# Web3 Security is Embarrasing by Andrew MacPherson | Devcon SEA

- Channel: [Devcon](https://streameth.org/devcon)
- Date: 2025-10-09
- Duration: 21:48
- Topics: Science & Technology
- Watch: https://streameth.org/watch/yt-4dr7sL42GAw
- YouTube: https://www.youtube.com/watch?v=4dr7sL42GAw

## Description

The explosive growth of Web3 has brought about innovation, decentralization, and financial opportunity. But let’s be honest—Web3 security is a disaster. In this talk, we’ll confront embarrassing truths: drainer attacks, weak wallet protections, and overlooked vulnerabilities. But we won’t stop there; I’ll share practical fixes to protect users and show how Web3 developers can raise the bar. If we want Web3 to thrive, we have to stop attackers beating us with low-effort attacks. We can do better!

Speaker(s): Andrew MacPherson
Skill level: Intermediate
Track: Security
Keywords: Security, Sustainability, User Experience

Follow us: https://twitter.com/efdevcon, https://twitter.com/ethereum, https://warpcast.com/devcon
Learn more about devcon: https://www.devcon.org/
Learn more about ethereum: https://ethereum.org/ 

Visit the https://archive.devcon.org/ to gain access to the entire library of Devcon talks with the ease of filtering, playlists, personalized suggestions, decentralized access on Swarm, IPFS and more.

Devcon is the Ethereum conference for developers, researchers, thinkers, and makers. 
Devcon SEA was held in Bangkok, Thailand on Nov 12 - Nov 15, 2024.
Devcon is organized and presented by the Ethereum Foundation. To find out more, please visit https://ethereum.foundation/

## Transcript

[Music] okay great hey slides here we go um great you don't need to pay attention but if you scan the QR code you get nft what a great time uh okay A little disclimer to start I love security like I go to a lot of security events I meet security people and they always have things like oh they enjoy cooking and mountain climbing and doing croquet um I enjoy security right in my free time I also do security I also love drama uh obviously look at my hair I work in crypto as well and I love ranting which you're about to find out um so my name is Andrew mcferson the Alias I usually use is Andrew Mohawk you won't figure out why uh it's because I'm very creative uh previously I built something called multigo at poova I did instant response at bitm uh I set up IR at Robin Hood I was the head of security at Unis Swap and uh I've recently moved to privy embedded wallet company uh also shout out to privy an embedded wallet company that's about to let me rant about wallets uh that's very kind of them um I'm also on uh seal for about a year and a half so been helping out with a lot of the stuff that I'll talk about okay so this is a rant a short rant in four parts that's CU they don't give me a longer slot if you give me a 2hour slot I will talk about it uh we're going to go through each of these uh progressively as we get uh on with it okay so the first slide web 3 is just web 2 plus one great at maths as well if you're wondering um basically we have all the intricacies of web 2 except that it's inherently more financial which obviously there a higher return on investment for attackers um we also have direct user to like infrastructure or user to chain in our case uh without any intermediaries so if you think of like web 2 uh if you go to an ATM and you say oh I want to you know withdraw all my funds they'll say hey like hey you have to go to the bank well we don't have that right what's a digital so you can do it 25 hours a day and irreversible actions which are the things we like so you know that's something so the first part is we are just generally failing our users we as security people if you're not security people that's not for you um you know if I if I look at the statistics here this one is is pretty depressing it is that uh ransomware is least is less profitable for attackers than drainers like R somewhere is everywhere they run somewhere like MGM it's very upsetting that that we lose to these people uh there's also 340 million lost in the first half of this year which is crazy amounts that's more than yacht money uh drainers are also super common and cheap so you can pay like a couple hundred bucks you'll get a drainer it works across all networks uh you don't need to understand how crypto Works they have automation they'll teach you how to set up Cloud flare and do hosting and register main they also have redundancy so every now and then we get their accounts banned and then they have thousands of other accounts that they'll use and say hey everyone come to these channels uh don't worry we have backups it's a lot better than a lot of web 3 companies uh which is surprising then also like the app stores are filled with uh fake apps so I think this really like sealed the deal for me when I was uh working at Unis swap is that there were some fake Unis swap app in the store and I was like okay well I've got some free time so take the app I'll decrypt it I have a look at what what's in it and it's just a web View and at the top it just says seed phrase and then underneath it it's just like an empty text box and then a button that says submit nothing no styling it was in pink it didn't have the logo I was like how can I lose possibly to these people they're doing literally the least amount of work I've ever seen um so that's why we're here then also we have a lot of dependency issues so we've seen a bunch of supply chain attacks uh this one recently and then obviously we had ler connect we have some things with npn like you can't get audit logs um but this is something that we don't see in web too like when was the last time you saw Robin Hood serve malware on their front page uh also I'm not going to go into smart contracts there is lots of attention there's lots of audits uh it's outside the scope really of this talk um and in Old security terms this is a layer eight talk I'm also really good at graphic design as you can see I've modified this slightly so that you can follow what's going to happen Okay so well we'll start with daps daps are basically like the pivotal point between your users and their wallets right and the providers and the underlying crypto and daps have a responsibility to users which I find that often they you know don't do effectively um but users are putting their life savings into your app and effectively you want your app to be popular so you're expecting a lot of users a lot of funds are going to be in it it is really important that you know you look after that uh then also obviously as your app gets more um popular you're going to get more attention from attackers like dprk so the idea is that we're here to help users right if you're building a Dap you're there to help users for starters web two before web 3 like you don't have we don't have to speedrun every Web Two security problem uh just cuz we're in web 3 right and the goals of building daps in terms of security should be that we help users make safer choices that are easier for them and that they want to make right so don't tell users like hey every time you want to sign a transaction go to the roof uh make sure you've got those things that vibrate the windows put on the EM Shield make sure you use 52 UB keys and then sign on your Ledger just to sign into the application right that is better security but it's ridiculous no one will do it um in terms of things that are effective Ubbi keys and P keys are super nice people kind of understand them and they provide like fishing resistant um you know integration which is which is really nice uh then also it's not just external facing so a lot of daps you know we'll we'll care a little bit about the users but we don't see it internally like if you if you're running a Dap and even if you're only a few Engineers please just use a password manager uh an UB keys or pass Keys anything that's web both in uh you'll cut out like 80% of the of the things that we see then obviously if you're building something you want to secure that the code right if you have money for it get an udit of your front of your uh front end of your interfaces so we'll see companies or daps that have like you know eight audits of the smart contracts and zero audits of the front end that integrates with the smart contract that if anything happens will just point to a different smart contract uh so it's really important to do that if you don't have money you can follow this great thing that um seal has put out uh that's at Frameworks that QR code goes to that um but then the the one thing that I see a lot of is that logging rarely counts so I go to a lot of incidents because I love drama um so I like to see what's happening in there well get an incident someone will be like okay well this terrible thing has happened I'll be like okay let's figure this out what happened with the pipelines you know how do people log in and you'll find out like they don't have any logging and because time only goes one way uh you can't turn logging on afterwards so definitely please turn on your logging um basic scanning stuff is free you can scan for secrets you can scan for dependencies um and you can scan for uh you know your code as well all these tools are free they'll integrate with your GitHub they'll integrate with however you uh deploy uh then also like have having a good uh I guess security culture there's something that someone in our company says all engineering is security engineering right doesn't matter what someone is doing if they're building something for the dep ultimately it impacts the security of the users and you should take that seriously okay providers we're going to start that timer is running down so we're going to start doing this otherwise he's going to be very upset that I've taken all this time Securities and arms race you can break into anything if you give me enough time and money there's nothing that's unhackable right um and what we need to do is we really need attackers to stop putting in more effort because it's very embarrassing to me to lose to attackers who do nothing um and one of the ways that doing that is that they're they're all using providers that make this super easy to either like register domains or deploy stuff so we need a demand that providers actually do something about this right but it is quite difficult because one they don't really want to um and also can lose them business like if all the fishing domain stopped you know being registered at some regist then they lose the money from that registration and it doesn't matter what you do the provider will say yes we look at it and they probably won't but there is one time of year that you're allowed to make demands that might get actioned um and that's during renewal season so right when you're about to pay them if you work at a company just you know ask them hey what are you doing about that web 3 fishing thing how are you protecting our users so you do have the options there uh then as part of seal I help out with the uh metamask block list it's basically like we try and automate finding scamming sites and just putting them in the block list ahead of time uh so we have 226,000 entries uh block domains in there right now there's about 173 that still have who is or adap data and about 127 that still resoled so you can still browse to them um I started trying to do that myself it's very quick to uh get rate limited and all sorts of bad things happen I once uh got our entire apartment uh blocked from the internet and I can tell you that my girlfriend was very upset um luckily someone linked me with uh who is XML and they did this all for free which was super cool so once I got the data I wrote some code to do the data I mean obviously Claude wrote some code and I ran it job security uh and this is the data of all the providers that we have 68% of our data goes to Cloud 68% of all scam domains go through Cloud F right and someone was like well maybe cloudly does most of the internet but actually in their uh Q3 rep from last year they only do about 16% of the internet so they do 16% of the internet but host 68% of our uh drainers and the traffic that goes through them so that's pretty disappointing uh you'll see I've got another slide on them uh they also do 10% of the malicious domains so besides all that traffic going through they're also uh registering some of those then also there's a slide that has statistics so I got to use this template 68.2 and then I said this is too much that's a quote for me you can use that uh regist draws are kind of the same I'm going to try to speed up a little bit so we get into it Twitter if you do Twitter basically follow the seal guidelines uh expect that your account is going to get taken away from you unfortunately that's the State of Affairs now you don't have options um even if your account has all the security Protections in place uh because you know you're relying on a third party provider uh but obviously do follow the guidelines so it's not triv easy for someone to do that ATN te Verizon like we get Sim swap still happen this is crazy right uh the government forced them to you know do something and what they did was like okay you can phone them and say like hey I I don't want my account Sim swapped and basically they'll go okay cool uh and that's it they'll add a note that says hey don't Sim Swap this account uh or you can give them a password or a code and they'll add it as a note into your account and then when someone is doing a Sim swap they should go and ask you know what is that password what is that account number obviously that is no security whatsoever if someone is getting paid like minimum wage to be yelled at by people who hate AT&T and you go and offer them their entire yearly salary they will definitely do that right it would be an insane choice not to uh if you are worried about it I'd like to switch to Google F because you can't Sim swap unless you have access to the Google account and the Google account you can protect with Hardware uh tokens make sure it's safe okay wallets this is my favorite part so wallets obviously evolving rapidly and I'm mostly going to be talking about extension wallets um you know obviously we have a lot of account abstraction and other things going on so wallets kind of make it easy to address the underlying complexity of crypto you know they have great uis and they have fun colors and animations and I can see all the things moving um and it's how we onboard a lot of users but they don't have the same guarantees like if you want to give away all your money the wallet will be like great that's we're having a great time let's give it all away um so I was thinking about it and I was like well what do wallets really know and they know a bunch about us right so wallet know where you are right now they know like the IP address you know they know your time zone things like that they know where you're connected to now cuz you just click connect and they know where you connect to before because you click connect then they still know that right they also know who you've sent funds to so okay there is an asteris there for the erc20 thing but if the wallet is in the browser it knows that you send funds to someone because you clicked on the buttons you put in the address uh everything like that um and then they also know like usually what do you do like after 5:00 p.m. you go to Pumped on phone and wreck yourself on memes so the first one that I have that really is bothering to me is these lookalike addresses so lookalike addresses are when the first you know three or four five whatever uh of the address are the same and the last are the same as the legitimate address so if you see here on the very bottom one is the legitimate address and the ones above that are uh fake ones that some you know attacker has set up so that when you go to send again you accidentally click on those ones and you get it but if you use one a modern wallet it'll just say hey this is a new account you sure you want to send here um and actually you see that dialogue a lot because everything you do you're generally sending to you know new addresses and things but actually the odds of you hitting um a wallet that you're intending to send to that has the same four and last four is crazy it's like one in 18 quadrillion I promise you if you hit those odds I will buy you a hat right I I'm not that much uh not that much money I want to spend on this but I will buy you a hat um so why don't Wallace just block it there's almost no reason for you to to get into that situation uh then we have similar URLs so wallets know the domain that you're connected to they're in the browser they have all the context of it so if you go to like unich train.org and later on you go to unchain dotop what do in the wallet say hey my dude this is not the same place why are you here and there's loads of tools that we can use to like you know basically like look at this we can look at Levenstein distance to say like okay how how close are they uh we can have a list of known good we can use an SSD Pat to say well the site we originally went to and this one look very similar so that seems quite suspicious even the the age of the domain so if you're going to a domain that's you know got registered 5 minutes ago maybe tell the user like hey we shouldn't do anything suspicious here you have all control wallets surely should protect our users better you can just block stuff uh then wallets also expect users to be Crypton native right I don't know how anyone is expected to do this but if anyone checks the call data of every transaction I will also buy your hat um but it's equivalent to you know insecurity when we used to say like oh you have to check the headers of every email it's kind of a ridiculous thing to do also the permit to approval flow my mom is never going to understand this no matter how many times I try explain to her um and if you love your mom I love my mom you wouldn't let her go on Twitter with a metamask wallet today because she would definitely get wrecked she would click on some site that has some picture of a cat and it would drain all of her funds right Wallace don't have the ability to go into a safe mode where I can say okay here is a list of all the domains I think that are fine you know you can interact with those anything else just don't interact with it uh because really I'm okay with my mom losing all her funds to moodang shitcoins but I'm not okay with her getting drained because then she's going to be like Andrew what are you do in security and I'm going to be like well nothing I'm sorry I'm a disappointment etc etc um so also while let don't warn users when unexpected things happen like if you are uh if you if you do drain someone you have to make multiple transactions right and they're not always in the same block so if the wallet suddenly notices that hey like all of your usdc just yeeted out of your wallet why doesn't it say like well uh we didn't do that is that something that you were expecting or even better whyn't it just move it to a new wallet if I have a lot I'd much rather pay the $2 for a new wallet um than you know or lose all my funds we have seed phases uh this is terrible for me me because we suck at remembering passwords that's why we password managers and trying to get rid of passwords and then we also suck at keeping things safe right I definitely do I can't find most of my things uh seed phrases are the you know joining of two things we're really bad at so we should just stop doing this it's really difficult to manage it's difficult to handle there are better ways that we can secure these so there are some Alternatives and look I put in a slide from the company um we do this we run in bettered wallet so that's where people can like sign in with like different authentication methods it's things they know they can use like Google or they can use par keys and that way you don't have to have a seed phrase that's moving around the other one I really like is the Unis swap extension um so if you've loaded up the extension and you have the mobile wallet you can scan the QR code in the extension it will then uh generate an OTP which it will check that you're on the same land so you have to be in the same you know house or whatever um and then you'll put in the code and it will transfer the seed phrase right you didn't have to copy it it wasn't in memory at some stage like there's a lot of good uh alter there okay so then the improvements that I really like to see webo and py I'm like a webo maxi if you don't agree with me find me afterwards I will convince you anytime you want uh allow listing or what I like to call Mom mode like why could I put the wallet in a safe mode that says you can only interact with stuff that is pre-approved uh if you're a high net worth individual all the time we'll say things like wow this person had a million dollars in their wallet what a crazy idea but if you are a high net worth individual why doesn't the wallet say okay well if you're going to interact with a site I don't know I'm just going to create you a new wallet let you interact with the site and then I don't have to risk all the other assets it seems like things that we could do uh emergency buttons why don't the wallets have something where I can just say revoke all I want everything to be revoked I don't want to have to go to revoke cash and half the time get scammed because there's also scamm your revoke cash sites um then also we should rethink the approval flows like I think that uix people Rock they're super good at figuring out like how can we explain something to a user how can we make the feel comfortable we should let them handle that uh and then of course clear signing like I don't want to look at call data ever again so that's it's too difficult for anyone reasonably to use the wallet uh to understand and process like it's much better if we have a a description of it okay the last thing uh oh I'm going to make this time the last thing that we'll say is security folks need empathy um so there's a lot of real people getting scammed many times you'll see people like just punching down being like wow you suck you know you got scammed by this uh that's really bad for security overall because one it shames people um and also they will feel less likely to report it right they're already in a bad place you don't need to do this um then sometimes I'll see things like this where someone's like you know what's sad is someone uh sold their house for some scam and then someone says well you know what's more sad than that is that I won the project I promise you it's not more sad that you won the project and they did nothing than someone who lost their house um security folks should dog food so if you give up got security advice you should take it yourself right A lot of people I see like giving out very difficult to follow security advice but if you're saying like hey I want a different email and telephone number for every account that I have try do that it's pretty difficult to do it's not easy to manage and as soon as you run into those things then you know users are not going to use it um do you run your own devices in lockdown mode I'm pretty sure no one here does because you can't use the Devcon app it does not work in lockdown mode um do you have 52 enabled on your web orn like are you putting in a pin every time you want to sign do you authenticate before signing every transaction so I think that you know using these really like gives us a good idea of like what is good and workable because we will use it then the last one security folk should support so if you see good security work say you something be like hey that's awesome we really like that you're doing that that's a cool thing um I think that that you know helps promote everyone I love talking about security so you can find me and tell me about your cool security things anytime you want I'm good with that uh SEC people should share their knowledge I find that a lot of people are like very nervous to share their knowledge but if you know a huge amount about one topic that single blog post is not going to ruin it that everyone now knows all all of the things that you know it'll also like promote other people um it might give you more ideas or people might like move on with with your ideas that you can like then extend further uh and then lastly you can submit a bug without getting paid a million dollars so overall let's make crypto safe enough for Andrew's Mom that's me [Applause] thanks can I just say I agree 100% with everything this man has just said let's give him a big round of applause you know we should we should get a picture together your hair and my hair one come come come let's get a selfie together my God you know I very rarely see a mohawk how many of you see a mohawk these days my god let's take one with the audience as well my God look at that oh that's amazing if I cut my hair in a mohawk we'll call it a mofro um ladies gentlemen um because our speaker he had so much content he decided to use his Q&A time to teach you guys a little bit more about security but I think all of us really enjoyed it let's give him one more big big round of applause and really really really really appreciate that uh I myself am some