Skip to content

OWASP SCS Web3 Attack Vectors Mapping Handbook

Cover of Web3 Attack Vectors Mapping
← All handbooks

Handbook 10 · 89 PDF pages

Map adversary tactics across the Web3 stack and apply the WA01–WA15 matrix to testing, detection, and defense.

Open PDF Download PDF

OWASP Smart Contract Security Project

Part of the OWASP SCS Handbook Series. Built to the series conventions.

Purpose and Scope

This handbook builds a structured map of Web3 attack vectors that runs from the wallet and the user sitting in front of it, through the dApp front end, into the smart contract layer, and out to the node and infrastructure that keep a chain running. It is the companion volume to the OWASP Web3 Attack Vectors Top 15, the Alternate Top 15 list published alongside the OWASP Smart Contract Top 10 (SC Top 10) at scs.owasp.org/sctop10/Web3-Attack-Vectors-Top15. Where the SC Top 10 catalogs on-chain logic risk, the Top 15 (WA01 through WA15) is an awareness list of the significant vectors that sit outside contract code: custody failures, social engineering, drainer malware, DNS hijacking, insider abuse, and nation-state operations against the people and pipelines that build Web3 software.

It organizes those vectors into a tactic-technique-procedure (TTP) catalog modeled on MITRE ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) and extended by MITRE AADAPT, MITRE's companion framework for digital asset and blockchain payment technologies. Each layer of the stack (user, wallet, dApp, contract, node, infrastructure) gets its own technique catalog, cross-referenced to the Top 15 vector IDs, to the Smart Contract Security Verification Standard (SCSVS), and to the Smart Contract Weakness Enumeration (SCWE), so a threat-modeling exercise or a detection team can work end to end from a single reference instead of stitching together five separate documents.

Target Audience

Security specialists, threat intelligence teams, and architects performing threat modeling across the Web3 stack.

How to Use This Handbook

Start with Part I to fix the taxonomy: the six layers this handbook uses, how they map onto WA01 through WA15, and the STRIDE-based threat-modeling method the rest of the book assumes. Part II is the technique catalog itself, one chapter per layer, and each chapter opens with its Top 15 alignment before working through specific techniques and their TTP IDs. Part III turns that catalog into a usable matrix: how to read it, how to apply it in a threat-modeling session, and how to apply it during detection and incident response. Part IV grounds the framework in named incidents, among them Bybit, the Ledger Connect Kit compromise, drainer-as-a-service campaigns, the Trust Wallet extension incident, and DPRK's TraderTraitor operation, traced across multiple layers at once. A reader building a detection program can go straight to the Part III matrix and the Part V quick-reference appendices; a reader running a single threat-modeling workshop should read Part I first, then the layer chapters that match the system's actual attack surface.

Relationship to SCSVS, SCSTG, and SCWE

This handbook sits above the three core Smart Contract Security (SCS) standards as the connective layer between them. SCSVS defines the controls a system must satisfy and the Smart Contract Security Testing Guide (SCSTG) defines how to test for them, but both are scoped to the contract and its immediate surroundings; the TTP catalog here extends threat coverage to the wallets, front ends, RPC endpoints, and infrastructure that SCSVS and SCSTG do not reach. SCWE catalogs on-chain weaknesses, and Chapter 7 maps this handbook's contract-layer techniques directly onto SCWE entries instead of duplicating them, while the other five layers fill the ground the enumeration leaves uncovered. Two sibling handbooks depend directly on this mapping: the CDN and Front-End Supply Chain Security Handbook (01) supplies the deep technical detail behind the dApp-layer techniques in Chapter 6, and the Incident Response Handbook (06) consumes the detection and mitigation columns of the Part III matrix as its triage reference.

Contents

Part I: Foundations

Part II: Tactics and Techniques by Layer

Part III: TTP Matrix and Use

Part IV: Case Studies and Examples

Part V: Appendices