Author: Sharon, Luccy, BlockBeats

Editor: Jack, BlockBeats

On September 20th, SlowMist MistTrack posted on social media that Coinbase Wallet has recently integrated with the Web3 messaging network protocol XMTP. As long as a user's wallet address opens the messaging network, they may receive any information sent through the messaging protocol. SlowMist discovered that many attackers are using this feature to send phishing links to wallet users.

After only two months of integration with Coinbase Wallet, XMTP has already been questioned by users about its security. How far are we from truly trusting social software in the Web3 field?

Attackers exploit vulnerabilities to send phishing links

In this incident, some users questioned XMTP officials on social media platforms, stating that they receive spam email notifications every day.

These doubts have emerged more than two months ago, when Coinbase Wallet announced its integration with the open-source communication network XMTP on its official Twitter account, and started instant messaging between wallet addresses. Many cryptocurrency enthusiasts raised questions about this: "Is the chat content encrypted?" "How will Coinbase Wallet's technology stand out, and what is the guarantee of message security?"

Despite the official statement from Lens Profile that all messages are end-to-end encrypted and can only be decrypted through wallet addresses, and that messages are sent off-chain without incurring any gas fees, the uncertainty surrounding the XMTP protocol in the encryption industry is evident from this incident.

In this incident, XMTP, which was questioned by users, is actually the underlying protocol of Coinbase Wallet. Currently, XMTP has penetrated into a larger range of industry ecology, because in addition to Coinbase Wallet, the Web3 social graph protocol Lens Protocol officially announced its integration with XMTP in November last year, providing secure and private profile-to-profile messaging services for its entire Lens ecosystem. Since its launch in early 2022, the XMTP network has generated over 1 million XMTP inboxes and sent over 300,000 DMs. The addition of Lens and Coinbase Wallet has brought in a large number of early seed users.

If this problem cannot be resolved in a timely manner, then these risky phishing links and meaningless spam emails may appear in the lives of tens of thousands of users at any time.

How far are we from achieving real-time cross-application chat?

In fact, the Web3 industry has always lacked a native, potential, and unified social tool. If WeChat, Telegram, and others were the core social software of the Web2 era, then the social battlefield of the Web3 era has not yet been finalized. From the architecture of the XMTP underlying protocol and the functions it presents, the most intuitive difference between Web3 social software and the core of the Web2 era lies in the fact that people can "cross-application real-time chat" with each other. It's like chatting with a merchant on Alipay or inquiring about prices with a seller on Ctrip in WeChat.

Related reading: "Detailed explanation of the decentralized business potential of XMTP behind the new features of Coinbase Wallet".

Currently, this feature cannot be truly realized in the Web2 era. Users are scattered across multiple different interfaces carried by apps, resulting in a fragmented experience. XMTP, on the other hand, has the potential to solve these pain points, which is why it has attracted a large amount of investment. On September 1, 2021, XMTP announced the completion of a $20 million Series A financing round, led by a16z, with participation from Coinbase Ventures, Not Boring Capital, and angel investors.

Can XMTP become the first person to open the infrastructure construction of Web3 social field?

Specifically, XMTP is a universal Web3 communication protocol and network that supports end-to-end encrypted communication between on-chain addresses. Developers can integrate the XMTP SDK into their Dapps without permission to achieve in-app DM and notification functions. In the XMTP protocol, the message inbox (DM) is bound to the user's Ethereum address, which means that users can send and receive their notifications through multiple different front-end applications, carry them with them (so-called portable), and migrate all interaction data (including follow-up, content publishing, and DM) to other applications at any time, provided that these applications also integrate the XMTP protocol. For example, the real-time chat scenario between Coinbase Wallet and Lens Protocol users is implemented by the XMTP protocol.

Of course, front-end users cannot directly perceive the existence of XMTP, because XMTP is aimed at developer users. However, its developer users, such as Coinbase Wallet and Lens Protocol, have a huge user base, so their users can basically be equated with XMTP users. Currently, the user experience is generally good, "relatively smooth" and "good timeliness for cross-application information sending and receiving". But on the other hand, someone has done experiments and found that "the objects of the experiment were randomly selected, and they can chat directly without the other party's consent. Whether this is lacking in privacy considerations (and how it differs from harassing messages) is questionable, but it is more convenient and accurate for the implementer".

Therefore, in the current SocialFi field of Web3, developers need to think more about how to plug defects and vulnerabilities, protect users' account security and privacy, and at the same time expand the ecosystem as much as possible, to avoid the original intention of decentralization being used by lawless elements, and thus leading to greater troubles. From this point of view, although XMTP has made a good start in the social narrative of Web3, it is still far from reaching the end.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia