a16z Crypto Urges a Paradigm Shift in DeFi Security

"Code is law → Standards are law"… Proposal to block hacking beforehand using immutability testing.

Global venture capital firm a16z Crypto has called for a security paradigm shift for decentralized finance (DeFi) protocols. With $650 million leaked due to code vulnerabilities last year alone, the firm argues that a fundamental shift in security approaches is necessary.

From “code is law” to “norms are law”

In a recent article, Daejun Park, a senior blockchain security researcher at a16z Crypto, argued that decentralized finance (DeFi) protocols need to shift from “code is law” to “spec is law.”

Researcher Park proposed adopting a more principled security approach, specifically hardcoding security guarantees through standardized norms and invariant checks, and automatically reverting transactions that violate predefined rules.

"Almost all known vulnerabilities can be detected through these checks, and hacks can be blocked at runtime," he explained.

Last year's code vulnerability damages approached $650 million.

According to a Slowmist report, hackers stole more than $649 million last year through code vulnerabilities.

Even Balancer, a veteran protocol that has been in operation since 2021, suffered a $128 million loss due to a code vulnerability in November of last year. Developers are concerned that hackers are increasingly using artificial intelligence (AI) to find vulnerabilities.

The DeFi ecosystem has long regarded smart contract code itself as absolute rule, under the principle that "code is law." However, a series of large-scale hacking incidents have clearly exposed the limitations of this approach.

Some also raise concerns, saying, "It's not a panacea."

However, some in the industry are cautiously optimistic that invariance testing is not a panacea.

"Immunity checks are not a panacea," said Immunefi's head of security, adding that they "could increase gas costs and drive away users."

"For many vulnerabilities, it's difficult to write invariant rules that detect attacks without generating false positives," said the co-founder of Asymmetric Research.

Nevertheless, there is industry-wide agreement that a fundamental shift in approach is needed to strengthen DeFi security, and a16z Crypto's proposal is expected to serve as an important starting point for future discussions on DeFi security standards.

Joohoon Choi joohoon@blockstreet.co.kr