Web2 Meets Web3: Hacking Decentralized Applications

This CertiK presentation outlines how integrating Web2 components with blockchain-based Dapps expands the attack surface, detailing client-side and server-side Web2 vulnerabilities, Web3-specific risks (transaction mishandling, smart-contract→backend attacks, and asset-operation errors), and five pentest case studies (unrestricted APIs draining gas, poor transaction timing causing DoS and race conditions, bridge contract validation failures, and misclassification of token assets). It emphasizes that Web2 weaknesses in Dapps can enable severe, direct financial losses (private key theft, unauthorized transactions, and asset mis-crediting) and recommends rigorous pentesting in addition to smart-contract audits.