonzeroDeltaCount() is required to be 0, i.e., no tokens are outstanding between the user and the pool.

The swap function

The swap function handles the token swap for the user.

• The swap function has the same access rights as the modifyPosition function, controlled by noDelegateCall and onlyByLocker modifier.
• Verify that the pool is initialized or not;
• Call the beforeSwap and afterSwap callback functions of the Hooks contract successively;
• Swapping tokens:
• The tickSpacing is the tick spacing (interpreted in the initialize function before);
• The zeroForOne is the direction of the token swap, which determines the coin for which the fee is charged;
• The amountSpecified is the number of tokens swapped.
• The sqrtPriceLimitX96 is the limited price, used to prevent slippage. (The swap function is also similar to Uniswap V3’s swap operation, which will not be discussed further in this article)
• Tokens balance update, note that here there is no transfer of tokens between the user and the pool, the final settlement of tokens by the settle function, take function to complete;
• Protocol fee update.

The take function

• Transfer tokens from the pool to the to address;
• Can be used for the flashloan.

The settle function

• Used to calculate the tokens that the user pays to the pool;
• Before calling the settle function, the user needs to transfer tokens to the PoolManager contract in advance, if the token is an ERC20 token.

The donate function

Donating tokens to the pool

BaseHook.sol and the official example Hooks are in the repository v4-periphery. There are five example Hooks in repository v4-periphery:

• FullRange.sol, add and remove liquidity across the entire price range, similar to Uniswap V2;
• GeomeanOracle.sol, uses the Uniswap pool to act as a Hook for the price oracle;
• LimitOrder.sol, Hook to support user limit orders;
• TWAMM.sol, TWAMM (Time Weighted Average Market Maker) is a type of market maker that makes a time-weighted average to calculate the price of an asset, and this Hook supports the TWAMM method of trading tokens. For more details, please refer to the blog post on the official website Uniswap v4 TWAMM Hook;
• VolatilityOracle.sol, support for a dynamic fee.

Note: At the time of writing, Uniswap V4 is not yet deployed on the mainnet and the code is still being updated. Uniswap mentioned that although some hooks have been audited and are in a production-ready state, it is not guaranteed that they are safe for all users, and it is recommended to conduct a security audit before the hooks go live.

The BaseHook contract

The BaseHook contract is an abstract contract, as the parent contract of Hooks contracts, contains the basic interfaces of the Hooks contract, which needs to be implemented by Hooks contracts.

The FullRange contract

Take the FullRange contract as an example to analyze. The liquidity range of the FullRange is the entire price range, rather than concentrated liquidity.

• The getHooksCalls function, it implies the Hook contract will implement 3 callback functions beforeInitialize, beforeModifyPosition, and beforeSwap.

• beforeInitialize, stores basic information of the new pool into poolInfo.
• The addLiquidity function, adds liquidity for users

• Query the pool liquidity and calculate the newly added liquidity;
• The actual liquidity management is done by the modifyPosition function, which calls the poolManager.lock function, which in turn calls back the LockAcquired function of the FullRange contract in the lock function;
• Mint LP tokens for the user and validate the slippage. (The first person to gain the LP tokens is debited with a small number of LP tokens equal to the share of MINIMUM_LIQUIDITY, which is actually how it was done in Uniswap V2.)
• The lockAcquired function, it is a callback function, e.g. the addLiquidity function triggers a call to this function and completes the settlement of the token transfer.

• The removeLiquidity function, it provides the ability to remove liquidity, which is equivalent to the inverse operation of addLiquidity.

The Community’s Hooks Contract

• Multi-Sig, which requires multiple signatures for certain pool operations, such as adding or removing liquidity. This can be used to add an extra layer of security to the pool;
• Whitelist, which restricts participation in the pool to a whitelist of approved addresses. This can be used to prevent certain people from participating in the pool, such as those who have been banned from the platform or those who are considered high-risk traders.
• Stop Loss Order, which allows users to place a stop loss order on their positions. This means that the position will be automatically closed if the price reaches a target price;
• Ref Fee Hook, hooks that charge a referral fee for swaps and liquidity additions. This can be used to incentivize users to refer others to the pool;
• Dynamic Fee Hook, a hook that uses a volatility fee prediction machine to adjust the pool fee based on the actual volatility of the currency pair.

Note: The community contract does not guarantee its security, so it is recommended that a security audit be conducted before the Hooks go live.

Uniswap V4 will go live after the Dencun upgrade, and its code may probably be updated in the meantime. This post is based on the following commits analysis: V4-core: 83557113a0425eb3d81570c30e7a5ce550037149, Dec 11, 2023 V4-periphery: 63d64fcd82bff9ec0bad89730ce28d7ffa8e4225, Dec 20, 2023 The new commit renames the interface modifyposition and callback functions, but the basic structure remains the same.

Reference

https://uniswap.org/ https://github.com/Uniswap/v4-core https://github.com/Uniswap/v4-periphery https://github.com/hyperoracle/awesome-uniswap-hooks

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

Summary

The Ethereum Cancun (Dencun) upgrade was launched on the test network Goerli on January 17th, which indicates that the mainnet of the Cancun upgrade will be launched soon. After that, Uniswap V4 will also be launched on the mainnet, because the core function of Uniswap V4 FLASH ACCOUNTING depends on the Transient storage opcodes in EIP-1153, and EIP-1153 will not be involved in EVM until Dencun upgrade is done. The core algorithm of Uniswap V4 is the same as V3’s AMM, with some enhanced features based on V3: Hooks, Singleton, Flash accounting, and Native ETH. MetaTrust Labs has launched a series of articles on Uniswap V4 to explain Uniswap V4 features, contract implementation, potential security risks, and other topics for readers.

Different Uniswap Versions

Uniswap V4

Compared to the previous version, Uniswap V4, changes have been made in the following areas:

• Hooks
• Singleton
• FLASH ACCOUNTING
• Native ETH

HOOKS

In Uniswap v4, users will be allowed to integrate more customized features into the centralized liquidity pool by way of hooks. This greatly enriches the business scenarios, e.g., Limit Orders, Dynamic Rates, TWAMM, Yield Interest Generation, and more.

Hooks is a customized contract. It is linked to a pool when initializing the pool. Uniswap V4 provides 8 hook functions, which need to be flagged and implemented accordingly in the hook contract, including:

• beforeInitialize/afterInitialize
• beforeModifyPosition/afterModifyPosition
• beforeSwap/afterSwap
• beforeDonate/afterDonate

Take the execution of beforeSwap and afterSwap as an example. The flowchart is as follows, in steps S0 and S2, check the beforeSwap/afterSwap flags. When they are true, it means that there are Hooks, and then call the beforeSwap/afterSwap function on the corresponding Hooks contract.

As Hook contracts have customized functionality, they naturally face certain security risks while enjoying the flexibility of Hooks. For examples:

• If the Hooks are upgradable;
• If the Hooks exist centralization risks;
• If there is an authority issue;
• If there is a DoS issue on the Hooks, etc. We will also introduce the security risks of Hooks contracts in the next article.

Singleton

Uniswap v4 abandons the way of creating transaction pools through the factory pattern in the previous version, and adopts and implements a single contract containing all the pools, i.e., the Singleton. A common scenario of Uniswap is a multi-hop swap, e.g., when exchanging $USDC for $Doge, it may be necessary to go through the intermediary tokens $WETH. Assumes that when exchanging $USDC for $Doge, it may need to go through $WETH as an intermediate token to make the swap, which is swapped on the two pools of [$USDC,$WETH] and [$WETH,$DOGE] in turn, along with tokens transfer.

With the singleton model, not only the cost of pool creation is reduced, but also the cost of multi-hop transactions is reduced, this is because all the pools are in a single contract, and the creation of the pools and the execution of the transactions are just updates to the state variables within a single contract.

FLASH ACCOUNTING

In previous versions of Uniswap, exchanges and adding liquidity to pools ended with token transfers, especially in multi-hop transactions that required transferring tokens across multiple pools, which resulted in high Gas fees. Instead, in Uniswap v4, each operation updates an internal net balance called delta, and external transfers are made only at the end of the lock. This reduces the gas fee in case of multi-hop transactions.

Flash accounting uses the Transient storage opcodes (TLOAD and TSTORE) from EIP-1153, which will be implemented in the Dencun upgrade, and UniswapV4 will go live on the mainnet with the Dencun upgrade as it approaches (Q1 2024).

Native ETH

The support of the Native ETH was stopped in Uniswap v2, and v3, but it will be supported in Uniswap v4, which reduces the gas consumption of native ETH wrap/unwrap operations, and also native ETH consumes less gas to transfer compared to ERC20 tokens, which consume 21k gas to transfer, while the ERC20 tokens consume about 40k gas. Business License

The main core source code of Uniswap V4 (except some Libraries) is released under the license Business Source License 1.1, which restricts the use of the Uniswap V4 source code in commercial or production environments for a period of four years, and permanently converts it to the GPL license at the end of that period.

Reference

https://eips.ethereum.org/EIPS/eip-1153 https://github.com/Uniswap/v4-core

Community Contributions to Uniswap v4

https://github.com/Uniswap/v4-core/blob/main/docs/whitepaper-v4.pdf

https://blog.uniswap.org/uniswap-v3 https://blog.uniswap.org/uniswap-v4#what-is-uniswap-v4

https://github.com/Uniswap/v4-core/blob/main/LICENSE

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

MetaTrust, a leading provider of innovative solutions in the AI+Crypto market, has made significant strides in the field of automated verification for smart contract fairness. Their research, titled “Towards Automated Verification of Smart Contract Fairness,” addresses the challenges associated with ensuring fairness in smart contract interactions. By integrating their cutting-edge product, Security Prover, with the FairCon framework, MetaTrust offers a comprehensive solution that enhances trust, reliability, and transparency in blockchain ecosystems.

Read more: https://dl.acm.org/doi/abs/10.1145/3368089.3409740

Key Findings:

The research has yielded key findings that revolutionize smart contract fairness verification:

1. FairCon Framework: MetaTrust has developed the FairCon framework, which automates the verification of fairness properties in smart contracts. This framework ensures that all participants are treated fairly, enhancing trust within the blockchain ecosystem.
2. Trust and Reliability: Fairness is critical for establishing trust and reliability in smart contracts. MetaTrust’s automated verification process promotes transparency and integrity, instilling confidence among stakeholders and mitigating potential disputes.

Integration with Security Prover:

MetaTrust’s integration of Security Prover, a component of their flagship product, MetaScan, strengthens the verification process and augments the overall security and fairness of smart contract interactions.

1. Comprehensive Analysis: The integration of Security Prover enables a comprehensive analysis of smart contracts, considering both fairness and security aspects simultaneously. This integration ensures that contracts are not only fair but also resistant to vulnerabilities and malicious attacks.
2. Synergistic Approach: By combining automated fairness verification with advanced security analysis, MetaTrust’s solution provides a synergistic approach to secure and fair smart contract operations. The integration of Security Prover adds an additional layer of protection and reliability to the fairness verification process.

Future Outlook:

MetaTrust’s research and integration of Security Prover pave the way for future advancements in smart contract fairness and security:

1. Advanced AI Techniques: MetaTrust will continue to leverage advanced AI techniques to enhance the accuracy and efficiency of fairness verification. This ongoing development ensures that smart contracts are thoroughly analyzed and meet rigorous fairness standards.
2. Real-time Monitoring: MetaTrust aims to implement real-time monitoring capabilities, enabling continuous monitoring and detection of fairness violations in smart contracts. This proactive approach helps prevent potential issues and reinforces the integrity of contract interactions.
3. Proactive Recommendations: MetaTrust plans to provide proactive security and fairness recommendations based on the analysis performed by the FairCon framework and Security Prover. This empowers users to address potential vulnerabilities and ensures a higher level of fairness and security in their smart contract implementations.

Conclusion:

MetaTrust’s research on automated verification of smart contract fairness, combined with the integration of Security Prover, sets new standards in the AI+Crypto market. By addressing fairness challenges and considering both security and fairness aspects, MetaTrust ensures the trustworthiness, reliability, and integrity of smart contract operations. Their future outlook includes advancements in AI techniques, real-time monitoring, and proactive recommendations, further solidifying their position as a leader in providing secure and fair smart contract solutions. With the integration of Security Prover, MetaTrust offers a comprehensive solution that enhances transparency and trust within the blockchain ecosystem, paving the way for widespread adoption of secure and fair smart contracts.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

On December 6, 2023, while Bitcoin investors were celebrating the surge brought by Inscriptions, Luke Dashjr, the developer of the Bitcoin Core node client, poured cold water on the excitement. He considered Inscriptions as a “spam” attack and submitted a fix code and CVE vulnerability report (CVE-2023–50428). Subsequently, the Bitcoin community erupted in debate, reminiscent of the chaos caused by the hard fork in 2017.

So, should Bitcoin prioritize security and sacrifice some unexpected features, or should it embrace unexpected innovations and tolerate potential security issues to some extent?

We know that the journey of Bitcoin is not just speculation and trading; it is also a process of continuous evolution in its ecosystem and security framework. This article aims to delve into the dual narrative of Bitcoin’s growth: the expanding utility within its ecosystem and the strengthening of security measures. We will explore the synergy between innovation and robust security protocols and how they pave the way for the new era of digital assets.

As the cornerstone of the cryptocurrency revolution, Bitcoin has always been regarded as a store of value similar to gold. While other public chain DeFi innovations are flourishing, it seems that people have forgotten about the existence of Bitcoin.

However, it was on Bitcoin that pioneers first experimented with stablecoins, Layer2, and even DEFI. For example, the popular stablecoin USDT was initially issued on the Bitcoin Omnilayer network. The following diagram provides a basic classification of the Bitcoin ecosystem from a technical implementation perspective.

This includes technologies such as sidechains based on two-way anchoring, text parsing based on output script (OP_RETURN), engraving based on Taproot scripts, driven chains based on BIP300 updates, and state channel-based Lightning Network.

Many of these terms may still be unfamiliar, but don’t worry. Let’s first familiarize ourselves with the fundamental knowledge and then explain the technical principles of these ecosystems one by one, discussing the associated security issues.

UTXO: The Basic Unit of Bitcoin Transactions

Different with Ethereum’s account balance system, Bitcoin does not employ the concept of accounts. Ethereum introduced four complex Merkle Patricia Tries to store and verify changes in account states. In contrast, Bitcoin ingeniously utilizes UTXO to address these issues in a more concise manner.

Four Trees of Ethereum

Inputs and Outputs of Bitcoin UTXO (Unspent Transaction Outputs) may sound convoluted, but it becomes easily understandable once you grasp the concepts of inputs, outputs, and transactions.

Inputs and Outputs of Transactions

Those familiar with Ethereum should know that transactions are the fundamental communication units within blockchain networks. Once a transaction is packaged, mined, and confirmed, it signifies the determination of state changes on the chain. In Bitcoin transactions, it is not a simple operation of states between addresses; rather, they consist of multiple input and output scripts.

The above diagram illustrates a typical Bitcoin 2 to 2 transaction. In theory, the amount of BTC in the inputs should be equal to the amount in the outputs. However, the portion of BTC that is less in outputs compared to inputs serves as the miner’s transaction fee, earned by the block miner. This is equivalent to the Gas Fee in Ethereum.

When transferring BTC from two input addresses, validation needs to be performed in the input script to prove that these two input addresses can spend the respective inputs (i.e., the unspent outputs, UTXO) from the previous transaction. The output script defines the conditions for spending the two output bitcoins, i.e., the conditions that must be met when using this unspent output as an input in the next transaction (typically, for a regular transfer, the condition is the signature of the output address). In the above diagram, P2wPKH represents the signature verification of a Taproot address, while P2PKH represents the signature of a legacy address.

Specifically, the data structure of a Bitcoin transaction is as follows:

In Bitcoin transactions, the basic structure consists of two key components: inputs and outputs. The input part specifies the sender of the transaction, while the output part indicates the recipient of the transaction and any change (if applicable). The transaction fee is the difference between the total input amount and the total output amount. Since the input of each transaction is the output of a previous transaction, the outputs of transactions become the core elements of the transaction structure.

This structure forms a chain-like connection. In the Bitcoin network, every valid transaction can be traced back to one or more previous transaction outputs. The starting point of these transaction chains is the mining reward, and the endpoint is the currently unspent transaction outputs. All unspent outputs in the network are collectively referred to as Unspent Transaction Outputs (UTXOs) in the Bitcoin network.

In the Bitcoin network, the inputs of each new transaction must be unspent outputs. Additionally, each input requires the corresponding private key signature of the previous output. Every node in the Bitcoin network stores all the UTXOs on the current blockchain to verify the validity of new transactions. Through the UTXO and signature verification mechanism, nodes can verify the validity of new transactions without tracing the entire transaction history, thereby simplifying the operation and maintenance process of the network.

Bitcoin’s unique transaction structure aligns with its whitepaper, “Bitcoin: A Peer-to-Peer Electronic Cash System.” Bitcoin is an electronic cash system, and its transaction structure simulates the process of cash transactions. The amount that can be spent on an address depends on the previously received cash amount. Each transaction aims to spend all the cash on that address as a whole, and the output addresses of a transaction usually consist of a recipient address and a change address, similar to receiving change in cash transactions at a supermarket.

Script

In the Bitcoin network, scripts play a crucial role. In fact, each output of a Bitcoin transaction refers to a script instead of a specific address. These scripts act like a set of rules that define how the recipient can spend the assets locked in the output.

The validity of a transaction relies on two types of scripts: the locking script and the unlocking script. The locking script exists in the output of a transaction and defines the conditions required to unlock that output. The corresponding unlocking script, which is located in the input part of the transaction, must follow the rules defined by the locking script to unlock the UTXO (Unspent Transaction Output) assets. The flexibility of this scripting language allows Bitcoin to implement various combinations of conditions, showcasing its characteristics as a “partially programmable currency.”

In the Bitcoin network, each node runs a stack-based interpreter to interpret these scripts based on “first-in, first-out” rules.

The most classic Bitcoin scripts mainly consist of two commonly used types: P2PKH (Pay-to-Public-Key-Hash) and P2SH (Pay-to-Script-Hash). P2PKH is a simple transaction type where the recipient only needs to sign with the corresponding private key to spend the assets. P2SH, on the other hand, is more complex. For example, in the case of multisignature, it requires a combination of multiple private key signatures to spend the assets.

These scripts and verification mechanisms together constitute the core operation of the Bitcoin network, ensuring the security and flexibility of transactions.

For example, in Bitcoin, the output script rules for P2PKH are as follows:

Pubkey script: OP_DUP OP_HASH160 OP_EQUALVERIFY OP_CHECKSIG

The input requires a signature:

Signature script: sig

For P2SH, the output script rules are as follows:

Pubkey script: OP_HASH160 OP_EQUAL

The input requires a multisig list:

Signature script: [sig] [sig...]

In the above two script rules, the pubkey script represents the locking script, and the signature script represents the unlocking script. The words starting with OP_ are script commands and instructions that nodes can interpret. These command rules are categorized based on the different pubkey scripts and also determine the rules for the unlocking script.

Bitcoin’s scripting mechanism is relatively simple. It is an engine based on a stack-based model that interprets related OP commands. The supported script rules are not too extensive, and it cannot implement complex logic. However, it provides a prototype for blockchain programmability. Some subsequent ecosystem projects have developed based on the principles of scripting. With the updates of Segregated Witness (SegWit) and Taproot, the types of OP commands have become more diverse, and the script size that can be included in each transaction has been increased, leading to an explosive growth in the Bitcoin ecosystem.

The popularity of mnemonic technology is closely related to Bitcoin’s Segregated Witness (SegWit) and Taproot updates.

From a technical perspective, the higher the decentralization level of a blockchain, the lower its efficiency usually is. Taking Bitcoin as an example, the size of each block is still maintained at 1MB, the same as the size of the first block mined by Satoshi Nakamoto. Faced with the scalability issue, the Bitcoin community did not choose the straightforward path of increasing the block size. Instead, they adopted a method called Segregated Witness (SegWit), which is an upgrade solution that does not require a hard fork. Its aim is to improve the network’s processing capacity and efficiency by optimizing the data structure within the blocks.

Segregated Witness (SegWit):

In Bitcoin transactions, the information is primarily divided into two parts: basic transaction data and witness data. The basic transaction data includes crucial financial information such as account balance, while the witness data is used for verifying the users’ identities. For users, they are mainly concerned with the information directly related to their assets, such as the account balance, and the details of identity verification do not need to occupy too many resources in the transaction. In other words, the receiving party is primarily interested in the availability of the assets and does not need to excessively focus on the detailed information of the sender.

However, in the transaction structure of Bitcoin, the witness data (i.e., signature information) occupies a significant amount of storage space, which leads to reduced transfer efficiency and increased transaction packaging costs. To address this issue, Segregated Witness (SegWit) technology was introduced. Its core idea is to separate the witness data from the main transaction data and store it separately. The result of this approach is an optimization of storage space utilization, thereby improving transaction efficiency and reducing costs.

In this way, without changing the original 1MB block size, each block can accommodate more transactions, while segregated witness data (which includes various signature scripts) can occupy an additional 3MB of space, laying the storage foundation for the enrichment of Taproot script instructions.

Taproot

Taproot is a significant soft fork upgrade to the Bitcoin network aimed at improving the privacy, efficiency, and processing capabilities of Bitcoin scripts and smart contracts. This upgrade is considered a major advancement since the Segregated Witness (SegWit) upgrade in 2017.

The Taproot upgrade consists of three different Bitcoin Improvement Proposals (BIPs): Taproot (Merkle Abstract Syntax Tree, MAST), Tapscript, and a new multisignature-friendly digital signature scheme called “Schnorr signatures.” Taproot aims to provide several benefits to Bitcoin users, including enhanced transaction privacy and reduced transaction costs. Additionally, it will enhance Bitcoin’s ability to execute more complex transactions, thereby expanding its range of applications.

The Taproot update directly affects three ecosystems: one is the Ordinals protocol, which utilizes Taproot’s script-path spend scripts to enable additional data; another is the Lightning Network, which upgrades to Taproot Asset, evolving from simple peer-to-peer BTC payments to multiparty payments and support for issuing new assets; and finally, the newly proposed BitVM, which incorporates boolean circuits into Taproot scripts using op_booland and op_not, thereby enabling smart contract virtual machine functionality.

Taproot’s advancements bring significant improvements to the Bitcoin network, enhancing privacy, scalability, and the capabilities of executing complex transactions and smart contracts.

Ordinals

Ordinals is a protocol invented by Casey Rodarmor in December 2022. It assigns a unique sequential number to each Satoshi and tracks them in transactions. Using Ordinals, anyone can attach additional data to the Taproot script of a UTXO, including text, images, videos, etc.

Those familiar with Ordinals certainly know that the total supply of Bitcoin is 21 million, and each bitcoin consists of 10⁸ Satoshis. Therefore, there are a total of 21 million * 10⁸ Satoshis on the Bitcoin network. The Ordinals protocol aims to differentiate these Satoshis, assigning a unique number to each of them. While this is theoretically possible, it is not practical to achieve in reality. Due to the need to resist dust attacks, the Bitcoin network imposes a minimum limit of 546 Satoshis (or 294 Satoshis for SegWit) for transactions. This means that it is not possible to transact with individual Satoshis. Depending on the address type, a minimum of 546 or 294 Satoshis must be transferred. According to the Ordinals “first in, first out” numbering theory, at least the Satoshis numbered from 1 to 294 in each block are indivisible.

Therefore, the concept of “engraving” is not about engraving on a specific Satoshi, but rather engraving in the script of a transaction that involves at least a transfer of 294 Satoshis. Centralized indexers, such as Unisat, can then track and identify the movement of these 294 or 456 Satoshis.

Inscription Encoding Method in Transactions

In principle, the spending of a Taproot script can only occur from existing Taproot outputs. Therefore, in theory, the inscription should be carried out through a two-stage commit/reveal process. Firstly, in the commit transaction, a Taproot input is created based on the script path spend content, and the spending/reveal signature conditions are indicated in the output. Secondly, in the reveal transaction, the output created by the commit transaction is spent, revealing the on-chain inscription content.

However, in practical indexer scenarios, the focus is not on the role of the reveal transaction but rather on directly reading the script fragment consisting of OP_FALSE OP_IF ... OP_ENDIF in the input script to extract the inscription content.

Because the combination of OP_FALSE OP_IF instructions causes that script segment not to be executed, arbitrary bytes of content can be stored within it without affecting the original script's logic.

A text inscription containing the string “Hello, world!” would be serialized as follows:

OP_FALSE OP_IF OP_PUSH "ord"OP_1OP_PUSH "text/plain;charset=utf-8"OP_0OP_PUSH "Hello, world!"OP_ENDIF

https://explorer.btc.com/btc/transaction/885d037ed114012864c031ed5ed8bbf5f95b95e1ef6469a808e9c08c4808e3ae

We can view the detailed information of this transaction：

By analyzing the encoding of the witness field starting from 0063 (OP_FALSE OP_IF), we can understand the serialized encoding content：

So, as long as we can decode the code in this part of the witness script, we can determine the engraved content. Here, the encoding represents plain text information, and other data such as HTML, images, videos, etc., follow similar principles.

In theory, you can also define your own encoding content, including encrypted content that only you know. However, these contents cannot be displayed in the Ordinals browser.

BRC20

On March 9, 2023, an anonymous Twitter user named “domo” tweeted about creating a standardized token called BRC20 on the Ordinals Protocol. The idea was to embed JSON string data in a Taproot script using the Ordinals protocol to deploy, mint, and transfer fungible BRC-20 tokens. Figure 1: The humble beginnings of BRC-20 tokens (the first post about domo)

From：Twitter（@domodata）

Figure 2: Three possible initial operations for BRC-20 tokens (p = protocol, op = operation, tick = ticker code/identifier, max = maximum supply, lim = minting limit, amt = amount)

From： https://domo-2.gitbook.io/brc-20-experiment/ Binance Research

The issuer of the token deploys the BRC-20 token onto the blockchain through deployment. Participants can then acquire tokens at almost no cost by using the “mint” operation (only paying the miner’s fee). Once the minted quantity exceeds the maximum supply (max), the indexer considers the minted script to be invalid. Afterward, addresses holding the tokens can transfer them using the “transfer” operation.

It’s worth noting that Casey, the founder of Ordinals, is highly displeased with the dominance of BRC-20 transactions on the Ordinals protocol. He openly expressed frustration with the amount of “garbage” that BRC-20 has brought to Ordinals. As a result, Casey’s team publicly requested Binance Research to remove any mention of Ordinals in the introduction of the ORDI token. Casey wants to dissociate the Ordinals protocol from ORDI.

Extension Protocol

BRC20 swap

Currently, the largest market, indexer, and wallet provider, Unisat, has proposed the BRC20 swap protocol for BRC20 transactions. Early users are now allowed to try it out.

Previously, in script transactions, only a partially signed Bitcoin transaction (PSBT) method was available, similar to Opensea’s off-chain signature scheme. It relied on centralized services to “match” the signatures of the buying and selling parties. This meant that BRC20 assets could only be traded through listing orders, resulting in low liquidity and trading efficiency, similar to NFT assets.

BRC20 swap introduces a mechanism called “modules” into the JSON string of the BRC20 protocol. Within this module, a script similar to a smart contract can be deployed. Taking the swap module as an example, users can lock BRC20 tokens into the module through a transfer, which initiates a transaction to themselves. The script of the transaction is then locked in the module. Users can complete the transaction or withdraw the LP by initiating another transaction to extract the BRC20 tokens.

Currently, BRC20 swap operates in an extension mode using black modules. Black modules ensure security by determining the funds a user can withdraw based on the sum of funds in the module. In other words, no user can withdraw more assets than the total assets locked in the module without consensus and verification.

Once the behavior of black modules is understood and executed by users, and as they gradually gain reliability and acceptance from more indexers, the product transitions from black modules to white modules, achieving consensus upgrade. Users can then freely deposit and withdraw assets.

In addition, because the BRC20 protocol and the entire Ordinals ecosystem are still in the early stages, Unisat has a significant influence and reputation, providing comprehensive indexing services for transactions and balance queries for the protocol, creating a centralized risk. The modular architecture allows more service providers to participate, thereby achieving a more decentralized indexing system.

BRC420

The BRC420 protocol, developed by RCSV, expands on the existing cipher by introducing recursive indexing. It defines more complex asset formats through recursion. Additionally, BRC420 establishes a relationship between ownership and royalties based on individual ciphers. When users mint assets, they are required to pay royalties to the creators. By owning a cipher, users can allocate usage rights and set prices, which encourages more innovation within the Ordinals ecosystem.

The introduction of BRC420 provides a broader imagination for the cipher ecosystem. It allows the construction of more intricate metaverses through recursive references and facilitates the development of smart contract ecosystems using code ciphers.

ARC20

The ARC20 token standard is provided by the Atomicals protocol. In this standard, “atomicals” are the basic units built on top of Bitcoin’s smallest unit, the satoshi (sat). This means that each ARC20 token is always backed by 1 sat. Additionally, ARC20 is the first token protocol that utilizes proof-of-work (PoW) ciphers for minting, allowing participants to directly mine ciphers or NFTs similar to mining Bitcoin.

Equating 1 ARC20 token to 1 satoshi brings several benefits:

• Firstly, the value of each ARC20 token will never be lower than 1 satoshi, making Bitcoin serve as a “digital gold anchor” in this process.
• Secondly, validating transactions only requires querying the UTXO corresponding to the satoshi, contrasting the complexity of BRC20, which requires off-chain ledger state records and third-party sorters.
• Additionally, all operations of ARC20 can be completed through the Bitcoin network without additional steps.
• Lastly, due to the composability of UTXOs, it is theoretically possible to achieve direct exchange between ARC20 tokens and Bitcoin, providing possibilities for future liquidity.

The Atomicals protocol sets special prefix parameters for Bitwork Mining of ARC20 tokens. Token issuers can choose a specific prefix, and users must calculate a matching prefix through CPU mining to qualify for minting the corresponding ARC20 token. This “one CPU, one vote” model aligns with the ideals of Bitcoin purists.

Cipher Security

On the surface, ciphers appear to be harmless text stored on the blockchain and parsed by centralized indexers. However, there are still several considerations for on-chain security:

• Increased node burden: Ciphers increase the size of Bitcoin blocks, requiring additional resources for nodes to propagate, store, and validate blocks. If there are too many ciphers, it can reduce the decentralization of the Bitcoin network and make it more susceptible to attacks.
• Reduced security: Ciphers can store any type of data, including malicious code. If malicious code is added to a Bitcoin block, it can lead to network vulnerabilities.
• Construction of transactions: Cipher transactions need to be constructed correctly and adhere to the first-in, first-out rules of ordinals to prevent the indexability of ciphers from being compromised due to negligence.
• Risk in buying and selling: The market for cipher transactions, whether OTC or PSBT, carries the risk of asset loss.

Here are some specific security issues:

• Increased orphan rate and fork rate: Ciphers increase the size of blocks, leading to increased orphan rates and fork rates. Orphan blocks are blocks not recognized by other nodes, and forks refer to the existence of multiple competing blockchains in the network. Orphans and forks reduce the stability and security of the network.
• Tampering with ciphers: Attackers can exploit the openness of ciphers for tampering attacks. For example, attackers can replace the stored information in the cipher with malicious code, infiltrating indexer servers or compromising user devices through trojans.
• Improper wallet usage: Mishandling wallets, such as transferring ciphers without the wallet indexing them, can result in asset loss.
• Phishing or scams: Attackers may use fake indexer websites such as Unisat to deceive users into engaging in cipher transactions and steal their assets.
• PSBT signature omissions: Atomicals Market has experienced asset losses due to incorrect signature methods used in PSBT.

https://metatrust.io/blogs/post/the-analysis-of-the-atomicals-market-user-asset-loss

To address these security issues, the following measures can be taken:

• Limiting the size of ciphers: The size of ciphers can be restricted to reduce the burden on nodes, as mentioned earlier by Luke.
• Encrypting ciphers: Ciphers can be encrypted to prevent attacks from malicious code.
• Using trusted sources for ciphers: Trusted sources can be utilized to prevent signature issues and phishing attempts.
• Using wallets that support ciphers: Wallets that support ciphers should be used for transfer activities.
• Conducting thorough code and script audits for ciphers: In the case of experiments involving BRC20-swap and recursive ciphers, the introduction of code and related scripts requires ensuring their security.

From a technical and security perspective, Bitcoin ciphers are essentially a vulnerability that circumvents the rules. Taproot scripts were not designed for data storage, and their security has some issues. Luke’s modifications to the Bitcoin Core code are correct from a security standpoint. Luke did not directly modify the consensus layer of Bitcoin but chose to adjust the Spam Filter module, allowing nodes to automatically filter out Ordinals transactions when receiving P2P broadcast messages. In this strategy filter, there are several functions named isStandard() that check various aspects of the transaction for compliance with the standards. If a transaction does not meet the standards, the received transaction will be quickly discarded by the node.

In other words, although Ordinals transactions can still be included in the blockchain, most nodes will not add such data to their transaction pools, which increases the delay in Ordinals data being accepted by mining pools willing to include them in blocks. However, if a mining pool broadcasts a block containing BRC20 transactions, other nodes will still recognize it.

Luke has introduced modifications to the policy filter in the Bitcoin Knots client and plans to introduce similar changes in the Bitcoin Core client. In this modification, he introduced a new parameter called g_script_size_policy_limit, which limits the script size in multiple different positions. This change means that the script size will be subject to additional restrictions when processing transactions, affecting how transactions are accepted and processed.

Currently, the default value for this parameter is 1650 bytes. Any node client can set this value at startup using the -maxscriptsize parameter:

However, even with code updates, it will take a considerable amount of time for all mining nodes to fully update to the new version. During this time, innovators in the cipher community should be able to create more secure protocols. （The latest news said the issue has been closed after the discussion by Bitcoin core developers.）

Metatrust Labs has already conducted risk scoring and monitoring of cipher investments through on-chain data and asset tracking on the metaScore platform. Additionally, they have introduced a rule engine for monitoring the Bitcoin network on the metaScout platform, which can assist investors in monitoring real-time data related to Bitcoin ciphers.

In this issue, we explore the technical principles and potential security issues of the current popular cipher ecosystem.

In the next issue, we will bring you a more complex Taproot circuit carving technique called bitVM. Stay tuned for more information!

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

MetaTrust, a leading AI web3 company, has conducted a research study on extracting specialized code abilities from large language models (LLMs) through imitation attacks. This research aligns with MetaTrust’s AI Repair product, which leverages the capabilities of LLMs to enhance software engineering processes.

Key Findings:

The study explores the feasibility of imitation attacks to extract specialized code abilities like “code synthesis” and “code translation” from LLMs. Through systematic analysis of different code-related tasks and query schemes, the researchers achieved promising outcomes. They also designed response checks to refine the imitation training process.

The research demonstrates that attackers, with a reasonable number of queries, can train a medium-sized backbone model to replicate specialized code behaviors similar to the target LLMs. This unveils a practical attack surface for generating adversarial code examples, highlighting the need for robust security measures. These findings directly inform the development of MetaTrust’s AI Repair product.

Integration with AI Repair:

MetaTrust recognizes the significance of this research for the software engineering industry and has incorporated it into their AI Repair product. By partnering with MetaTrust, software engineering companies can benefit from the secure and confidential management of proprietary code-related tasks while leveraging the specialized code abilities of LLMs.

AI Repair provides a secure platform for managing code snippets, enabling collaboration without exposing proprietary code to third-party providers. By utilizing the specialized code abilities extracted from LLMs, AI Repair empowers developers to streamline their software engineering processes and enhance efficiency, accuracy, and robustness.

Future Outlook:

The research findings hold great potential for further enhancing the capabilities of AI Repair in software engineering. Insights gained from studying the threats posed by imitation attacks help MetaTrust develop more secure and robust LLMs, ensuring the integrity of proprietary code-related tasks.

Additionally, the specialized code abilities extracted from LLMs can be leveraged within AI Repair to address various software engineering needs. These include adversarial example generation, automated code synthesis, code translation, code summarization, code quality improvement, automated testing and debugging, and enhanced developer productivity. By integrating these capabilities, AI Repair revolutionizes software engineering processes, providing advanced solutions for the challenges faced by developers.

Conclusion:

MetaTrust’s research on extracting specialized code abilities from large language models, in conjunction with their AI Repair product, offers significant advancements in software engineering. By partnering with MetaTrust, companies can securely manage their code-related tasks while benefiting from the specialized code abilities of LLMs. The research findings guide the development of more secure and robust LLMs, ensuring the integrity of proprietary code. AI Repair, powered by these specialized code abilities, empowers developers, enhances efficiency, and revolutionizes software engineering processes in a secure and confidential manner.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin

On January 1, 2024, a hacker attack against Orbit Chain drew the attention of the global cryptocurrency community. According to reports, hackers exploited a vulnerability in Orbit Chain, stealing $81.5 million worth of cryptocurrencies and transferring them to other addresses. Orbit Chain officials have confirmed the incident and said they are working with international law enforcement agencies to track down the attackers’ identity and motives. Some security researchers believe that the attack’s methods and targets are similar to the style of the North Korean hacker group “Lazarus”, which may be another cybercrime by the group. Who is “Lazarus”, and why do their activities raise such high alert internationally? How does the group use cryptocurrencies to circumvent international sanctions and anti-money laundering measures?

What is Lazarus?

Lazarus is a well-known hacker group with a North Korean official background that has been operating for more than a decade since 2009. The group is known for targeting organizations worldwide, and its actions so far include attacks on financial institutions, media, and government agencies. Lazarus Group is controlled by the 121 Bureau under the North Korean General Bureau of Reconnaissance. The group is known for attacking banks and cryptocurrency exchanges, obtaining economic benefits by stealing funds and data. Lazarus Group treats programmers with high standards and encourages people with computer talents to join the official “hacker” ranks.

Pyongyang Automation University is one of the important sources of Lazarus Group hackers. The group has shifted its focus from political attacks to economic attacks, focusing on attacking the cryptocurrency world. Their activities also involve targeting security researchers, embedding malicious code in open-source cryptocurrency platforms, executing large-scale cryptocurrency robberies, and spreading malware through fake job interviews. These hacker groups use funds obtained by illegal means to go through the typical money laundering process adopted by traditional cybercrime groups, and the stolen cryptocurrencies are often converted into fiat currencies to evade anti-money laundering measures.

South Korea, the United States, and Japan have been on high alert for the activities of North Korean hacker groups. It is reported that North Korean hacker groups have successfully stolen $3 billion worth of cryptocurrency funds in the past few years, which have been used to support North Korea’s nuclear and ballistic missile programs. Security advisers from the United States, South Korea, and Japan met in Seoul to discuss how to deal with North Korea’s cyber risks and announced a new trilateral cooperation initiative, focusing on addressing North Korea’s cybercrime and cryptocurrency laundering activities. The meeting was held at a time when tensions on the Korean Peninsula escalated, and North Korea accelerated the expansion of its nuclear weapons and missile programs and publicly demonstrated its attitude of using nuclear weapons preemptively.

Lazarus hacker group’s attack methods and targets are diverse, ranging from SWIFT network attacks on financial institutions to more widespread cryptocurrency robberies, showing the group’s high technical ability and threat. However, the preventive measures for these attacks are relatively few. Since 2018, North Korean hackers have stolen about $2 billion worth of virtual currencies. In 2023 alone, they stole about $200 million worth of cryptocurrencies, accounting for 20% of the stolen funds that year. These hackers pose a continuous threat to the virtual currency ecosystem, and their cyberattack methods are evolving and becoming more complex.

The scale of North Korean hacker groups’ activities exceeds that of other malicious actors by 10 times, and they also target the decentralized financial ecosystem. They use various methods to carry out cyberattacks, including phishing, supply chain attacks, and other forms of hacking. Therefore, enterprises and individual users need to strengthen cybersecurity measures, update software regularly, strengthen password policies, and increase their awareness of cybersecurity. At the same time, regulators also need to strengthen supervision, formulate stricter laws and regulations to curb this kind of cybercrime.

Attack Case 1: Lazarus Uses Log4Shell Vulnerability to Conduct Blacksmith Operation

Attack process and means:

1. Exploiting Log4Shell vulnerability: Lazarus first exploited the Log4Shell vulnerability, which is a remote code execution flaw found in the Log4j logging library. Since this vulnerability was discovered and fixed two years ago, many systems may still have unpatched versions, it provided Lazarus with an entry point.
2. Proxy tool deployment: Once gaining initial access, Lazarus set up a proxy tool, which was used to maintain persistent access on the compromised server. This tool allowed them to run reconnaissance commands, create new administrator accounts, and deploy other credential stealing tools.
3. NineRAT deployment: In the second stage, Lazarus deployed the NineRAT malware on the system. NineRAT is a remote access trojan that can collect system information, upgrade to new versions, stop execution, uninstall itself, and upload files from the infected computer. It also contains a dropper, which is responsible for establishing persistence and launching the main binary.
4. DLRAT and BottomLoader usage: Lazarus also used DLRAT and BottomLoader. DLRAT is a trojan and downloader that allows Lazarus to introduce additional payloads on the infected system. BottomLoader is a malware downloader that can fetch and execute payloads from hard-coded URLs.
5. Credential stealing and persistence: Using tools such as ProcDump and MimiKatz to dump credentials, to obtain more system information. At the same time, by creating URL files in the system’s startup directory, they achieved persistence of the new version or its deleted payload.
6. Reference links:

Attack Case 2: Lazarus Uses MagicLine4NX Software to Launch Supply Chain Attack

Attack process:

1. Watering hole attack: Lazarus hacker group infiltrated websites that specific users frequently visit and embedded malicious scripts in them. When users using MagicLine4NX authentication software visited these websites, the embedded code would execute, and the hackers could fully control the system.
2. Spreading malicious code using system vulnerability: The hackers exploited a zero-day vulnerability in MagicLine4NX software, which allowed the personal computers connected to the network to access their internet server. Then, they used the data synchronization function to spread the malicious code to the business-side server.
3. Attempting data transfer: The malware tried to establish connections with two C2 servers, one of which was a gateway within the network system and the other one was outside the internet. If the connection was successful, a large amount of internal network information could be leaked.

Technical means:

1. Zero-day vulnerability exploitation: The hackers exploited a zero-day vulnerability in MagicLine4NX software, which was an undisclosed flaw that allowed them to access the target system without authorization.
2. Supply chain attack: By exploiting the vulnerability in the supply chain, the hackers were able to bypass the normal security measures and directly attack the target system.
3. Data synchronization and C2 server connection: The hackers used the data synchronization function to spread the malicious code to the business-side server and tried to establish a connection with the external C2 server to further control and steal data.
4. Reference links:

Attack Case 3: Attacks on Cryptocurrencies

Targets: Cryptocurrency exchanges, wallets, decentralized finance (DeFi) ecosystem Attack time: Since 2018, especially in 2023 Attack process and technical means:

1. Exploiting vulnerabilities and leaked private keys: North Korean hackers used phishing and supply chain attacks with leaked private keys or seed phrases to infiltrate targets.
2. Cross-chain attacks: They specifically targeted cross-chain bridges, such as Axie Infinity Ronin Bridge, to steal large amounts of virtual currencies. Multi-stage money laundering process: North Korean hackers have used a complex “multi-stage money laundering process” in the past to obscure the source and destination of funds. They converted the stolen virtual currencies into different tokens, and then mixed and exchanged them multiple times through automated programs, mixers, and cross-chain swaps, to increase the difficulty of tracking.
3. Using decentralized exchanges: They exchanged the stolen virtual currencies for Ether through decentralized exchanges, and then mixed and exchanged them multiple times.

Based on the above cases, attackers can steal sensitive data, including confidential business information, customer data, and personal identity information, resulting in privacy breaches and potential legal consequences. Since hackers can fully control the target system, they may obtain a large amount of sensitive information, including the internal data and customer profiles of the enterprise. Lazarus’s hacker operations not only caused data leakage and system damage to the victimized organizations, but also may have a serious impact on the victims’ business operations.

These attacks usually involve complex supply chain attacks, making prevention and detection more difficult. Attacks may cause financial losses, including the costs of malware removal, data recovery, and system repair, as well as revenue losses due to business interruption. The hackers’ attacks resulted in a large amount of virtual currency being stolen, which not only caused economic losses to the victims, but also may expose their personal information and transaction data. Attacks on cross-chain bridges may paralyze the entire system, affecting the normal conduct of transactions.

To cope with such security threats, it is recommended that organizations take the following preventive measures:

1. Patch vulnerabilities in a timely manner: Ensure that security patches are applied in time to fix known vulnerabilities. Especially for software and components used in the supply chain, MetaScan’s automated audit function can timely detect and patch potential vulnerabilities.
2. Strengthen supply chain security: Establish a secure partnership with supply chain partners, review and verify software and components, and ensure that each link in the supply chain is not attacked by hackers. With MetaScout’s monitoring function, you can dynamically update the blacklist and block attacks from potential North Korean hacker addresses.
3. Security awareness training: Strengthen employee security awareness training. Educate employees on the importance of being alert to watering hole attacks, malicious scripts, and supply chain security, to reduce the impact of human factors on security. Scantist’s DevSecOps solution can provide organizations with one-stop security training and guidance.
4. Network traffic monitoring: Implement network traffic monitoring and intrusion detection systems (IDS/IPS), and timely detect abnormal activities and attack behaviors. MetaScout’s attack blocking mechanism can combine network traffic monitoring, timely identify and block hacker attacks on transactions.
5. Multi-layer defense: Adopt multi-layer defense measures, including firewalls, intrusion detection systems, anti-virus software, etc., to improve the security of the system. MetaScan’s Prover function can be used in conjunction with existing security tools and measures, forming a more comprehensive defense system.
6. Continuous monitoring and response: Establish a security monitoring and response mechanism, monitor network and system activities in real time, timely detect abnormal behaviors and take appropriate response measures, to minimize the losses caused by attacks. Scantist’s component analysis function can continuously monitor the vulnerabilities in the software supply chain and timely intercept problematic open source and third-party components.
7. Strengthen the security measures of cryptocurrency exchanges and wallets: Cryptocurrency exchanges and wallets should strengthen their security measures, such as using strong passwords, regularly changing private keys, implementing multi-layer security policies, etc. MetaScout’s blocking mechanism can provide cryptocurrency exchanges with attack blocking protection based on dynamic blacklists, ensuring the security of users’ digital assets.
8. Regular audits and inspections: Organizations should regularly conduct security audits and inspections of the system, to ensure that there are no potential security vulnerabilities. MetaScan’s automated audit function can help organizations conduct a comprehensive security assessment and timely detect potential vulnerabilities and risks.
9. Raise public awareness: Educate the public about the importance of cybersecurity, and let them know how to protect their digital assets. Organizations can raise public awareness of cybersecurity through publicity campaigns, social media, and other channels, and provide relevant security advice and guidance.

It should be noted that security threats and preventive recommendations should be evaluated and customized according to the actual situation and the latest security intelligence. In addition, regular backup and recovery of data, using strong passwords and multi-factor authentication, limiting privileged access, etc. are also effective measures to improve security.

About MetaTrust Labs

MetaTrust Labs is a leading provider of Web3 AI security tools and code auditing services incubated at Nanyang Technological University, Singapore. We provide advanced AI solutions that empower developers and project stakeholders to protect Web3 applications and smart contracts. At MetaTrust Labs, we are committed to protecting the Web3 space so that builders can innovate with confidence and reliability.

Website || Twitter || Discord || Linkedin