Audit reports

All Case Studies

Case Studies

About

Careers

Brand Assets

Invest

Company

Audits 

Services

Mitigate weaknesses in your smart contract and improve its functionality with a double line-to-line code analysis and a separate review by a lead auditor.

Secure the entire architecture and implementation layers of your blockchain protocol with professional security audits and testing.

Proactively detect vulnerabilities in your Web3 project by subjecting your systems to a simulated cyberattack in a secure and controlled environment.

Secure your cloud with Hacken's expert penetration testing. Our certified team delivers tailored security solutions for AWS, Azure, Kubernetes, and more, ensuring your data's safety.

Identify vulnerabilities in applications interacting with blockchain networks with secure code review and static security analysis.

Code review & static security analysis for crypto wallet apps.

Code review & security analysis for cross-chain crypto bridges.

Receive only relevant bug reports or undergo crowdsourced penetration testing with the help of thousands of ethical hackers curated by HackenProof.

Enhance transparency in crypto exchanges with independent on-chain proof of assets’ true collateralization.

Assess and strengthen your security practices, identify vulnerabilities, and safeguard valuable digital assets in the ever-evolving cryptocurrency landscape.

Ensure your token model robustness and efficiency and convey trust to investors and community with our thorough, independent audit of protocol economic security.

Solutions

Featured ecosystems

By Languages

Blog

Company 

Discover

Insights

Industry news

Network

Hacken news

Resources

Smart Contract Audit

Blockchain Protocol Audit 

Blockchain Penetration Testing

dApp Audit

Cross-Chain Bridge Audit

Crypto Wallet Audit

Bug Bounty

Proof of Reserves Audit

Solidity

Rust

Move

Solana

Near

Polkadot 

Cosmos 

Optimism

Ethereum (EVM) 

Avalanche

Fantom

Polygon

Aptos

zkSync

Arbitrum

Radix

Linea

MetaMask

Smart Contract Audit Solutions

Terms and Conditions 

Privacy Policy

<p>Decentralized apps (dApps) are integral to the blockchain ecosystem, providing seamless user experience and extended functionality. However, their safety is often overlooked.</p>



<p>Before we delve into the security aspect, let's establish a clear understanding of dApps.</p>



<p>A dApp is an off-chain application that interacts with the blockchain either directly through a node or indirectly via third-party services. dApps can be client-facing, offering a streamlined interface with a backend leveraging decentralized networks, or they can serve as backend applications processing blockchain data and responding to real-time events.</p>



<p>Although various interpretations exist, we'll stick to this definition for clarity and cohesion.</p>



<h2 class="wp-block-heading"><strong>Understanding dApp Security</strong></h2>



<p>Security should be a key consideration at every stage of a dApp's lifecycle. However, our emphasis will be on the software development process, acknowledging the crucial need for proactive security from the early stages of development. It's easier and more cost-effective to incorporate security measures from the start rather than adding it as an afterthought.</p>



<p>To ensure a secure application, it is fundamental to <strong>adhere to the main security principles</strong> of confidentiality, integrity, and availability. An application must securely manage sensitive information, provide accurate information, thoroughly verify inputs, and resist external manipulations. These principles serve as a baseline. Each application's security requirements are unique and should be carefully identified, considering business objectives, technical constraints, and other relevant factors.</p>



<p>Indeed, it can be challenging to understand what aspects are relevant to your system. It is, therefore, crucial, in the initial stages of development, to <strong>foster a thorough understanding of the product you are building</strong>. Ask critical questions about user expectations, potential negative impacts, desired behaviors, and feasible undesirable outcomes in less-than-ideal scenarios. Such inquiry assists in defining clear security goals and identifying areas requiring focused attention.</p>



<p>Following this understanding, you can proceed to design your application. Evaluate the features, their implementation, and alignment with the pre-established goals. At this stage, <strong>scrutinize every architectural and technical decision</strong>. Do not accept statements such as "X is the most secure way to do Y" without a critical assessment. There is no one-size-fits-all solution in security. Deeply understand the strengths and weaknesses of the technology you're using, ensuring its effective implementation to your specific use case.</p>



<p>Lastly, <strong>comprehensive documentation is vital</strong>. Recording your decisions and identified weak points serves as an invaluable guide for developers and security professionals, directing their focus where it is most required.</p>



<div id="blog-request-quote-container"></div>



<h2 class="wp-block-heading"><strong>Securing Different Types Of dApps In Practice</strong></h2>



<p>While the theory may seem simple, implementing security measures can be challenging. Therefore, we recommend following a recognized threat modeling framework, such as the "<a href="https://versprite.com/blog/what-is-pasta-threat-modeling/">Process for Attack Simulation and Threat Analysis</a>" (PASTA). This seven-stage linear framework aids in systematizing your security approach, closely aligning with the principles we previously highlighted:</p>



<ol>
<li>Define the objectives</li>



<li>Define the technical scope</li>



<li>Decompose the application</li>



<li>Analyze the threats</li>



<li>Vulnerability analysis</li>



<li>Attack analysis</li>



<li>Risk and impact analysis</li>
</ol>



<p>Additional guidelines can vary according to the type of your app. Hence, we've curated recommendations for popular dApp use cases, considering their types and associated risks.</p>



<h3 class="wp-block-heading">Security Tips For Non-Custodial Wallets</h3>



<p>This type of wallet has direct access to the private key and is responsible for its safekeeping, allowing you to have full ownership of your assets. Examples of such wallets are MetaMask, HackenAI, and MyEtherWallet.</p>



<p>The primary security consideration, in this case, should be the safety of the private key or seed stored by the wallet:</p>



<ul>
<li>The key should be properly encrypted and only leave the application if it is by design and is clearly communicated to the user.</li>



<li>Every interaction with the key should be carefully analyzed and verified to ensure that logic is sound and properly implemented. We also recommend making unit tests to do this automatically.</li>



<li>The debugging or monitoring mechanisms should not have access to the sensitive data the wallet stores.</li>
</ul>



<p>It is also vital to consider platform-specific weaknesses. For example, whether the application runs on mobile, desktop, web, or as a web extension makes a significant difference.</p>



<h3 class="wp-block-heading">Security Tips For Cross-Chain Bridges</h3>



<p>When looking at off-chain server applications that are part of <a href="https://hacken.io/discover/blockchain-bridges/">blockchain bridges</a>, we can highlight specific responsibilities they usually have:&nbsp;</p>



<ul>
<li>Verifying an event took place on a blockchain.</li>



<li>Transmitting external information to a blockchain.</li>
</ul>



<p>These features can help ensure <a href="https://hacken.io/discover/cross-chain-bridge-security/">cross-chain bridge security</a>. But, of course, you should also consider other system-specific concerns, such as private key safety, if they apply to your case.</p>



<p>The decision to consider something confirmed should be made on information given and verified by different data providers. For example, the system can require the signatures of multiple validators to accept the cross-chain transfer as valid. In this case, it would also be necessary for each validator to use a different blockchain node, falling back on the same principle of having multiple independent data sources. See <a href="https://cwe.mitre.org/data/definitions/1293.html">"CWE-1293: Missing Source Correlation of Multiple Independent Data"</a> to better understand this issue.&nbsp;</p>



<p>We also encourage you to read the <a href="https://hacken.io/discover/cross-chain-interoperability-report/">"Cross-chain Interoperability and Security"</a> report to understand the ecosystem's overall state better.</p>



<h3 class="wp-block-heading">Security Tips For Blockchain Explorers</h3>



<p>Explorers are the first stop when someone wants to see the status of the transfer they made. They are the most used dApps that currently exist, but it is also fair to say the most overlooked in terms of the security and impact they have on the day-to-day life of a cryptocurrency user. They provide valuable insight into blockchains and significantly simplify the overall user experience, but that comes at the cost of centralization. That, of course, is not a problem in its entirety but something to consider nonetheless.&nbsp;</p>



<p>In this case, the primary security concerns are the integrity of the information explorers provide and the safety of the website users.</p>



<ul>
<li>Blockchain explorers should collect and compare information from different blockchain nodes to reduce the risk of a compromised node affecting the system.&nbsp;</li>



<li>Information gathered from the blockchain should be viewed as user input rather than fully trusted.</li>



<li>The database containing indexed data should be resistant to external manipulation.</li>



<li>The website's security should have conventional security measures designed for sites with sensitive information implemented. It is necessary when you consider users using the website to verify transactions and conduct business.</li>
</ul>



<p>We also recommend being cautious when using blockchain explorers as a source of blockchain information, especially if it is the single data source in the system. Unfortunately, as of writing this article, we have yet to find a single blockchain explorer that takes any responsibility in case of providing inaccurate information on the service agreement level.</p>



<h3 class="wp-block-heading">Security Tips For Connected Websites</h3>



<p>These websites use third-party services, usually injected or connected wallets, to communicate with a blockchain, and they do not store or have access to users' private keys. As a result, they are already removing substantial security risks by not requiring custody over users' assets, leaving us to worry about less pressing but still integral security considerations.&nbsp;</p>



<p>In this case, users' privacy and conventional web safety are the leading security concerns.</p>



<p>Although most blockchain ecosystems themselves thrive on transparency, there is a common assumption that users should be able to stay private if they wish to. Based on that assumption, websites should limit the information they gather that might create a link between the user's identity and online presence or communicate to the user this is not the case. These concerns include but are not limited to IP addresses, geolocation, personal details, and other possibly identifiable information.</p>



<h2 class="wp-block-heading"><strong>Final Thoughts</strong></h2>



<p>In conclusion, dApp security is a proactive process that begins with the design and development of your app and continues throughout its lifecycle. This comprehensive strategy should involve identifying unique security requirements, critically evaluating design decisions, and documenting known weak points for future reference. By starting with a security-focused mindset and leveraging robust auditing services like <a href="https://hacken.io/services/dapp-audit/">dApp Audit</a> and <a href="https://hacken.io/services/blockchain-security/smart-contract-security-audit/">Smart Contract Audit</a>, you can build a more secure, robust, and user-friendly dApp.</p>

dApp Security: A Proactive Guide To Building Secure Decentralized Applications

<p>The crypto industry recently witnessed another high-profile hack, underscoring the critical importance of <a href="https://hacken.io/discover/wallet-security/">wallet security</a>. Atomic Wallet, a centralized storage and wallet service, fell victim to the breach, resulting in the theft of $35-100 million worth of various tokens. This article provides an overview of the incident and the ongoing investigation.</p>



<blockquote class="wp-block-quote"><p>It is essential for platform owners to <a href="https://hacken.io/services/dapp-audit/">perform dApp audits</a> to provide their end users with secure wallets.</p></blockquote>



<h2>Details Of The Hack</h2>



<p>Over the weekend, Atomic Wallet suffered a breach resulting in the theft of cryptocurrencies worth at least <a href="https://twitter.com/zachxbt/status/1665267820836319233?s=20">$35 million</a>, including bitcoin (BTC), ether (ETH), tether (USDT), dogecoin (DOGE), litecoin (LTC), BNB coin (BNB), and polygon (MATIC). Among the stolen assets, Tron-based USDT was reported to be the largest stash.&nbsp;</p>



<p>The security audit firm Least Authority previously <a href="https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/">warned</a> of risks in Atomic Wallet, citing vulnerabilities like flawed cryptography, non-adherence to best practices, insufficient documentation, and incorrect use of the Electron framework, all potentially endangering user funds.</p>



<h2>Investigation And Suspected Culprits</h2>



<p>Atomic Wallet has reported that they are investigating a recent hack that impacted 1% of their monthly active users. While specific details of the breach have not been disclosed by the company, they have requested affected users to provide information through Google Forms to assist with the investigation.</p>



<p>There have been reports suggesting that illicit funds from the hack have been traced to Sinbad.io, a crypto mixer allegedly favored by the Lazarus Group, a North Korean cyber-hacking group responsible for the Ronin and Harmony hacks. It is important to note that these reports are based on allegations, and further investigation is needed to confirm any connections.</p>



<h2>Expert Opinion And Technical Analysis</h2>



<p>Alexander Nazarov, Lead dApp Auditor at Hacken, provided valuable insights into the Atomic Wallet incident from a technical perspective. Potential attack vectors that could have led to the breach include:</p>



<p><strong>Insufficient entropy in key generation</strong>: Atomic Wallet generates a random seed that is mapped to a mnemonic using the BIP-39 wordlist. If the seed is not sufficiently random, it becomes susceptible to brute-force attacks.</p>



<p><strong>Fault attacks on key-related algorithms</strong>: This weakness can allow attackers to mathematically derive the private key from public information, such as signatures. Additionally, the Android version of Atomic Wallet was found to use an outdated and <a href="https://www.cve.org/CVERecord?id=CVE-2020-28498">vulnerable dependency</a>, which could have potentially contributed to the attack.</p>



<p><strong>Keys transmitted to a centralized server</strong>: There is a possibility that keys were unintentionally or intentionally transmitted to a centralized server, possibly through logs and monitoring mechanisms. This could have provided an opportunity for attackers to gain unauthorized access.</p>



<p><strong>Supply-chain attack</strong>: The incident could have resulted from a supply-chain attack if the attackers had gained access to the project's infrastructure. However, taking control of the newly updated website alone would not be sufficient to compromise all users, as it would only impact those using the desktop version or directly installing the Android APK from the website.</p>



<p>It’s important to emphasize that these potential attack vectors remain theoretical and have not been confirmed. And it’s impossible to draw definitive conclusions without access to the source code or deeper insights into the wallet.</p>



<p>Considering the broader picture, Nazarov raised the possibility the hack is not an “Atomic Wallet incident” per se. It is possible that the victims happened to use the same wallet, and therefore, it becomes crucial to identify other common patterns among affected users.</p>



<p>Either way, there's still a considerable risk that the vulnerability comes from Atomic Wallet, so we advise against its use. Atomic Wallet users should move their assets to another wallet for added safety. While users of other wallets have not reported similar problems, taking proactive measures can help mitigate potential risks and protect one's digital assets.</p>



<p>Although the technical analysis sheds light on potential vulnerabilities, it's essential to await the completion of the investigation to gain a comprehensive understanding of the incident.</p>



<h2>Final Thoughts</h2>



<p>In conclusion, the recent Atomic Wallet hack underscores the critical importance of wallet security in the crypto industry. Safeguarding your digital assets is paramount, and a secure wallet is a fundamental component of interacting with blockchain networks. To ensure the safety of your funds, pay close attention to wallet security practices and consider the benefits of <a href="https://hacken.io/services/dapp-audit/">dApp audits</a>. By prioritizing wallet security and seeking professional guidance, you can protect your assets and navigate the crypto landscape with confidence.</p>

Atomic Wallet Hack: Overview And Ongoing Investigation

Get our latest updates and expert insights on Web3 security