Monad, co-founder with Keone Hon, calls on the encryption community to prioritize security. As attackers gain more powerful AI capabilities, it is essential to share best practices for operational security ( OpSec ). At the same time, we should promote the foundation's open-source tools Ultrafuzz.

• Hon Encourages developers to run Ultrafuzz on their own contracts and enhances operational security.
• The OpSec guidelines for Monad cover phishing, credential management, employee devices, and third-party account permissions.
• Ultrafuzz was open-sourced in September, earlier than Hon's most recent call for the team to use that tool.
• The control hijacking losses cited in the guide include key leakage, supply chain attacks, as well as social engineering.

The resources of Monad Foundation also cover the software deployed by the software team, as well as the accounts, devices, and signature arrangements used to manage this software. Hon guides readers in the post to view Crypto OpSec Bible, guidelines related to administrator accounts, and research on finding vulnerabilities using AI.

He wrote, "In this era where AI empowers attackers, the only way for our industry to move forward is to continue to strengthen our defenses. Security should be the top priority for every team."

The OpSec guide for Monad is aimed at common security mistakes.

Written by Omar, the beginning of “Crypto OpSec Bible” expresses a sense of frustration regarding the recurring intrusion incidents, which involve unfamiliar code, phishing, exposed credentials, and poor device management.

This guide references the Lumos tracker of ChainLight. According to events tracked by this tracker from January 2023 to the statistical cut-off point cited in the guide, the value exploited due to control hijacking amounted to 3.31 billion US dollars, while the value exploited due to smart contract vulnerabilities was 983 million US dollars.

Among them, the categories of control hijack include social engineering, private key leakage, unauthorized access, supply chain attacks, and other traditional security failures. This comparison covers events recorded by the tracker and is presented as a historical snapshot.

Omar believes that encryption organizations still do not place enough emphasis on operational security. His suggestions include separating personal activities from work devices, using clean computers or browsers to handle encryption-related tasks, and checking transaction details before signing.

For critical accounts, the guidelines recommend using hardware security keys and properly saving backups. It is also advised to use unique passwords and to store authentication codes separately from passwords. For organizations, it is recommended to deploy terminal protection measures and to designate a clear contact person for reporting security incidents.

Hon Urges developers to check administrator permissions

For smart contract developers, Hon emphasizes not to rely on external accounts ( EOA ) to act as administrators, and reminds them to use dedicated laptops when signing management functions.

His resource list also includes formal verification as well as research on threat hunting using large language models. In another post, he encourages developers to run Ultrafuzz on their own contracts and mentions the experience with Antonio Viggiano, inviting feedback from the outside community.

Hon writes: "Smart contract developers, please run Ultrafuzz on your contracts!! It is open-source, and anyone can use it."

The open-source announcement for this tool was released on September 10th. Hon's latest posts have once again drawn external attention to this previously released tool, and at the same time, they have also sparked discussions about the operational security resources of the foundation.

Ultrafuzz combines AI investigation with contract testing

Ultrafuzz can be obtained through the public GitHub repository. It coordinates specialized AI agents to review contracts, map user behavior, investigate security attributes, run testing strategies, and organize the findings for review.

Monad indicates that more than 20 iterations of operational support for ecological projects have shaped this release version. This tool supports Solidity and Vyper.

In the technical explanation, Viggiano described the process of developing this tool while assisting a team in preparing for an external security review. Since the project lacked fuzz testing, this led to the creation of a AI auxiliary workflow for generating such tests.

His explanation showed that these agents would identify the conditions that the protocol is supposed to maintain, and then investigate whether specific operations or sequences of operations would undermine those conditions. Subsequently, the findings would be summarized, checked, and compiled into a report.

Monad requires users to run Ultrafuzz on disposable, isolated virtual machines. Its agent has unrestricted permissions, and there are warnings against running this tool on developer workstations or machines that store important credentials.

Recent security incidents have exposed risks related to accounts and software dependencies.

Some previous incidents involved multiple access points covered by this guide.

On October 26th, crypto.news reported that wallet manufacturer Foundation suffered a Cloudflare API key breach, which allowed fraudulent emails appearing to come from their official domain name to be sent. The company has revoked the relevant credentials and stated that the Passport hardware and the funds stored therein are still secure.

In July, there was an incident where the software package of a Injective developer was compromised. Security company Socket stated that malicious code intercepted the wallet generation function and transmitted the private key and mnemonic phrase through forged telemetry. The CEO of Injective, Eric Chen, indicated that the affected versions have been deprecated and the issue has been fixed.

Another survey in July involved OkoBot coin-stealing malware, which was spread through a GitHub repository that pretended to be legitimate software. This operation used false error messages and repair instructions to trick victims into executing malicious commands. Its modules included a forged wallet recovery interface, keyboard monitoring, and clipboard monitoring.