Gas Optimization In Solidity: Strategies For Cost-Effective Smart Contracts
Gas is the “fuel” that powers smart contract execution. This article offers practical strategies for Solidity gas optimization.
🇺🇦 Hacken stands with Ukraine!Learn more
Decentralized apps (dApps) are integral to the blockchain ecosystem, providing seamless user experience and extended functionality. However, their safety is often overlooked.
Before we delve into the security aspect, let’s establish a clear understanding of dApps.
A dApp is an off-chain application that interacts with the blockchain either directly through a node or indirectly via third-party services. dApps can be client-facing, offering a streamlined interface with a backend leveraging decentralized networks, or they can serve as backend applications processing blockchain data and responding to real-time events.
Although various interpretations exist, we’ll stick to this definition for clarity and cohesion.
Security should be a key consideration at every stage of a dApp’s lifecycle. However, our emphasis will be on the software development process, acknowledging the crucial need for proactive security from the early stages of development. It’s easier and more cost-effective to incorporate security measures from the start rather than adding it as an afterthought.
To ensure a secure application, it is fundamental to adhere to the main security principles of confidentiality, integrity, and availability. An application must securely manage sensitive information, provide accurate information, thoroughly verify inputs, and resist external manipulations. These principles serve as a baseline. Each application’s security requirements are unique and should be carefully identified, considering business objectives, technical constraints, and other relevant factors.
Indeed, it can be challenging to understand what aspects are relevant to your system. It is, therefore, crucial, in the initial stages of development, to foster a thorough understanding of the product you are building. Ask critical questions about user expectations, potential negative impacts, desired behaviors, and feasible undesirable outcomes in less-than-ideal scenarios. Such inquiry assists in defining clear security goals and identifying areas requiring focused attention.
Following this understanding, you can proceed to design your application. Evaluate the features, their implementation, and alignment with the pre-established goals. At this stage, scrutinize every architectural and technical decision. Do not accept statements such as “X is the most secure way to do Y” without a critical assessment. There is no one-size-fits-all solution in security. Deeply understand the strengths and weaknesses of the technology you’re using, ensuring its effective implementation to your specific use case.
Lastly, comprehensive documentation is vital. Recording your decisions and identified weak points serves as an invaluable guide for developers and security professionals, directing their focus where it is most required.
While the theory may seem simple, implementing security measures can be challenging. Therefore, we recommend following a recognized threat modeling framework, such as the “Process for Attack Simulation and Threat Analysis” (PASTA). This seven-stage linear framework aids in systematizing your security approach, closely aligning with the principles we previously highlighted:
Additional guidelines can vary according to the type of your app. Hence, we’ve curated recommendations for popular dApp use cases, considering their types and associated risks.
This type of wallet has direct access to the private key and is responsible for its safekeeping, allowing you to have full ownership of your assets. Examples of such wallets are MetaMask, HackenAI, and MyEtherWallet.
The primary security consideration, in this case, should be the safety of the private key or seed stored by the wallet:
It is also vital to consider platform-specific weaknesses. For example, whether the application runs on mobile, desktop, web, or as a web extension makes a significant difference.
When looking at off-chain server applications that are part of blockchain bridges, we can highlight specific responsibilities they usually have:
These features can help ensure cross-chain bridge security. But, of course, you should also consider other system-specific concerns, such as private key safety, if they apply to your case.
The decision to consider something confirmed should be made on information given and verified by different data providers. For example, the system can require the signatures of multiple validators to accept the cross-chain transfer as valid. In this case, it would also be necessary for each validator to use a different blockchain node, falling back on the same principle of having multiple independent data sources. See “CWE-1293: Missing Source Correlation of Multiple Independent Data” to better understand this issue.
We also encourage you to read the “Cross-chain Interoperability and Security” report to understand the ecosystem’s overall state better.
Explorers are the first stop when someone wants to see the status of the transfer they made. They are the most used dApps that currently exist, but it is also fair to say the most overlooked in terms of the security and impact they have on the day-to-day life of a cryptocurrency user. They provide valuable insight into blockchains and significantly simplify the overall user experience, but that comes at the cost of centralization. That, of course, is not a problem in its entirety but something to consider nonetheless.
In this case, the primary security concerns are the integrity of the information explorers provide and the safety of the website users.
We also recommend being cautious when using blockchain explorers as a source of blockchain information, especially if it is the single data source in the system. Unfortunately, as of writing this article, we have yet to find a single blockchain explorer that takes any responsibility in case of providing inaccurate information on the service agreement level.
These websites use third-party services, usually injected or connected wallets, to communicate with a blockchain, and they do not store or have access to users’ private keys. As a result, they are already removing substantial security risks by not requiring custody over users’ assets, leaving us to worry about less pressing but still integral security considerations.
In this case, users’ privacy and conventional web safety are the leading security concerns.
Although most blockchain ecosystems themselves thrive on transparency, there is a common assumption that users should be able to stay private if they wish to. Based on that assumption, websites should limit the information they gather that might create a link between the user’s identity and online presence or communicate to the user this is not the case. These concerns include but are not limited to IP addresses, geolocation, personal details, and other possibly identifiable information.
In conclusion, dApp security is a proactive process that begins with the design and development of your app and continues throughout its lifecycle. This comprehensive strategy should involve identifying unique security requirements, critically evaluating design decisions, and documenting known weak points for future reference. By starting with a security-focused mindset and leveraging robust auditing services like dApp Audit and Smart Contract Audit, you can build a more secure, robust, and user-friendly dApp.