Partnered With:

.bit Research Report: There are five potential risks when users use DID to trade assets

Read this article in 6 Minutes

DID protocol.bit issued a risk warning to remind users to keep their personal assets properly. At the same time, it shows that the risk does not originate from the DID system itself, but from the wrong use of the system.

Original source: .bit

The open source Web3 identity protocol.bit has recently discovered and analyzed the serious security risks involved in asset transactions using DID. After recognizing these serious threats and conducting research and analysis on them, the risk warning is published here to warn the blockchain industry and advise users to avoid using DID to send or exchange assets.

Web3 enthusiasts know that DID is used to represent the unique address of the asset owner on the blockchain, which can realize Asset transfer without entering complex long addresses. DID can be used to send tokens or assets to wallets or trading platforms, which will then use the identifier to verify the data of tokens or assets and send back responses. The risks, .bit found, lie in the application programming interfaces (APIs) used by wallets or trading platforms.

The API enables simple data transfer across different platforms and provides the necessary information from the DID required by the wallet. In a fully secure trading platform using DID, the asset holder would enter their DID name, the wallet would ask the API for the blockchain address of that name, the API would then return the corresponding address, the wallet would set up the transaction for user approval, Finally, the wallet sends the transaction to the public network to complete the asset transfer. In reality, as .bit's analysis shows, five potential risks associated with using DIDs can emerge.

1. Hackers enter the server to attack the API service and tamper with the data returned to the query.

2. Insiders of the API service tamper with the data returned by the query.

3. An internal error occurred in the API service, resulting in incorrect data being returned to the query.

4. The blockchain node used to synchronize data in the server of the API service lags behind the blockchain network, resulting in relevant data not being up-to-date, which in turn causes wrong data to be sent to the query.

5. The DID expired and was registered by another user without the previous user's knowledge.

There have been no public reports of assets being lost due to risk 1 or 2. But .bit believes that as long as users develop the habit of using .bit or other DIDs to send assets, these problems will inevitably occur. Risks 3, 4, and 5 are non-subjective factors that cannot be completely avoided. Similar to risks 1 and 2, once users develop the habit of using .bit or other DIDs to send assets, it is only a matter of time before non-subjective factors cause asset losses. Therefore, it is important for DID users to be aware of this warning and the risks involved. Currently, the use of DIDs in wallets or trading platforms is still in its infancy. In order to avoid the risk of asset loss due to technical failure or illegal activities, .bit recommends that users do not currently use DID in wallets or trading platforms for transactions.

Despite these risks, DID and .bit have a lot to look forward to. Risk does not arise from a system such as DID itself, but from the wrong use of the system. .bit will be participating in the Hong Kong Web3 Festival 2023 from April 12-15, where it will share more information on how to use DID, including security steps to take, and future security measures it plans to implement in its protocol.

For details, please follow the official Twitter: https://twitter.com/dotbithq< /a>