Firewalls: Why They're the Future of Web3 Security | Andrew Beal - Forta

[Music] hey everybody my name is Andy um I'm the head of ecosystem at Florida sound sound okay guys good Danny everybody can hear me perfect okay um so great great presentation on on stable coins um I'm going to transition the conversation and talk about uh security cyber security and specifically uh why firewalls are kind of the the future of of web 3 security um I want to actually start and kind of frame this discussion um by talking about something that happened late last week I assume everyone here is familiar with the attack that happened on on Friday bybit an large exchange um was exploited by some North Korean attackers who among other things uh were able to compromise a a a multi Sig front end and um use a malicious transaction to sort of get assets out of Cold Storage into a hot wallet and then and then uh moved off off the exchange um this was frustrating to watch for a couple reasons um one you know it's it's the latest in a long line of uh of exploits in this industry um but two things like this can be detected in real time and prevented uh If you're sort of taking proper proper measures um the other thing that that happens after events like this too is that um crypto Twitter mobilizes really quickly and starts to monitor the stolen funds as they get laundered um you know across the chain and into other assets and swapped for stable coins and and bridged onto other chains Etc and so the exact same thing happened after the the bit attack watching this this happen unfold in real time is also really frustrating too because um we know that these transactions are going to happen we're watching them happen in real time if this was happening on traditional Financial rails all of these transactions that you know Zach xbc is is highlighting here would be blocked right um no bank would accept these types of transfers because you know that they're malicious and they involved involve stolen funds right um we have the same knowledge uh of the transaction activity in the space we just don't have the mechanisms in place to to block those those malicious transactions um at least not yet so um this is where threat detection uh starts to enable things like like firewalls so when I talk about threat detection I'm talking about the process of identifying and analyzing uh potentially malicious or anomalous transactions um ideally you want to do it in real time and use a combination of of heuristics and Ai and machine learning uh to to help with that so little historical context here uh at Florida we've been doing threat detection for the better part of four years um in November 2021 when we started threat detection in web 3 was virtually non-existent totally sucked um there were a few security shops that were doing it in-house um but it it was not a service or a tool that was available to you as an exchange or a dii protocol or a rollup um last year when I gave a similar presentation about using AI for threat detection in February 2024 threat detection capabilities were a lot better um in 2025 a year later um actually really really good now so there's a lot more Ai and machine learning being used to analyze transactions in real time I'm going to get into exactly how we do that u in a little bit U but generally speaking we can identify most attacks um as they're happening um and it's it's obviously very easy to identify the the transactions that are laundering money sort of post post exploit so this kind of uh begs a question for the industry to answer and we're able to identify threats in real time protocols and chains now have to wrestle with if if I know that the transaction is malicious do I want to accept it um this was not a question that teams had to answer you know two years ago um because we didn't have as much threat intelligence as we have now um but but today teams do need to ask themselves this question and when we talk to our users um and other uh application uh developers and and and rollups out there I've never met a team that said no they didn't want to block that transaction um so practically speaking I think you know there's General consensus that uh preventing exploits and preventing you know post exploit money laundering is is is a good thing regardless of the you know censorship resistant um you know um themes out there so this leads to the sort of the natural conclusion here is let's build firewalls to to to block these transactions the same way we block a lot of malicious you know uh activity on the internet using using web 2 firewalls so real quick just to kind of uh anchor what we're doing at Florida kind of in the context of broader broader firewall um Innovation firewalls have been around in web 2 for 30 plus years they've gone through a number of um uh sort of innovation Cycles started out in the early 90s sort of early internet doing like basic packet filtering absolutely no machine learning at all it was very rudimentary fast forward to you know 2020s and we're using a lot of machine learning to analyze Network and application traffic so in web 3 we get the benefit of the state-of-the-art we get to start with um machine learning and and AI so we we're sort of fast forwarding you know to the to the to the current state of the last 30 years of of uh firewall Innovation so um let's talk about kind of how we plug into I'm going to use a rollup example too just just to kind of paint a picture of where firewalls fit in um so one way to plug in a firewall and we can do this because most rollups today are centralized um there's usually a a single provider to that's running their RPC and their their sequencer um we call these rollup as a service providers or Raz providers um so there's an entity that we can go to to plug into that to that chain so we wrap ourselves around the RPC and we route transaction activity up to the wall so we get all the transaction details we screen it in real time we will usually uh generate a risk score for that transaction so we're screening for a combination of security and compliance risks uh and then we pass that score back to the RPC and that transaction can get dropped if it's if it's too high risk um and if it's okay it'll get passed to the sequencer and into a block we can also move one step down in the transaction flow we can plug into the sequence uh using a proxy and and Screen there too um but the the the flow and the work happening behind the scenes is is exactly the the same all right so current state plugging into into those two areas I think long term um we expect rollups to decentralize over time uh I know base rollups is uh sort of a a Hot Topic today and and a lot of a lot of the large l2s arbitrum optimism base Etc have sort of signaled their support for you know moving to a base rollup model in the future which will allow for more decentralized block building so in that future firewalls can plug in directly to the Builder uh or the validator and you can do all the all the security um screening there okay so a little bit more on on how this detection works so what we do on the back end and when we get a transaction is we first we're going to simulate it we want to understand what the result of that transaction is and simulating will flatten that transaction out so we can see all the logs and all the traces so we need all that context and we'll take that and we'll pass it into our um ml engine um we can also run it against heuristics too which are just sort of you know more kind of rigid rules um and we can risk score those those transactions we take a a stateless approach to this meaning we don't look at any other context we don't look at transaction history uh from that address um we are only looking at it sort of the within the confines of that particular transaction because we need to do these checks really fast if you start looking at other stuff it slows down the analysis and our our in an Ideal World we're running these checks in tens of milliseconds if you start looking at other context or you start having to make you know calls to third party data sources and things like that you you can you just increase the latency a lot and it can it can it can make something that you know should happen in 50 milliseconds take Take 5 seconds so um this is I want to want to show you guys sort of the what it would look like if we were to screen let's say a day's worth of transaction activity on an L2 so real quick what you're seeing here is uh along the along the bottom is a risk score from 0 to one closer it is to one the higher risk it is on the left is just the quantity of transactions on a log scale so um you'll see the vast majority of transactions that we we screen at at the firewall get a 0.0 normal user Behavior really low risk often times just like uh transferring one you know one digital asset from one wall to another a simple eth transfer something like that right a stable coin transfer from one address to another normal user Behavior really low risk um there's usually going to be a much smaller number of transactions on that chain that are more complicated higher dollar amounts there's just more there's going to be more risk associated with that if you see something in the red we think that's an exploit and we want to block that transaction so anything above 08 high risk for us and uh to the extent we're integrated into the rollup that transaction would never make it into a block um here's another test we did over a uh particular block range on base back in April so we did it over this range because we knew there was an exploit that happened in that block range um so similar distribution you'll see you know the vast vast majority of transactions are zero on the the risk threshold but there's one that's um you know a. n it looks like um so that was the exploit transaction so from our standpoint this is what perfect detection looks like all the legitimate transactions make it through the one exploit transaction gets blocked so we prevent that attack okay um just to sort of highlight the impact that firewalls can have um this is data from sort of uh Q4 last year um in the red are uh total value of attacks across those months and in green uh are the dollar value of attacks that could have been detected by uh the the firewall so you'll see vast majority of of exploit activity and funds funds lost um could have been caught by the firewall and prevented so this is why we're so op optimistic about Security Solutions like this okay um historically because firewalls are are a fairly new um are a new tool at least in web 3 the standard approach was uh if there was an attack maybe best case you see it in the men poool and you can front run that attack and maybe pause your protocol or rescue those funds so that's so for the last couple years that's been sort of the the standard uh approach um it doesn't always work you're very susceptible to um Atomic attacks um and private menol transactions right you can't see those so you can't front run them um it's not very effective on l2s because the we don't really have men pools there um and I think the the big thing that I guess the big the big problem that we saw with with pausing is that it just has a much broader kind of impact radius it affects every user on the protocol or the chain if you're pausing a sequencer um and that's not how we deal with attacks in the real world today right we don't shut down a bank because there's a fraudulent transaction right you just want to take action against that particular transaction and that's what we can do with firewalls so uh we think firewalls are just a much more uh a much more effective much more scalable a much more realistic approach to um to to dealing with with attacks okay um I'm going to end with some predictions for 2025 the first is that uh in the next 10 months a firewall will block and an exploit transaction um we're just starting to see firewalls get implemented into uh rollups um and I think over the course of this year you're going to see a lot more l2s adopt adopt firewalls both for security and compliance reasons um so first prediction by the end of the year a firewall is going to block and exploit and I think that will be a watershed moment because then it will it will we'll have the we'll have the public proof point that um that these things are are are really effective second is that um firewalls are going to live primarily at the chain level because it's the easy to integrate there however um protocol teams will be able to opt in and out at will of different types of of screening so you'll be able to customize exactly what you want to do third prediction is that um rollup block building will decentralize I mentioned this earlier um we think rollups will migrate to more you know the based rollup model however um they'll still be able to preserve the ability to impose different security and compliance rules um on the validators and the builders that are that are in charge of uh their blocks and then the last one um firewalls are going to screen the world's onchain transaction flows um and they're going to do it using Ai and and ml um so I think we we expect you know over the next couple years firewalls are going to be screening billions of uh transactions um every day on chain defy Etc um and it's going to be sort of a the same way that firewalls are you know an afterthought in web 2 I I expect them to be an afterthought in in web 3 as well running behind the scenes and you know um both preventing attacks and and sort of helping helping helping teams and chains kind of manage their their risk all right um that's it for me guys thank you so much I'll stick around for a few minutes if anyone has any questions about threat detection or or firewalls or or security more more broadly to my team members are up there in the audience too so you can you can grab them if you're interested in chatting more thanks again have a good week