Front-Running In Blockchain: Real-Life Examples & Prevention

Web3 Security Stack: From Infrastructure To Ecosystem

<p>Layer 1 (L1) protocols, the backbone of blockchain systems, are crucial for consensus algorithms, transaction formats, and data structures. Testing L1 protocols, however, is a complex and challenging task due to their intricate, interdependent components. In this article, we will discuss the difficulties of testing L1 protocols and explore how fuzzing can be an effective solution for discovering and mitigating <a href="https://hacken.io/insights/blockchain-security-vulnerabilities/">security vulnerabilities</a> in the protocol layer of blockchain systems.</p>



<h2>Overview Of Fuzzing</h2>



<h3>What Is Fuzzing?</h3>



<p>Fuzzing is an automated testing technique for blockchain protocols and smart contracts. It generates an extreme number of semi-random inputs and feeds them to the tested system. The goal of fuzzing is to find security vulnerabilities by triggering unexpected or invalid behavior in the system.</p>



<h3>L1 Fuzzing&nbsp;</h3>



<p>Fuzzing is an amazing tool for layer 1 audits, especially when testing a virtual machine, as it automates many steps to ensure the security and stability of L1s. The best part is that the data is not as random as it seems. Fuzzer uses code coverage to check which inputs are working and which are not. By doing this, it can uncover really valuable insights that are impossible to spot with the human eye.</p>



<h3>Smart Contract Fuzzing</h3>



<p>For smart contracts, fuzzing involves analyzing the ABI or bytecode, generating randomized valid inputs for their functions, executing the contract with these inputs, and examining the results to identify and report any weaknesses.</p>



<h2>Main Challenge Of Fuzzing: Building A Fuzz Target</h2>



<p>Fuzzing is a powerful testing method, especially when used at scale, but it requires a lot of resources and time. Building a fuzz target is the biggest challenge because it requires a lot of manual work:</p>



<ol><li>tokenize the target</li><li>use specific formats</li><li>upload everything to the cloud</li></ol>



<p></p>



<p>To ensure high consistency and save us some time, we’ve automated target building with a tool called Hacken-Fuzz.</p>



<p>Our Hacken-Fuzz tool can automate all the processes to set up a fuzz target. It works with C, C+, Rust, Go, JavaScript, JVM, Swift, and Python. Hacken-Fuzz is effective because it runs 50 servers at once thanks to our infrastructure based on <a href="https://github.com/google/oss-fuzz">OSS-Fuzz</a>.</p>



<h2>Use Cases: When Is It Reasonable To Use Fuzzing</h2>



<p>With the right infrastructure, you can do amazing things with fuzzing, i.e., use it to detect code errors that are impossible to detect manually. These include critical weaknesses that result in node crashes, such as infinite loops, buffer overflows, uncontrolled memory allocations, etc. Finding and resolving these vulnerabilities can protect blockchains from a wide range of <a href="https://hacken-3.gitbook.io/l1-security/protocol-layer">protocol layer attacks</a>, such as long-range, 51%, and race attacks.</p>



<p>For smart contracts, fuzzing can be especially helpful in the areas of integer overflows/underflows, denial-of-service possibilities, tokenomics verification, gas-related issues, delegate call verification, and <a href="https://hacken.io/discover/reentrancy-attacks/">reentrancy</a>.</p>



<p>Fuzzing can be particularly useful in executing large, time-consuming operations or verifying manual analysis to identify false positives and overlooked issues. While fuzzing is a valuable testing tool, it should not be considered a comprehensive substitute for a thorough audit.</p>



<h3>What Challenges Does Fuzzing Address, And How?</h3>



<p>At Hacken, we believe that fuzzing is an effective method for exploring security vulnerabilities in L1 protocols for the following reasons.</p>



<p><strong>Simulating user behavior</strong>. Fuzzing can simulate real-world scenarios by generating random inputs that mimic user behavior. This means that fuzzing can test the system's robustness against various attacks, including those that are difficult to anticipate.</p>



<p><strong>Finding hidden vulnerabilities</strong>. Fuzzing can find security vulnerabilities that other testing methods might miss. For example, manual testing or static analysis might not be able to detect certain types of logic errors or race conditions that take extreme inputs.</p>



<p><strong>Scalability in L1</strong>. Fuzzing can scale to handle the complexity of L1 protocols with their interdependent components. Fuzzing can generate many inputs and explore various execution paths, increasing the chance of finding security vulnerabilities.</p>



<h2>Hands-On Application Of Fuzzing: The Case Of Minima</h2>



<p>Hacken fuzzing proves its worth in our daily work as auditors. I will share some details from a blockchain protocol audit for one of our clients, <a href="https://www.minima.global/">Minima</a>. Minima is a Java project building a blockchain for smartphones entirely from scratch. They developed everything on their own, including a virtual machine and a language for it. We found a dozen critical issues with the fuzzer, which were later verified manually. Our client fixed all the vulnerabilities, so we can safely discuss them here.</p>



<p>As a result, we used fuzzing to uncover the following critical vulnerabilities:</p>



<ol><li>Loop with unreachable exit condition using constant expressions, a.k.a. an infinite loop.</li><li>Two issues with a NULL pointer dereference.</li><li>Stack buffer overflow due to a recursive parsing of smart contracts that used all the space in the stack leading to a VM crash.</li><li>Another stack buffer overflow was causing a crash due to a lack of a bracket limit.</li><li>Uncontrolled memory allocation with a bitwise shift in hex values.</li><li>Memory allocation with excessive size value during the power function.</li><li>Resource consumption crashes the node when recursively replacing arguments for a given script in the generic function.</li><li>Uncontrolled memory allocation when calling the concat function many times.</li><li>Similar issue with the replace function that allowed the string to grow exponentially. It replaced “A” with AA,” so doing it long enough crashes memory.</li><li>Integer overflow in the subset function as it was possible to specify the starting position to be higher than the end position. Creating a massive string consumed all the memory.</li></ol>



<p>See the full audit report with detailed descriptions and processes <a href="https://hacken.io/audits/minima/">here</a>.</p>



<p>These were critical errors (i.e., dangerous enough to crash the virtual machine). Manually it couldn`t have been done because only the machine can take testing to the extreme, such as concating a string that takes up 2GB of memory or checking infinite numbers.</p>



<h2>Drawbacks Of Fuzzing</h2>



<p>Despite all the advantages of fuzzing, it's not a magic pill; you need a full audit and a knowledgeable developer to review and verify code errors. On top of that, the fuzzer won’t find all the errors to begin with. Here are some of the most pressing challenges of fuzzing:</p>



<p><strong>You need to fix issues after their discovery, or else fuzzing wouldn’t find anything else</strong>. The thing with fuzzing, after it finds a critical issue, you have to fix it, or else the fuzzer will stumble on the same issue again and again, not revealing all the issues that the codebase may have. Obviously, we don’t want that, so you have to fix each detected item as you go. So you fix the issue, and then you fuzz again. You may consider it a problem, but it’s also a good push factor actually to solve the found weaknesses.</p>



<p><strong>Problematic with complex bugs.</strong> Fuzzing is hard to apply to bugs that require many steps to execute.<strong> </strong>For example, if a bug requires three transactions to execute, fuzzing might not be able to detect it because generating such inputs is hard.</p>



<p><strong>Time-consuming. </strong>Generating many inputs and exploring various execution paths can take a lot of time, especially for complex L1 protocols. Also, we don’t know precisely how long each type of vulnerability will take.</p>



<p><strong>May miss logic errors (unless specifically designed for it). </strong>Fuzzing might not find logic errors if the system is not designed to detect them. For example, if the system doesn't have proper error-handling mechanisms, fuzzing might be unable to detect logic errors that lead to unexpected behavior.</p>



<p><strong>Problematic with stateful components. </strong>Fuzzing stateful components requires keeping track of the system's state, which can be challenging, especially for complex L1 protocols. It is hard to tell if fuzzer has what it takes to detect an issue.</p>



<p><strong>Problematic with multi-threaded applications. </strong>Finally, fuzzing is hard to apply to multi-threaded applications as it requires keeping track of the system's concurrency, which can be challenging, especially for complex L1 protocols.</p>



<h2>Conclusions</h2>



<p>Fuzzing is an amazing tool for <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">blockchain audits</a> that’s especially useful when testing a virtual machine, as it automates many processes. No single person can beat fuzzer in semi-random testing. Nevertheless, you still need 50-100+ servers to make it effective and, of course, the expertise to set up the target, but thankfully we at Hacken have built the necessary capabilities.&nbsp;</p>



<p>Yet, don’t get me wrong – fuzzing doesn’t substitute manual review, only makes it more effective. You still need a knowledgeable, experienced, and trusted blockchain auditor to verify issues found during fuzz testing, detect issues that cannot be found by random input generation, and recommend appropriate code fixes for all errors.</p>

Fuzzing For L1 Protocols And Smart Contracts: Detecting Vulnerabilities

<p>The crypto industry recently witnessed another high-profile hack, underscoring the critical importance of <a href="https://hacken.io/discover/wallet-security/">wallet security</a>. Atomic Wallet, a centralized storage and wallet service, fell victim to the breach, resulting in the theft of $35-100 million worth of various tokens. This article provides an overview of the incident and the ongoing investigation.</p>



<blockquote class="wp-block-quote"><p>It is essential for platform owners to <a href="https://hacken.io/services/dapp-audit/">perform dApp audits</a> to provide their end users with secure wallets.</p></blockquote>



<h2>Details Of The Hack</h2>



<p>Over the weekend, Atomic Wallet suffered a breach resulting in the theft of cryptocurrencies worth at least <a href="https://twitter.com/zachxbt/status/1665267820836319233?s=20">$35 million</a>, including bitcoin (BTC), ether (ETH), tether (USDT), dogecoin (DOGE), litecoin (LTC), BNB coin (BNB), and polygon (MATIC). Among the stolen assets, Tron-based USDT was reported to be the largest stash.&nbsp;</p>



<p>The security audit firm Least Authority previously <a href="https://www.coindesk.com/tech/2022/02/10/least-authority-discloses-security-risks-in-atomic-wallet/">warned</a> of risks in Atomic Wallet, citing vulnerabilities like flawed cryptography, non-adherence to best practices, insufficient documentation, and incorrect use of the Electron framework, all potentially endangering user funds.</p>



<h2>Investigation And Suspected Culprits</h2>



<p>Atomic Wallet has reported that they are investigating a recent hack that impacted 1% of their monthly active users. While specific details of the breach have not been disclosed by the company, they have requested affected users to provide information through Google Forms to assist with the investigation.</p>



<p>There have been reports suggesting that illicit funds from the hack have been traced to Sinbad.io, a crypto mixer allegedly favored by the Lazarus Group, a North Korean cyber-hacking group responsible for the Ronin and Harmony hacks. It is important to note that these reports are based on allegations, and further investigation is needed to confirm any connections.</p>



<h2>Expert Opinion And Technical Analysis</h2>



<p>Alexander Nazarov, Lead dApp Auditor at Hacken, provided valuable insights into the Atomic Wallet incident from a technical perspective. Potential attack vectors that could have led to the breach include:</p>



<p><strong>Insufficient entropy in key generation</strong>: Atomic Wallet generates a random seed that is mapped to a mnemonic using the BIP-39 wordlist. If the seed is not sufficiently random, it becomes susceptible to brute-force attacks.</p>



<p><strong>Fault attacks on key-related algorithms</strong>: This weakness can allow attackers to mathematically derive the private key from public information, such as signatures. Additionally, the Android version of Atomic Wallet was found to use an outdated and <a href="https://www.cve.org/CVERecord?id=CVE-2020-28498">vulnerable dependency</a>, which could have potentially contributed to the attack.</p>



<p><strong>Keys transmitted to a centralized server</strong>: There is a possibility that keys were unintentionally or intentionally transmitted to a centralized server, possibly through logs and monitoring mechanisms. This could have provided an opportunity for attackers to gain unauthorized access.</p>



<p><strong>Supply-chain attack</strong>: The incident could have resulted from a supply-chain attack if the attackers had gained access to the project's infrastructure. However, taking control of the newly updated website alone would not be sufficient to compromise all users, as it would only impact those using the desktop version or directly installing the Android APK from the website.</p>



<p>It’s important to emphasize that these potential attack vectors remain theoretical and have not been confirmed. And it’s impossible to draw definitive conclusions without access to the source code or deeper insights into the wallet.</p>



<p>Considering the broader picture, Nazarov raised the possibility the hack is not an “Atomic Wallet incident” per se. It is possible that the victims happened to use the same wallet, and therefore, it becomes crucial to identify other common patterns among affected users.</p>



<p>Either way, there's still a considerable risk that the vulnerability comes from Atomic Wallet, so we advise against its use. Atomic Wallet users should move their assets to another wallet for added safety. While users of other wallets have not reported similar problems, taking proactive measures can help mitigate potential risks and protect one's digital assets.</p>



<p>Although the technical analysis sheds light on potential vulnerabilities, it's essential to await the completion of the investigation to gain a comprehensive understanding of the incident.</p>



<h2>Final Thoughts</h2>



<p>In conclusion, the recent Atomic Wallet hack underscores the critical importance of wallet security in the crypto industry. Safeguarding your digital assets is paramount, and a secure wallet is a fundamental component of interacting with blockchain networks. To ensure the safety of your funds, pay close attention to wallet security practices and consider the benefits of <a href="https://hacken.io/services/dapp-audit/">dApp audits</a>. By prioritizing wallet security and seeking professional guidance, you can protect your assets and navigate the crypto landscape with confidence.</p>

Atomic Wallet Hack: Overview And Ongoing Investigation

<p>Scams are increasingly prevalent in the dynamic NFT market. Notably in 2023, even savvy investor Kevin Rose was duped, losing more than <a href="https://twitter.com/ArkhamIntel/status/1618336268513075202">$1 million</a> in blue-chip NFTs.&nbsp;</p>



<p>As of now, over <a href="https://dune.com/zengowallet/zengo-nft-hack-detectooor">$26 million</a> worth of NFTs have been stolen. While NFTs have legitimate applications across digital art, gaming, real estate, and more, the growing number of scam occurrences casts a shadow over the industry's reputation.</p>



<p>Whether you're trading, investing, or just dipping your toes in the NFT market—you must understand how NFT scams work and how to protect your assets.</p>



<p class="has-text-align-center has-white-color has-pale-cyan-blue-background-color has-text-color has-background has-medium-font-size">? <a href="https://twitter.com/hackenclub">Follow @hackenclub on Twitter</a></p>



<h2><strong>Common NFT Scams</strong></h2>



<h3><strong>NFT Rug Pull</strong></h3>



<p>In a rug pull scam, the team behind an NFT project drains its liquidity and disappears with the funds. They present their collection as a worthwhile investment, often adding a backdoor in smart contracts or asset management systems to facilitate the theft.&nbsp;</p>



<p>Pixelmon—a combat-based NFT game—remains one of the most phenomenal rugs in NFT. Starting at a 3 ETH floor price, the founders raised about <a href="https://twitter.com/Pixelmon?t=vmxPN9yMyq9udgRmsKIxnA&amp;s=09">$70 million</a>, after which they abandoned the project and stole the funds.</p>



<p>Sometimes, the rug perpetrator utilizes their influence. A rapper Soulja Boy rugged his audience three times in a row for a total of <a href="https://nftevening.com/soulja-boy-rugs-three-nft-drops-in-one-week/">69 ETH</a>.</p>



<figure class="wp-block-image"><img src="https://nftevening.com/wp-content/uploads/2023/04/Soulja-Boy.jpeg" alt="Soulja Boy NFT"/></figure>



<p class="has-text-align-center has-cyan-bluish-gray-color has-text-color has-small-font-size">Soulja Boy. Source: <a href="https://nftevening.com/zachxbt-reveals-sketchy-nft-activity-of-rapper-soulja-boy/" target="_blank" rel="noreferrer noopener nofollow">NFT Evening</a></p>



<h3><strong>Fake NFTs</strong></h3>



<p>Counterfeiting is a prevalent issue within the NFT market: plagiarized works, fake collections, and spam. Much like counterfeit art, fake NFTs are worthless. While major marketplaces combat this with detection systems, the responsibility is still on the investor to verify the token's authenticity and its creator’s legitimacy.</p>



<p>In February 2023, <a href="https://en.cryptonomist.ch/2023/02/10/hermes-plagiarized-nft/">Mason Rothschild</a> plagiarized the outlook of a French fashion bag named Hermès and made about 200 ETH.</p>



<h3><strong>Pump-And-Dump Schemes</strong></h3>



<p>In a pump-and-dump scheme, bad actors artificially increase the price. They pour liquidity into an NFT collection, simulating strong demand. Outsiders may view the rising prices as a sign of a good buy, only to be left with devalued NFTs when the demand dries up.</p>



<p>An artist, Ryder Ripps, has profited over <a href="https://news.bloomberglaw.com/ip-law/fake-bored-ape-yacht-club-nfts-sold-by-artist-yuga-labs-claims">$5 million</a> after dumping numerous NFTs on unfortunate collectors.</p>



<p>Pump-and-dump has become so rampant in the NFT space that a project named <a href="https://twitter.com/punk9059/status/1568966447292100611?t=nDuUKkKJBwqVBvl8HpoxVA&amp;s=19">Parrot</a> adopted the scheme as its utility, encouraging collectors to join the pump and make money.</p>



<blockquote class="twitter-tweet"><p lang="en" dir="ltr">Gotta love a good Pyramid Scheme that's at least explicit about it. <a href="https://t.co/Q9VtYNlhKe">pic.twitter.com/Q9VtYNlhKe</a></p>— NFTstatistics.eth (@punk9059) <a href="https://twitter.com/punk9059/status/1568966447292100611?ref_src=twsrc%5Etfw">September 11, 2022</a></blockquote> <script async="" src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>



<h3><strong>Phishing Scams</strong></h3>



<p>Scammers manipulate people into clicking malicious links that are designed to hijack control of the user's account or wallet. These links can be sent through various channels such as Discord, Twitter, and Telegram or embedded in random ads.</p>



<p>Malicious links can even come from official channels. Memeland by 9GAG, Proof/Moonbirds, and other popular NFT marketplaces were targeted by a sophisticated phishing attack in <a href="https://hacken.io/industry-news-and-insights/axie-infinity-new-phishing-attack-attempt-be-careful/">May 2022</a>. The attacker had compromised a widely-used Discord bot, Mee6, enabling them to post messages on public channels, giving the impression of authenticity. The attacker used the bot to distribute phishing links disguised as an "Official Mint Site". Victims who approved the transaction unknowingly transferred their NFTs to the scammer's wallet.&nbsp;</p>



<p>Both novices and OGs can get phished. Even <a href="https://twitter.com/NFT_GOD/status/1614442000958324739?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1614442000958324739%7Ctwgr%5E85edf662cd4edf1fe0f1a1888e3e5e9b3d0080c1%7Ctwcon%5Es1_&amp;ref_url=https%3A%2F%2Fwww.cryptotimes.io%2Fnft-god-lost-all-his-digital-assets-in-a-phishing-attack%2F">NFT God</a>, a famous NFT influencer on Twitter, admitted losing “a life-changing amount of their net worth” by downloading malware software from an ODS-sponsored link.</p>



<blockquote class="twitter-tweet"><p lang="en" dir="ltr">Last night my entire digital livelihood was violated. <br><br>Every account connected to me both personally and professionally was hacked and used to hurt others. <br><br>Less importantly, I lost a life changing amount of my net worth</p>— NFT God (@NFT_GOD) <a href="https://twitter.com/NFT_GOD/status/1614442000958324739?ref_src=twsrc%5Etfw">January 15, 2023</a></blockquote> <script async="" src="https://platform.twitter.com/widgets.js" charset="utf-8"></script>



<h3><strong>NFT Marketplace Hijacking</strong></h3>



<p>Scammers frequently replicate prominent NFT marketplaces like OpenSea and Rarible to sell fake NFTs. Additionally, these websites mimic wallet connection services, granting bad actors access to victims’ assets.</p>



<p>A serial NFT scammer called Elliot has stolen over <a href="https://www.nftgators.com/nft-scammer-nicknamed-devil-stole-5m-over-the-past-year/">$5 million</a> using this method.</p>



<h3><strong>Malicious Airdrop</strong></h3>



<p>In a malicious airdrop or giveaway, scammers promise free NFTs. They solicit wallet details from applicants, then use this information to compromise the wallets. These scams often proliferate on Twitter and other major social media platforms.</p>



<p>In March 2023, scammers used airdrops as clickbait to siphon over <a href="https://blockchain.news/news/scammers-target-nft-users-in-blur-token-airdrop-scam">$300k</a> from the BLUR NFT marketplace users.</p>



<h3><strong>Address Poisoning&nbsp;</strong></h3>



<p>Address poisoning is a less-known scam where fraudsters send a $0 transaction to your wallet from an address similar to yours. The aim is to trick those who copy-paste wallet addresses from their transaction history into inadvertently sending NFTs to the wrong, "poisoned" address.</p>



<p>Scammers recently poisoned the address of an Arbitrum user and stole over <a href="https://decrypt.co/125037/address-poisoning-attack-sees-scammer-make-off-1-3m-in-arb-tokens">$1.3 million</a>.</p>





<h2><strong>What Is The Impact Of NFT Scams On The Market?</strong></h2>



<p>In terms of numbers, it's estimated that cryptocurrency users have lost over $26 million to NFT-related scams since mid-2021, according to <a href="https://dune.com/zengowallet/zengo-nft-hack-detectooor">ZenGo Wallet NFT Hack Detector</a>.</p>



<figure class="wp-block-image size-full"><img src="http://wp.hacken.io/wp-content/uploads/2023/05/image-11.png" alt="" class="wp-image-19857"/></figure>



<p class="has-text-align-center has-cyan-bluish-gray-color has-text-color has-small-font-size">ZenGo Wallet NFT Hack Detector. Source: Dune</p>



<p>The effects of NFT scams reach far beyond individual victims, creating ripples that spread throughout the entire market. These impacts come in several forms and influence both the public perception and economic health of the NFT industry.</p>



<p><strong>Bad reputation</strong>. The first impact of this is bad PR for the NFT space. Many would-be investors and traders stepped back because they wouldn't want to be victims of the next rugs or counterfeit NFT collectibles. As a result of the bad PR, it is hard for utility-driven projects—worth all the support and investments—to gain the people's trust.</p>



<p><strong>Lower sales</strong>. Secondly, the total year-in-year value of the NFT industry is dropping. Looking at the data, NFT sales dropped by <a href="https://newsdirect.com/news/nft-sales-drop-83-in-a-year-2-37bn-drop-in-revenue-303243772">83%</a> between 2022 and May 2023. This is unsurprising because scammers stole over <a href="https://fortune.com/crypto/2022/08/24/100-million-worth-of-nfts-stolen-crypto-winter-elliptic/">$20 million</a> of NFTs in 2022 alone.</p>



<p><strong>NFT scams hit North America and Australia the most</strong>. The largest share of proceeds from NFT scams come from the U.S., Canada, and Australia. It’s no surprise since NFT is the most popular DeFi category among North American users.</p>



<figure class="wp-block-image size-full"><img src="http://wp.hacken.io/wp-content/uploads/2023/05/unknown.jpg" alt="" class="wp-image-19870"/></figure>



<p class="has-text-align-center has-cyan-bluish-gray-color has-text-color has-small-font-size">Source: <a href="https://go.chainalysis.com/geography-of-crypto-2022-report.html" target="_blank" rel="noreferrer noopener nofollow">Chainalysis</a></p>



<p>Many are novices in the crypto realm and potentially more susceptible to being tricked, which explains the higher incidence of scam-related revenues from these regions.</p>



<p><strong>Communal demand for audits</strong>. The NFT community is becoming more security-conscious before aping into any project. The community often demands a quality audit of the codebase to rest assured that there are no possible backdoors for rugs. Besides that, the audits also increase their confidence that threat actors have lesser chances of exploiting the smart contracts.</p>



<h2><strong>How To Avoid NFT Scams</strong></h2>



<p>Navigating the dynamic world of NFTs can be exciting, but it also requires constant vigilance. As scams become increasingly sophisticated, it's crucial to equip yourself with the knowledge and tools needed to protect your digital assets. Below are some key strategies you can employ to avoid falling victim to NFT scams.</p>



<ol><li><strong>Use Burner Wallets</strong>: Burner wallets have no assets and are used only for receiving airdrops. This limits the potential loss from scams.</li><li><strong>Verify Websites</strong>: Always confirm the correct website before interacting with an NFT marketplace. Be aware of deceptive sites that mimic popular ones.</li><li><strong>Research Projects</strong>: Investigate every project you invest in, considering the team's track record and the authenticity of the NFTs.</li><li><strong>Use MFA</strong>: Two-Factor Authentication to make your wallet more secure.</li><li><strong>Beware Of Links</strong>: Be cautious with links from unknown sources, especially on platforms like Twitter or Discord.</li><li><strong>Trustworthy Software Sources</strong>: Install software only from secure and trusted sources to prevent malware.</li><li><strong>Use VPNs</strong>: VPNs encrypt browsing data, offering anonymity and greater security online.</li><li><strong>Review Transactions</strong>: Don't sign off on transactions without thoroughly understanding their details.</li><li><strong>Use Hardware Wallets</strong>: Consider cold storage for large crypto assets, as they're harder to hack.</li><li><strong>Guard Your Keys</strong>: Never share your private keys or sensitive data, even if requested during an airdrop campaign.</li><li><strong>DYOR</strong>: More NFT degens now adopt the Do Your Research ethos as they now research to detect if a project is a pump-and-dump scheme, fake, or a rug.</li></ol>



<p></p>



<h2><strong>Wrapping Up</strong></h2>



<p>NFTs have immense potential to revolutionize digital ownership, but this burgeoning space has become a hunting ground for scams. As we navigate this exciting world, it's crucial to stay vigilant, practice due diligence, and prioritize security. Despite the challenges, the promise of a decentralized market where artists and creators can monetize their work is a worthy pursuit. As a community, we can work together to ensure that the potential of NFTs is not undermined by the actions of a few bad actors.</p>



<hr class="wp-block-separator"/>



<h3>FAQ</h3>



<div class="schema-faq wp-block-yoast-faq-block"><div class="schema-faq-section" id="faq-question-1685531364009"><strong class="schema-faq-question"><strong>What are common NFT scams?</strong></strong> <p class="schema-faq-answer">The most common NFT scams include phishing, address poisoning, wash trading, counterfeit NFTs, etc.</p> </div> <div class="schema-faq-section" id="faq-question-1685531372642"><strong class="schema-faq-question"><strong>What percent of NFT projects are scams?</strong></strong> <p class="schema-faq-answer">According to <a href="https://twitter.com/opensea/status/1486843202959122433?s=20&amp;t=WfDfurtj0_vYLBZxDVe_Fw">OpenSea</a>, around 80% of NFT projects are scams.</p> </div> <div class="schema-faq-section" id="faq-question-1685531380958"><strong class="schema-faq-question"><strong>Is an NFT a good investment?</strong></strong> <p class="schema-faq-answer">The potential of NFTs as a good investment varies greatly and is dependent on several factors. NFTs can indeed be a good investment as they offer unique ownership rights, often linked to digital art or other virtual assets, which could increase in value over time. However, the NFT market is also highly volatile and speculative, meaning investments can be risky.</p> </div> </div>

NFT Scams: How They're Hurting The Market

Sui Blockchain 101: An Overview Of The Benefits And Limitations

How To Audit A Smart Contract: ​​A Deep Dive Into Hacken's Process

<p>Blockchain architecture refers to the components and subcomponents or layers that make up a complete blockchain system. Each layer has a unique role, from storing data to maintaining network connectivity and ensuring consensus across the system.</p>



<p>Understanding these layers is crucial for blockchain developers and start-up entrepreneurs seeking to leverage blockchain technology effectively.</p>



<p>This article aims to demystify the intricacies of blockchain architecture by breaking down its layers and their respective functionalities. Our goal is to help you navigate the complexities of blockchain design, optimize performance, and identify potential <a href="https://hacken.io/insights/blockchain-security-vulnerabilities/">security vulnerabilities</a>.</p>



<h2 class="wp-block-heading"><strong>Types Of Blockchain Architecture</strong></h2>



<p>Generally speaking, there are four types of blockchains: public, private, consortium, and hybrid. Naturally, the specifics of blockchain architecture depend on the type.</p>



<figure class="wp-block-table is-style-stripes"><table><tbody><tr><td><strong>Type of Blockchain&nbsp;</strong></td><td><strong>Description</strong></td><td><strong>Scalability</strong></td><td><strong>Examples</strong></td></tr><tr><td><strong>Public Blockchain</strong></td><td>A decentralized blockchain accessible to anyone with an internet connection</td><td>Limited</td><td>Bitcoin, Ethereum</td></tr><tr><td><strong>Private Blockchain</strong></td><td>A blockchain that is only accessible to a select group of individuals or organizations</td><td>High</td><td>Hyperledger Fabric, Corda</td></tr><tr><td><strong>Hybrid Blockchain</strong></td><td>A blockchain that combines the features of both public and private blockchains</td><td>High</td><td>Dragonchain, EWF Baseline</td></tr><tr><td><strong>Consortium Blockchain</strong></td><td>A blockchain that is governed by a consortium of organizations</td><td>High</td><td>R3 Corda, Hyperledger Fabric</td></tr></tbody></table></figure>





<h3 class="wp-block-heading"><strong>Public Blockchains</strong></h3>



<p>Public blockchains are open to everyone and are not restricted by permissions. They can employ a variety of consensus mechanisms, although scalability can be challenging due to the increasing demands of a broad user base. Bitcoin and Ethereum are classic examples.</p>



<h3 class="wp-block-heading"><strong>Private Blockchains</strong></h3>



<p>Private blockchains are created for enterprise needs. It is a permissioned blockchain that is only accessible to a selected few, typically for business organizations. Hyperledger Fabric is one of the most prominent private blockchains.</p>



<h3 class="wp-block-heading"><strong>Hybrid Blockchains</strong></h3>



<p>Public and private blockchains have their pros and cons. The idea behind a hybrid blockchain, like Dragonchian, is to get the best of the two worlds.</p>



<h3 class="wp-block-heading"><strong>Consortium Blockchains&nbsp;</strong></h3>



<p>Consortium blockchains, such as R3 Corda, are owned and governed in partnership, i.e., when several private nodes form a consortium blockchain.</p>



<h2 class="wp-block-heading"><strong>Layered Structure Of Blockchain Architecture</strong></h2>



<p>Depending on a blockchain type, there are different ways to implement its architecture, and there is no standard for it. However, most blockchains typically have the following structure:</p>



<figure class="wp-block-table is-style-stripes"><table><tbody><tr><td><strong>Layer</strong></td><td><strong>What it does</strong></td><td><strong>Components</strong></td></tr><tr><td><strong>Application</strong></td><td>Hosts applications that interact with the blockchain.</td><td>Smart Contract, User Interface, Decentralized Applications</td></tr><tr><td><strong>Services &amp; Optional Components</strong></td><td>Enhances the functionality of the blockchain with additional services.</td><td>Governance/DAOs, Oracles, Wallets, Blockchain Monitor</td></tr><tr><td><strong>Protocol/Consensus</strong></td><td>Defines and regulates how nodes in a blockchain come into agreement.</td><td>Consensus, Sidechains, Permissioned and Permissionless, Propagation Protocol, Virtual Machines</td></tr><tr><td><strong>Network</strong></td><td>Facilitates effective discovery and interaction among nodes.</td><td>Communication Mechanisms, Trusted Execution Environments, Recursive Length Prefix</td></tr><tr><td><strong>Data</strong></td><td>Caters for the creation, management, and encryption of data.</td><td>Digital Signatures, Hash, Merkle Tree, Data Blocks, Asymmetric Encryption, Storage</td></tr><tr><td><strong>Hardware/Infrastructure</strong></td><td>Provides the physical resources needed to host a blockchain.</td><td>Mining, Nodes, Tokens, Servers</td></tr></tbody></table></figure>



<h3 class="wp-block-heading"><strong>Application Layer</strong></h3>



<p><em>Provides blockchain-based applications for the end user.</em><br><br>The application layer is the end product of the entire system offering specific products for the users, i.e., wallet, lending, staking, etc.</p>



<p>The application layer starts with a smart contract, a programmable code that governs state transitions. It can function as an escrow, payment channel, or vault and is known by different names in various ecosystems, like "programs" in Solana and "chaincode" in Hyperledger. Smart contracts are a frequent target for hackers, as any critical error in its code can be exploited for illegal gains.&nbsp;</p>



<p>Usually, users don’t interact with the smart contract directly. Instead, they rely on a front end of a Web3 application or an API. The Uniswap website is an example of a decentralized app combining UI and smart contracts.</p>



<h3 class="wp-block-heading"><strong>Services And Optional Components</strong></h3>



<p><em>Amplifies blockchain capabilities with additional features.</em><br><br>The services layer creates Web3 interconnection, removing barriers and enabling smooth interactions. Optional elements include Decentralized Autonomous Organisations (DAOs), aiding administration and communication in networks like Arbitrum and Polygon, but absent in Bitcoin and Ethereum. Oracles bridge Web3 applications with real-world data on asset pricing, aiding off-chain computations. Hot wallets store on-chain assets but also serve as access points, for example, Metamask or Kaikas – a native wallet for Klaytn. Lastly, block explorers track chain health, helping detect technical glitches and security breaches and mitigate issues early.&nbsp;</p>



<h3 class="wp-block-heading"><strong>Protocol (Consensus) Layer</strong></h3>



<p><em>Set rules for node agreement on the state</em>.<br><br>The protocol layer sets the rules for blockchain participation, with the consensus mechanism being its key component. Consensus ensures agreement among nodes for block mining and processing and outlines validator requirements, varying across proof-of-work, proof-of-stake, and other <a href="https://hacken.io/discover/consensus-mechanisms/">consensus mechanisms</a>. Propagation protocol broadcasts decisions, while protocol audits ensure security against threats like 51% attacks.</p>



<p>Blockchains can be permissioned (limiting access) or permissionless (open to all). Sidechains, operating parallel to main chains with separate consensus mechanisms, offer enhanced capabilitiesю An example is the Polygon-Ethereum relationship.</p>



<h3 class="wp-block-heading"><strong>Network Layer</strong></h3>



<p><em>Provides for peer node interaction</em>.<br><br>The network layer enables effective discovery and interaction among peers called nodes. Typically, a node locates a bootnode, which scans for available peers and initiates bonding. As information circulates, it's safeguarded through a Trusted Execution Environment (TEE) to maintain integrity. Node session maintenance varies across networks; for example, Ethereum employs Recursive Length Prefixes, defining the time nodes take to locate, authenticate, and share data.</p>



<h3 class="wp-block-heading"><strong>Data Layer</strong></h3>



<p><em>Ensures secure and confident message transmission</em>.<br><br>The data layer of blockchain technology is primarily concerned with data storage and structure. It houses the blockchain, a linear succession of blocks that store transaction information. Depending on the specific blockchain, the data structure can range from a simple transaction list, such as the one used by Bitcoin, to a more intricate structure, like Ethereum's state trie, which stores contract state information.</p>



<p>While the specifics of transaction addition and hashing used aren't the focus here, it is important to note that the data layer does play a role in maintaining integrity and privacy. This is the layer where most cryptographic primitives used in the protocol – signature algorithms, cryptographic libraries, and public-private key pairs — are defined and should be tied to high-security standards.</p>



<p>Asymmetric encryption is a critical component, with a public-private key pair keeping the data confidential. The public key is associated with a wallet address, and the private key grants control over assets tied to that address.</p>



<p>Every transaction is accompanied by a digital signature, a cryptographic mechanism that validates the control of the correct private key without revealing it, thus ensuring security. Cryptographic signatures are generated by signature algorithms such as The Elliptic Curve Digital Signature Algorithm, Rivest–Shamir–Adleman, and so on.</p>



<h3 class="wp-block-heading"><strong>Hardware/Infrastructure Layer</strong></h3>



<p><em>Provides the necessary capacities to host a blockchain.</em><br><br>Blockchain architecture extends to hardware and infrastructure. In this layer—In Proof-of-Work consensus protocols—miners and validators operate, with miners creating new blocks using specialized equipment (GPU, ventilator, stabilizer) and electricity, and validators running nodes for block mining. As for data storage, some blockchains opt for third-party decentralized data hostings, such as Filecoin, IPFS, Arweave, or Firebase, due to capacity limitations.</p>



<p>Nodes, or clients, come in three types: full, light, and archive nodes. Full nodes store the entire chain's state, participate in consensus processes, and provide data upon request. Light nodes host only block summaries, while archive nodes store transaction data from the genesis block to the present, available for user queries.</p>



<p>The infrastructure layer also includes virtual machines, which act like operating systems and host smart contracts. Blockchains often have native virtual machines, such as the Avalanche Virtual Machine for Avalanche and the Ethereum Virtual Machine for Ethereum. However, a blockchain can also be compatible with other virtual machines.</p>



<h2 class="wp-block-heading"><strong>Understanding Layers 1 and 2 Blockchains</strong></h2>



<p>Application, Services, Protocol, Network, Data, and Infrastructure layers make up a complete blockchain. However, it's also important to understand <a href="https://hacken.io/discover/l1-l2-scalability/">L1 vs. L2 scalability solutions</a>, as these are the “layers” you’ll come across most often.</p>



<figure class="wp-block-table is-style-stripes"><table><tbody><tr><td></td><td><strong>Features</strong></td><td><strong>Scaling Solutions</strong></td><td><strong>Examples</strong></td></tr><tr><td><strong>Layer 1</strong></td><td>Independent, Secure, Permissionless</td><td>Sharding, Forks</td><td>Ethereum, Bitcoin, Solana</td></tr><tr><td><strong>Layer 2</strong></td><td>Dependent, Scalable, Fast</td><td>State Channels, Nested Blockchains, Rollups, Sidechains</td><td>Polygon, Lightning Network, Arbitrum</td></tr></tbody></table></figure>



<h3 class="wp-block-heading"><strong>Layer 1 Blockchains</strong></h3>



<p>Ethereum and Bitcoin are the two most dominant L1s in Web3. Layer 1 blockchains are foundational and self-sustaining chains. They are mostly public and permissionless. A typical layer 1 blockchain has all components of blockchain architecture.</p>



<p>The scalability of most L1s, however, can be quite modest due to their technical bottlenecks. Some L1s have been proactive with native scaling solutions. For instance, Ethereum is implementing sharding to fast-track its throughput.</p>



<h3 class="wp-block-heading"><strong>Layer 2 Blockchains&nbsp;</strong></h3>



<p>Layer 2 blockchains provide scaling in the form of higher throughput and lower gas while relying on L1 for security and underlying operations. But they typically implement a different consensus layer.</p>



<p>There are various creative ways L2 carries out its scaling activities: running a side chain, state channels, rollups, or nested blockchains. The Lightning Network and Stack are remarkable examples of an L2 in the Bitcoin ecosystem.</p>



<h2 class="wp-block-heading">Final Thoughts</h2>



<p>A blockchain is an eventual product of different compartments and layers. These layers provide it with various factors it needs to function properly.</p>



<p>Note, however, that one of the greatest pain points of blockchain technology is security breaches. Each layer of the blockchain is prone to vulnerabilities. To that end, the protocol, dApp, and smart contracts should be <a href="https://hacken.io/services/blockchain-security/blockchain-protocol-security/">comprehensively audited</a> to block off potential security threats.</p>



<p class="has-text-align-center has-pale-cyan-blue-background-color has-background has-medium-font-size"><a href="https://twitter.com/hackenclub">Follow @hackenclub on 𝕏 (Twitter)</a></p>



<hr class="wp-block-separator has-css-opacity"/>



<h2 class="wp-block-heading"><strong>FAQs</strong></h2>



<div class="schema-faq wp-block-yoast-faq-block"><div class="schema-faq-section" id="faq-question-1684310756614"><strong class="schema-faq-question"><strong>What are the 5 main layers of blockchain architecture?</strong></strong> <p class="schema-faq-answer">A blockchain needs 5 main layers in its architecture: Application Layer, Protocol (Consensus) Layer, Network Layer, Data Layer, and Hardware/Infrastructure Layer.</p> </div> <div class="schema-faq-section" id="faq-question-1684310763097"><strong class="schema-faq-question"><strong>What are the different types of blockchain architecture?</strong></strong> <p class="schema-faq-answer">Different types of blockchain architecture include public blockchains, private blockchains, hybrid blockchains, and consortium blockchains.</p> </div> <div class="schema-faq-section" id="faq-question-1684310770217"><strong class="schema-faq-question"><strong>What are the components of blockchain architecture?</strong></strong> <p class="schema-faq-answer">A blockchain has different components based on why it was created. Generally, the components often include consensus algorithms, P2P nodal interactions, hash, system management, etc.</p> </div> </div>

Oleh Malanii

Get our latest updates and expert insights on Web3 security