Web3, blockchain and cryptoasset security: foundations and decisions

Learning outcomes

You will (1) explain what blockchains, tokens, keys and smart contracts are; (2) recognise where risk sits; (3) make an informed first decision.

1.1 The case and the basics

Elena Varga manages operations at the fictional Copperleaf Coffee Roasters, a business with four cafés and about 3,000 regular customers. A vendor has proposed running the café loyalty scheme as points tokens on a small permissioned Ethereum-compatible ledger. Elena joins a one-month intensive course at the fictional Quickstart Security Academy, coached by Mr Samuel Otieno, to decide sensibly. Every person, business and number here is synthetic. She learns that a blockchain is a shared, append-only record of transactions in linked blocks, as Nakamoto's 2008 paper described, kept consistent by several computers called nodes.

1.2 Tokens, keys and contracts

A token is an entry on the ledger recording who holds how many units of something, here loyalty points. Holdings are controlled by private keys: whoever holds the key for an address can move its tokens, and the ledger cannot tell whether that person is the rightful owner. A smart contract is a program stored on the ledger that sets the rules, such as who may create points and how they are spent, as Buterin's whitepaper describes. Elena notes that the most powerful thing in the system is whoever controls the contract's privileged functions, such as creating points or changing the rules.

1.3 Where risk sits and the first decision

Elena learns that many losses in this field come from poorly protected keys and weak operations rather than from the ledger itself, and that the OWASP Smart Contract Top 10 lists access control failures among the most common contract weaknesses. She also asks whether a blockchain is needed at all; NIST IR 8202 encourages organisations to consider simpler alternatives. Her first decision is not to say yes or no yet, but to require answers to three questions from the vendor: who controls privileged functions, where customer data will be stored, and how problems would be detected and fixed.

Worked example

Elena defers the yes-or-no decision and asks the vendor who controls privileged functions, where customer data lives and how problems are detected.

Synthetic case. Elena Varga, Mr Samuel Otieno, Quickstart Security Academy, Copperleaf Coffee Roasters and the vendor are synthetic; Nakamoto, Buterin, OWASP SC Top 10 and NIST IR 8202 are real sources.

Errors and limits

Assuming a blockchain makes a system secure ignores that keys and operations carry most risk.

Exercises

• EX001 — Business size. How many regular customers does Copperleaf have?
  Show marking criteria

  Rubric: 3 = about 3,000;; 2 = 3,000;; 1 = 300;; 0 = none.
• EX002 — Blockchain definition. In one phrase, what is a blockchain?
  Show marking criteria

  Rubric: 3 = a shared append-only record in linked blocks;; 2 = shared ledger;; 1 = a database anyone edits;; 0 = none.
• EX003 — Token meaning. What does a token record here?
  Show marking criteria

  Rubric: 3 = who holds how many loyalty points;; 2 = point holdings;; 1 = customer names;; 0 = none.
• EX004 — Key control. Who can move tokens at an address?
  Show marking criteria

  Rubric: 3 = whoever holds its private key;; 2 = key holder;; 1 = the café manager;; 0 = none.
• EX005 — Ledger blind spot. What can the ledger not tell about a key holder?
  Show marking criteria

  Rubric: 3 = whether they are the rightful owner;; 2 = rightful owner;; 1 = their balance;; 0 = none.
• EX006 — Contract role. What does the smart contract do here?
  Show marking criteria

  Rubric: 3 = sets rules for creating and spending points;; 2 = sets rules;; 1 = prints receipts;; 0 = none.
• EX007 — Most powerful party. Who is most powerful in the system?
  Show marking criteria

  Rubric: 3 = whoever controls privileged functions;; 2 = privileged controller;; 1 = customers;; 0 = none.
• EX008 — Common loss source. Where do many losses come from?
  Show marking criteria

  Rubric: 3 = poorly protected keys and weak operations;; 2 = keys and operations;; 1 = the ledger itself;; 0 = none.
• EX009 — OWASP point. Which weakness does the OWASP list highlight here?
  Show marking criteria

  Rubric: 3 = access control failures;; 2 = access control;; 1 = spelling;; 0 = none.
• EX010 — Alternatives question. What does NIST IR 8202 encourage organisations to consider?
  Show marking criteria

  Rubric: 3 = whether simpler alternatives would do;; 2 = alternatives;; 1 = more blockchains;; 0 = none.
• EX011 — Decision deferred. What is Elena's first decision?
  Show marking criteria

  Rubric: 3 = not yet yes or no, but to require answers;; 2 = defer;; 1 = sign immediately;; 0 = none.
• EX012 — Vendor question. Name one question for the vendor.
  Show marking criteria

  Rubric: 3 = where customer data will be stored;; 2 = who controls privileged functions;; 1 = what colour the app is;; 0 = none.
• EX013 — Course length. How long is Elena's course?
  Show marking criteria

  Rubric: 3 = one month;; 2 = a month;; 1 = one year;; 0 = none.

Synthesis

Understanding tokens, keys and contracts lets a manager ask the questions that matter before deciding.

Continue studying — lesson 01 (chapter 01 of 20)

← Course home · Course chapter index · Chapter 02 →

Continue to the next authored lesson.