Evolving Onchain Security: Sui's Strategy for Managing Risk After Deployment

Rethinking Onchain Security

In the ever-shifting landscape of decentralized finance (DeFi), the approach to security must evolve alongside the products it aims to protect. Traditional security methodologies tend to focus on the moment a product is launched, assessing vulnerabilities through audits and reviews without considering how ongoing changes can introduce new risks. This limited view is insufficient in a dynamic environment where applications grow, adapt, and increasingly influence one another.

Building for Resilience

When a DeFi application thrives, it often accumulates more value and establishes new dependencies with other protocols. Unfortunately, this flourishing can introduce complex risks. Security incidents in the DeFi sector, including those linked to Sui, have underlined the necessity for proactive and continuous security evaluation. Incidents have shown that problems can arise not solely from code flaws but from the administrative interfaces or external dependencies that applications rely on.

A Shift in Focus

To address the vulnerabilities exposed by recent incidents, the Sui Foundation has proactively established a $10 million fund for ecosystem security. This initiative aims to bolster security via subsidized audits, enhanced bug bounties, and strengthened defensive tools for monitoring shared infrastructure. The next phase involves transforming these investments into practical tools for developers that can be utilized throughout the application lifecycle, from conception through deployment and beyond.

Understanding Dependencies

In the interconnected world of DeFi, applications are seldom isolated. A lending protocol may rely on multiple components like price feeds and transaction routers, creating a tapestry of dependencies. Consequently, a failure in one application can have cascading effects across multiple services. Effective security must account for not only code vulnerabilities but also governance structures, permissions, and the possibility of outdated data feeds.

Tracking Value Accumulation

To navigate this complexity, Sui’s security solutions focus on tracking dependencies and pinpointing where value congregates within the ecosystem. These insights allow developers to prioritize security measures based on potential impact rather than taking a one-size-fits-all approach. This method of risk assessment enables builders to allocate resources strategically, directing attention to the areas where failures would have the most significant consequences.

Autonomous Transactions and Security Evidence

As applications increasingly operate autonomously—signing transactions and managing assets without human intervention—the importance of up-to-date security evidence is magnified. An agent's actions on the blockchain can evolve rapidly, often relying on information that may no longer be accurate. Therefore, Sui emphasizes the need for security systems that are inherently connected to the actual code being executed and capable of reflecting any changes in real-time.

Four Guiding Principles

Several key principles guide Sui's approach to security in both current and future applications:

• Programming Model: The Move programming model incorporates internal regulations for asset management, significantly reducing the risk of common developmental errors.
• No False Security: While a favorable programming model minimizes potential pitfalls, it’s crucial to recognize that no programming language can guarantee security on its own.
• Audit Limitations: Standard audits provide information about code at the time of review, but real-time linkages between code versions and audit results are necessary for ongoing vigilance.
• Evidence Packaging: When new code modifications occur, builders, institutions, and automated agents must have access to information about previous audits, changes since then, and any emerging vulnerabilities.

Technology and Continuous Improvement

The objective of ongoing security analysis is not to replace traditional audits but to develop a framework that highlights discrepancies between an application’s current state and the conditions at the time of audit. This requires sophisticated monitoring tools that can discern changes in deployed code and transaction behaviors over time. For example, a high-risk application, like a lending market, warrants significantly more scrutiny than a standard leaderboard, necessitating a tailored approach to security oversight.

Beyond Basic Security

While prevention, review, and continuous scrutiny can mitigate risks, they cannot completely eliminate them. Builders remain accountable for the security of their applications and must engage in thorough threat modeling, effective testing, and prompt fixes. The Sui ecosystem aims to simplify the burdens placed on developers, creating an environment where the foundational security infrastructure is readily available and not reliant on disparate service providers.

Holistic Security Infrastructure

Your application should begin with the principles of security before launch and continue to adapt as protocols change and value accumulates within the ecosystem. Comprehensive security does not hinge solely on one-off audits; it involves an understanding of the interconnected relationships within the entire DeFi landscape.

The infrastructure that Sui is currently developing will enhance verification processes, ensuring that the deployed code and published audits correspond accurately, thereby providing critical feedback and insight into ecosystem vulnerabilities. As these tools become available, they will enable builders, auditors, and agents to work with the most current and verifiable data available, drastically improving their ability to assess and respond to risks.

Stay informed on the latest developments and see how security measures are evolving within the Sui ecosystem by visiting the Sui Security Hub.