Skip to content

Commit

Permalink
Update the docs of op-monitorism and op-defender (#52)
Browse files Browse the repository at this point in the history
* Docs: Update + create README needed for the docs.

* Update README.md

* Update README.md

* Fix incorrect links to the docs for `Drippie` and `Secrets`.

* README: update fault docs.

* README: Update the `op-monitorism`

* docs: put the monitors first and explain what they are for.

* docs: update the main intro

* docs: create a table of contents

* Update README.md

* docs: update the ToC.
  • Loading branch information
Ethnical authored Aug 16, 2024
1 parent 0126c80 commit f4fc5a0
Show file tree
Hide file tree
Showing 4 changed files with 257 additions and 19 deletions.
83 changes: 65 additions & 18 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,10 +1,31 @@
- [Monitorism](#monitorism)
- [Monitors Components](#monitors-components)
- [Global Events Monitor](#global-events-monitor)
- [Liveness Expiration Monitor](#liveness-expiration-monitor)
- [Withdrawals Monitor](#withdrawals-monitor)
- [Balances Monitor](#balances-monitor)
- [Fault Monitor](#fault-monitor)
- [Multisig Monitor](#multisig-monitor)
- [Drippie Monitor](#drippie-monitor)
- [Secrets Monitor](#secrets-monitor)
- [Defender Components](#defender-components)
- [HTTP API PSP Executor Service](#http-api-psp-executor-service)
- [CLI & Docs](#cli--docs)
- [Bootstrap](#bootstrap)
- [Command line Options](#command-line-options)

# Monitorism

A blockchain surveillance tool that supports monitoring for the OP Stack and EVM-compatible chains.
_Monitorism_ is a tooling suite that supports monitoring and active remediation actions for the OP Stack chain.

The suite is composed of two main components: `op-monitorism` and `op-defender`, that can be used together or separately and see below for more details.

## Monitors Component
## Monitors Components

The list of all the monitors currently built into monitorism is below.
The `monitors` are passive security service allowing to provide automated monitoring for the OP Stack.
There are components that are designed to make monitoring of the OP stack and alerting on specific events, that could be a sign of a security incident.

The list of all the monitors currently built into `op-monitorism` is below.

### Global Events Monitor

Expand All @@ -24,16 +45,10 @@ The Liveness Expiration Monitor is made for monitoring the liveness expiration o
| `op-monitorism/liveness_expiration` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/liveness_expiration/README.md) |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------- |

### Fault Monitor

The fault monitor checks for changes in output roots posted to the `L2OutputOracle` contract.
On change, reconstructing the output root from a trusted L2 source and looking for a match.

| `op-monitorism/fault` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/fault/README.md) |
| --------------------- | ------------------------------------------------------------------------------------------------- |

### Withdrawals Monitor

![6d5477f5585cb49ff2f8bd147c2e7037772de6a1dd128ce4331596b011ce6ea9](https://github.com/user-attachments/assets/ac5e0a61-b495-4254-b32a-86abf61f0dc1)

The withdrawals monitor checks for new withdrawals that have been proven to the `OptimismPortal` contract.
Each withdrawal is checked against the `L2ToL1MessagePasser` contract.

Expand All @@ -42,13 +57,27 @@ Each withdrawal is checked against the `L2ToL1MessagePasser` contract.

### Balances Monitor

![5cd47a6e0f2fb7d921001db9eea24bb62bb892615011d03f275e02a147823827](https://github.com/user-attachments/assets/44884a76-e06d-4f58-a21f-94c2275e9d8b)

The balances monitor simply emits a metric reporting the balances for the configured accounts.

| `op-monitorism/balances` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/balances/README.md) |
| ------------------------ | ---------------------------------------------------------------------------------------------------- |

### Fault Monitor

<img width="1696" alt="148f61f4600327b94b55be39ca42c58c797d70d7017dbb7d56dbefa208cc7164" src="https://github.com/user-attachments/assets/68ecfaa0-ee6d-46be-b760-a9eb8b232d65">

The fault monitor checks for changes in output roots posted to the `L2OutputOracle` contract.
On change, reconstructing the output root from a trusted L2 source and looking for a match.

| `op-monitorism/fault` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/fault/README.md) |
| --------------------- | ------------------------------------------------------------------------------------------------- |

### Multisig Monitor

![7dab260ee38122980274fee27b114c590405cff2e5a68e6090290ecb786b68f2](https://github.com/user-attachments/assets/0eeb161b-923a-40fd-b561-468df3d5091d)

The multisig monitor reports the paused status of the `OptimismPortal` contract.
If set, the latest nonce of the configued `Safe` address. And also if set, the latest presigned nonce stored in One Password.
The latest presigned nonce is identifyed by looking for items in the configued vault that follow a `ready-<nonce>.json` name.
Expand All @@ -61,22 +90,40 @@ The highest nonce of this item name format is reported.

The drippie monitor tracks the execution and executability of drips within a Drippie contract.

| `op-monitorism/drippie` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/multisig/README.md) |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| `op-monitorism/drippie` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/drippie/README.md) |
| ----------------------- | --------------------------------------------------------------------------------------------------- |

### Secrets Monitor

The secrets monitor takes a Drippie contract as a parameter and monitors for any drips within that contract that use the CheckSecrets dripcheck contract. CheckSecrets is a dripcheck that allows a drip to begin once a specific secret has been revealed (after a delay period) and cancels the drip if a second secret is revealed. It's important to monitor for these secrets being revealed as this could be a sign that the secret storage platform has been compromised and someone is attempting to exflitrate the ETH controlled by that drip.

| `op-monitorism/secrets` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/multisig/README.md) |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
| `op-monitorism/secrets` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/secrets/README.md) |
| ----------------------- | --------------------------------------------------------------------------------------------------- |

## Defender Components

## CLI and Docs
The _defenders_ are active security service allowing to provide automated defense for the OP Stack.
There are components that are designed to make immediate actions onchain/offchain to protect the assets.

The list of all the defender currently built into `op-defender` is below.

### HTTP API PSP Executor Service

![f112841bad84c59ea3ed1ca380740f5694f553de8755b96b1a40ece4d1c26f81](https://github.com/user-attachments/assets/17235e99-bf25-40a5-af2c-a0d9990c6276)

The PSP Executor Service is made for executing PSP onchain faster to increase our readiness and speed in case of incident response.

| `op-defender/psp_executor` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-defender/psp_executor/README.md) |
| -------------------------- | ------------------------------------------------------------------------------------------------------ |

## CLI & Docs

### Bootstrap

## Development
After cloning, please run `./bootstrap.sh` to set up the development environment correctly.

## Intro
### Command line Options

The cli has the ability to spin up a monitor for varying activities, each emmitting metrics used to setup alerts.

```
Expand Down
23 changes: 22 additions & 1 deletion op-defender/README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# Defender
# Defenders

_op-defender_ is an active security service allowing to provide automated defense for the OP Stack.

Expand Down Expand Up @@ -27,6 +27,27 @@ GLOBAL OPTIONS:
--version, -v print the version
```

Each _defender_ has some common configuration, configurable both via cli or env with defaults.

```bash
OPTIONS:
--rpc-url value Node URL of a peer (default: "http://127.0.0.1:8545") [$PSPEXECUTOR_MON_NODE_URL]
--privatekey value Private key of the account that will issue the pause () [$PSPEXECUTOR_MON_PRIVATE_KEY]
--receiver.address value The receiver address of the pause request. [$PSPEXECUTOR_MON_RECEIVER_ADDRESS]
--port.api value Port of the API server you want to listen on (e.g. 8080). (default: "8080") [$PSPEXECUTOR_MON_PORT_API]
--data value calldata to execute the pause on mainnet with the signatures. [$PSPEXECUTOR_MON_CALLDATA]
--log.level value The lowest log level that will be output (default: INFO) [$MONITORISM_LOG_LEVEL]
--log.format value Format the log output. Supported formats: 'text', 'terminal', 'logfmt', 'json', 'json-pretty', (default: text) [$MONITORISM_LOG_FORMAT]
--log.color Color the log output if in terminal mode (default: false) [$MONITORISM_LOG_COLOR]
--metrics.enabled Enable the metrics server (default: false) [$MONITORISM_METRICS_ENABLED]
--metrics.addr value Metrics listening address (default: "0.0.0.0") [$MONITORISM_METRICS_ADDR]
--metrics.port value Metrics listening port (default: 7300) [$MONITORISM_METRICS_PORT]
--loop.interval.msec value Loop interval of the monitor in milliseconds (default: 60000) [$MONITORISM_LOOP_INTERVAL_MSEC]
--help, -h show help


```
### PSP Executor Service
![f112841bad84c59ea3ed1ca380740f5694f553de8755b96b1a40ece4d1c26f81](https://github.com/user-attachments/assets/17235e99-bf25-40a5-af2c-a0d9990c6276)
Expand Down
24 changes: 24 additions & 0 deletions op-defender/psp_executor/README.md
Original file line number Diff line number Diff line change
Expand Up @@ -6,6 +6,10 @@ The service is design to listen on a port and execute a PSP onchain when a reque

⚠️ The service as to use a authentification method before calling this API ⚠️

### Options and Configuration

The current options are the following:

```
OPTIONS:
--rpc-url value Node URL of a peer (default: "http://127.0.0.1:8545") [$PSPEXECUTOR_MON_NODE_URL]
Expand All @@ -22,3 +26,23 @@ OPTIONS:
--loop.interval.msec value Loop interval of the monitor in milliseconds (default: 60000) [$MONITORISM_LOOP_INTERVAL_MSEC]
--help, -h show help
```

## Usage
### HTTP API service
To start the HTTP API service we can use the following oneliner command:
![f112841bad84c59ea3ed1ca380740f5694f553de8755b96b1a40ece4d1c26f81](https://github.com/user-attachments/assets/17235e99-bf25-40a5-af2c-a0d9990c6276)

```shell
go run ../cmd/defender psp_executor --privatekey XXXXXX --receiver.address 0xDEADBEEFDEADBEEFDEADBEEFDEADBEEFDEADBEEF --rpc.url http://localhost:8545 --port.api 8080
```

### cURL HTTP API

To use the HTTP API you can use the following `curl` command:

![image](https://github.com/user-attachments/assets/3edc2ee5-6dfd-4872-9bc6-e3ead7444a96)

```bash
curl -X POST http://${HTTP_API_PSP}:${PORT}/api/psp_execution \-H "Content-Type: application/json" \-d '{"pause": true, "timestamp": 1719432011, "operator": "Tom"}'
```

146 changes: 146 additions & 0 deletions op-monitorism/README.md
Original file line number Diff line number Diff line change
@@ -0,0 +1,146 @@
# Monitors

`op-monitorism` is a collection of monitoring tools for the OP stack. Each monitor is designed to track a specific aspect of the Optimism stack and emit metrics that can be used to set up alerts.

The following the commands are currently available:

```bash
NAME:
Monitorism - OP Stack Monitoring

USAGE:
Monitorism [global options] command [command options]

VERSION:
0.1.0-unstable

DESCRIPTION:
OP Stack Monitoring

COMMANDS:
multisig Monitors OptimismPortal pause status, Safe nonce, and Pre-Signed nonce stored in 1Password
fault Monitors output roots posted on L1 against L2
withdrawals Monitors proven withdrawals on L1 against L2
balances Monitors account balances
drippie Monitors Drippie contract
secrets Monitors secrets revealed in the CheckSecrets dripcheck
global_events Monitors global events with YAML configuration
liveness_expiration Monitor the liveness expiration on Gnosis Safe.
version Show version
help, h Shows a list of commands or help for one command

GLOBAL OPTIONS:
--help, -h show help
--version, -v print the version
```

Each _monitor_ has some common configuration, configurable both via cli or env with defaults.

```bash
OPTIONS:
--log.level value [$MONITORISM_LOG_LEVEL] The lowest log level that will be output (default: INFO)
--log.format value [$MONITORISM_LOG_FORMAT] Format the log output. Supported formats: 'text', 'terminal', 'logfmt', 'json', 'json-pretty', (default: text)
--log.color [$MONITORISM_LOG_COLOR] Color the log output if in terminal mode (default: false)
--metrics.enabled [$MONITORISM_METRICS_ENABLED] Enable the metrics server (default: false)
--metrics.addr value [$MONITORISM_METRICS_ADDR] Metrics listening address (default: "0.0.0.0")
--metrics.port value [$MONITORISM_METRICS_PORT] Metrics listening port (default: 7300)
--loop.interval.msec value [$MONITORISM_LOOP_INTERVAL_MSEC] Loop interval of the monitor in milliseconds (default: 60000)
```
### Liveness Expiration Monitor
![ab27497cea05fbd51b7b1c2ecde5bc69307ac0f27349f6bba4f3f21423116071](https://github.com/ethereum-optimism/monitorism/assets/23560242/af7a7e29-fff5-4df3-82f0-94c2f28fde84)
The Liveness Expiration Monitor is made for monitoring the liveness expiration on Safes.
| `op-monitorism/liveness_expiration` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/liveness_expiration/README.md) |
| ----------------------------------- | --------------------------------------------------------------------------------------------------------------- |
### Withdrawals Monitor
![6d5477f5585cb49ff2f8bd147c2e7037772de6a1dd128ce4331596b011ce6ea9](https://github.com/user-attachments/assets/ac5e0a61-b495-4254-b32a-86abf61f0dc1)
The withdrawals monitor checks for new withdrawals that have been proven to the `OptimismPortal` contract.
Each withdrawal is checked against the `L2ToL1MessagePasser` contract.
| `op-monitorism/withdrawals` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/withdrawals/README.md) |
| --------------------------- | ------------------------------------------------------------------------------------------------------- |
### Balances Monitor
![5cd47a6e0f2fb7d921001db9eea24bb62bb892615011d03f275e02a147823827](https://github.com/user-attachments/assets/44884a76-e06d-4f58-a21f-94c2275e9d8b)
The balances monitor simply emits a metric reporting the balances for the configured accounts.
| `op-monitorism/balances` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/balances/README.md) |
| ------------------------ | ---------------------------------------------------------------------------------------------------- |
### Fault Monitor
<img width="1696" alt="148f61f4600327b94b55be39ca42c58c797d70d7017dbb7d56dbefa208cc7164" src="https://github.com/user-attachments/assets/68ecfaa0-ee6d-46be-b760-a9eb8b232d65">
The fault monitor checks for changes in output roots posted to the `L2OutputOracle` contract.
On change, reconstructing the output root from a trusted L2 source and looking for a match.
| `op-monitorism/fault` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/fault/README.md) |
| --------------------- | ------------------------------------------------------------------------------------------------- |
### Multisig Monitor
![7dab260ee38122980274fee27b114c590405cff2e5a68e6090290ecb786b68f2](https://github.com/user-attachments/assets/0eeb161b-923a-40fd-b561-468df3d5091d)
The multisig monitor reports the paused status of the `OptimismPortal` contract.
If set, the latest nonce of the configued `Safe` address. And also if set, the latest presigned nonce stored in One Password.
The latest presigned nonce is identifyed by looking for items in the configued vault that follow a `ready-<nonce>.json` name.
The highest nonce of this item name format is reported.
| `op-monitorism/multisig` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/multisig/README.md) |
| ------------------------ | ---------------------------------------------------------------------------------------------------- |
### Drippie Monitor
The drippie monitor tracks the execution and executability of drips within a Drippie contract.
| `op-monitorism/drippie` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/drippie/README.md) |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
### Secrets Monitor
The secrets monitor takes a Drippie contract as a parameter and monitors for any drips within that contract that use the CheckSecrets dripcheck contract. CheckSecrets is a dripcheck that allows a drip to begin once a specific secret has been revealed (after a delay period) and cancels the drip if a second secret is revealed. It's important to monitor for these secrets being revealed as this could be a sign that the secret storage platform has been compromised and someone is attempting to exflitrate the ETH controlled by that drip.
| `op-monitorism/secrets` | [README](https://github.com/ethereum-optimism/monitorism/blob/main/op-monitorism/secrets/README.md) |
| ----------------------- | ---------------------------------------------------------------------------------------------------- |
## CLI and Docs
## Development
After cloning, please run `./bootstrap.sh` to set up the development environment correctly.
## Intro
The cli has the ability to spin up a monitor for varying activities, each emmitting metrics used to setup alerts.
```
COMMANDS:
multisig Monitors OptimismPortal pause status, Safe nonce, and Pre-Signed nonce stored in 1Password
fault Monitors output roots posted on L1 against L2
withdrawals Monitors proven withdrawals on L1 against L2
balances Monitors account balances
secrets Monitors secrets revealed in the CheckSecrets dripcheck
```
Each monitor has some common configuration, configurable both via cli or env with defaults.
```
OPTIONS:
--log.level value [$MONITORISM_LOG_LEVEL] The lowest log level that will be output (default: INFO)
--log.format value [$MONITORISM_LOG_FORMAT] Format the log output. Supported formats: 'text', 'terminal', 'logfmt', 'json', 'json-pretty', (default: text)
--log.color [$MONITORISM_LOG_COLOR] Color the log output if in terminal mode (default: false)
--metrics.enabled [$MONITORISM_METRICS_ENABLED] Enable the metrics server (default: false)
--metrics.addr value [$MONITORISM_METRICS_ADDR] Metrics listening address (default: "0.0.0.0")
--metrics.port value [$MONITORISM_METRICS_PORT] Metrics listening port (default: 7300)
--loop.interval.msec value [$MONITORISM_LOOP_INTERVAL_MSEC] Loop interval of the monitor in milliseconds (default: 60000)
```

0 comments on commit f4fc5a0

Please sign in to comment.