a16z Crypto Calls for DeFi to Shift from "Code is Law" to "Regulation is Law" to Address Vulnerability Crisis

ChainCatcher message, a16z Crypto senior security researcher Daejun Park published an article calling for DeFi protocols to shift from “code is law” to “regulation is law,” adopting more principled security approaches. The specific method involves hardcoding security guarantees through standardized norms and invariant checks, automatically reverting transactions that violate predefined rules. Park pointed out that almost all known vulnerabilities trigger such checks, which are expected to prevent hacker attacks during execution.

According to a Slowmist report, hackers stole over $649 million through code vulnerabilities last year. Even the well-established protocol Balancer, which has been running since 2021, lost $128 million last November due to a code bug. Developers are concerned that hackers are increasingly using AI to find vulnerabilities.

Immunefi security director noted that invariant checks increase gas costs and may drive away users, and are not a panacea. Co-founder of Asymmetric Research stated that many vulnerabilities are difficult to detect with invariant rules that can identify attacks without false positives.