Web3 & Blockchain Security

1. Web3 Security Landscape

Web3 security is a rapidly growing field due to the massive value at risk. Unlike traditional apps, blockchain exploits are often irreversible, and attackers can be anonymous.

2. Smart Contract Vulnerabilities

• Reentrancy: Recursive calls drain funds
• Integer overflow/underflow: Arithmetic errors
• Access control: Missing authorization
• Front-running: Transaction ordering manipulation
• Oracle manipulation: Price feed attacks
• Flash loan attacks: Uncollateralized exploits

3. Reentrancy Attacks

// VULNERABLE - Reentrancy
function withdraw() public {
    uint amount = balances[msg.sender];
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
    balances[msg.sender] = 0;  // Updated AFTER external call!
}

// SECURE - Checks-Effects-Interactions
function withdraw() public {
    uint amount = balances[msg.sender];
    balances[msg.sender] = 0;  // Update BEFORE external call
    (bool success, ) = msg.sender.call{value: amount}("");
    require(success);
}

4. DeFi-Specific Risks

# Flash Loan Attack Pattern:
1. Borrow millions (no collateral needed)
2. Manipulate price oracle
3. Exploit vulnerable protocol at manipulated price
4. Repay loan
5. Keep profits

# Defense:
# - TWAP oracles (time-weighted average)
# - Multiple price sources
# - Flash loan guards

5. Smart Contract Auditing

# Audit checklist:
# - Reentrancy vulnerabilities
# - Access control issues
# - Arithmetic errors (use SafeMath or Solidity 0.8+)
# - Front-running potential
# - Oracle dependencies
# - Upgrade mechanism safety
# - Gas optimization

# Tools:
# Slither - Static analysis
slither ./contracts

# Mythril - Symbolic execution
myth analyze contracts/Contract.sol

# Echidna - Fuzzing
echidna-test contracts/Contract.sol

6. Wallet Security

• ✅ Hardware wallets for significant holdings
• ✅ Multi-signature for organizations
• ✅ Verify transaction details before signing
• ✅ Revoke unnecessary token approvals
• ❌ Never share seed phrases
• ❌ Beware of phishing (fake dApps, airdrops)

7. Web3 Security Tools

8. Web3 Security Career

• Bug bounties: Immunefi, Code4rena ($150K+ payouts)
• Audit firms: Trail of Bits, OpenZeppelin, Consensys Diligence
• Skills: Solidity, EVM, DeFi protocols, traditional security

FAQ

Cryptography Bug Bounty Secure Coding