Web3 infrastructure specialist GoPlus Labs has published a report on industry security practices. It reveals the value of user data in mitigating security threats. "Uncharted Consensus: The Widespread Use and Potential of User Security Data in Web3" shows the threats and opportunities available within the web3 space and the ability of API data to identify emerging security problems.
Unpacking API Data
GoPlus Labs has developed an API suite that provides data analysis for web3 security including modules for Token Risk and NFT Risk. These APIs provide a trove of insights into user behavior and can be used to identify emerging security threats and even mitigate them. The growth in web3 users over the past two years has resulted in GoPlus APIs processing millions of calls a day. As a result, GoPlus has gained unrivaled visibility into the health of the on-chain landscape, allowing it to identify new threats.
Its latest report draws upon this rich seam of data and highlights a significant increase in malicious address API usage, which grew from 10.5 million calls in January 2023 to over 30 million by July 2023. The report explains: "By utilizing the malicious address API, platforms can identify and flag addresses associated with known fraudulent, phishing, and other malicious activities. This service is vital in preventing users from inadvertently interacting with these malicious addresses, significantly reducing their risk of potential financial loss."
Web3 Users Start Taking Precautions
As the number of security threats present in the web3 space has ramped up, so has awareness of the measures that can be taken to counter these risks. Analysis of GoPlus's Approval Security API from November 2022 to January 2024 shows a marked increase in the number of users taking action to revoke malicious token approvals to prevent their wallets from being drained.
Spikes in the usage of this API feature can be correlated with major incidents when DeFi protocols were compromised, typically through techniques such as front-end injection, as was the case with Hashflow. While such incidents result in hundreds of thousands of dollars being stolen through users inadvertently approving malicious contracts, the upside is that these cases highlight the value of digital housekeeping. Users should periodically review token approvals and revoke any permissions that are no longer required for active trading.
Derisking Token Trading
One of the most persistent risks on-chain traders face is when buying new tokens on decentralized exchanges. During memecoin season, when the appetite for risk is high, scam tokens are endemic. Many of these prove to be honeypots that can't be sold or contain a whitelist that only allows insiders to sell. There are also copycat tokens that mimic highly anticipated tokens of the same name that are due to launch.
Even experienced traders can get caught up due to the sophistication of scammers when it comes to cloaking the malicious code used in scam tokens. GoPlus highlights many of these issues in its web3 security report, citing "a concerning trend of tokens with risks such as 'is blacklisted,' and 'is honeypot,' indicating a sophisticated landscape of user security threats."
One of the key takeaways from the report is the need for dynamic security strategies that can keep pace with new threats and mitigate them as far as possible. The report concludes by listing the top 10 token risks, with the number one spot going to mintable tokens that allow the issuer to dump new tokens onto the market and send the value to zero. The second most prevalent issue is tokens whose code is not open source, which enables unscrupulous developers to include malicious code.
The GoPlus report, which can be read in full here, provides a snapshot of the web3 landscape today and shows the areas where more robust security tools are required.
