Holistic Approach of Full Stack Web3 Security, Anouar Ali, Valkyri | ETHSofia 2025

[Music] So about me, I am uh known in Twitter under the name Aliex40. I am a web 3 security researcher but I have a background in web 2 penetration testing. Um I am a co-founder at uh solo audit.com which is a public good platform that enables protocol to access solo auditors without any added commissions and directly without a middleman. I am also which is important to this speech.

I am also a co-founder at Valkyrie. Valkyrie is uh at Valkyrie we are trying to pioneer a new approach to web3 security in which we target the whole scope not only smart contracts. We look at all the things that involve a web 3 protocol or a web3 system. About me personally, I am OCP certified which is like one of the most acknowledged web 2 penetration testing certification. I am also known for auditing a lot of lending protocols.

For the guys who are new to web 3. Lending protocols are basically like banks but for web 3. You are allowed to put in your assets, lend them, earn interest or also borrow on top of them. So what is the scope of full stack audits? In a usual engagement for web3 security, we only look at the smart contracts.

But what we are trying to do with full stack audits, we start an engagement usually with something usually known in web to security under threat modeling. We will look at the system. What are the components that if compromised could lead to the destruction or to the obliation of the system those things could involve smart contracts of course web apps, front ends, websites, off-chain scripts. A lot of people use for example liquidation bots or something similar and they write it all in off-chain scripts that run around like cloud instances. We also like target wallet integration for example chain safe multisigs and we also like look into APIs cloud infrastructure and of course like things like supply chain so basically configuration of the app.

So why should protocols focus on full stack audits or what is the benefit? The issue that we have in web3 security is that we have focused a lot on smart contracts and we forgot that it's not the only part of the system that the attackers will look at. It's only a part of a multi-layered system that attackers will try to target. As I said, traditional audits only focus on smart contracts and for full stack audits, we will try or we are trying to target the whole stack that is relevant to the security purpose of the protocol. So most web three guys are number guys.

They they like to see data. They like to see numbers. And we also want to back our hypothesis with numbers. So how if we look for example at the 100 biggest hacks in DeFi history, we are talking about billions of dollars of thefts of funds that have been stolen. And if we look at those numbers, we find like almost 60% of those 100 top DeFi hacks were actually relying on web two systems on off-chain infrastructure.

They didn't even touch the smart contracts. They still did billions of dollars in damages. And we also like actually when we see the data we find out we find out that this trend is only accelerating. If you look at the data in 2025 27% of hacks are web two hacks for web three protocols and it's only accelerating. So yeah, so the attacker mindset, this is something we talk about a lot in Web2 security and as an attacker, you actually want to do harm to the protocol.

You want to steal it, you need to think about an attacker. The attacker will always look for the weakest link, the thing that he can exploit. If you have $5 million budget and you spend it all, for example, on securing your smart contracts, the attacker might say, "Okay, you guys take the security of your smart contracts seriously. I will target the front end. I will target the developers who work there.

I will target the wallet integration. I will target the cloud in infrastructure." And this is like how the attackers actually work. And this is also like uh the things we have been seeing especially this year. Proof of concepts something we uh penetration testers usually have to provide uh to prove every idea or concept.

Uh in this speech I will just talk about some hacks that didn't involve any smart contracts. For example, the hack for mixing network just $200 million was was stolen and the bug or the issue was actually in the cloud infrastructure that database and cloud uh cloud services. It didn't involve anything about smart contracts. The attacker just simply ignored the smart contract, looked for the weakest link. the cloud and the database in this case was the important factor.

Another big or famous hack was the BMBB bridge hack. Almost 600 million hack also didn't involve anything about smart contracts in this case offchain infra. Another proof of concept, another big hack mixing network. $200 million were stolen and the issue ah sorry no no yeah the third one and the last one was of course the biggest hack in defi history or in blockchain history which happened this year which is the bbit hack $1.5 billion which is basically like a budget for a government or a state was simply stolen and it was like a supply chain attack for uh the software that they used for multisig to manage their assets.

So we if you look at this what we have been doing in web3 security we have been working hard to secure the smart contracts. It have been difficult especially in the early days knowing like technology is not quite major and we tried very very hard to secure the smart contracts and avoid the hundred of millions of dollars of theft uh because of smart contracts. But this led to the fact that we ignored everything else on the security stack. We only looked at the smart contracts projects have uh raised a lot of money. Their strategy was because like they they were afraid of being hacked for hundred of millions of dollars due to smart contract hacks.

They put all their money, all their focus, all their strategy to secure the smart contracts. And this focus or this intensive look at the smart contract have created a gap that attackers this year or like continuously and u in an accelerating manner have tried to target which is this created a gap that they started to ignore other important aspects of the security of the protocol. So how are we trying to target this at Valkyrie? Valkyrie is uh founded and uh with dual or hybrid skilled security researchers meaning security researchers that have both the knowledge in penetration testing and the knowledge in smart contracts auditing. Why would you you might ask?

Because most sadly and is like the truth because both system are quite different from each other the web two penetration testers they actually don't know how or the manner that web 3 or blockchain system works and the security researchers for smart contracts they also tend or mostly tend to don't know how the attacks the exploits that you rely on the web two side actually works and for this We decided we need both. We need the hybrid approach. We need a security researcher who actually knows both words. And yeah, a full stack audits will usually start with a threat modeling engagement. In a threat modeling engagement, we will look at the whole stack of the protocol.

For example, do you guys rely on offchain scripts? Do you have do you use a multi-ig? Do you uh have cloud instances? Do you rely on a third party in uh uh integration? Do you expose your API to the users?

And of course, if you deployed any smart contracts, we will look at the whole stack from the attacker perspective. How can I do harm to the project? What parts of the system could be very vulnerable to exploits? We will do the threat modeling exercise and then we will decide on the engagement. We should audit the cloud infra.

We should audit the smart contracts and we should audit for example the front end. And for this we make sure we don't miss any gaps because the team will be able to know the whole stack to look at the system from a big picture mode. look how everything works together and try to attack it or try to audit it in a manner to keep the system secure. So yeah, at Valkyrie we try to divide the models or like uh the stack of a system of a web3 system into four layers. The first layer is of course the smart contracts which we actually all the traditional audits tend to focus on and like work on uh digitally uh ferociously so to say.

This of course uh auditing such smart contracts involves for example multiple techniques formal verification manual audits fuzzing testing uh and attack vectors or the type of vulnerabilities is actually also like uh it's not similar to other parts of the multiple layers that we have here. The second layer is the infrastructure security. Uh for example, how you guys manage your private keys, how your wallet is managed, um which infrastructure or which infrastructure provider do you work on? Have you hardened your infrastructure? Is the cloud instance configured correctly to like uh avoid or make sure no one access it without the the right access.

Uh the third layer is of course like application security. This also like have been a very good target for web for like attackers which is like front ends for example. Some guys have also mobile apps and uh most of those like involve also like we have a lot of 100 million um hacks that just happened because of compromised web application. Um the fourth layer which is the operational uh security part and this is to be honest with you this is like the most dangerous or the part that I think we in web 3 ignore the most which is like because I have seen it I have seen it a lot. A developer will receive a very attractive opportunity so to say from a company.

He downloads the scripts or the PDF or like clone the GitHub and they get his keys and we have a 100 million or I don't know uh I think um Tapiokia was had a similar scenario last year. Um, Ronin bridge 600 600 million attack was also a LinkedIn offer for a developer who got like the PDF very nice salary was very excited downloaded the PDF $600 million was stolen out of this attack. So when we look at all those different layers we should make sure as uh we are building the future of web 3 to take all those layers seriously. It's not just smart contracts. If you look how big the surface is, if you just focus only on one aspect of it, we are really making the life of hackers very easy.

If you if you just secure your smart contracts, look how many surfaces, attacks, paths and attacker can use to harm you. Oh yeah, the final promotion. Self shameless promotion. Yeah. So we we do that in Valkyrie.

We are uh pioneering this uh approach, this holistic approach to full stack security. We are trying to help build a better future for web 3 application. not only focusing on smart contracts but also focusing on the whole stack for web3 security. That was it for me for my talk. I hope you guys enjoyed it and let's talk [Applause] [Music] Heat.