MonitorChain: An Overview
Real-Time Security Alerts for Ethereum Tokens and Exchanges
“It pains us to see the endless headlines of multimillion dollar hacks which could have been prevented so easily. Our goal is to stem the tide of these catastrophic losses and bring trust and confidence to the blockchain’s ‘Wild West’ reputation.”
As cryptocurrency trading matures as an industry, new tools are needed to reduce the damage caused by hacks and theft, with current methods proving inadequate.
The Problem: Rampant Crypto Hacks and Theft Wreak Havoc on Exchanges
Cryptocurrency fraud is a major problem, with over a billion dollars USD equivalent worth of digital coins stolen thus far in 2018 alone, along with tens of thousands of Ethereum smart contracts being detected as vulnerable to exploit. The nature of smart contracts and the blockchain make the already serious problem of digital security even harder because smart contracts cannot be edited once deployed – blockchain transactions are irreversible, leaving few options for recourse following fraud.
Security flaws and poorly coded smart contracts have led to numerous hacks, theft and exploits on Ethereum token contracts resulting in millions of dollars being stolen, harming the reputation of exchanges, and destroying the reputation of many recent ICOs. Recent examples of these include the Titanium Bars blockchain [1] having its locked reserve account stolen required a hard fork; an intentional exploit in Monero Gold [2] leading to an exit scam stealing over $4 million; and SmartMesh [3] having infinite counterfeit tokens created and dumped on exchanges at a cost of over $1.4m. These are not only costly and reputation damaging but come with severe potential legal and regulatory implications. Despite the best efforts of smart contract auditing firms and the evolution of the blockchain industry, it is evident that these exploits will continue to occur and represent and existential threat to both companies who issue tokens, as well as the exchanges which they are traded on.
The Solution: MonitorChain – a Decentralized Security Alarm Oracle
Once a major theft or hack occurs, there is often delayed awareness, miscommunication, and inadequate internal security oversight by cryptocurrency exchanges and by the token creators themselves. MonitorChain steps in by instantly alerting all subscribers with detailed, actionable data notifications the moment an incident takes place. Protective measures such as freezing a token contract or suspension of trading on exchanges can be done before thieves have a chance to launder their ill-gotten digital goods.
Realizing that, as security is a cat and mouse game and that despite best efforts exploits will always be a reality, MonitorChain seeks to add safeguards for early detection to minimize the financial, reputational, and legal impact of such threats. By monitoring blockchain activity for these tokens for suspicious events, MonitorChain’s feed will provide near instant alerts to subscribers of a potential token compromise, so that they are able to take prompt or automated action such as suspending trading of the token or informing key partners to protect their assets. This information is all provided in a feed tied to the Ethereum network by smart contract itself, for use as an oracle.
[1] https://www.trustnodes.com/2018/04/25/okex-temporarily-suspends-erc20-token-deposits-following-bug-12-obscure-ethereum-tokens
[2] https://btcmanager.com/understanding-latest-cryptocurrency-scam-monero-gold/
[3] https://medium.com/@smartmesh/smartmesh-announcement-on-ethereum-smart-contract-overflow-vulnerability-f1ded8777720
What is MonitorChain?
MonitorChain is an on-chain Ethereum smart contract subscription feed tied to security alert detecting block explorer node, designed for use as an oracle by cryptocurrency exchanges and token smart contracts. Ethereum blockchain activity is recorded and analyzed in real time by a combination of encoded rules and heuristics to detect suspicious activity that indicates the presence of potential fraud. When an exploit or theft occurs, MonitorChain securely sends notifications to subscribers over the Ethereum network including actionable information related to the incident, addresses and tokens impacted, and severity in a format that can easily be programmatically integrated to both smart contracts as an oracle, as well as centralized systems via API, to allow instant preventative protective action to be taken, such as temporary token contract freezes and exchange trading suspensions.
Use Cases
For Exchanges
MonitorChain provides instant alerts the second fraud occurs, protecting the exchange from being the dumping ground for hackers and thieves to launder their ill-gotten coins. Combining expert defined alert conditions with heuristic triggers, the moment a potential hack or theft occurs, MonitorChain sends an on-chain notification to subscribers over the Ethereum network. These alerts can be directly integrated with smart contracts or exchange management platforms to take protective action such as halting trading of specific markets, notifying key personnel, or disabling deposits and withdrawals of effected tokens without impacting the rest of an exchange. Easy to use and integrate, MonitorChain is an essential security component for any centralized or decentralized cryptocurrency exchange.
For Token Creators (ICOs)
MonitorChain allows a degree of protection and control for token creators should a crisis occur. With instant alerts, MonitorChain can be used to take protective action such as invoking freeze/destruction functions, notifying exchanges to halt trading, and informing key personnel for timely PR responses. Custom monitoring rules and sender authorization expand the utility for token creators, allowing MonitorChain to provide further assistance in mainnet migrations, insider trading prevention, and detecting market manipulation.
For Traders and Cryptocurrency Investors
When hackers steal or counterfeit tokens, the first thing they do is send them to exchanges and dump them to unsuspecting investors. MonitorChain provides instant alerts the second fraud occurs, protecting traders from purchasing these tokens and being stuck bag holding. MonitorChain gives traders an inside edge, allowing them to know whether rapid price movement on altcoin markets is due to fraud. It can also be integrated into trading bots, to prevent programmatic issues of bots incorrectly buying into the price dump of a major hack/theft. This is in addition to the indirect benefits traders and investors receive through use of MonitorChain by the exchanges and tokens they trade on and own.
How Does MonitorChain Work
MonitorChain is comprised of the following components: MonitorChain Smart Contract (MCSC), Monitor, Tracker and AccessInterface library (AIL). MCSC is the main part of the MonitorChain system and is a central point of integration for MonitorChain components. Information from other components flow towards it but primarily, all other stakeholders get data by querying its functions. It serves as an Oracle that can be queried by other smart contracts or off-chain applications to get information about the statuses of specific tokens or blocked addresses. It also controls access to the token statuses and blocked addresses and governs the process of token status changes. Monitor is the component that listens, through a proper Ethereum node endpoint provider, for transaction related events which are submitted to the Ethereum blockchain. For each token transaction that is executed, Monitor performs transaction validation. Validation is based on the general token validation rules which include checking of the considerable total supply increase, transaction of an amount that exceeds sender’s balance, very big token transaction etc. The accounted rules are modeling the exploits that have already been discovered. But it also covers future exploits since it is monitoring the total supply and the transferred amounts of the token.
Given that each token smart contract has its own specific implementation, monitor can perform token specific validation. This can include change of a hard cap value predefined in the contract, violation of the token release rules encoded into the contract, massive transfers from the token reserve addresses etc. Such per token monitoring requires specific token smart contract audit and development of dedicated validation scripts. Based on the level of detected validation error, Monitor sends the status change to MonitorChainSC that includes token address, error level and error description text. Error levels are currently defined in the following way: 0 – Good, 1 – Notice, 2 – Warning, 3 – Severe, 4 – Emergency. Once the problematic transaction has been detected by Monitor, it sends the transaction destination address to MonitorChainSC and spawns the Tracker component. Tracker is responsible for tracking the transaction tree whose root is the detected problematic transaction destination address. During tracking, Tracker triages the involved addresses based on previous transactions of other tokens, interactions with well-known DApps and the transaction amount value to identify whether the address should be blocked. AIL is the helper library that should be utilized by MonitorChain users to access MCSC. It contains two parts, AIL contract, which implements the smart contract functions available for the client and AIL library that enables Node.js developers to call MonitorChain programmatically.
Subscriber Benefits
Tokens and exchanges alike can use MonitorChain to show a commitment to security and fraud reduction. This has the potential to have far ranging benefits beyond direct financial loss mitigation in exploits, but to reduce insurance premiums and even have a positive impact on future governmental regulation, as it would demonstrate that these companies are effective at and dedicated to protecting investors.
In addition to standard protective Monitoring, subscribers to MonitorChain are provided a trust seal to display on their websites to convey trust to users.
Beyond the listed set of features, the MonitorChain team works directly with token creators and exchanges to set custom alert conditions, specific monitoring rules and alert thresholds based on business needs, allowing for complete customization.
Resources and Further Reading
Information for Token Creators and ICOs
Information for Cryptocurrency Traders and Investors