| title | Front-End Web Application Security | SEAL | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| description | Secure Web3 frontends and mobile clients so users never interact with swapped contracts or malicious scripts; web, mobile, third-party scripts | |||||||||||||||
| tags |
|
|||||||||||||||
| contributors |
|
import { TagList, AttributionList, ContributeFooter } from '../../../components'
🔑 Key Takeaway: A compromised frontend can silently route wallets to attacker contracts. Treat web and mobile clients as high-value control planes, not cosmetic packaging.
Front-end and mobile surfaces of Web3 protocols are often overlooked relative to on-chain review. If a client is compromised—injected scripts, swapped destinations, malicious dependencies—users can interact with attacker-controlled contracts or leak session power without any smart-contract bug.
This framework covers baseline web app practices, third-party script controls (CSP/SRI and related), mobile notes, common vulnerability classes, and catalogues of tools.
- Web Application Security: frameworks, OWASP-oriented defects, hosting lock-down, availability patterns.
- Third-Party Script Security: CSP, SRI, Trusted Types, and incident lessons for script supply chain.
- Mobile Application Security: mobile client controls for Web3 apps.
- Common Vulnerabilities: ATO, XSS, CSRF, IDOR, and related classes.
- Security Tools and Resources: scanners and curated tool lists.
- Supply Chain: dependency and frontend delivery integrity
- ENS: name resolution integrity when clients display or resolve names
- Infrastructure: hosting, DNS, CDN, DDoS
- Wallet Security: wallet UX and signing confirmation boundaries
- Secure Software Development: reviews and coding standards
- Security Testing: dynamic and static test methods