# Implement Chainalysis and Hypernative Real-Time Monitoring and Incident Response plan for Ajna’s Smart Contracts **URL:** \ **Category:** Grant Proposals\ **Tags:** cycle-2, unsubmitted\ **Created:** [March 26, 2024, 3:17pm UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190 "2024-03-26T15:17:06Z")\ **Posts on this page:** 6\ **Page:** 1
**Author:** ![adi-hypernative](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adi-hypernative](https://forum.ajna.finance/u/adi-hypernative)\ **Post date:** [March 26, 2024, 3:17pm UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/1 "2024-03-26T15:17:06Z")
**[RFC] - `Implement Chainalysis and Hypernative Real-Time Monitoring and Incident Response plan for Ajna’s Smart Contracts`** Summary (TL;DR) This proposal suggests adopting a combined offering of Hypernative and Chainalysis Incident Response to enhance Ajna’s protection against potential hacks or exploits. This initiative benefits Ajna users by safeguarding their funds from potential exploits on Ajna contracts and reducing potential losses in the event of an incident. Hypernative, the leading web 3 security standard for threat prevention and real time monitoring, will provide real-time alerts on exploits that pose threats to Ajna contracts, enabling rapid communication and response to such threats. This capability will empower users to react in real-time to exploits and automatically withdraw their positions. After a hack commences, investigative response time becomes the most critical factor in asset recovery. Chainalysis Incident Response (CIR), the leading crypto asset recovery solution, is an important security measure to have in place to protect Ajna in the event of a hack. **References - Chainalysis** ● Website: [Chainalysis Professional Crypto Investigations & Special Programs 1 ](https://www.chainalysis.com/crypto-investigations-and-special-programs/)● Customer Stories / Customer References: - [Blog post on the Axie Infinity Hack & Successful Asset Recovery: “$30 Million Seized: How the Crypto Community Is Making It Difficult for North Korean Hackers To Profit” 1](https://www.chainalysis.com/blog/axie-infinity-ronin-bridge-dprk-hack-seizure/) - [Twitter Post from Morpho: “Morpho Labs has partnered up with Chainalysis to strengthen the Incident Response Plan for Morpho protocol!”](https://twitter.com/MorphoLabs/status/1645788874592112644) - [Twitter Post from Algorand: “We have engaged Chainalysis to help trace compromised wallet transfers and freeze funds if they are deposited in an exchange that integrates with and acts upon Chainalysis data.” ](https://twitter.com/algofoundation/status/1633212651655274497?s=46&t=uR20NrhfUiRt25xG3G525g)● Source Data: - [Chainalysis: The Chainalysis 2023 Crypto Crime Report, including original data and research into cryptocurrency-based crime.](https://go.chainalysis.com/2023-crypto-crime-report.html) - [Security Intelligence: Cryptocurrency-Related Crime Boomed in 2022](https://securityintelligence.com/news/cryptocurrency-related-crime-boomed-2022/) - [Sharedum: Top 10 DeFi Hacks You Should Know in 2023](https://shardeum.org/blog/defi-hacks/) - [Cointelegraph: DeFi exploits and access control hacks cost crypto investors billions in 2022: Report](https://cointelegraph.com/news/defi-exploits-and-access-control-hacks-cost-crypto-investors-billions-in-2022-report) **References - Hypernative** - Website: [www.hypernative.io](http://www.hypernative.io) - Customer Stories / Customer References: - [x.com](https://twitter.com/RDNTCapital/status/1742638373863325790) - [x.com](https://twitter.com/mwilliammyers/status/1745356262567739485) - [x.com](https://twitter.com/DeusDao/status/1661751727228596226) - [15/04/23 Hundred Finance Hack Post-Mortem | by TerraBellus | Hundred Finance](https://blog.hundred.finance/15-04-23-hundred-finance-hack-post-mortem-d895b618cf33) - [BonqDAO report of the attack on the Bonq protocol on February 1,… — Bonq DAO](https://mirror.xyz/bonqdaoblog.eth/Mq4qgNieUi-ytphYzPU-lWY_E1J2F7STq_xlCR3qGsE) - [x.com](https://twitter.com/senamakel/status/1610953131252416513) - [x.com](https://twitter.com/Palmswaporg/status/1684902587303104512) - [x.com](https://twitter.com/jaypeggerz/status/1608395021031723010) - [x.com](https://twitter.com/0xGreg_/status/1608418111887396864) - [x.com](https://twitter.com/XaveFinance/status/1579735814824931329) - [He stole $200 million. He gave it back. Now, the hacker is explaining why](https://www.coinage.media/s2/he-stole-200-million-he-gave-it-back-now-hes-ready-to-explain-why) **Main Objective** Context: Hackers are stealing more cryptocurrency from DeFi platforms than ever before. In last year’s “Crypto Crime Report,” Chainalysis detailed how DeFi protocols in 2021 became the primary target of crypto hackers. That trend intensified in 2022 and is expected to continue. By the numbers, 2022 was the biggest year ever for crypto hacking, with $3.8B stolen, primarily from DeFi protocols and by North Korea-linked attackers. DeFi protocols as victims accounted for 82.1% of all cryptocurrency stolen by hackers in 2022 — a total of $3.1 billion — up from 73.3% in 2021. As a result, it has become a top priority for DeFi projects to have protection in place above smart contract audits. **Motivation:** The adoption of the combined offering of Hypernative and Chainalysis aims to enhance the security of the Ajna protocol by providing real-time alerts to the community in the event of an attack and ensuring a swift response to exploit incidents. Real-time alerts enable users to respond promptly and automatically to attempted attacks, significantly minimizing the potential for losses. Swift response time is critical for successful asset recovery, as it increases the chance of controlling and reclaiming funds before they are irretrievably lost, such as being transferred to fiat off-ramps or sanctioned exchanges. By adopting the combined offering of Chainalysis CIR and Hypernative, Ajna gains access to a team comprising Chainalysis’ and Hypernative’s professional investigators, cybersecurity experts, and data engineers. This team stands ready to respond immediately in the event of a hack or exploit, thereby enhancing the likelihood of fund recovery. Chainalysis has played a pivotal role in recovering over $11B in stolen funds through their investigations and supported initiatives. Meanwhile, Hypernative successfully saved the entire position for one of its customers in the recent Abracadabra attack, which took place on January 30th, 2024, thanks to accurate and prompt detection and automated actions triggered by the Hypernative system. Today, Hypernative safeguards the funds and digital assets of leading industry players, including Balancer, Circle, Starknet, Zetachain, Linea (Consensys), Galaxy Digital, OlympusDAO, Radiant, Alchemix, Karpatkey DAO, among others. **Scope of Work** 1. Monitoring & Alerts - setup and configure the Hypernative system Objective: Provide a robust monitoring and alert system to assess smart contracts and on-chain holdings for potential security threats or anomalies. **Tasks:** **A. Protocol Security** 1. Reviewing security framework and response procedure, assigning a contact person for various events - Set standard operational procedure (response & contact points) on the category of events and time-sensitivity for any security or operational case. - Provide ongoing monitoring and promptly relay alerts to designated client contacts. - Understand and create post-incident measures. - Automatically notify Chainalysis to label attacker wallets and track stolen funds. **2. Protocol Security Alerts** - Leverage Hypernative zero-day detection modules to detect threats and alerts in real-time on security incidents related to or directed at Ajna Protocol contracts. - Alert and warn the community in real-time regarding anomalies and threats and allow users to automatically withdraw their positions. - Hypernative enables users to create custom monitors, allowing them to set up alerts for specific wallets, whales, events, contract calls, and more. This customization feature empowers users to tailor their monitoring according to their specific requirements. **2. Bridges, and related Tokens** - Bridge Security Monitoring - Related Token Monitoring **3. Phishing and Scamming Detection** - On-chain detection - Detect phishing campaigns targeted at AJNA token holders and provide alerts to warn the community **4. Participants Monitoring** - Monitor suspicious users - Monitor suspicious or illicit activity or illicit funds holdings for protocol participants **5. Protocol Operations Monitoring** - Monitor protocol treasury and wallets - Monitor protocol-defined parameters/invariants **6. OpSec Guidelines** **Objective** : To lead a Web3-specific discussion that ensures the client’s operational security is at its highest standard. **Tasks** : a) Conduct an operational security discussion specific to Web3 threat vectors and assets at risk. b) Create a report detailing potential vulnerabilities, risks, and recommendations of how to improve Web3 specific Operational Security. c) Support the OpSec through quarterly reports of emerging threats and trends and immediate communication of urgent or imminent risks in the market that may be applicable. \*Note: This OpSec review is not intended for the complete technology stack. It is specifically focused on wallets/vaults, access points, community engagement and external social communication. **7. Emergency Response Plan** **Objective** : To help establish a well-defined and actionable crisis management plan to handle potential security breaches or threats. **Tasks** : a) Develop an external communication strategy to inform stakeholders, partners, and users, ensuring accurate information dissemination. b) Create an internal communication protocol to ensure immediate and cohesive action across the team. c) Outline a technical response procedure to identify, isolate, and mitigate threats in real-time. **8. Incident Response** **Objective** : To provide swift action in the event of a security incident, ensuring minimal damage and maximum recovery potential. **Tasks** : a) Trace and attribute unauthorized or suspicious transactions to their source. b) Engage with involved platforms, exchanges, or Web3 entities to assist in obtaining a temporary freeze on suspect funds. c) Provide detailed reports of incidents to assist in legal or organizational action. **9. Recovery Support** **Objective** : To assist clients in the aftermath of a security incident in the fund recovery process. **Tasks** : a) Offer digital forensics services to understand the depth and source of the breach. b) Provide malware disassembly, identifying potential threats and ensuring their removal. c) Aid in the asset recovery process, leveraging relationships with platforms and exchanges. d) Provide recommendations and guidance on post-incident best practices to prevent recurrence. **Specification** The request is to approve a $48K budget expenditure for 12 months, approved and released by the DAO contributors. It includes up to 100 hours of investigative work and support for any hacks or incidents that occur in the covered 12 month period. Approval of this grant shall begin the onboarding process for CIR and Hypernative, and transfer of payment for 12 months of coverage. ---
**Author:** ![Doo\_StableLab](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.ajna.finance/doo_stablelab/32/17_2.png) [@Doo\_StableLab](https://forum.ajna.finance/u/Doo_StableLab)\ **Post date:** [March 27, 2024, 12:11am UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/2 "2024-03-27T00:11:39Z")
Is it related to earlier submission by chainalysis team? ---
**Author:** ![adi-hypernative](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adi-hypernative](https://forum.ajna.finance/u/adi-hypernative)\ **Post date:** [March 27, 2024, 7:00am UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/3 "2024-03-27T07:00:10Z")
Hi, yes, this is a combined offer that includes both Chainalysis CIR and Hypernative solutions to protect Ajna’s contracts. ---
**Author:** ![Davidutro](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.ajna.finance/davidutro/32/8_2.png) [@Davidutro](https://forum.ajna.finance/u/Davidutro)\ **Post date:** [March 27, 2024, 3:39pm UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/4 "2024-03-27T15:39:02Z")
From my understanding this proposal replaces the previous one, which is obsolete now. ---
**Author:** ![adi-hypernative](https://avatars.discourse-cdn.com/v4/letter/a/5daacb/32.png) [@adi-hypernative](https://forum.ajna.finance/u/adi-hypernative)\ **Post date:** [March 27, 2024, 6:17pm UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/5 "2024-03-27T18:17:32Z")
Yes this is correct, this proposal replaces the previous one. ---
**Author:** ![Davidutro](https://yyz1.discourse-cdn.com/flex027/user_avatar/forum.ajna.finance/davidutro/32/8_2.png) [@Davidutro](https://forum.ajna.finance/u/Davidutro)\ **Post date:** [May 2, 2024, 4:49pm UTC](https://forum.ajna.finance/t/implement-chainalysis-and-hypernative-real-time-monitoring-and-incident-response-plan-for-ajna-s-smart-contracts/190/6 "2024-05-02T16:49:24Z")
While I find monitoring for hacks & trying to prevent the hacker from moving funds to be a potentially valuable service for end users. And while I have committed to being an incident response coordinator whether or not this agreement passes, I have a few concerns about this proposal. 1. cost/benefit & missing terms; The original 25k annual cost of this service seemed expensive but still reasonable. The revised 48k annual cost seems unsustainable. given the current AJNA price and purpose of the grant program. If a hack doesn’t occur do we get a large portion of that 48k budget to roll over to next year? Do we get a refund to the treasury? There’s currently no terms set for that. If a hack did occur and it was due to the underlying contracts I’m fairly certain AJNA is done. If it were relaunched it would probably need a rebrand and some additional investment from the original team anyway which cannot be guaranteed. There’s also, in my view, a low likelihood of fund recovery. Ajna is multichain. I don’t think this proposal sets terms or expectations for what networks are covered and whether monitoring, recovery, and investigation spans I get the benefit of giving users a feeling of security by enlisting this service. It could marginally increase TVL/TVB/etc. It could also act as a hack deterrent, but if the exploiter is sophisticated it won’t matter anyway. 1. As mentioned above, my sense of the probability of success for fund recovery is unclear. 2. Opsec Guidelines make little sense Since Ajna is a fully decentralized & live defi protocol it doesn’t make sense to have this service. Shouldn’t it be front ends themselves that are clients for this? If we pay for it via this grant proposal it seems odd to me that specifics are not detailed. Is [ajnafi.com](http://ajnafi.com) covered? [summer.fi](http://summer.fi)? and if they are, do they want this service? This feels like an unnecessary part of the proposal that increases the total cost. In summary, the net benefit is not enough in my eyes and the spend is pretty large in a moment where we have very limited resources.