In the first quarter of 2022, hackers stole $1.2 billion from DeFi protocols through vulnerabilities in smart contracts. Even though there are methods to protect dApps smart contracts from hacks and exploits, the amount of lost and withdrawn funds continues to grow. This undermines user reliance in the whole crypto sphere and especially DeFi, which undergoes the larger half of attacks. How to protect your project from hacking - read in the article.
What is the difference between an exploit and a hack?
The easiest way to understand how these two types of attacks on a smart contract differ is through an example. Let's imagine that there were two robberies on the street. In the first case, the thieves had to find a master key from the lock, and then work hard to crack the safe. And in the second, they simply entered through an open window and found money in a desk drawer. The architecture of smart contracts can be complex, so developers sometimes accidentally leave "open windows" in it for hackers. Finding such vulnerabilities in a smart contract is called an exploit.
There are several common causes of smart contract hacks and exploits.
Compromised admin key. A smart contract claims to be completely decentralized and regulates the relationship between dApps users. But there are a limited number of administrators who have access to privileged functions. If a hacker steals the key, he can take control of the smart contract and steal user funds.
Errors in the smart contract. As we wrote above, the code is written by people who cannot be insured against errors. There are different types of vulnerabilities in a smart contract - sometimes it's a complex problem that is not easy to detect, and sometimes it's a simple typo in a line of code. But the result of any mistake can be calculated in millions of dollars of stolen funds.
Errors in the smart contract logic. Some projects simply copy third-party protocols due to a lack of experience and knowledge. Meanwhile, the smart contract includes all the steps and actions that the user takes. And if any part of the logic of these actions is violated, then the funds and user data are at risk.
How to protect your application from attacks
Most security issues are fairly easy to fix. Below are a few steps that the project team needs to consider when deploying their application or project to DeFi and Web 3.0
- Hire an experienced development team. Project security starts with the development of a smart contract. No matter how it seems that there are already enough ready-made smart contacts for deploying applications in blockchain networks, template solutions are not suitable for all projects. In addition, the creation of a smart contract is not the only difficult stage in the roadmap. Developers must be able to test the project properly and know how to work with smart contract audit data.
- Pass unit testing. The essence of the blockchain is that its data is immutable - if errors are found after the application is launched, they cannot be corrected. Therefore, it is necessary to test the functionality of the smart contract in advance in a test network.
- Pass an independent audit of the smart contract. It usually helps to identify errors in the code, find and assess potential vulnerabilities, and test interface logic. If the project is complex and involves large amounts of blocked user funds, it is advisable to undergo an audit in several accredited firms at once. Here are some auditors: Certik, Blaize, Hacken, SlowMist, and Chainsulting.
- Ensure the security of admin keys. You must carefully consider the storage of private keys and not trust them to third parties. It would be better to introduce multi-factor authentication - access to the smart contract could be obtained using not one, but several keys. In this case, even if one of them is compromised, attackers will not be able to access the functions of the smart contract.
- Ask help from the community or white hat hackers. This is an optional step, but in some cases, a simple audit may not be enough. For example, for new second-layer networks or multi-billion dollar DeFi protocols. The introduction of rewards for found bugs and vulnerabilities might solve several problems at once - it will improve the user experience in the application and help prevent potential hacking of the protocol.
Many of the tips above may seem obvious, but as crypto crime statistics show, not all protocols follow them. Exploits and hacks of smart contracts ultimately lead to loss of reputation, reduce industry credibility and attract the attention of regulators. Therefore, it is especially important to monitor the security measures of your project.