Security, Privacy, and Decentralization in Web3

TL;DR

This paper investigates the security, privacy, and decentralization of DeFi front ends, revealing significant risks and misconceptions about decentralization, with empirical measurements showing prevalent tracking, privacy leaks, and centralized infrastructure.

Contribution

First comprehensive web measurement study of DeFi front ends, exposing security and privacy vulnerabilities and challenging assumptions about decentralization in DeFi.

Findings

Over 56% of DeFi sites are tracked by common trackers.

Trackers can link Ethereum addresses with personal information.

DeFi infrastructure is more centralized than claimed.

Abstract

Much of the recent excitement around decentralized finance (DeFi) comes from hopes that DeFi can be a secure, private, less centralized alternative to traditional finance systems. However, people moving to DeFi sites in hopes of improving their security and privacy may end up with less of both as recent attacks have demonstrated. In this work, we improve the understanding of DeFi by conducting the first Web measurements of the security, privacy, and decentralization properties of popular DeFi front ends. We find that DeFi applications -- or dapps -- suffer from the same security and privacy risks that frequent other parts of the Web but those risks are greatly exacerbated considering the money that is involved in DeFi. Our results show that a common tracker can observe user behavior on over 56% of websites we analyzed and many trackers on DeFi sites can trivially link a user's Ethereum address with PII (e.g., user name or demographic information), or phish users by initiating fake Ethereum transactions. Lastly, we establish that despite claims to the opposite, because of companies like Amazon and Cloudflare operating significant Web infrastructure, DeFi as a whole is considerably less decentralized than previously believed.