Curriculum·Graduate·G205
Monitoring, Alerting, and Response
The Ronin bridge, which connected Ethereum to the Axie Infinity sidechain, 23 March 2022, about 624 million dollars. Withdrawals needed five of nine validator signatures, and the attacker controlled five: four run by Sky Mavis and a fifth run by the Axie DAO, which had allowlisted Sky Mavis to sign on its behalf during heavy load in November 2021 and never revoked it.
Lesson 1 opens on
Ronin bridge, 23 March 2022
The Ronin bridge connected Ethereum to Ronin, the sidechain built for the Axie Infinity game. Withdrawals were authorized by five of nine validator signatures. The attacker gained control of five validators, four run by the operator Sky Mavis and a fifth run by the Axie DAO, which in November 2021 had allowlisted Sky Mavis to sign transactions on its behalf during a period of heavy user load; the arrangement ended in December and the allowlist was never revoked.
The lessons
- G205-01What to watch, and the outflow nobody watchedDistinguish a public ledger from a monitored one, and explain why publication is not observationabout 31 min · opens on Ronin bridge, 23 March 2022
- G205-02The compromise that leaves no on-chain traceExplain why some compromises produce no on-chain signal: the drain looks like a legitimate signatureabout 31 min · opens on Slope wallet, 2 August 2022
- G205-03Detection is the longest clockSeparate an incident into three clocks: the attacker's preparation, your detection, and your responseabout 31 min · opens on bZx, 5 November 2021
- G205-04Your runbook when a position is at riskExplain what a runbook is: a set of actions decided before an incident so the response clock is execution, not deliberationabout 31 min · opens on Rari Capital and Fei Protocol Fuse, 30 April 2022