Shima Capital CTO: Reflecting on the Curve incident, why do we need Runtime Protection?

Author: Carl Hua, Partner and CTO at Shima Capital

After the recent Curve reentrancy exploit, I reflected on my experience at JPL NASA, where I learned the key principles for developing reliable and resilient software. These insights are now more important than ever for the crypto industry for the following reasons:

Ultimately, people only really care about two types of software: software that can kill you and software that can cost you money.

In the critical software of any aerospace machine, most of the budget (80%+) is not allocated to development itself, but to integration and testing. If the software fails, the vehicle comes crashing down—fighter jets, drones, spacecraft, etc.

Most of the code in aerospace software (if classified as critical modules) adheres to extremely strict testing/development standards, such as DO-178 B Level A. Not only is every line of code required to be tested, but every logical condition is also specifically tested if there is nested logic.

At JPL NASA, the philosophy of writing advanced aerospace software is not to write the prettiest, cleanest code, but to write code that is easy to unit test. Why? Simply put: when you send a spacecraft into space, you only have one chance, and no one wants to take risks with a high probability of failure. This is similar to the logic of blockchain, as immutable code is a key feature, and we only have one chance to use our funds correctly in each transaction, so why not take the development of dApps more seriously?

Despite strict development, testing, and code auditing processes, these measures are clearly insufficient to mitigate all errors and attacks, as it is nearly impossible to eliminate all runtime errors through testing and auditing. So how do we protect our software from failure?

Runtime Protection

Runtime protection is a security technology that protects software applications from malicious attacks while they are running. Its principle is to perform real-time detection during the actual execution of the code, analyzing the program's actual behavior to protect it from malicious data and attacks.

The runtime protection of highly reliable software requires significant investment and design, as it is the last line of defense to ensure that the software does not enter an unknown state or fail. This is not just a point of argument, but a practice validated over decades.

Today in Web3, I believe DeFi applications require the same high reliability and should consider the same approach. However, due to its potential limitations, the EVM is not designed to handle complex tasks like runtime protection. So how do we provide runtime protection?

One way is through Aspect programming, with Aspects designed by the Artela blockchain network, which can switch execution contexts throughout the lifecycle of any smart contract transaction to perform advanced checks on the program's real-time state. Artela provides a unique design for runtime protection through Aspect and EVM compatibility, which has the potential to become the future foundation for crypto smart contract security.

Artela has published a specific use case of Aspects in preventing Curve reentrancy attacks in the article below, and I hope to engage in discussions together!

“Compiler Vulnerabilities Unsolved? Runtime Protection Achieves On-Chain Risk Control for DeFi”