Skip links

How to Secure Web3 Applications: A Focus on Startups

Web3 is a relatively new technology that promises to greatly improve websites and its underlying application security.The boom and increased acceptance of cryptocurrencies and that of NFTs (Non-Fungible Tokens) has also resulted in web3 projects springing up from every angle, these projects are mostly birthed by startups with great ideas, disrupting the status quo. This article tries to focus on how startups can ensure their project is secure for its users before launch.

Web3 application security

It’s always exciting to have an idea and not just any idea but the type that’s thought worthy of funding by Venture Capitalists (VCs) who are willing to invest in the project, but most of the time this excitement could be distracting for these startups who are all about how to deploy quickly and hit the market running, giving less attention to or leaving a key component fall through the cracks, security.

Web3 Applications Security

Web3 applications are mostly decentralised and built on a public blockchain, but then startups are less prepared for the new dangers that comes with launching this applications, as a result the company that can predict and stop most of these potential security issues tend to stay ahead of its competitors. This is because the integrity of the company offering a solution and her customer’s confidence rely heavily on the security of it’s application’s. 

Below are a few suggestions on how startups and the web3 community in general providing solutions can better secure their applications.

Security by Design Not Just a Necessity

There is a major difference between doing something out of necessity and doing the same thing because “it’s part of your culture”, so to speak. When web3 application engineers and developers build with security imbibed in there architecture and code they write, they tend to avoid most of the minor and major security breaches.

One mistake some startup blockchain developers make is to rely on audits(more on this later) to help them catch bugs and potential exploits. Audits are great, a priority even, because no one will probably look at or engage with your project (at least, experienced users of web3 projects) until they have seen your smart-contract audit report, but this report alone isn’t enough. 

Instead of merely hoping that security flaws are discovered after a final audit, blockchain developers and web3 engineers should understand and have it in mind from the start (without compromising user’s experience) that every block of code is a potential landmine that can be catastrophic, even more so than traditional web2 applications.

 As we’ve seen in recent times, reports of web3 project hacks are mostly from code exploits, usually from DeFi (Decentralised Finance) platforms that offer lending services. Examples includes Acala network which got exploited , enabling hackers to mint their stable coin to the whopping amount of 1.2 billion aUSD, the Wormhole DeFi platform hack due to a patch on there GitHub that was yet to be shipped, giving the hackers the ability to walk away with $325 million and then there is Inverse Finance, another Ethereum based DeFi and lending platform that got exploited to the tune of $15.6 million.

Smart Contract Audit

The Blockchain can be secure but not so much can be said about the application running on them. Like we’ve stated earlier, as a startup one of the boxes you must tick for your project is the smart contract audit, this is because most web3 applications interacting with the blockchain are basically smart-contracts. Before jumping into smart-contract audit, let’s have a quick understanding of smart contracts.

smart contract process

What is a Smart Contract?

Unlike traditional contracts written in text (think paper and ink) and agreed upon by all the parties involved by appending signature among other means, smart contracts are self-executing codes (so long the conditions are met) used to facilitate complex data transactions, this can range from Initial Coin Offerings(ICO), supply chain management and lending services among others. This process is automatic as does not require an intermediary it is also immutable, which means it cant be changed after execution.

What is a Smart Contract Audit?

A smart contract audit generally is an extensive examination and study of its underlying code.The goal of these audits is to find and address any flaws, bugs or vulnerabilities in the code that make up the said smart contract.

Before worrying about the cost of carrying out an audit you should know there are basically two types of smart contract auditing process which can be classified into manual code review and automatic code analysis. With manual analysis, the auditors go through every line of code to ensure there are no flaws in relation to compilation error, stack problems and re-entrance mistake. While automatic code analysis has the advantage of being more time saving as well providing faster vulnerability finding.

There are a lot of reputable firms that carry out smart contract audits to ensure your project is in good hands. Examples of such firms include A&D Forensics, being Africa’s leading blockchain intelligence service provider, has smart contract on their list of services, check out the auditing page here. Others include Certik, Chainsulting, openZeppelin among others.

Vulnerability Assessment and  Penetration Testing

Vulnerability Assessment

Security, especially application security, is a continuous process. For a startup in web3 and every other service provider that collects, stores and processes users’ information, one sure way you can never go wrong in securing your application is to not just look at it from the end user’s perspective but also through the eyes of an adversary whose intention is to find vulnerabilities in your application and exploit them.

One might argue that web3 aims to eliminate the need for collection of user details but to a large extent the so called web3 application has a lot of web2 features in them. There is also the issue of business logic vulnerability,basically an attacker having found this flaw which is usually introduced into the application as a result of poor design and implementation, uses it to elicit unintended behaviour. In a nutshell the attacker manipulates legitimate functionality to achieve malicious goals.

What are Vulnerability Assessment and Penetration Testing?

The two aforementioned services are similar but quite different in practice. Vulnerability assessment aims to find potential loopholes that could be exploited by bad actors within a system in a live environment, without going further to exploit those findings. it usually has few false-positives since no proof of concept will be generated. These findings are then put together alongside possible fixes in a report and sent to the client. Vulnerability assessments are mostly achieved with automated tools.

In the case of penetration testing, after finding these vulnerabilities the pen-tester goes ahead to prove that the application is actually vulnerable by exploiting it using those findings. Just like vulnerability assessment, a report describing the process followed to exploit the application and possible fixes is sent to the client. 

Education

It’s almost unanimously agreed upon that web3 space is still in its infancy, as a result, a lot of education is needed for web3 engineers on the best practice in terms of blockchain application development as all as end users on the best practice in keeping their information and assets secure. This can come in form of a blog post on how to keep there private key secure, a newsletter on recent security trends or a small carousel on your web3 platform giving the users the recent updates as they unfold etc.

Conclusion

One truth that hasn’t changed since the digital age came to life is that there is no 100% security, web3 application’s inclusive. Having said that, startups in web3 as well as established application and solution providers need to be one thousand and one steps (1001) ahead of bad actors always, this way, the chances of being breached are almost eliminated.

Some of the ways to achieve this as we’ve earlier highlighted is by tasking web3 engineers and developers with taking responsibility for the codes they write, making sure a proper smart contract security audit is done as well as continuous vulnerability assessment and penetration testing, at least twice in a year. Not forgetting education, which is key in keeping the users informed. 

Visit A&D Forensics for your smart contract audit here as well as your Vulnerability assessment and penetration testing here.

You made it! Thanks for reading.

Leave a comment

Certified Cryptocurrency Investigation(CCI) Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.

Step 1 of 2
Certified Cryptocurrency Investigation Training

Learn how cryptocurrency related transactions, crimes are tracked, traced and prosecuted.

Step 1 of 2
CERTIFIED CRYPTOCURRENCY COMPLIANCE SPECIALIST(3CS)

Learn how compliance could be a competitive advantage to your exchanges with all your AML, CTF, KYC and OFAC requirements.

Step 1 of 2
Smart Contract Audit

To speak to us regarding Smart Contract Audit, please fill the form below. We will make every attempt to respond to you as soon as possible

Call Direct: +2348036180089 | +2349095503040

Section Divider

Get in touch

To speak with us as regards our services, to make comments and ask questions, please fill the form below. We will reply as soon as possible.

Call Direct: +2348036180089 | +2349095503040

LEAD FACILITATOR – CRYPTOCURRENCY INTUITION

Onyekelu Chioma is a passionate and professional teacher with expertise on blockchain and cryptocurrency education. She is a renowned blockchain advocate in Africa with the belief that there are so many career opportunities to be leveraged on in the Blockchain Industry.

Chioma is the Head of Academic and Training, the Crypto Bootcamp Community, and a member of Stake holders in blockchain technology association of Nigeria (SiBAN).

Chioma’s passion for fourth industrial revolution technology has helped her hold key strategic positions in various private sectors, regulating the way for blockchain adoption in the continent of Africa.

As an experienced teacher, blockchain educator, and a cryptocurrency trading coach, she has trained a lot of students and assisted them in identifying their innate skills which enabled them to carve a niche so as to become experts in their chosen blockchain career.

She’s currently a Crypto Forensic Intern at A&D Forensics and undergoing her Masters studies in Blockchain and Cryptocurrency at University of Nicosia

LEAD FACILITATOR – CRYPTOCURRENCY INVESTIGATIONS

Adedeji is a Forensic Investigation Practitioner and CertifiedBlockchain/Cryptocurrency Forensic
Investigator (CFE, CCI, CCFI & Reactor Certified) with more than Fifteen years of experience across few banks within the Nigeria Financial Sector and educator in Corporate workplace settings, Deji is uniquely qualified and involved in forensics analysis of Financial Infractions, Cryptocurrency crimes and designing plans that works for Government, Regulators, Law enforcement. He was appointed by SEC Nigeria as Member Virtual Asset and Fintech Regulatory framework drafting Committee, He is a member of Global Digital Finance’s KYC/AML working group in France and a member of the Industry led Thinktank that worked on and came out with FATF cryptocurrency Travel rule InterMessaging Standard for Virtual Assets (IVMS101) to help combat money laundering and terrorism financing using cryptocurrencies around the globe.
His law enforcement training efforts on new money and cybercrime have seen him train many law enforcement agents in various countriesn i.e Nigeria Police, Nigeria Army CyberWarfare command, Zambia Financial Intelligence Unit, Zambia Central Bank and more.
He is Chainalysis Sole Africa Investigative Partner helping law enforcement investigate criminal organizations using cryptocurrency to conceal illiccit activities across Africa, he is also a training Partner for Blockchain Intelligence Group based out of Canada.

Cryptocurrency Investigation Training

Learn how cryptocurrency related transactions, crimes are tracked,
traced and prosecuted.