September 2025
Intermediate to advanced
640 pages
19h 47m
English
Content preview from Blockchain Application Security
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.
Appendix CMapping of Threat Scenarios to Exploitable Attack Paths
| Threat scenario (TS) | Attack vector | CWE | Entry point | Derived attack scenario |
|---|---|---|---|---|
| TS1: mobile or browser client/UI | Exploiting improper authentication via stolen session tokens | CWE-287 (improper authentication) | Mobile or browser client | An attacker uses stolen session tokens obtained through phishing to impersonate legitimate users, allowing unauthorized access and fraudulent transactions. |
| TS2: digital wallet/smart contracts | Reusing valid transactions to perform replay attacks | CWE-326 (inadequate encryption strength) | Digital wallet API | The attacker intercepts and replays previously signed wallet transactions due to weak encryption, leading to duplicate payments or withdrawals. |
| TS3: distributed digital identity system/trust boundary | Manipulating identity data transmitted between the dApp and identity system | CWE-345 (insufficient verification of data authenticity) | Identity validation API | The attacker tampers with transmitted identity payloads, corrupting user data or enabling fraudulent access by impersonating a legitimate user. |
| TS4: dApp frontend and components | Injecting malicious scripts into input fields | CWE-79 (cross-site scripting) | dApp frontend | Malicious scripts injected into input fields execute in the victim’s browser, allowing the attacker to steal session tokens and execute unauthorized transactions. |
| TS5: dApp middleware (JSON-RPC) | Exploiting deserialization vulnerabilities to inject malicious payloads | CWE-502 (deserialization of untrusted ... |
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access
More than 5,000 organizations count on O’Reilly
O’Reilly covers everything we've got, with content to help us build a world-class technology community, upgrade the capabilities and competencies of our teams, and improve overall team performance as well as their engagement.Julian F.
I wanted to learn C and C++, but it didn't click for me until I picked up an O'Reilly book. When I went on the O’Reilly platform, I was astonished to find all the books there, plus live events and sandboxes so you could play around with the technology.Addison B.
I’ve been on the O’Reilly platform for more than eight years. I use a couple of learning platforms, but I'm on O'Reilly more than anybody else. When you're there, you start learning. I'm never disappointed.Amir M.
I'm always learning. So when I got on to O'Reilly, I was like a kid in a candy store. There are playlists. There are answers. There's on-demand training. It's worth its weight in gold, in terms of what it allows me to do.