Web3 security -hidden 100 billion market

Once, the Greeks constructed a horse with a giant wood, dedicated to the city of Troy.People in the city think they are a symbol of peace, and they do not know that there are threats hidden in it.

With the successful launch of the Bitcoin ETF, more and more new users and funds are reopening to Web3. The preheating of the market seems to indicate that the future of Web3 is closer to the future of large -scale applications.However, the lack of policy and hidden safety hazards are still the main obstacles to hindering the widespread popularization of cryptocurrencies.

In the encrypted world, hackers can directly profit millions or even hundreds of millions of dollars through vulnerabilities on the attack chain. At the same time, the anonymous of cryptocurrencies created conditions for the whole body of the hacker.As of the end of 2023, the total lock value (TVL) of all decentralized finance (DEFI) protocols was about $ 4 billion (currently $ 10 billion),In 2022 alone, the total value of the DEFI agreement stolen to token reached 310 million US dollars, accounting for 7 %of the above value.This number fully illustrates the seriousness of security issues in the Web3 industry, just like the Damocles sword hanging on our head.

Not only is it the environment on the chain, the security issues of the web3 user side cannot be underestimated.Judging from the data disclosed by SCAM SNIFFER, 324,000 users were stolen by 324,000 users in 2023, and the total value of the stolen amount was as high as 295 million US dollars. Both the influence and the amount of the amount were very serious.However, from the perspective of users, the security accident itself is lagging -before the accident occurs, users often have difficulty fulfilling the seriousness of potential risks.Therefore, people often fall in“Survivor error”, Thus ignoring the importance of security.

Starting from the security challenges faced by the current market, this article explores the security risks brought by the rapid growth of Web3 users.By analyzing the security solutions proposed by companies such as GoPlus, we further understand how to support the large -scale application of Web3 from the aspects of compliance and security.We believe that web3 security is a 100 billion -level market that has not been fully excavated, and as the web3 user group continues to expand, the demand for user security services has shown an index -level growth trend.

The article has long known?

Hidden threats and 100 billion markets

1.1 Asset safety

1.2 Behavior

1.3 Protocol Security
Web3 security track analysis
Next generation of security products: escort for large -scale application for web3
Conclusion

The full text is 5400 words, and it is expected to read 12 minutes

Hidden threats and 100 billion markets

At present, Web3’s safe product forms are mainly TOB, TOC, TOD.The B -side is mainly the safety audit of the product. It conducts the penetration test and output audit report for the product, mainly for safety protection on the product side.The C -end is mainly aimed at the protection of user security environment. Based on real -time capture and analysis of threat intelligence, the detection service is output through the API, and security protection is performed on the user side.The TOD (Developer) is mainly for developer tools to provide automated security audit tools and services provided by Web3 developers.

Security audit is a necessary static security measure.Almost every web3 product will conduct safety audit and publicize the audit report.Security audits not only enable the community to verify the security of the secondary verification agreement, but also one of the basis for users to trust products.

However, security audits are not universal.In view of the development trend and current narrative of the market, we foresee that the challenge of the user’s security environment will continue to rise, mainly reflected in the following aspects:

Asset safety

The start of each round of market must be accompanied by the issuance of new assets.With the popularity of ERC404 and the rise of FT and NFT hybrid tokens, the issuance of assets on the chain in the future will continue to innovate and complex.The challenges to the security of new assets are increasing day by day.With the mapping and integration of different asset types through smart contracts, the system complexity increases, and correspondingly, its security is also facing greater challenges.This complexity provides a broader attack space for attackers. For example, by designing a specific callback mechanism or tax collection mechanism, attackers can interfere with asset transfer and even launch direct DOS attacks.This makes it difficult for traditional asset issuance contract security audits and formalized verifications of such Pre-Chains.It has real -time monitoring, warning, and dynamic interception solutions.

Behavioral safety

Data provided by CSIA shows that 90 %of network attacks begin with phishing.This is also applicable to Web3. The attackers aim at users’ private keys or chain funds. Through platforms such as Discord, X, Telegram, sending fishing links or fraud information, guiding unwavering users to conduct wrong transfer, wrong smart contract interaction, Or install virus files and other behaviors.

The interaction on the chain has high learning costs, which is anti -human.Even a offline signature can cause the loss of millions of dollars. When we click on the signature, facing various input parameters, do we really know what we are authorized?On January 22, 2024, a cryptocurrency user suffered a fishing attack and signed a Permit signature with error parameters.After obtaining the signature, the hacker used the signature -authorized wallet address to take away the tokens worth $ 4.2 million from the user’s account.

The weakness of the security environment of the user can also lead to asset loss.For example, when the user imports the private key into the Android APP wallet, the private key is often kept on the mobile phone’s clipboard after copying.In this case, the private key will be read when opening the malicious software, and automatically detects the chain assets possessed by the wallet automatic transfer after automatic transfer, or stole user assets after the incubation period.

As more and more new users enter Web3, the security problem of the user environment will become a huge hidden danger.

Protocol security

Re -attacking is still one of the biggest challenges facing the security of the agreement.Although many risk control strategies have been adopted, incidents involving such attacks frequently occur.For example, in July last year, CURVE suffered a severe re -attack due to the defect of the compiler of the contract programming language Vyper, which led to a loss of up to $ 60 million. This incident also widely questioned the security of Defi.

Although there are many “white box” solutions for contract source logic, hackers like CURVE have revealed an important issue: even if the source code of the contract is correct, the problem of the compiler may cause the final operation results and expectations and expectationsThere are differences in design.The “conversion” of the contract from the source code to the actual Runtime is a challenging process. Each step may bring unexpected problems, and the source code itself may not completely cover all potential scenes.Therefore, the security of the source code and the compilation level is not enough; even if the source code seems to be perfect, due to the problem of the compiler, the vulnerability may still appear quietly.

As a result, Runtime protection will become necessary.Unlike existing risk control measures at the level of the source code of the agreement and take effect before the operation, the protection of the protection rules and operations involved in the preparation of the agreement developers during runtime to handle the unpredictable situation during the operation.This helps perform real -time assessment and response to the results of runtime execution.

According to the predictions of the crypto asset management company Bitwise, the total cryptocurrency assets in 2030 will reach $ 16 trillion.If we quantitative analysis from the angle of security cost risk assessment (Security Cost Risk Assessment), the occurrence of the occurrence of security accidents is almost 100 % asset loss, so the exposure factor (EF) can be set to 1, so a single loss can be set, so a single loss can beSingle Loss Expectancy (SLE) is $ 16 trillion.When the annual incidence (ARO) is 1 %, we can get annual dispersion (ALE), which can get the maximum value of $ 160 billion, that is, the largest value of cryptocurrency assets.

Based on the severity of cryptocurrency security stories, frequent and high -speed growth in the market size, we can foresee that Web3 security will be a $ 100 billion market, accompanied by the growth of the Web3 market and user scale, and grows at a high speed.Furthermore, considering the huge growth of individual users and the increasing attention to asset security,We can foresee that the C -end market’s demand for Web3 security services and products will show geometric growth, which is a blue ocean market that is still digging.

Web3 security track analysis

With the continuous emergence of Web3 security issues, people have increased significantly for the need to protect digital assets, verify the authenticity of NFT, monitor decentralized applications, and ensure that advanced tools that ensure anti -money laundering regulations have increased significantly.According to statistics, the current security threat facing Web3 mainly comes from:

Agreement -oriented hacker attack
Fraud, fishing, and private key theft for users
Security attack on the chain itself

In order to cope with these risks, companies in the current market mainly launch corresponding services and tools with TOB testing and auditing (Pre-Chain) and TOC monitoring.Compared to TOC, TOB track players have launched earlier, and new players continue to enter the venue.However, with the complexity of the Web3 market environment, the TOB audit is gradually difficult to cope with various security threats, the importance of TOC monitoring is also highlighted, and its demand has also continued to increase.

In the current market, companies represented by Certik and Beosin provide TOB testing and audit services.Most of the services provided by such companies are smart contract levels, and the security audit and formalized verification of smart contracts are performed.After this type of pre-Chain method, through wallet visual analysis, smart contract vulnerability security analysis, source code security audit, etc., smart contracts can be detected to a certain extent to reduce risk.

The TOC monitoring is performed on the ON-Chain process, and the risk analysis, transaction simulation, and status monitoring of smart contract code, chain status, user transaction meta-information information are completed.Compared to TOB, the C -end security company of Web3 is generally late, butThe growth rate is very considerable.The services provided by Web3 Security Company represented by GoPlus are gradually applying to various ecosystems of the Web3.

Since Goplus was founded in May 2021, its application API daily daily adjustment has risen rapidly. From the initial queries of hundreds of times a day, to 20 million times a day in the market peak.The figure below shows the change in the amount of calls from 2022 to 2024. Its growth rate shows the growth of GoPlus in the field of web3.

The user data module launched by it has gradually become an important part of various types of web3 applications, on top market websites such as CoinmarketCap (CMC), Coingecko, DEXSCREENER, Dextools, SUSHISWAP, Kyber Network and other leading decentralized exchanges, as wellMetamask Snap, Bitget Wallet, SafePal and other wallets play a key role.

In addition, the module is also used by user security service companies such as Blowfish, Webacy, Kekkai.This shows the important role of the GoPlus user security data module in defining the security infrastructure of Web3 ecosystems, and also proves its important position in contemporary decentralized platforms.

GoPlus mainly provides the following API services. Through targeted data analysis of multiple key modules, it provides comprehensive insight into user security data to prevent continuous evolutionary security threats and respond to many aspects of Web3 security challenges.

Token Risk API: Used to evaluate risks related to different cryptocurrencies
NFT Risk API: Used to evaluate the risk summary of various NFT
Malicious address API: Used to identify and mark fraud, online fishing, and other malicious activities related adDRESS
DAPP Security API: Provide real -time monitoring and threat detection for decentralized applications
Approval contract API: Used to manage and audit the authority of intelligent contract calls

We also noticed Harpie on the C -side track.Harpie focuses on protecting the Ethereum Wallet Steal, and cooperates with companies such as OpenSea and Coinbase. It has protected thousands of users from security threats such as fraud, hacking attacks, and private keys.The company launched the product from two aspects: “monitoring” and “recovery”, looking for vulnerabilities or threats by monitoring wallets, and immediately notified and helped users repair after discovering vulnerabilities;Response, save assets.It can prevent attack and respond to safety emergencies, and has achieved great results in the safety of Ethereum wallets.

In addition, SCAMSNiffer provides services in the form of a browser plugin.The product can detect the real -time detection through the malicious website detection engine and multiple blacklist data sources before the user opens the link to protect the user from the influence of malicious websites.When users conduct online transactions, provide detection of fraud methods such as online fishing to protect user asset security.

Next generation of security products: escort for large -scale application for web3

In response to the problems such as asset security, behavior safety, agreement security and other problems in the chain, and the needs of compliance on the chain, we have deeply studied the solution of GoPlus and Artla. The purpose is to understand how they maintain the user’s security environment and chain chain.The upper operation environment supports the large -scale application of Web3.

User safe environment INFRA

Blockchain transaction security is the cornerstone of Web3 large -scale application security.The hacking, fishing attacks and Rug Pulls on the chain are frequent. The trading trace of transactions on the chain, suspicious behavior identification on the chain, and the security of user portrait ability are critical.Based on this, Goplus launched the first full -scene personal security detection platform Secwarex.

Secwarex is a Web3 personal security product constructed based on the Secware user security protocol. It provides a complete period of operation that includes a real -time identification chain, alarm, and interception in time.Specific scenario customized safety interception strategy.

In response to the security education of user behavior, Secwarex cleverly combines learning security knowledge with obtaining tokens by launching the Learn2earn program, so that users can also get practical rewards while enhancing security awareness.
Fund compliance solution

Anti -money laundering (AML) is one of the most urgent demands on the current public blockchain.On the public chain, by analyzing the source of the transaction, the expected behavior, the amount, the frequency and other factors, the suspicious or abnormal behavior can be identified in a timely manner, which helps decentralized exchanges, wallets and regulators to detect potentialIllegal activities, and take measures such as warning, frozen assets or reporting to law enforcement agencies in a timely manner to strengthen the compliance and large -scale application of DEFI.

As the behavior on the chain is continuously enriched, the decentralized application Know Your Transaction will become an indispensable condition for large -scale applications.Goplus’s malicious address API is important for exchanges, wallets and financial services operating in Web3 and to ensure its operations and ensure its operations.Continue monitoring and adapting to ensure the importance of the integrity of the ecosystem and the importance of its user security.
Chain security protocol

ARTELA is the first public chain Layer1 that is protected by natively supporting runtime.Through the EVM ++ design, ARTELA dynamically integrated native extension module ASPECT supports adding extension logic at each cut point of the trading life cycle to record the execution status of each function call.

When a threatening repeatable calls occur during the execution of the callback function, the ASPECT detects and immediately retrases the transaction to prevent the attacker from using the loophole.Taking the re -incoming attack protection of the Curve contract as an example, Artla provides a chain -based protocol security solution for various DEFI applications.

With the increase of the complexity of the protocol and the diversity of the underlying compiler, the “black box” solution protected during the runtime on the chain is the importance of the “white box” solution that only conducts static inspection of the contract code logic.More prominent.

Conclusion

On January 10, 2024, SEC officially announced the listing and transactions of the spot Bitcoin ETF, representing the most important steps that the crypto asset category obtained by mainstream.With the maturity of the policy environment and the continuous strengthening of security protection measures, we will eventually see the arrival of Web3 large -scale applications.If the large -scale application of Web3 is a wave of stimulating waves, then Web3 security is a sturdy dam built for user assets, resisting foreign storms, and ensuring that everyone can pass every wave steadily.

Reference:

SCAM SNIFFER Report 2023 Cryptocurrencies network fishing fraud will steal 300 million US dollars https://drops.scamsniffer.io/zh/post/scam-sniffer-320 million US dollars of assets of 320,000 users in the annual report are malicious/this year malicious/
Mike: ERC404 Hidden hidden https://x.com/mikelee205/status/1760512619411357797?s=46&AMP ;t=0aof3l1pmoanzxpmmmmmmMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMMPKWG
How we go maInstream: The state of web3 security | patrick colorins at smartcon 2023 https://www.youtube.com/watch?v=eyf6luowgk&AMP ;t=1489ss
2023 Web3 Security LandScape Report. Https://salusec.io/blog/Web3-soCURITY- LANDSCAPE- REPORT
Defillama https://defillama.com/
Quantitative information security assessment method. Https://www.sohu.com/a/561657716_99962556
Eliminate Reentrance Attacks with-Chain Runtime Protection. Https://artla.network/blog/eliminate-attacks-with-n-runtime-ilect ION
Signature phingshing. Https://support.metamask.io/hc/en-s/Articles/18370182015899-signature-Phishing
How Dangerous is Permit Signature Fishing? $ 4.2 Million Stolen from Crypto Giant. Https://www.coinlive.com/news/how-dangerous-signature-fishing -4-2-Million-Stolen-FROM
CISA Report https://www.cisa.gov/stopransomware/general-nformation