[EXAIP-12] Implementation of Pre-Incident Measures for Risk Mitigation and Contract Pausing

• Proposal ID: EXAIP-12
• Proposer: Exactly Core Team
• Date: April 04, 2024

Summary

This proposal aims to implement pre-incident measures within Exactly Protocol's smart contracts to enhance security and risk mitigation capabilities, as outlined in the previously approved EXAIP-07. The objective is to prepare the protocol to react promptly in case of security threats or incidents by enabling the pausing of contracts as part of a comprehensive security framework.

Background

After the approval of EXAIP-07, Exactly Protocol entered into a partnership with Hypernative to improve its security infrastructure and threat prevention capabilities. Hypernative's platform will provide real-time security monitoring, threat detection, and incident response. To effectively leverage this partnership, it is imperative to implement pre-incident measures that allow for the swift mitigation of risks and the ability to pause contracts when necessary.

Proposal

The following actions will be taken to implement pre-incident measures within Exactly Protocol:

• Review and Enhancement of Security Framework:

Conduct a comprehensive review of the existing security framework. Identify potential vulnerabilities and areas of improvement. Enhance the security framework to align with industry best practices and the specific requirements of Exactly Protocol.

• Pre-Incident Measures:

Develop and implement pre-incident measures to mitigate risks in real time. Define specific criteria and thresholds that trigger the activation of these measures. Pre-incident measures may include but are not limited to pausing contracts, limiting or capping protocol functionality, blacklisting addresses, and moving funds to a secure vault for emergencies.

• Contract Pausing Functionality:

Integrate contract pausing functionality into Exactly Protocol's smart contracts. Ensure the pausing mechanism is designed to be activated promptly in response to predefined security triggers. Develop a clear and accessible process for resuming contract functionality once the security threat has been addressed.

Benefits

Implementing pre-incident measures and contract pausing functionality is crucial to the success of EXAIP-07 and the overall security enhancement of Exactly Protocol. These measures will allow the protocol to react swiftly to security threats, minimizing the potential for hacks, exploits, and catastrophic losses. By partnering with Hypernative and implementing these measures, Exactly Protocol aims to establish long-term sustainable growth and security for its community and stakeholders.

Implementation

Enhanced Paused State

The paused state now enacts a total market pause, effectively preventing user operations. This includes preventing the withdrawal of funds, the transfer of market shares, and halting all market activities. Activation of this state is granted to individuals with either the PAUSER_ROLE or the newly established EMERGENCY_ADMIN_ROLE, facilitating a rapid and authorized response to safeguard the market during pivotal moments. The market can only be shifted back to its operational state by the PAUSER_ROLE, a measure designed to control the market’s reactivation post-pause meticulously. This mechanism is particularly valuable in situations like thwarting an attack, where the EMERGENCY_ADMIN_ROLE could be temporarily assigned to a trusted entity such as Hypernative, ensuring a swift response while necessitating deliberate action to resume market operations.

Introduction of the IsFrozen State

With a focus on nuanced market management, the isFrozen state has been implemented to limit new borrows and deposits specifically. This approach allows for precise modulation of market activities, circumventing a full operational freeze and, thus, preserving a degree of user engagement and liquidity. Contrary to the paused state, the isFrozen state does not impede the access to or transfer of existing funds and market shares. Authority over this state is exclusively held by the DEFAULT_ADMIN_ROLE.

Code

• Changes: https://github.com/exactly/protocol/commit/52809e9255bbd82342b00da6af411169bcbdd73c
• Diff: https://github.com/exactly/protocol/compare/d95c0...52809

This diff will be audited by ABDK and Hashlock teams.

Conclusion

In conclusion, implementing pre-incident measures and contract pausing functionalities in EXAIP-12 is a significant stride toward fortifying Exactly Protocol's security and operational resilience. By integrating comprehensive risk mitigation strategies, such as the enhanced paused state and the isFrozen state, the protocol can swiftly and effectively respond to potential security threats. The partnership with Hypernative and the subsequent security enhancements align with the goals outlined in EXAIP-07 and underscore Exactly Protocol’s commitment to safeguarding its ecosystem against unanticipated incidents.