Exploiting The Off-Chain Ecosystem In Web 3 Bug Bounty

Exploiting The Off-Chain Ecosystem In Web 3 Bug Bounty

Speakers: Bruno Halltari, Security Researcher, OtterSec

Conference: Bug Bounty Village

YouTube: https://www.youtube.com/watch?v=aED_tYXCsOI

Overview

In this insightful talk from Bug Bounty Village, Bruno Halltari, a security researcher at OtterSec, sheds light on a frequently underestimated area within Web3 security: the off-chain ecosystem. While much of the focus in Web3 bug bounties and security research gravitates towards the complex world of smart contracts and on-chain vulnerabilities, Halltari compellingly argues that significant, high-impact findings—and substantial payouts—are still readily available in the off-chain components of decentralized applications (dApps).

Halltari's presentation challenges the prevailing notion among many bug bounty hunters that the most lucrative targets are exclusively found on the blockchain itself. By showcasing real-world cases he discovered, he illustrates how traditional web vulnerabilities, when applied to the unique architecture of Web3 dApps, can lead to severe compromises, including account takeovers and credential theft. The talk serves as a crucial reminder for the security community to broaden its scope beyond the blockchain, recognizing that the integration points and user interfaces of Web3 projects often harbor critical weaknesses inherited from standard web development practices.

The core of Halltari's argument is built upon practical examples, demonstrating sophisticated bypasses for Cross-Site Scripting (XSS) protections and exploitations of OAuth misconfigurations. These examples highlight not only the technical ingenuity required to uncover such flaws but also the importance of a comprehensive security mindset that extends to every layer of a Web3 application. For bug bounty hunters seeking to maximize their impact and rewards, this talk underscores the strategic advantage of mastering off-chain attack vectors.

Background

▶ Watch: Introduction to off-chain Web3 bug bounties (0:00)

The landscape of Web3 security is often dominated by discussions around smart contract audits, blockchain consensus mechanisms, and cryptographic primitives. This emphasis is understandable, given the immutable and high-value nature of on-chain assets and operations. Consequently, many bug bounty programs in the Web3 space tend to prioritize vulnerabilities directly affecting smart contracts, sometimes leading to a perception among hunters that off-chain components are less critical or less rewarding targets.

However, Web3 applications are rarely entirely on-chain. They typically consist of a front-end (often a web application built with frameworks like React), backend services, APIs, and integration points with traditional web technologies such as OAuth for authentication. These "off-chain" elements bridge the gap between users and the blockchain, providing interfaces for interaction, data display, and identity management. The problem arises when developers, in their haste to build innovative decentralized solutions, inadvertently carry over or introduce common web security pitfalls into these off-chain components.

The existence of these vulnerabilities is not due to a fundamental flaw in Web3 itself, but rather a combination of factors: the rapid development pace, the reuse of existing web development tools and libraries, and sometimes a lack of specialized web security expertise within teams primarily focused on blockchain development. Halltari's talk directly addresses this gap, demonstrating that classic web attack vectors like Cross-Site Scripting (XSS) and OAuth misconfigurations remain highly effective and often overlooked in the Web3 context, offering significant opportunities for bug bounty hunters willing to look beyond the blockchain.

Key Findings

▶ Watch: DOMPurify bypass using object input (4:00)

Bruno Halltari's presentation unveiled several critical vulnerabilities he discovered in Web3 applications, categorized into two main areas: sophisticated XSS bypasses and an OAuth misconfiguration exploit. These findings collectively underscore the persistent relevance of traditional web security flaws within the Web3 ecosystem.

The first set of findings revolved around multiple Cross-Site Scripting (XSS) vulnerabilities discovered on a Web3 platform called Nearweb, a program on Immunefi. Halltari demonstrated how he successively bypassed several layers of sanitization designed to prevent XSS, ultimately achieving an account takeover. These bypasses included:

• Blob URI Bypass: Exploiting a flawed sanitizeURL function that failed to account for the malicious potential of Blob URIs containing HTML/JavaScript.
• DOMPurify Object Bypass: Circumventing DOMPurify, a widely respected sanitization library, by passing an object instead of a string, tricking the library into believing a malicious payload was safe.
• React is Attribute and Prototype Pollution: A highly advanced technique involving prototype pollution via a third-party library (elliptic) to reintroduce a forbidden React attribute (is), forcing React to treat an element as custom and thus bypass its sanitization for attributes like onerror. This particular finding resulted in a $10,000 payout.

The second key finding detailed an OAuth misconfiguration where localhost was permitted as a redirect URI for Google Sign-In (GSI) authentication. Halltari explained how this seemingly innocuous configuration, often left for development testing, becomes a severe vulnerability on mobile platforms. By leveraging the fact that mobile applications can spin up local web servers and listen on localhost without special permissions, an attacker could craft a malicious app to intercept sensitive JWT (JSON Web Token) credentials. This exploit, demonstrated with a video proof-of-concept, secured a $5,000 bounty.

Together, these findings serve as compelling evidence that off-chain components in Web3 dApps are not merely ancillary but critical attack surfaces that can yield significant impact and rewards for discerning bug bounty hunters.

Technical Deep Dive

▶ Watch: Prototype pollution using elliptic's cloneDeep (5:30)

The technical depth of Halltari's findings provides a masterclass in exploiting the nuances of web application security within a Web3 context. Each vulnerability showcased a meticulous understanding of how frameworks, libraries, and protocols can be subverted.

Nearweb XSS: Chaining Sanitization Bypasses

The Nearweb platform featured an editor allowing users to input HTML code to create widgets. This HTML was processed within a JavaScript sandbox, specifically a React environment. The initial defense mechanism against XSS was a custom function designed to sanitize href attributes.

1. Blob URI Bypass

The first vulnerability targeted a custom sanitizeURL function. This function attempted to remove JavaScript URIs, HTML entities, and ensured that schemes were safe (e.g., http, https, mailto). However, it overlooked Blob URIs. Blobs represent raw file-like objects, and crucially, they can contain HTML content.

An attacker could craft a payload like:

By creating a widget with a Blob URI containing malicious JavaScript, Halltari bypassed the sanitizeURL function, as it wasn't designed to handle or scrutinize the content within a blob: scheme. The browser would interpret the blob as a local file, executing the embedded script.

2. DOMPurify Object Bypass

Following the initial Blob URI bypass, the Nearweb developers patched the vulnerability by replacing their custom sanitizeURL with DOMPurify, a robust sanitization library. Specifically, they used DOMPurify's isvalidattribute function to validate HTML attributes.

The isvalidattribute function, while powerful, was primarily designed to operate on strings. Halltari discovered that the vulnerable code, before passing input to DOMPurify, wasn't strictly enforcing that the input must be a string. This allowed an attacker to pass an object instead.

The key insight was to craft an object whose valueOf() or toString() method would be called by DOMPurify during its internal processing. The object was designed such that its initial representation (e.g., valueOf()) appeared safe (e.g., mailto: scheme, which DOMPurify considers benign). However, when DOMPurify internally attempted to process the attribute further or convert it to a string for operations like string.replace, the toString() method of the crafted object would return a malicious javascript: URI.

A simplified conceptual payload would look like:

This clever bypass exploited a type confusion, leveraging DOMPurify's string-centric validation against an object input, allowing the javascript: URI to sneak through.

3. React is Attribute and Prototype Pollution

The final and most sophisticated XSS bypass on Nearweb involved a combination of prototype pollution and a specific behavior of the React framework. React has a special attribute called is, which is used to define custom elements. Crucially, when React detects a custom element (i.e., an element with the is attribute), it often bypasses its internal sanitization logic for the element's attributes. The Nearweb application had initially blacklisted the is attribute to prevent this exact attack vector.

Halltari's breakthrough came from identifying a prototype pollution vulnerability within a third-party library used by Nearweb: cloneDeep from elliptic. The elliptic library, often used for cryptographic operations, contained code that added methods to the prototype chain (e.g., string.prototype). This meant an attacker could modify the global String.prototype object.

With prototype pollution achieved, the next step was to find a "gadget" within the React codebase that could be triggered by this pollution. Halltari discovered a specific flow in React's attribute handling:

The final exploit chained these components:

1. Pollute string.prototype: By calling elliptic's cloneDeep function with specific input, the is attribute was injected into String.prototype.
2. Trigger React gadget: An attacker would then declare a string within the React component's context. Because string.prototype was polluted, this string would now "inherit" the is attribute.
3. Bypass sanitization: React, upon encountering this string (now effectively having an is attribute), would mistakenly identify the element as a custom element. This caused React to skip its usual sanitization for attributes like onerror, allowing an onerror="alert(document.domain)" payload to execute, leading to an account takeover.

This complex chain of vulnerabilities, leveraging a third-party library's flaw to manipulate a core framework's behavior, highlights the intricate nature of modern web security and earned a $10,000 bounty.

OAuth Misconfiguration: Localhost Redirect URI on Mobile

The second major finding involved an OAuth misconfiguration in a Web3 exchange that used Google Sign-In (GSI) for authentication. Developers often allow localhost as a valid redirect URI during development for testing purposes, assuming it poses no risk in production. However, Halltari demonstrated how this assumption is false, especially on mobile devices.

The critical insight is that on mobile operating systems, any installed application can spin up a local web server and listen on localhost without requiring special permissions. This transforms localhost from a benign testing endpoint into a potential attack vector.

Vulnerable Flow (with GSI):

For Google Sign-In, two parameters are crucial: redirect_uri and origin. Both must allow localhost for the vulnerability to exist. Halltari noted that Google's own web SDKs for GSI had, at times, suggested using localhost for these parameters, contributing to widespread misconfigurations.

The exploit steps were as follows:

1. Malicious Mobile App: An attacker develops a malicious mobile application that, upon launch, starts a local web server listening on localhost (e.g., http://localhost:8080).
2. Initiate OAuth Flow: The malicious app opens a pop-up or iframe directed to the vulnerable exchange's authentication endpoint. It provides the client_id and sets both redirect_uri and origin to http://localhost:8080.
3. Bypass User Interaction (auto_select): Google Sign-In has an auto_select feature. If the user already has an active Google session on their device, this feature can allow the authentication flow to complete without explicit user interaction (i.e., no "Do you want to log in with this account?" prompt).
4. Token Interception: After successful authentication with Google, the OAuth provider redirects the user's browser back to the specified redirect_uri (http://localhost:8080) along with the JWT token or an authorization code that can be exchanged for it.
5. Credential Theft: The malicious app's localhost web server intercepts this redirect, extracts the JWT token from the URL parameters (location.search or location.hash), and can then send it to an attacker-controlled server, effectively compromising the user's account on the Web3 exchange.

Halltari provided a video demonstration of this attack, showing a malicious app opening a pop-up, completing the authentication flow without user interaction, and successfully capturing the JWT credential. This critical flaw earned a $5,000 bounty, underscoring the severe implications of seemingly minor misconfigurations when combined with platform-specific behaviors.

Demo / Proof of Concept

▶ Watch: Increasing XSS impact with wallet interactions (7:10)

Bruno Halltari provided a compelling video demonstration of the OAuth misconfiguration exploit. The demonstration clearly illustrated the practical execution and impact of allowing localhost as a redirect URI for Google Sign-In authentication on a mobile device.

In the video, Halltari launched a specially crafted malicious mobile application. Upon execution, the app seamlessly initiated the authentication flow with the vulnerable Web3 exchange. A pop-up window briefly appeared, but critically, the process completed without any user interaction or explicit consent. This was a direct result of the auto_select feature in Google Sign-In, which, when combined with an existing Google session on the device, bypasses the typical login prompt.

Within moments, the malicious application successfully intercepted and displayed the sensitive JWT (JSON Web Token) credential that was redirected to its localhost web server. The ease and speed with which the token was acquired highlighted the severity of this vulnerability, demonstrating how an attacker could gain unauthorized access to a user's account on the exchange. This clear and concise proof-of-concept was instrumental in securing a $5,000 bounty for the finding.

Defensive Implications

▶ Watch: OAuth localhost redirect URI trick (8:05)

The vulnerabilities detailed by Bruno Halltari provide crucial insights for developers and security teams building and defending Web3 applications. A multi-layered defense strategy, extending beyond on-chain security, is paramount.

For XSS Vulnerabilities:

• Robust Input Validation and Output Encoding: Never trust user input. Implement strict server-side validation for all incoming data. On the client-side, always use context-aware output encoding when rendering user-supplied data into HTML, JavaScript, or other contexts. Libraries like React often handle some encoding, but developers must understand their limitations and potential bypasses.
• Correct Use of Sanitization Libraries: While libraries like DOMPurify are powerful, they must be used correctly. Ensure that inputs are strictly typed (e.g., always pass strings to functions expecting strings) to prevent type confusion attacks like the object bypass demonstrated. Keep all security libraries updated to their latest versions.
• Awareness of Framework-Specific Behaviors: Understand how your chosen front-end framework (e.g., React) handles attributes, custom elements, and sanitization. Special attributes like is can alter default security behaviors.
• Third-Party Library Audits: Regularly audit third-party libraries for known vulnerabilities, especially those related to prototype pollution (like the elliptic library example). Use tools for dependency scanning and be cautious when including libraries that modify global prototypes.
• Content Security Policy (CSP): Implement a strong and granular Content Security Policy (CSP) to mitigate the impact of any successful XSS attacks. A restrictive CSP can prevent injected scripts from executing, loading external resources, or sending data to arbitrary domains.
• Secure Sandboxing: If allowing user-generated content, ensure sandboxing mechanisms are robust and truly isolated. Regularly review and test sandbox bypasses, as demonstrated with the Blob URI technique.

For OAuth Misconfigurations:

• Strict Redirect URI Validation: This is the most critical defense. **Never allow localhost or wildcard * in production OAuth configurations.** Maintain a strict allowlist of fully qualified, specific redirect URIs. Developers should use separate OAuth client IDs and configurations for development/testing environments that do not allow localhost and are never deployed to production.
• Origin Validation: For OAuth flows that use an origin parameter (like Google Sign-In), ensure it is also strictly validated against an allowlist of trusted domains, and localhost is excluded in production.
• Regular Configuration Review: Periodically review all OAuth provider configurations to ensure that no testing-related settings (like localhost allowances) have inadvertently made it into production.
• Understand Mobile-Specific Attack Vectors: Be aware that mobile applications can behave differently than web browsers, particularly concerning localhost access. Assumptions about security based solely on desktop browser behavior may not hold true for mobile.
• User Interaction for Authentication: Where possible, ensure that authentication flows always require explicit user interaction, even with features like auto_select. This adds a layer of defense by making silent token theft more difficult.

By addressing these off-chain vulnerabilities with the same rigor applied to on-chain smart contract security, Web3 projects can significantly enhance their overall security posture and protect users from account compromise and data theft.

Key Takeaways

• Off-chain vulnerabilities are prevalent and high-impact in Web3: Despite the focus on on-chain security, traditional web attack vectors like XSS and OAuth misconfigurations remain critical threats in Web3 dApps, often leading to severe consequences like account takeovers.
• Standard web attack vectors are still highly relevant: Bug bounty hunters should not neglect classic web vulnerabilities. A deep understanding of common web exploits can yield significant findings in the Web3 ecosystem.
• Deep understanding of frameworks and third-party libraries is crucial: Exploiting vulnerabilities often requires intricate knowledge of how front-end frameworks (like React) and their integrated libraries (like DOMPurify, elliptic) process and sanitize user input.
• Prototype pollution can be a powerful primitive for chaining exploits: As demonstrated, polluting global prototypes can alter the behavior of core application components and frameworks, enabling complex bypasses of security mechanisms.
• localhost redirect URIs are dangerous, especially on mobile: Allowing localhost in production OAuth configurations is a critical misconfiguration. Mobile applications can exploit this to intercept sensitive credentials without user interaction.
• Proving impact is vital for higher bounties: For XSS, demonstrating direct interaction with wallet functionalities (e.g., popping a fake sign-in transaction) or achieving account takeover significantly increases the perceived impact and payout.

About the Speaker(s)

Bruno Halltari is a dedicated security researcher currently working with OtterSec. His professional focus lies in uncovering vulnerabilities across various platforms. With a background in participating in Capture The Flag (CTF) competitions, Halltari has honed his skills in identifying intricate security flaws. He is an active participant in the bug bounty community, contributing to platforms such as Integrity, HackerOne, and Immunefi, where he focuses on finding and reporting vulnerabilities to improve the security of various applications, including those in the Web3 space.