How to solve the blockchain infrastructure security problem while creating a dApp
The race for WEB3 has begun. Enterprise capitalists, cryptocurrency startups, engineers, and visionaries are creating WEB3 (or Net 3.0) powered by blockchain. A brand new frontier arose, extra democratic, decentralized, unbiased, and superb for information restoration.
However is every part so good concerning decentralization and safety of infrastructures? No, and quite a few instances of man-in-the-middle assaults are proof of that.
However to resolve the safety problem, let’s bear in mind what WEB3 is. The core idea of WEB3 is to resolve the safety issues attributable to centralization and to supply folks with authority over their information and identification. So at what degree of expertise are these unlucky incidents of safety breaches occurring in your blockchain infrastructure? Let’s determine it out.
To concentrate on the interior points of WEB3, applied sciences comparable to EVM, Solidity, and JavaScript nonetheless play an enormous function. Nevertheless, we use Node suppliers and WEB3 API suppliers when discussing backend options.
Node suppliers are firms that will let you use their companies as a substitute of working your nodes. That is very handy as a result of as a substitute of organising your node and experiencing all of the stress and expense that comes with it, you possibly can ship your dApp transaction requests over the Web to the node supplier. When you’re desirous about sensible contract growth, you could use one or two node suppliers (for redundancy).
There are a lot of WEB3 API suppliers; nevertheless, in lots of situations, these firms work with nodes behind the scenes. With these instruments utilized, you will get any pre-compiled and pre-computed information on the chain.
Furthermore, it’s easy to determine dependable communication and interplay between totally different purposes by way of these WEB3 APIs. As well as, high quality APIs hold coding constant and secure. We, due to this fact, depend on reliable WEB3 APIs essentially the most when creating purposes.
💡 Distinction between Node suppliers and WEB3 API suppliers: WEB3 supplier permits your software to speak with a blockchain node by submitting JSON-RPC requests to a server. Node service suppliers run distributed node shoppers behind the scenes and allow them to write to and browse from a blockchain utilizing an API key.
What’s the safety menace for dApps builders?
Nodes are nonetheless comparatively primitive applied sciences, however they’re nonetheless beneficial. For instance, a WEB3 node can not inform you what customers have deposited of their accounts. Moreover merely offering uncooked blockchain data, nodes can not course of a number of sensible contracts. Moreover, nodes have restricted capabilities and may solely course of one chain. Fortuitously, there are APIs accessible that will help you circumvent this limitation.
APIs outline and standardize purposes’ interactions, permitting you to make use of uncooked blockchain information. Because of this WEB3 APIs are useful for dApp growth. WEB3 APIs are a key element within the growth of dApps; along with providing a easy interface, they permit a bit of software program to work together with different purposes. As a result of dependable APIs permit for constant coding in a secure atmosphere, dApp builders don’t have to reinvent the wheel.
Moreover, through the use of these WEB3 supplier APIs, you possibly can simply hyperlink to nodes. Subsequently, you shouldn’t have to fret about connecting to nodes when utilizing these APIs. When interacting with these suppliers, you might also obtain all kinds of beneficial precalculated and precompiled on-chain information.
However such companies don’t solely shut builders’ requests within the safety plans, and usually, it’s important to pay upfront for his or her use.
The very fact is that there are increasingly more instances of dApps being hacked utilizing the man-in-the-middle assault we talked about above.
That is when an attacker, utilizing vulnerabilities in DNS servers (for instance), switched servers to serve jsonrpc-endpoints visitors.
One sufferer is understood to have lost 16.5 WBTC (~$350,840). And about 23 cryptocurrency initiatives have already encountered an identical DNS assault.
A quite simple answer means that you can shield your self from such man-in-the-middle assaults. And we are going to return to this.
Additionally, you probably have a growth workforce, you possibly can go your individual manner and attempt to construct your answer, however you want a super-skilled workforce of like-minded folks to make it work.
The issue of this course of is that you would be able to considerably overestimate your power. A process that appears simple then raises many questions, that are solved by a few years of expertise in a single’s work. Subsequently, you probably have plenty of time and sources, you need to settle for this path.
Violation of three most important blockchain rules within the WEB3
So let’s take a breath now and have a look at the present safety challenges within the WEB3 world from an infrastructure perspective.
The primary rules of blockchain are
- decentralization
- transparency
- trustlessness
However does it work in apply? Check out the hottest dApp structure.
We are able to see that customers on the entrance finish are sending requests to JSON-RPC suppliers (this might be Infura, Alchemy, Quicknode, and so on.).
So the requests are routed to a shared atmosphere the place we now have no management over the information transformation on the API gateway, caching engine, blockchain nodes, or anything.
And that is the place the primary downside arises as a result of a shared atmosphere implies that many customers, bots, and hackers, particularly, work in the identical atmosphere. It is a actual black field for the developer that pulls an excessive amount of consideration from attackers.
Properly, this strategy contradicts all 3 rules of WEB3 as a result of:
- It centralizes entry to the Blockchain, passing every part by way of a shared atmosphere;
- It’s not clear—we can not confirm responses from such an API;
- Subsequently, it can’t be referred to as true distrust for the reason that safety problems with such an infrastructure are based mostly merely on belief. See for your self within the following diagram.
The second problem is that the described infrastructure model permits for man-in-the-middle assaults, which criminals periodically use.
The next companies could be attacked:
-
- Area or DNS registrars
- JSON-RPC suppliers
- Any third-party aggregated companies
A self-hosted cluster of blockchain nodes is the one answer
However is there an answer? Sure — configured on-prem atmosphere.
First, it makes use of a self-hosted cluster of blockchain nodes. All nodes are initialized from official genesis and synchronized utilizing p2p. This ensures information consistency.
Nodes needs to be up to date periodically with diminished snapshots to run as effectively as potential. The best answer is mechanically creating new nodes from the diminished snapshot when zooming. When you initialize the node from scratch, this strategy means that you can get a brand new node inside half-hour as a substitute of a number of days.
One other vital level is the automated replace of the blockchain software program after its launch—this will also be accomplished. The primary factor is to create a snapshot with the brand new model (as generally it could require some information operations, which might take time), after which the brand new nodes ought to begin mechanically with the brand new snapshot and up to date software program.
Under is an infrastructure diagram that solves many of the described issues.
It’s also important to watch the synchronization state and exclude these nodes which are behind the upstream circulate. This may be accomplished, for instance, with the assistance of well being checks.
Along with the truth that entry could be restricted by IP deal with, it’s price mentioning that the nice outdated JWT token can shield in opposition to area registrar or DNS assaults. JWT token is well built-in into web3js and different libraries and needs to be carried out on the API gateway aspect in our blockchain cluster.
On this manner, we make the blockchain endpoint safe and decentralized.
Summing up
Web3 remains to be in its early levels. However the race for decentralization is already on. And it is possible for you to to see that essentially the most safe purposes are more likely to be those that use essentially the most modern and open-source approaches.
And due to this fact, you shouldn’t ignore the fundamental rules of WEB3 as a result of then your newly created dApp is not going to present safety to different contributors. The one choice at present accessible is an autonomous cluster of geo-distributed blockchain nodes.
Creator:
Daniel Yavorovych
Co-Founder & CTO at RPCFast and Dysnix
