This article first appeared in Forum, The Edge Malaysia Weekly on June 20, 2022 - June 26, 2022

AI and blockchain systems add a level of risk to the framework of financial risk management that can be categorised as new technological risks that organisations need to be aware of, and updated in the cybersecurity risk framework.

By integrating security into every stage of the digital transformation, we can keep computerised systems safe from cyberthreats. It is imperative that financial risk management spans the entire life cycle, from conception to disposal. Security management is evaluated at certain points called “control gates” or “decision points”.

The organisation must ensure security measures are implemented, security concerns are addressed and risks are understood before moving on to the next life cycle phase. Standards can be continually updated and improved using agile approaches. As part of integrating security, a security planning exercise must be conducted, which should include:

•     Determining the key security roles during the system development process;

•     Identifying key security milestones and documenting activities involved during the process;

•     Integrating secure design, IT architecture and coding standards; and

•     Educating all stakeholders about security performance goals, implications, requirements and considerations.

They demonstrate to stakeholders important aspects of system development and implications of critical decisions made on security so as to prepare for potential security threats.

Among the technological risks associated with decentralised finance (DeFi) applications that can be considered as new security threats are:

1. Oracle risks

Without oracles, a blockchain is entirely self-contained, and it is unaware of any events occurring outside of the local blockchain. (Blockchain oracles are mechanisms that connect blockchains to external systems, enabling smart contracts to operate based on inputs and outputs from the real world.)

Oracles act as a bridge that can digest external and non-deterministic information into a format that a blockchain can understand and execute particular conditions with. It is critical that the DeFi protocols permit certain routine actions, such as liquidations and prediction market settlements, to function correctly by enabling secure, tamper-resistant asset prices.

Oracle risk then arises when protocols rely on these feeds. As they exist today, oracles present the highest risk to DeFi protocols that use them. As a result of the arbitrageurs’ exploits, all on-chain oracles have been vulnerable, causing millions of dollars to be lost. Some oracle services, including Chainlink and Maker, have suffered outages that have had devastating downstream effects.

The greatest threat to DeFi is currently the oracles, since they lack native blockchain capabilities, hardening and resilience. The centralised oracle operator may have all the best intentions, but they are still subject to all the problems that plague centralised systems today such as downtime, DDOS attacks, hacks and incompetence, which put the funds of the users at risk.

2. Protocol governance risks

A smart contract controls an application and is autonomous, so the only risk is related to its programming. A DeFi application is typically more complex than autonomous code. To maintain its financial stability, MakerDAO’s decentralised credit facility relies on an active governance process that proactively adjusts protocol parameters. (MakerDAO is a peer-to-peer organisation that allows people to lend and borrow using cryptocurrencies.) Many DeFi protocols utilise similar systems, which rely on humans to manage protocol risks. In doing so, a new risk is introduced — governance risk — which is unique to the DeFi landscape.

Protocol governance consists of representative or liquid democratic mechanisms. By purchasing rights to the protocol’s governance on a liquid exchange, users and investors are able to participate in the governance process. Following their acquisition by holders, the tokens will be used to determine the direction of the protocol. Despite the fixed supply of government tokens, the protocol is still vulnerable to control by malicious actors due to the risk of attacks on the majority (51%). Traditional fintech companies typically have founders in control, making it unlikely an external party could change the direction of the company.

DeFi, however, is vulnerable to attacks from the moment the governance system is launched. The acquisition of a majority of liquid governance tokens alone can easily enable an adversary to control the protocol and steal funds. There has never been a successful governance attack on an Ethereum-based DeFi project, but a financially capable adversary could exploit a protocol if the incentives were great enough.

3. Smart-contract risks

The inherent properties of blockchains allow them to reduce traditional financial risks, such as counterparty risk. DeFI, however, is based on code. This software foundation provides attackers with a greater attack surface than traditional financial institutions. Due to the open nature of public blockchains, anyone can access and interact with the code after it has been deployed. By storing and transferring blockchain native financial assets, smart contracts present new and unique risks.

By exploiting a logic error in the code, an attacker can withdraw funds beyond the functionality of a smart contract. Such an exploit can take the form of any kind of software bug. Consider a smart contract that is designed to escrow deposits from any ERC-20 user and transfer the entire balance to the winner of a lottery. To determine the amount when transferring tokens, the contract uses its internal number. In our hypothetical case, the bug exists there. Rounding errors may cause the internal number to differ slightly from the actual balance of tokens held by the contract. When transferring, it will transfer “too much” and will fail. As a result, tokens will be functionally locked within the protocol in the absence of a failsafe. They are known as “bricked” funds and can never be retrieved.

Smart contracts are still in their infancy, and complex ones do not yet have the resilience to handle high-value transactions. Smart-contract risk will be a limiting factor in DeFi application adoption, as hesitant users will not trust the contracts they interact with in places where their funds are held.

4. Scaling risks

Ethereum has a throughput of less than 0.1% of Visa, which is capable of processing more than 25,000 transactions per second. Due to Ethereum’s lack of scalability, DeFi may not be able to keep up with demand. Efforts are aimed at increasing Ethereum’s scalability or replacing Ethereum with an alternative blockchain that can handle higher transaction volumes more easily. However, all attempts to date have failed.

In addition to vertical and horizontal scaling, there are two other general ways to increase blockchain throughput. The first is to centralise all transaction processing into one big machine. With a centralised blockchain, such as Ethereum, communication overhead (transactions and blocks) is reduced, but the system is still centralised, with one machine largely responsible for the system’s processing. Using horizontal scaling, however, the system is divided into multiple parts, retaining decentralisation and increasing throughput through parallelisation. Ethereum 2.0 applies this approach in conjunction with a Proof of Stake consensus algorithm.

The field of DeFi is filled with multiple approaches to reduce the scalability risks, but there is no clear winner. The potential impact of applications will be limited as long as DeFi’s growth is limited by blockchain scaling.

The future of financial industries will heavily utilise automation and AI-driven technology integrated to blockchain-based systems to help financial service providers uplift existing processes and realise new revenue streams and business models to serve their customers better. Despite the significant benefit of digital transformation, there are forces, such as cybercriminals and hackers, who will overturn these benefits through forcing system breakdowns, cloud data leakages and so on.

Cybersecurity is one of the top priorities for all institutions due to the rapid evolution of complex technologies, cross-border data exchanges, emerging usage of cloud-based systems and dApps (decentralised applications). When the objectives of financial inclusion are set and rules are framed to achieve them, an effective mechanism must be implemented to make sure that the rules are enforced and observed. Effective enforcement requires a mechanism to detect the violation and proper sanctions to deter anyone from violating the rules, for instance, theft of digital assets. These include implementing defence from unseen aggressors through the mechanism of monitoring, prevention, and protection.

It is mandatory for financial institutions to be capable of developing a resilient cybersecurity framework to be sustainable in the long run. The main function of a vigilant cybersecurity framework is to detect cyberthreats and efficiently respond to breach events. With this adoption of the cybersecurity framework, it will help Islamic financial institutions to minimise financial losses due to business disruption. In relation to this, it is highly recommended for the management to focus on six main areas which are to:

i.     Proactively manage cyber risk, regu  lations and compliance;

ii.     Build and execute a strategic cybersecurity road map;

iii.    Establish commercially reasonable cybersecurity capability;

iv.     Develop world-class cyber and incident response;

v.     Acquire, develop and retain key security talent; and

vi.     Align cybersecurity teams with new technology and business risks.

New tools to fight cybercrime can be developed based on the right cybersecurity framework. With the appropriate tools in place, cyberthreats arising from the digital transformation of the financial sector can be mitigated, thus enabling financial institutions to maximise the potential benefits of digitalisation in the financial sector.

Dr Hazik Mohamed is the managing director of Stellar Consulting Group, global head of FinTech at iFINTELL Business Intelligence Sdn Bhd and FinTech instructor at Sapience Consulting Pte Ltd

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's AppStore and Androids' Google Play.