Roadmap › Blockchain & Web3 Fundamentals › Module: Building dApps
Lessons in this course (15)
15. Security, risks and compliance
Advanced★ Must knowLesson 15 of 15
Common attacks and failures:
- Private key / seed phrase theft (phishing, malware, fake support) — the #1 cause of individual losses.
- Malicious approvals and drainer sites; address-poisoning scams.
- Smart contract bugs: reentrancy (The DAO, 2016 — led to the Ethereum/Ethereum Classic split), access control mistakes, integer issues (pre-0.8), oracle manipulation, flash-loan exploits, front-running/MEV, signature replay, upgradeable proxy misconfiguration.
- Bridge hacks and compromised validator/multisig keys.
- Rug pulls and pump-and-dump schemes.
Mitigations: audits, OpenZeppelin libraries, tests + fuzzing + formal verification, bug bounties (Immunefi), timelocks and multisig admins, monitoring (Forta, OpenZeppelin Defender), limiting approvals, hardware wallets.
Compliance: KYC/AML for exchanges and on/off-ramps, the FATF "travel rule", tax reporting. India: virtual digital assets taxed at 30% on gains plus 1% TDS on transfers (since 2022), and exchanges must register with the Financial Intelligence Unit (FIU-IND). Taiwan: crypto service providers must register for AML with the Financial Supervisory Commission (FSC), with a dedicated VASP law being developed. Rules change — check current regulations.