During 2022 alone we have experienced around 125 hacks, which the vast majority of them happened through smart contracts.
The hackers study the smart contracts and the whole software development process in order to understand where they can get in and what to exploit in order to accomplish the hack successfully.
Web3 builders had an incredible focus on building protocols and dApps so far, doing their best to optimize speed and results. Talking about optimization, the software development phase is where developers can get the most out of basic cybersecurity practices.
The software development process is made of the following phases:
- Design: identifying the desired features and properties
- Develop: writing the code
- Test and Review: deploying the code in a test environment in order to identify possible bugs, if all the functions work correctly and run some specific tests
- Deploy: launching the system publicly (for most web3 projects, it can be the deployment on a Mainnet)
- Maintain: constantly assessing the system in order to ensure that it’s performing as intended
Now that we broke down the steps of the software development supply chain, we can do some quick considerations for each phase. The following picture is provided by a16z crypto, the leading venture capital firm in the crypto space:
Breaking down the path of software development does not want to assume that it always follows a straight, linear path but it’s very helpful in order to understand some security best practices to follow. Let’s explore each of them more specifically.
Please, keep in mind that those are just best practices in order to prepare your software to be secure, they won’t make it un-hackable.
Design Process (1)
Threat Modeling and Security Design
Threat Modeling is used to identify the specific parts of an application that a hacker would be able to exploit. Once a threat modeling assessment is done, security design comes to play. This combo helps to structure the entire software for a better cybersecurity fit.
Considering the importance of this step and the difficulty of finding experienced and reliable blockchain engineers, cybersecurity companies like CryptoArmor come to help. We adopt an attacker mindset and simulate the attack (without causing any damage) in order to be in a position of perfect understanding of your software.
Development Phase (2)
a) Administration and Access Control
The Principle of Least Privilege says that each actor should have the minimal amount of access required. By restricting the ability to call specific functions (especially those that run administrative tasks) to privileged accounts or smart contracts, we are substantially reducing the vulnerability of that specific function.
b) Take advantage of reusable and hard-tested templates and integrations.
Taking advantage of community-audited smart contract standards comes in handy when the goal is to reduce security risks. OpenZeppelin is an example of website where a good deal of smart contract standards can be found. This is one of the most beautiful parts of web3: making open-source software and re-use it where possible!
Considering of all the possible integrations that you may need to make in order to build the protocol you have in mind, it’s important to calculate and understand in a detailed manner your overall security exposure.
CryptoArmor can help and guide you through these key phases of development. Since security is not a status but an ongoing practice, we give you support also if you already deployed your protocols by identifying the best fixes you can make.
Test and Review (3)
a) Constant testing, documenting and auditing.
Create an easy-to-run but complete test suite along some very specific documents describing the expected behavior of the software plays a key role in securing an application.
The documentation will play an important role also for external auditors like CryptoArmor, which through it can get to know your code and intended outcomes to perform a top of the notch security test and assessment.
Stress testing a software to identify all the possible security problems and bugs is the job for a specialized and experienced security team. CryptoArmor makes this entire process easy for project owners as we provide both workforce and knowledge to implement ad hoc tests with the goal to find which parts of code the hacker would try to exploit, warn you and suggest some edits.
One of the strong benefits of having a company like CryptoArmor to take care of all security concerns is that your team can keep focusing on project development, offering more and better experiences to your users while we make everything safe. Otherwise, you’d face the trade-off choice of picking security over development or development over security. These are both building blocks of a fantastic product, there should not be any trade-off.
Deployment and Maintenance (4, 5)
a) Incentivize Whitehat Community Engagement
The highly collaborative spirit of web3 gives developers the opportunity to engage with the community in order to increase the security of a product. One of the most widespread ways to do this is creating a bug bounty. A program of this kind, even tho should not be considered a completely cybersecurity strategy, can present a lot of benefits also from a community engagement and to generate enthusiasm and commitment around your project.
Like mentioned above, a bug bounty is not a substitute for a cybersecurity strategy but instead a smart way to make some improvements while making the community engaged.
b) Real Time Monitoring
A real time monitoring system is a routine security exercise which monitors smart contracts and critical components (oracles, bridges) in order to identify and report suspicious activity.
Crypto Armor is specialized in systems of this kind as we strongly believe in the benefits of a proactive cybersecurity approach. Thanks to this approach we’re able to detect issues at an early stage and stopping any potential damage. CryptoArmor’s XDR software is the first line of defense in our multi-layered web3 security strategy. By following the “Prevent, Detect and Respond” approach, your application becomes a safe place for your users.
c) Incident and Emergency Response
Incident and emergency response team have the goal to contain, respond and remediate to security incidents. Security events happen even for organizations with the most mature security program, this is why security can not be neglected.
With a great Incidente Response service, CryptoArmor dedicates you a full team of experts to respond and remediate the threat, help your organization to get back to an operational state and prevent any further damages. After the threat is mitigated, we do a full review to share with your engineering team to help you implement a better security posture and create further needed documents for third parties like law enforcement and insurance providers. Visit cryptoarmor.net for more specifics.
Closing remarks
Overall, having a strong cybersecurity defense is no less important than the development of a product your customers like. If we want to be more precise, a product that is kept secure by a solid cybersecurity posture is surely a more appreciated product. In one of our previous articles (here), we outlined the scenario of hacks that happened from January to October 2022, which accounted for a total of $3b of total funds lost through 125 hacks. This number could have been easily avoided if the targeted companies had paid more attention to cybersecurity, rather than leaving their customers and users unprotected.
Considering the increasing amount of hacks and total value lost because of them, having a cybersecurity strategy can also become a feature of your organization to leverage in order to get a bigger market share and drive customers away from your competitors and lead them to your application.
The FTX scandal is making this interest in interacting with safe protocols even more prominent.
CryptoArmor is a blockchain Cybersecurity-as-a-Service company that builds proactive security strategies in order to keep your business and customers safe. CryptoArmor’s software helps detect and prevent hacks in real time by monitoring for security events and vulnerabilities in code. Join CryptoArmor’s beta to try out CryptoArmor’s threat detection software. CryptoArmor is headquartered in Austin, Texas.
Request a connection inside CryptoArmor by sending an email at: info@cryptoarmor.net
Source: https://a16zcrypto.com/smart-contract-security-checklist-web3-development/?utm_source=pocket_saves
