Enforceable Human-Readable Transactions: Can They Prevent Bybit-Style Hacks?

The recent Bybit hack was an eye opener! How they ended up handling the situation was commendable imo. But what if this were to happen yet again?

https://preview.redd.it/kij3pjdiaole1.png?681&format=png&auto=webp&s=a076a72618f5fd0c77596670f89372b6fcc0913a

An ethresear.ch article tackles the topic extensively and provides an interesting potential solution. Essentially, a multi-sig Safe{Wallet} proxy contract was pointed to a malicious contract when signers approved transactions through a compromised UI, failing to properly verify the signature hash on Ledger.

The write up proposes using enforceable human-readable transactions (HRTs) to tackle this vulnerability. The present state of current transaction formats can be opaque and confusing, allowing malicious actors to exploit ambiguities for hacks. HRTs clearly outline trade conditions, ensuring that every transaction is transparent and verifiable by users. This subsequently ensures they see exactly what they’re signing up for, reduces the chance of manipulation by making transactions understandable and enforceable.

The technique is possible when specialized for each application. This specialization allows trusted developers have deep knowledge of their own systems to address the issue at the application level. L2s or Application Specific Rollups such as Cartesi, are ideal infrastructure fits for this approach due to the availability of increased computational power, more blockspace, EIP-712 support, and the libraries available on Linux, able to transform Ethereum encoded content into human readable content.

However, the downside highlighted in the article is it requires two signatures: one for the application and another for Ethereum.

Check out the full article here and let's discuss what you make of this proposal in its entirety? A total game changer, or there are some potential pitfalls to consider?