Techniques for cosigning blockchain transactions

1 . A method for preventing blind signing attacks by configuring a policy-enforcing cosigner as a signer in a main multisignature (multisig) wallet, comprising:

selecting, by the policy-enforcing cosigner executed in the main multisig wallet, a blockchain transaction from a multisig transaction queue of the main multisig wallet;

processing, by a security engine connected to the policy-enforcing cosigner, the blockchain transaction through simulation and security validation to determine whether the blockchain transaction is valid, wherein the simulation comprises executing transaction logic in at least one of a sandbox execution environment and an emulator that replicates a target blockchain state, and generating predicted state changes resulting from the blockchain transaction, and further wherein the security validation comprises performing, by the security engine, at least one of static code analysis of call data associated with the blockchain transaction and dynamic analysis of simulated execution to detect a predefined threat condition;

signing, by the policy-enforcing cosigner, the blockchain transaction when the blockchain transaction is determined to be valid; and

withholding a signature for the blockchain transaction when the blockchain transaction is determined to be invalid, wherein the policy-enforcing cosigner is configured as a required signer of the main multisig wallet, such that the blockchain transaction cannot be executed without a signature associated with the policy-enforcing cosigner.

2 . The method of claim 1 , further comprising:

providing, by the policy-enforcing consigner, a signature for the blockchain transaction after the signature was withheld, in response to approval by a user.

3 . The method of claim 2 , further comprising:

providing, by an independent signer operated under control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the blockchain transaction has been simulated and security-validated by the security engine; and

providing, by a dependent signer operated under the control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the user approval.

4 . The method of claim 3 , further comprising:

configuring the policy-enforcing cosigner as a dedicated wallet in a 1-2 threshold configuration.

5 . The method of claim 1 , further comprising:

configuring the policy-enforcing cosigner to be addressed as a single signer on the blockchain in a signer set of the main multisig wallet.

6 . The method of claim 5 , further comprising:

providing, by an independent signer operated under control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the blockchain transaction has been simulated and security-validated by the security engine; and

providing, by a dependent signer operated under the control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the user approval, wherein each of the independent signer and the dependent signer is on an isolated signing path associated with the single signer address of the policy-enforcing cosigner on the blockchain.

7 . The method of claim 5 , further comprising:

executing, by a multisig smart contract of the main multisig wallet, the blockchain transaction only upon validating satisfaction of a quorum threshold and a presence of the signature associated with the policy-enforcing cosigner.

8 . The method of claim 1 , further comprising:

cryptographically signing, by the security engine, at least one output of the simulation and the security validation; and

storing the cryptographically signed output for audit and/or compliance review.

9 . The method of claim 1 , further comprising:

performing the simulation off-chain, wherein the off-chain simulation includes at least one of heuristic analysis, behavioral analysis, threat-intelligence testing, and validating the blockchain transaction against a set of rules.

10 . The method of claim 1 , further comprising:

performing both static code analysis of the call data and dynamic analysis of simulated execution to identify one or more threats including at least one of access-control failures, gas exhaustion, and arithmetic errors.

11 . The method of claim 1 , wherein the security validation comprises:

validating the blockchain transaction against a set of malicious websites maintained by the security engine.

12 . The method of claim 1 , wherein the main multisig wallet is any one of: a standard cryptocurrency wallet and a multi-party computation (MPC) cryptocurrency wallet.

13 . A non-transitory computer-readable medium storing a set of instructions for preventing blind signing attacks by configuring a policy-enforcing cosigner as a signer in a main multisignature (multisig) wallet, the set of instructions comprising:

one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:

select, by the policy-enforcing cosigner executed in the main multisig wallet, a blockchain transaction from a multisig transaction queue of the main multisig wallet;

process, by a security engine connected to the policy-enforcing cosigner, the blockchain transaction through simulation and security validation to determine whether the blockchain transaction is valid, wherein the simulation comprises executing transaction logic in at least one of a sandbox execution environment and an emulator that replicates a target blockchain state, and generating predicted state changes resulting from the blockchain transaction, and further wherein the security validation comprises performing, by the security engine, at least one of static code analysis of call data associated with the blockchain transaction and dynamic analysis of simulated execution to detect a predefined threat condition;

sign, by the policy-enforcing cosigner, the blockchain transaction when the blockchain transaction is determined to be valid; and

withhold a signature for the blockchain transaction when the blockchain transaction is determined to be invalid, wherein the policy-enforcing cosigner is configured as a required signer of the main multisig wallet, such that the blockchain transaction cannot be executed without a signature associated with the policy-enforcing cosigner.

14 . A system for preventing blind signing attacks by configuring a policy-enforcing cosigner as a signer in a main multisignature (multisig) wallet comprising:

a processing circuitry;

a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:

select, by the policy-enforcing cosigner executed in the main multisig wallet, a blockchain transaction from a multisig transaction queue of the main multisig wallet;

process, by a security engine connected to the policy-enforcing cosigner, the blockchain transaction through simulation and security validation to determine whether the blockchain transaction is valid, wherein the simulation comprises executing transaction logic in at least one of a sandbox execution environment and an emulator that replicates a target blockchain state, and generating predicted state changes resulting from the blockchain transaction, and further wherein the security validation comprises performing, by the security engine, at least one of static code analysis of call data associated with the blockchain transaction and dynamic analysis of simulated execution to detect a predefined threat condition;

sign, by the policy-enforcing cosigner, the blockchain transaction when the blockchain transaction is determined to be valid; and

withhold a signature for the blockchain transaction when the blockchain transaction is determined to be invalid, wherein the policy-enforcing cosigner is configured as a required signer of the main multisig wallet, such that the blockchain transaction cannot be executed without a signature associated with the policy-enforcing cosigner.

15 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

provide, by the policy-enforcing consigner, a signature for the blockchain transaction after the signature was withheld, in response to approval by a user.

16 . The system of claim 15 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

provide, by an independent signer operated under control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the blockchain transaction has been simulated and security-validated by the security engine; and

provide, by a dependent signer operated under the control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the user approval.

17 . The system of claim 16 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the policy-enforcing cosigner as a dedicated wallet in a 1-2 threshold configuration.

18 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

configure the policy-enforcing cosigner to be addressed as a single signer on the blockchain in a signer set of the main multisig wallet.

19 . The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

provide, by an independent signer operated under control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the blockchain transaction has been simulated and security-validated by the security engine; and

provide, by a dependent signer operated under the control of the policy-enforcing cosigner, the signature for the blockchain transaction only after the user approval, wherein each of the independent signer and the dependent signer is on an isolated signing path associated with the single signer address of the policy-enforcing cosigner on the blockchain.

20 . The system of claim 18 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

execute, by a multisig smart contract of the main multisig wallet, the blockchain transaction only upon validating satisfaction of a quorum threshold and a presence of the signature associated with the policy-enforcing cosigner.

21 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

cryptographically sign, by the security engine, at least one output of the simulation and the security validation; and

store the cryptographically signed output for audit and/or compliance review.

22 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

perform the simulation off-chain, wherein the off-chain simulation includes at least one of heuristic analysis, behavioral analysis, threat-intelligence testing, and validating the blockchain transaction against a set of rules.

23 . The system of claim 14 , wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to:

perform both static code analysis of the call data and dynamic analysis of simulated execution to identify one or more threats including at least one of access-control failures, gas exhaustion, and arithmetic errors.

24 . The system of claim 14 , wherein the security validation comprises:

validate the blockchain transaction against a set of malicious websites maintained by the security engine.

25 . The system of claim 14 , wherein the main multisig wallet is any one of:

a standard cryptocurrency wallet and a multi-party computation (MPC) cryptocurrency wallet.