Web3 is a relatively new technology that promises to greatly improve websites and its underlying application security.The boom and increased acceptance of cryptocurrencies and that of NFTs (Non-Fungible Tokens) has also resulted in web3 projects springing up from every angle, these projects are mostly birthed by startups with great ideas, disrupting the status quo. This article tries to focus on how startups can ensure their project is secure for its users before launch.
It’s always exciting to have an idea and not just any idea but the type that’s thought worthy of funding by Venture Capitalists (VCs) who are willing to invest in the project, but most of the time this excitement could be distracting for these startups who are all about how to deploy quickly and hit the market running, giving less attention to or leaving a key component fall through the cracks, security.
Web3 Applications Security
Web3 applications are mostly decentralised and built on a public blockchain, but then startups are less prepared for the new dangers that comes with launching this applications, as a result the company that can predict and stop most of these potential security issues tend to stay ahead of its competitors. This is because the integrity of the company offering a solution and her customer’s confidence rely heavily on the security of it’s application’s.
Below are a few suggestions on how startups and the web3 community in general providing solutions can better secure their applications.
Security by Design Not Just a Necessity
There is a major difference between doing something out of necessity and doing the same thing because “it’s part of your culture”, so to speak. When web3 application engineers and developers build with security imbibed in there architecture and code they write, they tend to avoid most of the minor and major security breaches.
One mistake some startup blockchain developers make is to rely on audits(more on this later) to help them catch bugs and potential exploits. Audits are great, a priority even, because no one will probably look at or engage with your project (at least, experienced users of web3 projects) until they have seen your smart-contract audit report, but this report alone isn’t enough.
Instead of merely hoping that security flaws are discovered after a final audit, blockchain developers and web3 engineers should understand and have it in mind from the start (without compromising user’s experience) that every block of code is a potential landmine that can be catastrophic, even more so than traditional web2 applications.
As we’ve seen in recent times, reports of web3 project hacks are mostly from code exploits, usually from DeFi (Decentralised Finance) platforms that offer lending services. Examples includes Acala network which got exploited , enabling hackers to mint their stable coin to the whopping amount of 1.2 billion aUSD, the Wormhole DeFi platform hack due to a patch on there GitHub that was yet to be shipped, giving the hackers the ability to walk away with $325 million and then there is Inverse Finance, another Ethereum based DeFi and lending platform that got exploited to the tune of $15.6 million.
Smart Contract Audit
The Blockchain can be secure but not so much can be said about the application running on them. Like we’ve stated earlier, as a startup one of the boxes you must tick for your project is the smart contract audit, this is because most web3 applications interacting with the blockchain are basically smart-contracts. Before jumping into smart-contract audit, let’s have a quick understanding of smart contracts.
What is a Smart Contract?
Unlike traditional contracts written in text (think paper and ink) and agreed upon by all the parties involved by appending signature among other means, smart contracts are self-executing codes (so long the conditions are met) used to facilitate complex data transactions, this can range from Initial Coin Offerings(ICO), supply chain management and lending services among others. This process is automatic as does not require an intermediary it is also immutable, which means it cant be changed after execution.
What is a Smart Contract Audit?
A smart contract audit generally is an extensive examination and study of its underlying code.The goal of these audits is to find and address any flaws, bugs or vulnerabilities in the code that make up the said smart contract.
Before worrying about the cost of carrying out an audit you should know there are basically two types of smart contract auditing process which can be classified into manual code review and automatic code analysis. With manual analysis, the auditors go through every line of code to ensure there are no flaws in relation to compilation error, stack problems and re-entrance mistake. While automatic code analysis has the advantage of being more time saving as well providing faster vulnerability finding.
There are a lot of reputable firms that carry out smart contract audits to ensure your project is in good hands. Examples of such firms include A&D Forensics, being Africa’s leading blockchain intelligence service provider, has smart contract on their list of services, check out the auditing page here. Others include Certik, Chainsulting, openZeppelin among others.
Vulnerability Assessment and Penetration Testing
Security, especially application security, is a continuous process. For a startup in web3 and every other service provider that collects, stores and processes users’ information, one sure way you can never go wrong in securing your application is to not just look at it from the end user’s perspective but also through the eyes of an adversary whose intention is to find vulnerabilities in your application and exploit them.
One might argue that web3 aims to eliminate the need for collection of user details but to a large extent the so called web3 application has a lot of web2 features in them. There is also the issue of business logic vulnerability,basically an attacker having found this flaw which is usually introduced into the application as a result of poor design and implementation, uses it to elicit unintended behaviour. In a nutshell the attacker manipulates legitimate functionality to achieve malicious goals.
What are Vulnerability Assessment and Penetration Testing?
The two aforementioned services are similar but quite different in practice. Vulnerability assessment aims to find potential loopholes that could be exploited by bad actors within a system in a live environment, without going further to exploit those findings. it usually has few false-positives since no proof of concept will be generated. These findings are then put together alongside possible fixes in a report and sent to the client. Vulnerability assessments are mostly achieved with automated tools.
In the case of penetration testing, after finding these vulnerabilities the pen-tester goes ahead to prove that the application is actually vulnerable by exploiting it using those findings. Just like vulnerability assessment, a report describing the process followed to exploit the application and possible fixes is sent to the client.
Education
It’s almost unanimously agreed upon that web3 space is still in its infancy, as a result, a lot of education is needed for web3 engineers on the best practice in terms of blockchain application development as all as end users on the best practice in keeping their information and assets secure. This can come in form of a blog post on how to keep there private key secure, a newsletter on recent security trends or a small carousel on your web3 platform giving the users the recent updates as they unfold etc.
Conclusion
One truth that hasn’t changed since the digital age came to life is that there is no 100% security, web3 application’s inclusive. Having said that, startups in web3 as well as established application and solution providers need to be one thousand and one steps (1001) ahead of bad actors always, this way, the chances of being breached are almost eliminated.
Some of the ways to achieve this as we’ve earlier highlighted is by tasking web3 engineers and developers with taking responsibility for the codes they write, making sure a proper smart contract security audit is done as well as continuous vulnerability assessment and penetration testing, at least twice in a year. Not forgetting education, which is key in keeping the users informed.
Visit A&D Forensics for your smart contract audit here as well as your Vulnerability assessment and penetration testing here.
You made it! Thanks for reading.
