Litepaper
A new approach for Web3 projects’ security
The Sayfer LitePaper lays out a 360° cyber approach for Web3 projects and protocols, beyond the one-time smart contract audit.
The problem
Web3 hacks are on the rise. Every few days, another major project gets hacked. At best, the only security measure Web3 projects perform is an audit of their contracts. This security measure eventually leaves many other aspects of the business vulnerable to attacks. We’ve often seen this in hacks like the $120M BadgerDAO hack, the $650M Ronin Bridge hack, and pretty much every CEX that lost its private keys.
This old approach contains many lousy security practices that increase the chance of getting hacked:
- Problem 1Single point of failure. When creating complex projects and protocols, you want to ensure that even if one component of your system is compromised, you won’t lose all of your funds. It is easy to know where the obvious points of failure are, but tough to find the not-so-obvious ones, like a stolen employee phone connected to a GitHub account that can push new code.
- Problem 2Lack of security layers. Security is not a binary outcome; it is layers. You cannot lock the door and leave the window open. If your risk is high, you should mitigate it with more security layers, with each component monitored and abnormal behavior blocked based on predefined policies.
- Problem 3One-time testing. The nature of audits is to occur once every few months, yet projects cannot risk being less secure the rest of the year. The Wormhole bridge exploit is a perfect example: eight hours after a commit with a deprecated function was deployed, $300M was stolen. Proper CI/CD tools and ongoing security measures would have prevented it.
The solution: a 360° cyber approach
Projects and protocols aren’t just contracts. They are complex systems that require complex solutions. As a native Web3 cybersecurity company, Sayfer understands the architecture of your platform, the structure of your business, and the budget and development hours you can allocate. We provide a tailor-made, complete cybersecurity roadmap, and your security grows at the same pace as your project.
- Step 1Active and passive assessment. First we talk to you and understand your applications, architecture, employees and known vulnerabilities. Then we test your claims by trying to hack into your system: a security audit of the contracts, a standard penetration test of your web or mobile application, or a red-team style test to find novel breaches.
- Step 2Historical hacks analysis. Hackers copy what works. To predict where the next attack on your system will come from, we analyze hacks of projects with a similar structure and features to yours, from private-key losses at centralized exchanges to social engineering in NFT and Discord communities.
- Step 3Build a cybersecurity roadmap. We map all valuable assets and their attack vectors, then protect them from several angles, in multiple layers, in runtime. Typical steps include fixing known vulnerabilities, implementing security layers (3rd-party products and in-house modules), a secure software development process, security architecture modifications, secure business processes, and employee education.
- Step 4Implementation guidance. Cybersecurity is not a one-time show. We help you implement 3rd-party tools and write their policies, consult when you design new modules that affect security, modify the roadmap as business requirements shift, and help you in case of an incident: what happened, what got lost, and what to do about it.
Summary
Web3 security is hard, and almost any project is a victim of some sort of cybersecurity attack. Using our unique approach to 360° cyber protection, we take your project to the highest possible level of security standards: we find the security assets and breaches of your system, analyze historical hacks of similar projects, build a security roadmap that adds layers and prevents a single point of failure, and stay by your side to implement it correctly.
Want to hear more?
Write us and get a free consulting meeting.
