dApp and web3 front end penetration testing
Front end attacks drain wallets without touching the smart contract. HYDN tests the dApp interface users interact with: wallet connection, transaction and approval construction, signing prompts, third-party scripts, DNS and hosting, and the classic web flaws such as XSS and CSRF that let an attacker change what a user signs.
What we test
- Transaction construction. Whether the calldata, recipient, amount and approval the site builds can be altered by an attacker.
- Approvals and permits. Whether the dApp ever asks for more allowance than it needs, and whether signature-based permits can be abused.
- Wallet connection. Session handling, chain switching and how the dApp behaves when a user connects a different account.
- Third-party scripts. Analytics, widgets and libraries loaded from other domains, any of which could inject a drainer if compromised.
- DNS and hosting. Registrar and DNS account security, and whether the domain or hosting could be taken over.
- Web flaws. XSS, CSRF, content security policy and clickjacking.
- RPC and APIs. The endpoints the front end trusts for balances, prices and routing.
Why this layer gets attacked
The front end is where users are, it changes often, and it is rarely in scope for a smart contract audit. Attackers who take over a domain, a build pipeline or a third-party script can serve a convincing copy of your site that asks for one extra approval. See our article on front end crypto attacks.
Frequently asked questions
Our contracts are audited. Why test the front end?
Because users interact with the front end, not the contract. If an attacker can change the transaction your site asks a user to sign, a perfect contract does not help them. Velodrome and Aerodrome both suffered front end attacks while their contracts were sound.
What is a malicious approval?
A transaction that grants an attacker permission to move a user's tokens. Once signed, the attacker can drain the approved tokens at any time, so the approval itself is the attack.
Published Updated