{"id":316743,"date":"2023-04-12T13:00:14","date_gmt":"2023-04-12T12:00:14","guid":{"rendered":"https:\/\/cryptoslate.com\/?p=316743"},"modified":"2023-04-12T02:08:55","modified_gmt":"2023-04-12T01:08:55","slug":"how-to-solve-the-blockchain-infrastructure-security-problem-while-creating-a-dapp","status":"publish","type":"post","link":"https:\/\/cryptoslate.com\/how-to-solve-the-blockchain-infrastructure-security-problem-while-creating-a-dapp\/","title":{"rendered":"How to solve the blockchain infrastructure security problem while creating a dApp"},"content":{"rendered":"

The race for WEB3 has begun. Venture capitalists, cryptocurrency startups, engineers, and visionaries are developing WEB3 (or Web 3.0) powered by blockchain. A new frontier arose, more democratic, decentralized, independent, and ideal for data recovery.<\/span><\/p>\n

But is everything so perfect regarding decentralization and security of infrastructures? No, and numerous cases of man-in-the-middle attacks are proof of that.<\/span><\/p>\n

But to solve the security issue, let's remember what WEB3 is. The core concept of WEB3 is to solve the security problems caused by centralization and to provide people with authority over their data and identification. So at what level of technology are these unfortunate incidents of security breaches occurring in your blockchain infrastructure? Let's figure it out.<\/span><\/p>\n

To focus on the internal aspects of WEB3, technologies such as EVM, Solidity, and JavaScript still play a massive role. However, we use Node providers and WEB3 API providers when discussing backend features.<\/span><\/p>\n

Node providers<\/span><\/strong>\u00a0are companies that allow you to use their services instead of running your nodes. This is very convenient because instead of setting up your node and experiencing all the stress and expense that comes with it, you can send your dApp transaction requests over the Internet to the node provider. If you're interested in smart contract development, you may use one or two node providers (for redundancy).<\/span><\/p>\n

There are many\u00a0WEB3 API providers<\/strong>; however<\/span>, in many instances, these companies work with nodes behind the scenes. With these tools applied, you can get any pre-compiled and pre-computed data on the chain.<\/span><\/p>\n

Moreover, it is simple to establish reliable communication and interaction between different applications through these WEB3 APIs. In addition, quality APIs keep coding consistent and stable. We, therefore, rely on trustworthy WEB3 APIs the most when creating applications.<\/span><\/p>\n

\ud83d\udca1\u00a0Difference between Node providers and WEB3 API providers<\/strong>:<\/span>\u00a0WEB3 provider allows your application to communicate with a blockchain node by submitting JSON-RPC requests to a server. Node service providers run distributed node clients behind the scenes and let them write to and read from a blockchain using an API key.<\/span><\/p>\n

What is the security threat for dApps developers?<\/span><\/h2>\n

Nodes are still relatively primitive technologies, but they are still valuable. For example, a WEB3 node cannot tell you what users have deposited in their accounts. Besides simply providing raw blockchain information, nodes cannot process multiple smart contracts. Furthermore, nodes have limited capabilities and can only process one chain. Fortunately, there are APIs available to help you circumvent this limitation.<\/span><\/p>\n

APIs define and standardize applications' interactions, allowing you to use raw blockchain data. This is why WEB3 APIs are helpful for dApp development. WEB3 APIs are a key component in the development of dApps; in addition to offering a simple interface, they allow a piece of software to interact with other applications. Because reliable APIs allow for consistent coding in a stable environment, dApp developers don't need to reinvent the wheel.<\/span><\/p>\n

Furthermore, by using these WEB3 provider APIs, you can easily link to nodes. Therefore, you do not have to worry about connecting to nodes when using these APIs. When interacting with these providers, you may also receive all sorts of valuable precalculated and precompiled on-chain data.<\/span><\/p>\n

But such services do not entirely close developers' requests in the security plans, and in most cases, you have to pay in advance for their use.<\/span><\/p>\n

The fact is that there are more and more cases of dApps being hacked using the man-in-the-middle attack we mentioned above.<\/span><\/p>\n

This is when an attacker, using vulnerabilities in DNS servers (for example), switched servers to serve jsonrpc-endpoints traffic.<\/span><\/p>\n

One victim is known to\u00a0<\/a>have lost 16.5 WBTC<\/a><\/span>\u00a0(~$350,840). And about 23 cryptocurrency projects have already encountered a similar DNS attack.<\/span><\/p>\n

A very simple solution allows you to protect yourself from such man-in-the-middle attacks. And we will return to this.<\/span><\/p>\n

Also, if you have a development team, you can go your own way and try to build your solution, but you need a super-skilled team of like-minded people to make it work.<\/span><\/p>\n

The difficulty of this process is that you can significantly overestimate your strength. A task that seems easy then raises many questions, which are solved by many years of experience in one's work. Therefore, if you have a lot of time and resources, you should accept this path.<\/span><\/p>\n

Violation of 3 main blockchain principles in the WEB3<\/span><\/h2>\n

So let's take a breath now and look at the current security challenges in the WEB3 world from an infrastructure perspective.<\/span><\/p>\n

The main principles of blockchain are<\/span><\/p>\n