a16z Crypto Calls for DeFi to Shift from “Code is Law” to “Norms are Law” to Address Vulnerability Crisis

a16z Crypto Senior Security Researcher Daejun Park published an article urging DeFi protocols to move from “Code is Law” to “Norms are Law,” adopting more principled security approaches. The specific method involves using standardized norms and invariant checks for hardcoded security guarantees, automatically reverting transactions that violate predefined rules.
Park pointed out that almost all known vulnerabilities trigger such checks, which are expected to prevent hacker attacks during execution. According to Slowmist, last year hackers stole over $649 million through code vulnerabilities. Even the longstanding protocol Balancer, which has been running since 2021, lost $128 million last November due to a code vulnerability. Developers are concerned that hackers are increasingly using AI to find vulnerabilities. Immunefi Security Director noted that invariant checks increase gas costs and may drive away users, and are not a panacea. Co-founder of Asymmetric Research stated that many vulnerabilities are difficult to detect with invariant rules that can both catch attacks and avoid false positives.