🔒 SECURITY FIRST:
Our smart contracts are fully audited by the chads @chainthreatsec ✅
🛡️ Wager funds protected by secure escrow
⚡ Session keys verified safe
🔐 Game logic tamper-proof
🏆 Prize pool distributions guaranteed
Your ETH is safe. Your strategy is what matters.
Bet with confidence. 💰
The @playhuego audit is complete and soon to be listed on the official @AbstractChain Portal!
ChainThreat Security (Web2/Web3 assessments) executed the audit, led by @abarbatei.
Big thanks to @0xmorgosh & team for the trust.
More audits coming to Abstract soon!
Full report 👇
One of the most common security vulnerabilities I see in web dApp assessments is relying on signed messages (i.e., personal_sign) for authentication.
Web3 dApps often use personal_sign for authentication, assuming it’s secure because only the owner of the wallet can sign messages. But what if attackers trick users into signing something they shouldn’t from a fake site?
The Risk:
An attacker can phish a signature from a user and reuse it to impersonate them, transfer offchain assets to a new onchain wallet, or execute layer-2 transactions—without needing their private key.
Actual Findings:
- The ability to phish admin account signatures to access their cloud hosted airdrop portal for unauthorized minting of assets.
- The ability to takeover player accounts and their in-game NFT assets.
How to Fix It:
- Require two-factor auth for sensitive state changing actions
- Implement strict CORS policies to prevent phishing attempts
- Require domain-bound signatures (EIP-4361: Sign-In with Ethereum)
- Use a nonce in signed message requests to prevent replay attacks
**The risks vary depending on if you're operating on a layer 2 protocol, use a Web2 backend, or are using pure web3 infra without a backend.
If your dApp uses personal_sign, how do you prevent signature reuse?
The 3 Most Common Front-End Attacks on DApps
@1inch & @Cointelegraph fell victim to front-end exploits last month. DApps using @solana's web3.js were hit just this week.
Hackers don’t stop at smart contracts—they find the weakest link.
Here’s how to protect your DApp 🧵
The following dapps should ensure their versions of the Lottie Player js library are pinned to <= 2.0.4. Blockaid identified a supply chain attack affecting versions >= 2.0.5
@Velvet_Capital@dexkit@DeBox_Social@yup_io@StabilityW_AI
https://t.co/LSIhYOExTu
🚨 URGENT: Blockaid systems have detected a potential supply chain attack targeting dApps that use Lottie Player.
A new version of this npm packaged was deployed a couple of minutes ago, with multiple legitimate dApps now issuing malicious transactions.
More updates soon.
We ran a quick scan and the following dapps run the vulnerable library identified by @blockaid_. We'll keep scanning for other dapps. Reach out if you think you might be vulnerable.
@EDUMOfficial, @DeBox_Social, @Crypto_Scratch_
🚨 URGENT: Blockaid systems have detected a potential supply chain attack targeting dApps that use Lottie Player.
A new version of this npm packaged was deployed a couple of minutes ago, with multiple legitimate dApps now issuing malicious transactions.
More updates soon.
Honored to receive such a testimonial from @TomBilyeu on my penetration testing and consulting work for @projectkyzen. With @chainthreatsec, we’re bridging traditional security assessments into Web3, delivering end-to-end testing across your entire attack surface.
Recently @_jasondoyle has been testing a lot of security-focused browser extensions. With this he helped us catch a potential bypass of our extension.
Now that the issue is fixed, we want to send him a public shoutout for all this work he's doing for the crypto community! 🫡
Front-end attacks and phishing continue to be major attack vectors draining user wallets. Our founder @_jasondoyle has been working with several Web3 scam detection providers to enhance their capabilities.
Working with the community is a core value of our team at Blockaid, which is why we would like to take a moment to shout out @jdoylesecurity and the work he's been doing lately to help security providers up their game, like this recent analysis of security tools or his dApp security course 🦾
Security Researcher @jdoylesecurity has been doing important penetration testing to help improve Web3 security tooling.
Today he shares his methodology on the Revoke blog to help more people become security researchers and make the industry safer.
https://t.co/PDmi4XZy5Y
Thank you for the shout-out! Remember, #Web3Security is more than #SmartContract audits. Open to share more insights and help others secure their projects. Feel free to reach out for advice or discussions. Let's strengthen Web3 together! 💪 #Blockchain#CyberSecurity