On December 7th, the Web3 Developer Camp, exclusively supported by the CrossSpace community and led by Amazon Web Services (AWS), was successfully held at the AWS Causeway Bay venue. As an offline sharing session of the "Web3 Security" series seminar, this event successfully invited experts and executives from Web3 security, wallets, L1/L2 public chains, cloud services, exchanges, and investment institutions to share on-site, presenting a conference full of practical content and high discussion on Web3 security.

As a leading enterprise in the global cloud service market, AWS has always been paying attention to and actively exploring the security practices of the Web3 industry. In this security series event, AWS hopes to help improve the industry practitioners' awareness of security, build a sustainable Web3 ecosystem, and lay the foundation for the healthy development of various tracks in 2024. The experts and guests participating in this security-themed seminar come from many leading organizations in the industry, including (in no particular order): Beosin, Conflux, Hashkey Exchange, OKX Wallet, Polkadot, Scroll, SlowMist, SNZ Capital, and Taiko.

At the beginning of the article, let's review the roundtable discussion topic of this event together. This session invited executives and experts from leading Web3 organizations Taiko, Hashkey Exchange, Beosin, and SNZ Capital to discuss how their projects are implementing Web3 security missions. We also had the opportunity to hear from the popular L1/L2 public chains Conflux and Scroll about their technology and ecological development roadmap for 2024 for the first time offline.

From left to right: CrossSpace Co-founder and CEO Leon (host), SNZ Capital Investment Manager Michael, Taiko Co-founder and Chief Strategy Officer Terence, Conflux CTO Ming Wu, Scroll APAC Growth Lead Marcus Liu, Hashkey Exchange Exchange Product Director Vincent Wong, Beosin Security Researcher Eaton.

Roundtable Talk: What Security Issues Should Web3 Projects Pay Attention to?

Web3 projects are prone to blindly pursuing market expansion and neglecting basic security during their development. This year, several incidents of large-scale on-chain fund theft have sounded the alarm for Web3 practitioners regarding security. As a company that has been deeply involved in the security field, Beosin's security researcher, Eaton, has provided some suggestions for project teams: "During the initial stages of operation, project teams need to learn to use AI and auditing tools to speed up the review process and detect contract vulnerabilities, thereby saving audit time and solving complex business logic problems. During the project development phase, teams need to ensure the accuracy of business logic, focus on testing, and use a test-driven development approach. At the same time, they should handle the integration of third-party applications with caution to prevent the introduction of unknown security vulnerabilities. After the project is completed, it is strongly recommended that the project team hire a professional auditing team to audit the project to help discover and solve potential vulnerabilities, thereby ensuring the security of the project."

SNZ Capital has rich experience in investing in Web3 infrastructure and application projects. Its investment manager, Michael, also expressed SNZ's emphasis on the security of its portfolio companies: "Security is crucial for SNZ and is an important consideration in our investment strategy. To this end, we have established partnerships with security companies to provide comprehensive security services to the development teams of portfolio projects. In addition to security management in the infrastructure and middleware fields, we also provide post-management services to these companies to ensure that they receive services from security vendors we are familiar with. We require portfolio companies to prioritize security in their business strategies, understand the importance of security audits, including real-time fraud, vulnerability monitoring, and compatibility assessments, to ensure secure design."

Roundtable Talk: How do well-operated Web3 projects practice security?

Taiko, as a rapidly growing open-source ZK-rollup in the Ethereum ecosystem, ensures its security through its fully decentralized architecture and multiple validators participating in verification. Taiko's co-founder and Chief Strategy Officer Terence stated in a roundtable discussion, "Taiko is an equivalent Rollup Layer 2 network to Ethereum with a fully decentralized architecture. Its advantages include open-source, community building, and security, committed to ensuring code quality and security through the participation of global contributors. Currently, Taiko is in the testnet phase with over 10,000 proposals and validator nodes, and this number is expected to continue to grow. This means that users do not need to trust Taiko, as we do not have a centralized sequencer, which is an important feature that sets us apart from other Layer 2 networks."

Hashkey, as a licensed virtual asset exchange in Hong Kong that directly interacts with investment users, has been continuously expanding its product categories. Ensuring customer confidence and trust is one of its top priorities. "Hashkey Exchange has always been committed to strictly complying with the custody policies stipulated by the Securities and Futures Commission. 98% of assets are securely stored in cold wallets, while only 2% are stored in hot wallets to ensure the high security of assets. In order to further protect the rights and interests of investors, we have established partnerships with insurance companies such as AON and OneDegree to provide users with additional insurance protection." Vincent Wong, the product director of Hashkey Exchange, further shared that "from KYC verification, we ensure that our customers are legal and genuine. At the same time, we provide password reminder functions and require users to regularly change their passwords to enhance account security. In addition, we also provide educational materials to customers and invite them to learn more about blockchain knowledge and related facilities. Through these methods, we hope to establish long-term trust and cooperation with customers, ensuring that they feel safe and protected when using our platform for transactions."

Roundtable Hot Topic: Technical Development and Ecological Support of Layer1/2 Leading Public Chains

As a leading representative of Layer1 in the encryption industry, Conflux recently announced its developer roadmap for 2024. Chief Technology Officer Ming Wu shared several directions in which Conflux plans to improve the developer experience, including actively seeking programmable data availability solutions to enable smart contracts to interact with independent DA layers for efficient storage and retrieval of large-scale states; integrating artificial intelligence platforms into Conflux and positioning them as incentive layers; actively exploring heterogeneous virtual machine architectures to improve scalability and expand the ecosystem, as well as researching the integration of multi-party computation (MPC) to enhance privacy protection and MEV resistance. Ming Wu said, "We look forward to making our technology more mature and practical in the coming years by improving system performance to adapt to more application scenarios."

Another Layer2 public chain representative, Scroll, which recently went online, also shared its recent ecological security practices and support plans for multiple developer communities. Marcus Liu, the growth manager for Scroll in the Asia-Pacific region, said: "In terms of security, Scroll's main security comes from our ZKP, which uses the mathematical principles of ZK to ensure that ZKEVM's operation results are secure and trustworthy, and will be uploaded to ETH as a layer chain for ZK Proof verification. In addition to strict audits of all contracts and circuits, Scroll currently also has a Bug bounty program and works with community members to strengthen security with an open source spirit. The next steps in the roadmap to achieve decentralized Prover and decentralized Sequencer will also enhance Scroll's decentralization and security."

On the day of the event, in addition to the roundtable session, the 【Web3 Ethical Hacking and Best Security Practices】 training by AWS, and the valuable sharing from security organizations SlowMist, the new generation public chain Polkadot, and Web3 application OKX Wallet experts are also worth revisiting. Next, let us approach the front line of security through recording, and learn about knowledge and experience in security risk categories, practical security strategies, application-side security, and ecological development security.

Smart Contract Vulnerabilities Continue to Dominate Top Three Hacker Attack Categories by 2023

Smart contract vulnerabilities will continue to be one of the most common types of hacker attacks in 2023. According to the security report for the third quarter of this year by Beosin, a security company, contract vulnerability exploitation is the third most common type of attack after private key leaks and database attacks. "22 instances of contract vulnerability exploitation resulted in a total loss of approximately $93.27 million. Among the vulnerability categories, reentrancy vulnerabilities caused the most damage, with 82.8% of the losses in contract vulnerability incidents resulting from reentrancy vulnerabilities."

AWS Web3 solution architect David Sung and Gong Tao shared three types of common hacking events in smart contracts, including reentrancy attacks. In this type of attack, the attacker exploits security vulnerabilities in the contract by repeatedly calling the same function before a transaction is completed, causing the contract's funds to be transferred or consumed multiple times. This type of attack is often due to flaws in the contract's design or insufficient defense strategies. Since reentrancy attacks pose a serious threat to the security and stability of smart contracts, defending against them should be considered a critical task when developing smart contracts.

Another two common types of attack include delegate call attack and integer overflow and underflow attack. Delegate call attack is used to promote code reuse. EVM provides an opcode DELEGATECALL to insert the bytecode of the called contract into the bytecode of the calling contract. Therefore, the malicious target contract can directly modify (or manipulate) the state variables of the calling contract. Integer overflow and underflow attacks occur when the result of arithmetic operations exceeds the range of Solidity data types, leading to unauthorized operations on their state variables.

If you want to learn how to deal with hacker attacks, you can refer to the AWS "Web3 Ethical Hacking and Best Security Practices" security practical course. Visit the related special page.

Web3 project security policies before, during, and after operation

Web3 projects need to pay attention to potential security risks from the beginning of their operation. Security incidents often occur in smart contracts, blockchain wallets, and exchanges. Tony, the head of SlowMist Hong Kong community, shared on site that "SlowMist will provide solutions for blockchain security incidents in three stages: before the incident, during the incident, and after the incident." Project teams can evaluate potential security risks based on their own development stages.

Before a security incident occurs, project teams can conduct comprehensive testing on potential security risks. At this stage, SlowMist's Red Teaming can help project teams assess potential attacks from real vulnerabilities in enterprise personnel, enterprise business systems, enterprise supply chains, enterprise office systems, and enterprise physical security, providing customized security defense solutions and prioritizing protection for vulnerable nodes to increase the cost for attackers.

During a security incident, the project party should strengthen real-time monitoring of on-chain and off-chain security, cooperate with security companies to timely detect and respond to potential security threats. After a security incident occurs, immediate defensive actions should be taken, such as utilizing SlowMist's emergency response support services and on-chain/off-chain tracking and investigation services to timely defend against attacks and identify the root cause of the incident.

Considering that many Web3 project teams need to consider security during the code design phase and cannot rely solely on short-term guidance from security companies, SlowMist has open-sourced its Web3 project security practice requirements on Github, detailing the security risks that need to be considered in the development environment. This move will effectively encourage project teams to establish and improve their own security systems based on Web3 project security practice requirements, and have a certain level of security capability after security audits.

SlowMist calls on project parties to enhance security capabilities comprehensively

Embrace cutting-edge technology and build secure Web3 applications

With the maturity of blockchain underlying technology, more and more Web3 front-end applications are emerging. OKX Wallet is undoubtedly a product with excellent user experience. As an application facing end users, how to improve user experience while ensuring the security of user funds and data? Darrel Wang, the product manager of OKX Wallet, shared their secrets on site, which come from the security enhancement of the system's underlying technology, full-stack security capabilities, and active embrace of cutting-edge security technologies. The following is a detailed sharing:

Firstly, OKX Wallet has undergone system-level strengthening to ensure that products related to user assets have financial institution-level security. By enhancing the security of the application, efforts are made to prevent hacker intrusions and ensure that users trade in a secure environment.

Secondly, OKX Wallet places great emphasis on its full-stack security capabilities. From node services and block explorers to user terminals, its complete upstream and downstream service capabilities ensure compliance and excellent security performance throughout the entire process. For example, the product provides an active risk alert function, which actively prevents the appearance of phishing websites and further ensures the security of users' assets.

Once again, OKX Wallet emphasizes innovation and actively embraces cutting-edge technology. This year, it launched a smart contract account based on the Account Abstraction Protocol (EIP-4337), which greatly improves the wallet's security management capabilities with its recoverable feature. The MPC non-private key wallet launched on the platform utilizes multi-party secure computing technology to reduce the private key security risks caused by single-point failures, allowing users to be free from the fear of losing their private keys.

Web3 project parties need to be proficient in cloud service infrastructure, focusing on service categories, security, and flexibility

When it comes to security, AWS has always been committed to providing project parties with services in security, compliance, governance, and other aspects. Through the AWS Nitro system, security is built in at the chip level, continuously monitoring, protecting, and verifying instance hardware to minimize potential attack surfaces. AWS also supports more security standards and certifications than any other cloud provider. Nitro Enclaves, combined with KMS/CloudHSM, provides the best cloud-based private key security management solution for Web3 BUIDLers and is widely adopted in the industry. Shield Advanced and WAF provide security protection for dApps, nodes, and various Web3 infrastructure layers.

In terms of flexibility, AWS provides project owners with multiple service categories and pricing options for different products to help them optimize costs. David added: "We offer a wide range of analytics and machine learning service options that can meet all project data analysis needs. From data migration, data storage, big data analysis, log analysis, stream analysis, business intelligence, and machine learning (ML), we also allow flexible service selection to reduce costs."

If the project team needs to understand how to build secure cloud applications on AWS and the Web3 ecosystem support provided by AWS, click the link to learn more.

The above is the essence of the content sharing for this event, hoping to inspire BUIDLers and developers in the Web3 industry. We sincerely hope that under the constantly evolving security consensus in the industry, the Web3 ecosystem can usher in rapid growth in the next stage, and CrossSpace will continue to collaborate with AWS, high-quality security companies in the industry, and participants in the Web3 ecosystem to bring more sharing events to everyone.

This article is from a submission and does not represent the views of BlockBeats.

Welcome to join the official BlockBeats community:

Telegram Subscription Group: https://t.me/theblockbeats

Telegram Discussion Group: https://t.me/BlockBeats_App

Official Twitter Account: https://twitter.com/BlockBeatsAsia