Security
Describes the different security elements within MAYAChain
MAYAChain has several layers of security within the code base to ensure solvency of the network, stability of the protocol and minimize the impact of any exploit. These measures are in addition to human security efforts, see more information here.
Conformation Counting
To project against double-spend attacks and re-orgs (non-instant finality chains), MAYAChain users Conformation counting for specific chains when receiving incoming value. Bifrost informs MAYAChain when to process the incoming value. How many confirmations are required is dependent on the size of the incoming value.
Note, MAYAChain and Binance Beacon Chain have near-instant finality so confirmation counting is not required.
Outbound Transaction Throttling
To prevent large amounts of funds from leaving the network in an instant, large outbound transactions are throttled from immediately leaving the network. Each block has an outbound value limit **** (currently 1000 CACAO worth) and each outbound transaction has a maximum time limit that it can be processed. This has three effects:
Each outbound transaction to compete for the next outbound block, else, it will be processed in the following block, effectively throttling the total outbound capacity of the network. This is independent of conf-counting.
Large outbounds to spread across multiple blocks, up to 720 blocks (approx one hour).
Ensures one large outbound request of $1,000,000 is handled the same as one million $1 outbound requests.
This feature is controlled by several Mimir values that can be changed by Node Operators as required.
This serves as a defensive layer buying time and allowing a vigilant node operator to pause trading or automatically halt checks to engage before the large malicious outbound transaction is irreversibly executed and funds are lost. While the feature negatively impacts the user experience of MAYAChain, but is necessary in ensuring the protection of liquidity provider funds.
The feature is designed to grow as the network grows and is controlled by several Mimir values that can be changed by Node Operators as required. Additionally, the feature is designed to promote bug disclosure instead of directly attacking the network as a bug disclosure is likely more profitable.
MAYAChain has different levels of halt controls within the network which are controlled by Mimir values or by nodes, depending on the type and level.
The halts that can affect an individual **** chain are:
Halt Signing- outbounds que
Halt LP - add/remove stopped, swapping allowed.
Halt Trading - no trading allows
Halt Chain - nodes stop observing that chain
There are also network level halts
Trading halt
To get more information see here.
Automatic Solvency Checker
The solvency checker of the network’s primary vault was introduced to catch issues early or prevent them before they happened. Detected issues can trigger an automatic trading halt on a specific chain. There are two types of automatic solvency checks:
Reactive: The network continually compares the assets the network believes it has in its primary vault (Asgard Vault) to what assets are actually stored in the network’s chain wallets. For every connected chain, each node compares the stored Asgard vault value to each chain Asgard Wallet amount. If the Asgard Vault value is more than the wallet value by 1%, the node reports insolvency for that chain.
Proactive: This mode is more powerful and is intended to catch insolvencies even before they appear. When a node attempts to sign a txOut, it will do a calculation to check if by executing the txOut the vault becomes insolvent. If so, then it refuses to sign and reports insolvency.
Automatic Trading Halting
If more than 66% of nodes, report an insolvency with a chain (reactive or proactive), trading for all assets on that chain is automatically halted (Halt{Chain}Trading). The halt will also emit a security event to ThorSec.
Why 1% difference allowance?
MAYAChain builds an awareness of balances purely by adding the incoming funds, then subtracting the outgoings. Thus the expected balance is the aggregate of the ins and outs. Divergences can occur when actual on-chain balances start to diverge. For gas assets (assets used to pay gas), small divergences can be intermittent, but normally less than +/- 1%.
Secondary Vault Security
Yggdrasil Vaults, the secondary vaults that hold approx 25% of the network funds, are secured by the Node Operators’ bonds and the threat of their bond being slashed 1.5x of any funds they mishandle (e.g steal or attempt to double spend).
Node Operator Triggered Halts
Node Operators have the ability to halt trading within MAYAChain if they detect malicious activity. This is in addition to automatic chain-specific halting functionality. The ability has been made with the potential for abuse in mind.
A single node can pause trading (HaltTrading) for up to an hour (720 blocks). Any additional node that calls for a halt will add 720 blocks to the halt timer. Any node that calls for the resumption of trading removes 720 blocks from the timer. The halt functions can only be called once by each active node per churn cycle (3 days). This gives the network the ability to respond to a malicious threat without giving any node unilateral control.
Unauthorized Transaction Detection
This blanket protection will automatically pause MAYAChain on a specific chain (Halt{Chain}Trading) and stop Yggdrasill vault funding if an unauthorised transaction is detected. This will emit a security event and be sent to MAYASec. The halt will allow Node Operators, MAYASec, and the development team to investigate and react immediately following an unauthorised transaction and issue a fix and restore service as quickly as possible.
Automatic Security Flagging
Security events have been added within the code which automatically emits events when certain conditions are met such as node slashing for unauthorized transactions, attempted double-spending, or very large withdraws. Emitted events are sent to a MAYASec Discord monitoring channel for immediate review. These emitted on-chain events can also be seen on Midgard.
Last updated