Security Special 05｜OKX Web3 & BlockSec: Tagging All Whales — The Latest Risk Mitigation Guide for the DeFi World
TechFlow Selected TechFlow Selected
Security Special 05｜OKX Web3 & BlockSec: Tagging All Whales — The Latest Risk Mitigation Guide for the DeFi World
Featuring blockchain security pioneers BlockSec and the OKX Web3 Wallet Security Team, this guide delivers a DeFi risk mitigation strategy for all users and projects on the path to becoming—or already established as—whales.
Navigating Web3 tides with focused insightsIntroduction
OKX Web3 Wallet has specially launched the "Security Special" series, offering targeted guidance on various types of blockchain security issues. Through real-life cases happening around users and in collaboration with experts or institutions from the security field, we provide dual perspectives to help users gradually understand and summarize safe trading practices. Our goal is to strengthen user education on security and empower users to protect their private keys and wallet assets starting from themselves.
The greatest charm of the DeFi world is that everyone has the potential to become a "whale."
But even whales can't afford to be reckless—they may enjoy the rewards, but they also get their share of beatings.
So remember: when playing on-chain, safety comes first.
Otherwise, you’ll end up back at square one.
This is the fifth installment of our Security Special series. We’re honored to invite BlockSec, a leading blockchain security pioneer, alongside the OKX Web3 Wallet Security Team, to share a practical DeFi risk-avoidance guide for all users and project teams—whether aspiring or already established whales. Topics include how to read audit reports, common metrics and parameters for assessing DeFi project risks, how projects or whale users can build monitoring capabilities, and essential DeFi security rules. Don’t miss it!
BlockSec Security Team: BlockSec is a globally leading full-stack blockchain security service provider. To date, the company has served over 300 clients, including well-known projects such as MetaMask, Compound, Uniswap Foundation, Forta, PancakeSwap, and Puffer. Through white-hat rescue operations, BlockSec has recovered more than $20 million in lost funds.
Dr. Yajin Zhou, CEO & Co-Founder of BlockSec, is a professor at Zhejiang University's School of Computer Science and an award-winning scholar recognized by Aminer as one of the world’s most influential researchers, with over 50 top-tier publications cited more than 10,000 times. Dr. Lei Wu, CTO & Co-Founder, is also a professor at Zhejiang University and former co-founder of PeckShield, leading his team to discover dozens of zero-day vulnerabilities in major blockchain projects. Raymond, the Product Director, previously led security product development at Tencent and 360.
OKX Web3 Wallet Security Team: Hello everyone, we’re excited to share our insights today. The OKX Web3 Security team is responsible for building comprehensive security capabilities across OKX’s Web3 ecosystem, including smart contract audits, wallet security enhancements, and on-chain project monitoring. We aim to deliver multi-layered protection for product, fund, and transaction security, contributing to a safer overall blockchain environment.
Q1: Share some real-world examples of DeFi risks users have encountered
BlockSec Security Team: DeFi attracts many large investors due to its relatively stable high returns. Many projects actively invite whales to boost liquidity. For instance, news often reports whales depositing massive amounts into DeFi protocols. While these whales earn steady returns, they also face significant risks. Below are some publicly known DeFi incidents:
Case 1: In the 2022 PolyNetwork security incident, over $600 million in assets were stolen. It was rumored that Shen Yu had $100 million involved. Although the attacker later returned the funds and the event ended positively—with Shen Yu even announcing plans to build an on-chain monument—the experience must have been extremely stressful. While a few security events have favorable outcomes, most do not.
Case 2: In 2023, the popular DEX SushiSwap was attacked, resulting in a loss of over $3.3 million for whale 0xSifu, accounting for about 90% of the total loss.
Case 3: In March this year, Prisma suffered a security breach causing $14 million in losses across 17 wallets—an average of $820,000 per wallet—but four users accounted for 80% of the total. Most of the stolen assets remain unrecovered.
Ultimately, especially on mainnets where gas fees are non-trivial, only users with substantial capital can achieve meaningful returns (excluding airdrops). Thus, the majority of TVL in DeFi projects comes from whales, with just 2% of whales sometimes contributing 80% of the TVL. When security incidents occur, these whales inevitably bear the brunt of the losses. “Don’t just see the whales feasting—they also take hits.”
OKX Web3 Wallet Security Team: As the on-chain world continues to grow, so do the number of DeFi-related risks faced by users. On-chain security remains the most fundamental and critical need.
Case 1: PlayDapp Privileged Account Private Key Leak. From February 9–12, 2024, the Ethereum-based gaming platform PlayDapp suffered an attack due to a leaked private key. An unauthorized actor minted and stole 1.79 billion PLA tokens, valued at approximately $32.35 million. The attacker added a new minter role and distributed the tokens across multiple on-chain addresses and exchanges.
Case 2: Hedgey Finance Attack. On April 19, 2024, Hedgey Finance experienced a major security vulnerability on both Ethereum and Arbitrum networks, resulting in approximately $44.7 million in losses. The attacker exploited insufficient input validation in the contract to gain unauthorized access and drain funds.
Q2: Can you categorize the main types of risks currently present in the DeFi space?
OKX Web3 Wallet Security Team: Based on real incidents, we’ve categorized four common types of risks in DeFi today:
Type 1: Phishing Attacks. Phishing is a common cyberattack method where attackers impersonate legitimate entities to trick victims into revealing sensitive information like private keys, passwords, or personal data. In DeFi, phishing attacks typically occur through:
1) Fake websites: Attackers create phishing sites mimicking real DeFi platforms to trick users into signing malicious approvals or transfers.
2) Social engineering: On Twitter, attackers use fake accounts or hijack official project Twitter/Discord accounts to post fraudulent promotions or airdrop links (which are actually phishing traps).
3) Malicious smart contracts: Attackers deploy seemingly attractive contracts or DeFi projects to lure users into granting access permissions, then steal funds.
Type 2: Rug Pulls. A rug pull is a unique scam in DeFi where developers abruptly withdraw funds after attracting investments, leaving investors with worthless tokens. These often happen on decentralized exchanges (DEXs) or liquidity mining projects. Common forms include:
1) Liquidity withdrawal: Developers provide initial liquidity to attract deposits, then suddenly remove it all, crashing the token price.
2) Fake projects: Developers launch seemingly legitimate projects using false promises and high yields to lure investment, despite having no real product or service.
3) Contract permission changes: Developers exploit backdoors or admin privileges in smart contracts to alter rules or withdraw funds at will.
Type 3: Smart Contract Vulnerabilities. Smart contracts are self-executing code on blockchains; once deployed, they cannot be changed. Any bugs can lead to severe consequences. Common vulnerabilities include:
1) Reentrancy: Attackers repeatedly call a vulnerable function before the previous execution completes, manipulating internal state.
2) Logic errors: Flaws in design or implementation cause unintended behavior.
3) Integer overflow/underflow: Improper handling of integer arithmetic leads to unexpected results.
4) Price manipulation: Attackers manipulate oracle prices to profit unfairly.
5) Precision loss: Floating-point or integer precision issues result in calculation errors.
6) Lack of input validation: Failure to validate user inputs creates exploitable weaknesses.
Type 4: Governance Risks. These involve core decision-making mechanisms. If exploited, they can derail a project or cause financial loss and trust erosion. Key risks include:
1) Private key leaks: Some DeFi projects rely on EOA (Externally Owned Accounts) or multisig wallets for privileged access. If keys are leaked, attackers can freely manipulate contracts or funds.
2) Governance attacks:
• Borrowing governance tokens: Attackers borrow large amounts of voting power to temporarily control proposals.
• Concentrated voting power: If governance tokens are held by a few entities, they can dominate decisions.
Q3: What dimensions or parameters can help preliminarily assess a DeFi project’s security and risk level?
BlockSec Security Team: Before participating in any DeFi project, conducting a comprehensive security assessment is crucial—especially for large investors. Proper due diligence significantly enhances fund safety.
First, conduct a full code security review. Check whether the project has been audited, particularly by reputable firms like OpenZeppelin, Trail of Bits, or BlockSec. Was it reviewed by multiple auditors? Is the latest code version covered? Generally, code vetted by several respected security firms greatly reduces attack risks.
Second, check if the project has real-time security monitoring. Audits offer static security but don’t address dynamic runtime issues—such as improper parameter adjustments or new pool additions. Projects with active monitoring systems inherently operate more securely.
Third, evaluate emergency auto-response capabilities. This is often overlooked. In many incidents, projects lack automatic circuit breakers (e.g., halting sensitive fund operations). Relying solely on manual responses proves inefficient or ineffective during crises.
Fourth, assess external dependencies and their robustness. DeFi protocols rely on third-party data such as pricing and liquidity feeds. Evaluate the number of dependencies, their security track records, and whether abnormal data triggers alerts and automated responses. Protocols relying on top-tier services with built-in fault tolerance are generally safer.
Fifth, examine community governance structure. Does the team implement community voting for major decisions? Are sensitive actions executed via multisig? Is there neutral community participation in multisig or a dedicated security council? Strong governance increases transparency and reduces rug-pull risks.
Finally, consider the project’s history. Research the team’s background. If core members have prior projects with repeated hacks or rug pulls, the current project likely carries higher risk.
In summary, before investing in DeFi—especially with large sums—users must do thorough research. Assess the project’s security posture across pre-launch audits, post-launch monitoring, auto-response systems, external dependencies, governance models, and historical track record to safeguard their capital.
OKX Web3 Wallet Security Team: While no method guarantees 100% safety, users can combine multiple evaluation dimensions to estimate a DeFi project’s risk profile.
1. Technical Security
1) Smart Contract Audit:
• Confirm audits by multiple reputable firms with strong industry reputations.
• Review the number and severity of issues reported, ensuring all have been resolved.
• Verify that the deployed code matches the audited version.
2) Open Source Code:
• Ensure the project’s code is open source, allowing public scrutiny and vulnerability discovery.
• Research the development team’s background, especially their blockchain and security expertise, transparency, and public presence.
• Check for a bug bounty program incentivizing white-hat hackers to report vulnerabilities.
3) Financial & Economic Security
• Total Value Locked (TVL): Higher TVL may indicate greater market trust.
• Trading Volume & Liquidity: Low liquidity increases price manipulation risks.
• Tokenomics: Analyze token distribution, incentives, inflation model, and concentration of holdings.
4) Operational & Management Security
• Governance Model: Assess decentralization, community voting rights, and concentration of governance power.
• Risk Mitigation: Look for clear risk management strategies and emergency response plans. Also evaluate transparency—does the team publish regular updates and engage actively with the community?
5) Market & Community Sentiment
• Community Activity: Active communities suggest broader support and engagement.
• Media & Social Coverage: Monitor sentiment across media outlets and social platforms.
• Partners & Investors: Presence of reputable partners or backers adds credibility—but shouldn’t be the sole deciding factor.
Q4: How should users read audit reports and verify open-source status?
BlockSec Security Team: Audited projects usually publish reports via official channels—project documentation, GitHub repositories, etc. However, verifying authenticity is essential. Methods include checking digital signatures or contacting the auditing firm directly for confirmation.
Once you obtain an audit report, how should you interpret it?
1) Check if reputable firms conducted the audit—e.g., OpenZeppelin, Trail of Bits, BlockSec.
2) Verify that all reported issues have been fixed. If not, assess the rationale provided. Note that audit reports vary in quality—some distinguish valid vs. invalid findings. Focus on confirmed vulnerabilities. Ideally, consult an independent security advisor for third-party evaluation.
3) Compare the audit date with recent project upgrades. Ensure the audit covers all currently live code. Due to cost constraints, some projects only audit partial codebases—verify whether core protocol components were included.
4) Confirm whether the on-chain code is verified (open-sourced) and matches the audited version. Audits often reference GitHub code rather than deployed bytecode. If the on-chain code isn’t open or differs significantly, proceed with caution.
In short, reading audit reports requires technical expertise. We strongly recommend involving independent security consultants.
OKX Web3 Wallet Security Team: Users can find audit reports and source code status via the project’s official website or third-party explorers like OKLink. Here’s how:
1) Visit the official site. Trusted DeFi projects typically link to security documents under sections like “Security,” “Audits,” or “Contracts” on their docs page. They may also share this info on Medium, Twitter, or other official socials.
2) After locating the contract address, use OKLink to search it. Under the “Contract” tab, check if the source code is verified and publicly viewable.
3) With the audit report and verified code, begin reviewing. Key points:
• Understand the report structure: overview, findings, remediation, and conclusion.
• In the overview, note the audit scope and target. Cross-check the GitHub commit ID mentioned against the actual deployed code.
• In the findings section, confirm that all issues were addressed and re-audited if necessary.
• Compare multiple audit reports (if available) to track improvements over time.
Q5: What is the value of hack history and bounty programs in evaluating DeFi project security?
OKX Web3 Wallet Security Team: Historical breaches and bug bounty programs offer valuable insights into a project’s security posture:
1) Hack History
• Reveals past vulnerabilities: Shows specific flaws previously exploited and whether they were properly patched.
• Assesses incident response: How the team handled past attacks reflects their crisis management maturity. Prompt fixes and user compensation signal reliability.
• Impacts reputation: Frequent breaches erode trust, but learning from mistakes and strengthening defenses can rebuild long-term credibility.
2) Bug Bounty Programs
Bounty programs are vital for uncovering hidden vulnerabilities. Their value includes:
• Crowdsourced auditing: Encourages global researchers to test security, exposing blind spots missed internally.
• Validates security strength: Few critical bugs found despite ongoing bounties suggest a mature, secure system.
• Enables continuous improvement: Helps teams adapt to emerging threats and update defenses proactively.
• Demonstrates security culture: A serious, active bounty program signals the team prioritizes security.
• Builds investor confidence: Proactive security efforts reassure users and attract investment from risk-conscious participants.
Q6: How can users build monitoring and threat detection capabilities when engaging with DeFi?
BlockSec Security Team: Take whale users as an example—individuals or small investment groups with large capital but limited internal security teams or tools. Most whales currently lack sufficient risk awareness, which explains their heavy losses.
Given the stakes, some whales now use public security tools for monitoring. Many monitoring products exist, but choosing wisely is critical. Key considerations:
1) Usability: Many tools require coding skills, creating high entry barriers. Understanding contract architecture or tracking addresses isn’t trivial for average users.
2) Accuracy: No one wants sleep-disrupting false alarms. High precision minimizes alert fatigue.
3) Security: At scale, never overlook the tool provider’s own security. Recent attacks like Gala Games reportedly stemmed from compromised third-party services. Trustworthy teams and proven products are essential.
To date, many whales have approached us. We recommend professional asset management solutions that enable secure fund management—including yield farming, withdrawals, risk detection, and emergency exits—without sacrificing convenience.
Q7: What are your security recommendations for participating in DeFi, and how should risks be managed?
BlockSec Security Team: For large investors, preserving principal is paramount. After thorough risk analysis, consider the following steps:
1) Evaluate the project’s security commitment: Consider audit depth, real-time monitoring, auto-response capability, and governance quality. These reflect how seriously the team treats user fund safety.
2) Build personal monitoring and auto-response systems: When a protocol is breached, whales should detect it immediately and withdraw funds quickly—rather than relying solely on the project team. In 2023, major projects like Curve, KyberSwap, and Euler Finance were attacked. Sadly, large investors often lacked timely intelligence or emergency exit mechanisms.
3) Partner with trusted security providers: Continuously monitor code updates, parameter changes, and other risks. Without expert tools and teams, this is nearly impossible.
4) Secure private keys: For active trading accounts, combine online multisig with offline key storage to eliminate single-point failure risks.
What if you face a security incident?
Your first instinct should be capital preservation—withdraw funds immediately. But attackers move fast; manual responses are often too slow. Automated withdrawal upon threat detection is ideal. We offer tools that trigger automatic fund exits upon detecting attack transactions.
Next, if losses occur, push the project to engage security firms for fund tracing and recovery. As crypto security improves, recovery rates are rising.
Lastly, as a whale, ask security firms to audit your entire portfolio. Many attacks share root causes—e.g., the Compound V2 precision loss flaw led to repeated attacks last year. Identify similar risks early and either communicate with teams or exit promptly.
OKX Web3 Wallet Security Team: Users can adopt multiple strategies to safely participate in DeFi, reducing fund loss risks while enjoying decentralized finance benefits. We break this down into user-level and OKX Web3 Wallet-level measures.
1) For Users:
• Choose audited projects: Prioritize those reviewed by reputable firms like ConsenSys Diligence, Trail of Bits, OpenZeppelin, Quantstamp, or ABDK. Read public audit reports to understand risks and fixes.
• Research project and team: Study whitepapers, official sites, and team backgrounds. Follow their activity on social media and developer forums to assess credibility and technical strength.
• Diversify investments: Avoid putting all funds into a single project. Spread across different DeFi categories—lending, DEXs, yield farming—to reduce exposure.
• Test with small amounts: Before large trades, perform small test transactions to verify platform safety.
• Monitor accounts regularly: Use tools like Etherscan to track on-chain activity. Respond quickly to anomalies—revoke authorizations, contact support, etc.
• Be cautious with new projects: Approach newly launched or unproven protocols carefully. Start with small allocations and observe performance.
• Use mainstream Web3 wallets: Interact only via trusted wallets offering enhanced security features.
• Prevent phishing: Avoid suspicious links and emails. Never enter private keys or seed phrases on untrusted sites. Always verify URLs and download apps only from official sources.
2) From OKX Web3 Wallet’s Perspective:
We offer multiple layers of protection:
1) Risky Domain Detection: OKX Web3 Wallet analyzes domains when accessing dApps. Suspicious or malicious sites are blocked or flagged.
2) Ponzi Token Detection: The wallet identifies and blocks known scam tokens (“Pi Xiu Pan”), preventing interactions.
3) Address Labeling System: A comprehensive database flags suspicious addresses during transactions.
4) Transaction Simulation: Before submitting any transaction, OKX simulates execution and displays expected asset and permission changes, helping users confirm legitimacy.
5) Integrated DeFi Services: OKX Web3 Wallet integrates major DeFi platforms, enabling safe interaction. It also recommends optimal paths for swaps and cross-chain bridges, including efficient gas strategies.
6) Ongoing Security Enhancements: We continue expanding advanced security features to better protect OKX Wallet users.
Q8: Beyond users, what risks do DeFi projects face—and how can they defend against them?
BlockSec Security Team: DeFi projects face three main risk categories: code security, operational security, and external dependency risks.
1) Code Security Risks: Potential vulnerabilities in the project’s codebase. Since smart contracts form the core logic of DeFi, special attention is needed:
• Follow best practices—e.g., Checks-Effects-Interactions pattern to prevent reentrancy.
• Conduct rigorous internal testing, ideally in environments mirroring production (tools like Phalcon Fork can help).
• Engage reputable third-party auditors. Multiple audits increase coverage. Even with perfect processes, unknown bugs may exist—audits help surface common ones.
2) Operational Security Risks: Threats arising post-launch. Even fully tested code may harbor undiscovered bugs. Additional risks include key leaks and misconfigured parameters. Mitigation strategies:
• Robust key management: Use hardware wallets or MPC-based solutions.
• Real-time monitoring: Track privileged operations and system health.
• Automated response: Tools like BlockSec Phalcon can auto-pause protocols during attacks.
• Eliminate single points of failure: Use multisig wallets (e.g., Safe) for admin actions.
3) External Dependency Risks: Risks from third-party integrations—e.g., price oracles feeding incorrect data. Recommendations:
• Partner with reliable, industry-leading protocols.
• Monitor external services continuously.
• Implement automated fallbacks—e.g., switch to backup oracles instead of pausing entirely.
Additional Monitoring Tips for Projects:
• Set precise monitoring points: Identify critical variables and locations. Consider using battle-tested third-party detection engines.
• Ensure accuracy and timeliness: Minimize false positives/negatives. Detection must happen before attack transactions confirm.
• Enable automated responses: Combine accurate detection with customizable frameworks to pause functions or isolate assets instantly.
Overall, building robust monitoring requires collaboration with professional external security providers.
OKX Web3 Wallet Security Team: DeFi projects face diverse risks, primarily:
1) Technical Risks: Smart contract bugs and cyberattacks. Defenses include secure coding practices, third-party audits, bug bounties, and asset isolation.
2) Market Risks: Price volatility, liquidity shortages, market manipulation, and composability risks. Use stablecoins, hedging, liquidity mining, decentralized oracles, and fee optimization.
3) Operational Risks: Human error and governance flaws. Implement strict SOPs, automation, balanced governance (e.g., voting delays, multisig), and emergency response plans.
4) Regulatory Risks: Compliance with laws, AML/KYC obligations. Hire legal counsel, establish transparent policies, and proactively adopt compliance measures to build trust.
Q9: How should DeFi project teams choose a good audit firm?
BlockSec Security Team: Here are simple criteria for selecting a qualified audit company:
1) Has audited well-known projects: Indicates recognition and trust from reputable teams.
2) Track record of audited projects: While audits don’t guarantee immunity, projects audited by top firms rarely suffer breaches.
3) Quality of audit reports: Review sample reports—compare vulnerability severity, quantity, and whether findings were accepted and fixed.
4) Expertise of personnel: Auditor qualifications, education, and industry experience contribute significantly to audit quality.
Finally, thank you for reading the fifth issue of OKX Web3 Wallet’s Security Special series. We’re already preparing Issue 06—with real case studies, risk identification techniques, and practical security tips. Stay tuned!
Disclaimer:
This article is for informational purposes only and does not constitute (i) investment advice or recommendation; (ii) an offer or solicitation to buy, sell, or hold digital assets; or (iii) financial, accounting, legal, or tax advice. Holding digital assets—including stablecoins and NFTs—involves high risk and values may fluctuate significantly or become worthless. You should carefully consider whether trading or holding digital assets is suitable for you based on your financial situation. You are solely responsible for understanding and complying with applicable local laws and regulations.
Join TechFlow official community to stay tuned
Telegram:https://t.me/TechFlowDaily
X (Twitter):https://x.com/TechFlowPost
X (Twitter) EN:https://x.com/BlockFlow_News
OKX
