Web3 Safe Browsing Guide: Top 10 Consumer Security Tools

Original Title: "Web3 Pitfall Guide: Overview of the Top 10 Consumer Security Tools"

Original Author: 0xHankester, Biteye Community

Web3 has brought back data and asset sovereignty to users through blockchain technology, allowing users to manage their own information and property, while also leading users into the dark forest. In the Code is Law Web3 world, interacting with various contracts is a user's basic action, but ordinary users without a development background find it difficult to identify vulnerabilities maliciously embedded in contract code and are susceptible to financial loss.

01 Typical Security Issues for Consumer Users

Improper Authorization: Users usually need to authorize contracts when interacting with a dapp, and some malicious addresses may initiate asset transfer authorization requests. If a user approves, the assets can be directly transferred away;

Mechanism Change: Contract developers can change the Token mechanism through various means, such as minting, burning, changing transaction fees, etc.;

Foo Dog Contract: Users' buying and selling behavior is restricted, commonly seen as free buying but restricted selling.

02 Top 10 Pitfall Avoidance Tools

To address the above issues, we have compiled the top 10 pitfall avoidance tools to help Web3 users safeguard their assets and accounts. Except for Harpie, which requires a fixed fee of 0.01 ETH in the event of asset recovery, and MistTrack, which requires a paid subscription after a one-month free trial period, the other tools are free.

2.1 Contract Risk Scanners

Go+ Security

Website: https://gopluslabs.io/

StaySafu

Website: https://app.staysafu.org/

Token Sniffer

Website: https://tokensniffer.com/

2.1.1 Features and Use Cases

Features: Detect contract address risks and quickly obtain a simple audit report.

Use Cases: When interacting with a dApp or entering an address on a dex to buy a low-cap Token , if unsure whether its smart contract has vulnerabilities or other risks, you can input the smart contract address to be interacted with into the scanning function of the above tools to view the risk detection results.

2.1.2 Project Comparison

Public Chain Support

Security Capability

Project Background

Comprehensive Review

Go+ Security: The most comprehensive coverage of public chains, with a greater range of risk indicators, providing a more thorough understanding of potential risks.

Tokensiffer: Also covers many indicators, with detailed explanations for each, allowing for a deeper insight into risk points.

StaySafu: Limited risk indicators and public chain support

2.2 Wallet Anti-Phishing Plugin

Scam Sniffer

Website: https://scamsniffer.io

Pocket Universe

Website: https://www.pocketuniverse.app/

2.2.1 Functionality and Use Case

Functionality: After downloading and installing the plugin, when the wallet initiates interaction, the security plugin will scan the interaction logic, display a pop-up with the security scan result, and alert the user to any risks.

Use Case: Some phishing contracts may guide users to authorize signatures through airdrops. When a user receives a suspicious airdrop and wishes to cash out, the initiated interaction will be recognized, informing the user of the level of interaction risk.

2.2.2 Project Comparison

Supported Wallet: All are MetaMask

Security Capability

Project Background

Comprehensive Review: This type of tool is relatively homogeneous. As user adoption increases, such projects can accumulate more risk data to enhance their security capabilities.

2.3 On-Chain Real-time Monitoring

Forta

Website: https://forta.org

Function: Monitors the state changes of smart contract addresses and wallet addresses, and sends notifications to email, Slack, Discord, and other messaging apps.

Use Case: Users provide the addresses they want to monitor to Forta and specify their preferred notification method. This way, they can receive real-time on-chain updates without the need to constantly check their wallet or monitor specific contract addresses.

Supported Blockchains: Ethereum, Polygon, BSC, Avalanche, Optimism, Fantom, Arbitrum.

Project Background: Forta, incubated by OpenZeppelin, raised a $23 million Series A led by A16z in October 2021. Other investors include Coinbase Ventures, True Ventures, OpenZeppelin, among others.

2.4 Authorization Viewing and Revocation

Revoke

Website: https://revoke.cash/

Approved.zone

Website: https://approved.zone/

2.4.1 Functionality and Use Case

Functionality: View authorized NFTs and tokens and revoke authorizations.

Use Case: Many phishing smart contracts guide users to authorize their signature through various scenarios, some authorizations may involve asset transfers, with the risk of assets being transferred at any time. Through such tools, users can see what authorizations they have granted and can revoke them

2.4.2 Project Comparison

Support for Public Chains

Project Background: No other information available

Summary: This type of tool is relatively homogeneous, and supporting more public chains makes the product more user-friendly.

2.5 On-Chain Firewall

Harpie

Website: https://harpie.io

Functionality: Restricts asset transactions, allowing users to pre-set addresses of trusted networks, apps, or friends. If assets are transferred to an address outside the trusted addresses, Harpie will block the transaction during execution.

Use Case: When users want to further reduce the risk of asset transfer, they can use Harpie to select the assets to protect and set whitelist addresses to which the assets can be transferred. When the asset is transferred to an address outside the whitelist, the transaction will be blocked.

Support for Public Chains: Ethereum

Project Background: In late September 2022, Harpie completed a $4.5 million seed round of financing, led by Dragonfly Capital, with participation from Coinbase Ventures and OpenSea, among others

2.6 On-Chain Security Data Analysis

MistTrack

Website: https://misttrack.io

Functionality: Analyzes on-chain information such as related transactions and fund flows of the target wallet address, assesses address risk comprehensively, and can also monitor an address to receive status change notifications.

Use Case: You can analyze information related to your own address, check if it has interacted with any risky addresses, analyze potential security risks; after suffering financial loss, you can view the receiving address of the lost assets, analyze the type of attack, and learn from the experience.

Supported Blockchains: Ethereum, BSC, Polygon, Avalanche, Tron, IoTeX

Project Background: This project is a consumer security product launched by SlowMist Technology

03 Summary

For newcomers who have just joined the Web3 world, installing an anti-phishing wallet plugin is essential, as it allows newcomers to fully understand potential risks and build a security mindset from the beginning. For the more experienced participants in the web3 world, before rushing into a project, they should also scan the project's risks and take a moment to calm down to avoid falling victim to inexplicable losses. Finally, may we safely navigate and thrive in the Web3 dark forest, reaping the rewards!

Original Article Link

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia