Looking back: we were watching the right thing, but asking the wrong question
After reading the post-mortem, I went back through this thread and the earlier thread about the first Gateway Address. There is an analytical mistake in our discussion that I think is worth acknowledging.
We were watching the right thing. From the first Gateway Address, we discussed following balance changes, deposits and withdrawals, additional registrations and, later, descriptor or metadata changes, asset movements and other on-chain activity.
But our attention was focused almost entirely on identifying legitimate adoption. In this thread we tried to determine who might be behind the first two Gateway Addresses and what services they represented. Even @Glassmeadow’s brief “Thorchain one of the two” reflected that same direction of inquiry.
We were essentially asking:
Who is using Gateway Addresses, and what are they building?
What we failed to ask was:
What would malicious or abnormal use of a Gateway Address look like?
This is especially striking when rereading @freedomsawp’s September 1 question about the first Gateway Address:
“Do we have any idea who registered this one and what they will be using it for?”
We now know that this was the Gateway Address used by the attacker.
I do not want to rewrite history. Nothing in that question, or in the mere registration of the address, demonstrated that an attack was taking place. I am not claiming that we could have identified the exploit from what we knew then.
But there is a methodological lesson here:
We identified the right object to watch and even described the right evidence to watch for, but we failed to interpret that evidence through an adversarial threat model.
We were watching Gateway for signs of adoption. We should also have been watching it for signs of abuse.
When the new version of Gateway Addresses goes live, I think we should go one step further: not only watch individual addresses and their activity, but also systematically monitor the protocol invariants that must always hold.
The exact invariants will depend on the redesigned Gateway mechanism. But the principle is already clear: do not only watch what Gateway users are doing; watch whether Gateway itself is behaving within its invariants.
That, for me, is the main lesson from rereading these threads.
