Let’s start from the OKX security system and clarify the two major threads of Web3 security.

We cannot talk about safety without its antonym, risk.

Recently, a series of security incidents such as the theft of MIxin and CoinEx and the attack on HTX hot wallet have once again focused investors attention on industry security issues.

According to Paidun statistics, as of September 25, Mixin (loss of US$200 million), Euler Labs (loss of US$197 million, hackers have refunded US$197 million), Vyper/Curve (loss of US$73.6 million, hackers have refunded US$52.3 million), CoinEx ( Loss of $70 million), Atomic Wallet (loss of $65 million), Stake (loss of $41 million), CoinsPaid (loss of $37.7 million), Poly Network (loss of $26 million), low-carb-crusader (loss of $25 million) ), phishing against giant whales (loss of 24 million US dollars) and other top ten hacker attacks, the total losses caused by the top ten hacker attacks were no less than 600 million yuan.

In the dark forest of the crypto world, various risks such as hacking attacks and phishing scams occur all the time.

This article will use OKX, which takes security first as the first principle of product design, as a sample to systematically dismantle the security system of OKX Web3 wallet and OKX CEX, and dig out the security world of Web3 from what the team does, thinks and thinks. Essential question.

When it comes to wallet security, identifying, flagging, and blocking risks in real time is key

According to statistics from the Web3.0 industry security report for the second quarter of 2023 released by CertiK, CertiK discovered a total of 212 security incidents, and hackers and other malicious actors have squeezed $310 million worth of tokens from the Web3.0 industry. This shows the seriousness of the asset security problem on the chain.

Taking the commonly used EOA account of Ethereum as an example, in general, assets can only be transferred if the private key is lost, the approve function is used to authorize a malicious contract, and the permit function is used to sign a malicious currency transfer message.

Regarding the problem of private key loss, on the one hand, it is the loss of mnemonic words caused by human inexperience, which often happens to novices who have just entered the industry; on the other hand, it may be that players log in to phishing websites when receiving airdrops and actively fill in their private keys. Caused by keys and mnemonics. Both situations are very common. Of course, there are also cases where a malicious wallet is downloaded or the computer/mobile phone where the wallet is located is implanted with a Trojan horse program and finally controlled by hackers. However, with today’s mobile phones and computers, you only need to download the software from the regular website and remember If you upgrade to the latest version in a timely manner and have basic network security knowledge, you will be less likely to get caught.

In response to the problem of private key loss caused by lack of human experience, OKX Web3 Wallet helps users avoid risks by launching the MPC private keyless wallet.

The full name of MPC is Multi-Party Computation, which can be simply understood as a multi-signature wallet. OKX Web3 MPC wallet uses MPC technology to fragment the private key into three parts, which are kept by the OKX exchange, user equipment, and cloud backup (iCloud/Google Drive). When creating a wallet, users only need to log in to the OKX APP and select Create an address without a private key wallet, and enable cloud backup to back up the third fragment. There is no need to manually keep the mnemonic, and users need 2/3 fragments to complete signature authorization when using it. All transaction processes will not The private key plain text appears. To a certain extent, it solves the asset security problem caused by the leakage of private keys. In addition, OKX has also set up an emergency escape function for the MPC wallet. When users encounter special situations, they only need to enter the cloud backup password at the emergency exit to quickly obtain the private key and transfer assets, which is safe and convenient.

Security issues related to mnemonic phrases caused by insufficient human experience generally occur among entry-level users. For users with interactive experience, risks mostly occur in the two aspects of approve authorization and permit signature, such as the phishing risks mentioned above.

The approve function is an important part of the on-chain interaction, allowing the contract to call the transferForm function to transfer the assets in the address according to the rules agreed in the contract code. Once approve is authorized to a malicious contract, it will face a greater risk of asset theft.

Signature risks mainly arise from the permit extension function of the erc 20 protocol, which allows users to complete authorization operations by signing messages, and send the signature results to another wallet to complete asset transfer operations. It is common when users use the DEX pending order function. Take 1inchs Fusion function as an example. This function allows users to sign the pending order message. After signing, the user can entrust the assets to 1inch for processing without paying gas, and then 1inch will provide The coin the user wants to buy. During this process, if a website forges malicious messages to get users to sign, the consequences will most likely be regrettable.

Therefore, risk monitoring is particularly important.

The OKX Web3 team has developed an authorization management page. Users can directly check their authorization status on protocols and currencies on this page. At the same time, they can directly cancel authorization on this page to avoid unnecessary risks. For those malicious risk contracts, the OKX Web3 wallet helps users conduct risk detection by accessing the KYT Sky Eye system. Currently, the system contains more than 300 million cryptocurrency addresses and can detect malicious addresses, suspicious transactions (pixiu disk/phishing, etc.) ) to carry out effective risk detection and automatic early warning.

Neil, head of the security architecture of the OKX Web3 team, said that OKX will next perform hierarchical processing of address tags. Whitelist addresses will be processed through ordinary prompts, graylist addresses will be processed through common risk prompts, and blacklist addresses will be intercepted directly. In the future The team will continue to build in various aspects such as risk prevention, risk cleanup, risk coverage, and user education to strengthen the security protection system and unswervingly serve as users security guards.

In fact, in addition to the risks hidden in the interactive environment, the security of the wallet itself is also particularly important. At present, the OKX Web3 wallet has fully open sourced the multi-chain signature SDK, the core algorithm of the MPC private keyless wallet, the AA wallet and the BRC 20-S. The significance of open source code is to make the product transparent and reliable, and to accept the judgment of peers while promoting communication and open collaboration among developers, thereby promoting the development and progress of Web3 technology.

Of course, in addition to various risks on the chain, the systemic risks caused by the collapse of centralized platforms such as FTX are even more worrying.

Regarding CEX security, the focus is on self-regulation and building a strong risk control system

From Fcoin’s disappearance to FTX’s collapse, many CEX platforms have not escaped the curse of collapse in the past few years. The reason is mostly caused by poor internal management under the mismatch between rapid growth and corporate responsibility awareness. Of course, the more fundamental reason lies in human nature.

Therefore, self-restraint and self-regulation have become a must for CEX.

Since the end of last year, leading companies in the industry have launched self-regulation models to improve fund transparency through mechanisms such as POR, and upload user funds to the chain for public disclosure.

According to official information, OKX has issued reserve certificates for 11 consecutive months, and the reserve rates of 22 public currencies have exceeded 100%. Among them, the reserve rates of BTC, ETH, and USDT are 102%, 103%, and 102% respectively. , with a total value of US$11.2 billion, they are one of the few mainstream crypto exchanges in the industry that publishes reserve certificates on a monthly basis. Relevant people said that OKX is committed to improving POR transparency to traditional financial audit standards and will continue to lead the industry in safety and transparency. It has now upgraded the POR system through innovative technologies such as zk-STARK, and users can independently verify OKXs solvency at any time. So far, hundreds of thousands of users have participated in visiting the POR page and completed self-verification.

Talking about the security of CEX, we can never escape the weakness of human nature, but this cannot be overcome in the short term. For ordinary users, they should pay more attention to how to ensure the safety of assets when extreme events occur? For platforms, it is even more necessary to clearly realize that helping users to live alone in a crisis is the core competitiveness.

In the Luna crash incident, the OKX risk control system immediately activated the automatic redemption mechanism to help users participating in UST financial management escape smoothly; in the 3 Commas API data leakage incident, OKX was the only user among the many exchanges it cooperated with to suffer 0 losses. And it is the platform with the most complete security performance. In the face of various tests, OKX has demonstrated excellent quality.

The key to being able to ride through the wind and waves many times is that the OKX team always simulates potential risks in advance and invests a lot of time and energy in the establishment and iteration of the risk control system. The relevant person in charge of the risk control system said: OKXs API system has powerful Fast API functions, IP whitelists, anti-fraud risk control and third-party whitelist functions. These are the core functions of the OKX API risk control system. Even if hackers invade API keys, and keys cannot be easily used. Although users usually cannot perceive the existence of these measures, they always work silently at critical moments.

Indeed, security does not require sexy stories. Its essence lies in whether the platform can maintain a sense of responsibility at all times. This seems to require a fulcrum. The person in charge of risk control said frankly that the fulcrum of OKX’s sense of responsibility lies in the hope of promoting “technology for good” Taking root in Web3.

Back to the essence of security issues

As the industry develops, there will be more and more types of security issues, especially in the current market environment. Many hackers are targeting the encryption world. For security guardians, the challenges they face will also increase. Perhaps only with such a belief can OKX continue to move forward.

By dismantling OKXs security system, we can clearly see its approach and mentality on Web3 security issues. They have figured out the two major threads of the development of the Web3 security world, and have established strong defense lines along the two major threads. .

Although security issues will always come back to whether people are inclined toward good or toward evil, as ordinary users, it is difficult for us to make a distinction. We can only try our best to improve security awareness and choose platforms with great influence as much as possible. The more powerful you are, the more you cherish your own feathers, the more you can maintain your righteous thoughts.