The Emerald project ran away with tens of millions of assets and gave you a guide to avoiding risks in EOS DeFi

In the face of huge benefits, the Emerald project party finally chose to run away. Whether it is for EOS DeFi or the entire public chain ecology, it has caused a very bad impact, especially for the EOS ecology. EOS DeFi has just Some achievements, the number of projects is relatively small, 10 fingers can be counted, from the probability point of view, the probability of this accident is a bit high.

Although the ETH and TRON ecosystems often run away, from the market reaction, it seems that everyone is staring at EOS. Once there is a problem with the EOS public chain, it will be infinitely magnified by the market to make a fuss, making it seem that only EOS DeFi has The problem is the same, probably because many people have been hurt by EOS.

But this is no wonder to others, pull is justice, who made the price of EOS so bad, who made EOS a child without a father, the official project B1 is not tough, and EOS can only be bullied, EOS is really a poor child.

secondary title

1. Project level

1. Contract code audit

For the DeFi projects we participate in, the contract codes must at least be audited by security agencies. Common and reliable security audit agencies include SlowMist and Paidun. Generally, projects need to pass cross-audits by two or more security agencies. The more security agencies participate in the cross-audit, the less likely the contract will be vulnerable.

The essence of a smart contract is a piece of code running in the blockchain network, which fulfills the functional requirements submitted by users. After all, the contract code is written by humans, and programs written by humans will inevitably have some errors and defects, so it is necessary for the contract to be audited by a third-party security agency.

After the contract code of the project party is written, the security audit company will conduct a comprehensive inspection of the smart contract, and review the potential security risks of the contract and provide improvement plans to ensure the safety of the smart contract code of the online project. This should be the responsibility of all project parties. What should be done is also the most basic security requirement.

If the contract has not been audited by the security agency, once the contract code has a loophole and is discovered by hackers, the funds in the contract account can easily be stolen by hackers.

Although the code that has been audited by the security agency cannot guarantee that the code is 100% free of loopholes, users still have to rest assured that the audited code is always more reliable than the unaudited one. The contract code of the project party Participating in the audit can at least let us see the attitude of the project party.

Therefore, for a project, the contract must be audited by the security agency, which is the minimum requirement. Correspondingly, users still trust the security audit company.

It is necessary for contracts to be audited by security agencies, but it is not sufficient for asset security. That is, it is the minimum requirement for contracts to be audited by security agencies, but it is definitely not enough to be audited by security agencies. Without the cooperation of other security measures , we must also be very cautious when participating. As the richest man Wang said, we should not blindly believe in auditing.

2. Multi-signature contract account

2. Multi-signature contract account

Whether the contract code is audited by the security agency or the audited code is open source, these are all done at the contract code level. After the contract is audited, hackers are prevented to some extent, but it does not prevent the project party from running away, because the private key of the contract account is in the hands of the project party. If there is no multi-signature setting, the project party can unilaterally transfer Take the assets in the contract account.

If the contract is audited and multi-signature is set, it will of course be much safer. If the contract audit is mainly to prevent hackers, then the multi-signature is mainly to prevent the project party from running away.

For the EOS DeFi project,"Contract audit + multi-signature"It should be a standard configuration. Although this does not guarantee 100% that there will be no accidents, it can at least reduce the probability of accidents to a large extent.

Is it safe if the contract account is set with multi-signature function?

Even if the multi-signature function is enabled on the contract account, it may not necessarily be able to achieve the multi-signature function we want. The key depends on how the multi-signature is set up, just as Mr. Jun of Whale Exchange reminded:

Pay attention to the threshold rules for multi-signature. If the project party can directly or indirectly control the multi-signature to meet the threshold requirements, it can control the account arbitrarily, regardless of other multi-signature parties.

Therefore, even if it is a multi-signature function, you must pay attention to avoiding pitfalls.

1) Open the account permissions to see if the multi-signature settings are reasonable

For the multi-signature setting of the contract account, we still need to open it to see if the setting is reasonable, and to see if there are signs of control or collusion. If the project party can control other signatories, the multi-signature is useless, and it is essentially a cover for defrauding leeks. Don't be fooled by blindfolds.

For example, a multi-signature account has 10 nodes participating in the signature, and the"1+3"The multi-signature mode, that is, the project party and any other 3 parties can sign and agree.

But among these 10 nodes, 3 of them are controlled by the project party, or can collude with the project party, so such multi-signature is meaningless, no matter how many nodes participate in the signature , because no matter how many nodes participate in the signature, as long as you can reach a conspiracy with 3 of them, the other nodes are also decorations.

Therefore, for multi-signature accounts, we need to look at each node participating in the signature to see if they are independent of each other and can be controlled by the project party. Of course, it is difficult to judge, but if the nodes participating in the signature are well-known super nodes in the EOS community, the risk will be greatly reduced. After all, EOS super nodes are relatively reliable. Which super node is Whoever did it is basically public, and people can be found.

At present, the multi-signature settings of Dabao and Dafengshou are quite reasonable.

The multi-signature of Dafengshou adopts"1+3"The model, that is, if Dafengshou wants to change the contract or transfer funds, in addition to Dafengshou's signature name, three other participants need to sign together to perform related operations.

According to the multi-signature settings of Dafengshou, if there is an extreme situation, that is, Dafengshou’s own private key is lost, then the other 5 participants (including b1) can sign together to perform certain operations, which is more clever It also includes b1 of Block one, that is, when the private key of Dafengshou is lost, b1 must participate in the signature to perform related operations. Without the participation of b1, other nodes cannot join together because they cannot reach the threshold. Perform related operations.

Among the accounts participating in Dafengshou multi-signature, in addition to b1, there are Whale Exchange, EOS Canon and TP Wallet. They are all credible and famous nodes in the EOS ecosystem, and they are all independent of each other. The possibility of collusion is basically non-existent. Therefore, Dafengshou’s multi-signature is quite reasonable. I personally think that the number of nodes participating in the signature is a little small, and some more trusted nodes can be added appropriately. If there is an extreme situation such as two nodes that cannot sign, the contract cannot be executed.

Let's look at the multi-signature settings of Defibox again.

Similarly, Defibox also adopts"3+1"In the multi-signature mode, if you want to modify the contract or initiate a transfer operation, in addition to Defibox, three other nodes need to participate in the signature to perform related operations.

The multi-signature setting of Defibox is also reasonable. There are more nodes that have the right to participate in the signature, as many as 11, far more than 5 in Dafengshou. If there are more nodes participating in the signature, it will be more flexible. If some nodes have problems and cannot sign , then you can find other nodes. In short, you only need to gather 3 signatures from the 11 nodes.

In the multi-signature account of Defibox, although there are many nodes that have the right to participate in the signature, it is not just the number of nodes that participate in the signature. These 11 nodes are actually quite representative. For example, the nodes that can participate in the signature are safe Companies, well-known wallets, well-known exchanges, and super nodes, etc., the geographical location of the nodes is relatively scattered, there are domestic nodes and foreign nodes, and the possibility of collusion between nodes is almost non-existent.

Compared with Dabao's multi-signature setting, Dafengshou considers that if its private key is lost, other nodes and B1 can initiate a request, but in the multi-signature setting of defibox, this extreme situation is not considered. If Defibox's own private key is lost, other nodes cannot perform related operations even if they are all united. Because the threshold cannot be reached, I also consulted the staff of Xia Dabao about the multi-signature setting of defibox.

The staff of Dabao replied that not only does defibox have a backup mechanism to ensure that the private key will not be lost, but even if Dabao’s private key is lost, this does not affect the user’s assets, which can be taken away by themselves.

Dabao and Dafengshou’s multi-signature account settings have their own characteristics. It would be even better if the settings of the two can be combined.

2) Whether the contract account of each fund pool has multi-signature settings

For DeFi project parties, they often have multiple contract accounts. For example, taking Defibox as an example, the liquidity pool and the USN stablecoin mortgage contract account are different, so try to check all contract accounts involving assets. See if there is a multi-signature function set up.

secondary title

2. Capital and investment strategy level

When we invest in DeFi projects, no matter what the project is, we should not all in our own funds. There are many projects where the DeFi currency has plummeted by more than 90%. It will be troublesome to stand guard when the price is high.

After a large number of sell-offs by the founder of SUSHI and the emerald project's escape, the market has become more and more rational. Everyone knows that the bubble is very large, and the bubble will burst sooner or later. Just don't be the last The relay one is fine. When a project comes out, don't rush to buy it. You can let Zidan fly for a while, let it fall first, observe more and think more.

In addition to not being all in at the capital level, when choosing a project, you should try to spread your investment as much as possible, and don’t bet all your funds on one project. In the current market, it may be more appropriate to invest in the track. For example, in EOS DeFi, many friends have invested in DFS, BOX and OGX at the same time. Rather than betting on one project, diversification may be a better investment strategy.

Don't pin all your hopes on one project, but diversify your funds into multiple high-quality projects, which may be more suitable for us, and the risks are also dispersed in this way. Because before investing, it is also difficult for us to see which project will eventually be implemented. Everyone is crossing the river by feeling the stones. After all, there is an element of gambling in it.