Decoding Web3: In-depth Analysis of the Third-Party Package Supply Chain

Kai Ma,Zhuo Wang,Yanjie Zhao,Haoyu Wang
DOI: https://doi.org/10.1145/3671016.3671402
2024-01-01
Abstract:With the growth of the Web3 domain, there has been a significant rise of third-party software packages. These range from basic blockchain interaction tools and contract development aids to frontend development packages for Decentralized Applications (DApps), with the diversity and inter-dependencies of these packages continuing to grow. However, despite these advancements, the security of these packages has not kept pace, highlighted by several significant Web3 supply chain attacks. It underscored the urgent need for a deeper understanding of the Web3 third-party library supply chain. In this paper, we present the first comprehensive analysis of the Web3 third-party package supply chain using knowledge graphs, which detail the structure, themes, and evolving dynamics within this domain. Further, we analyze the characteristics of vulnerabilities and their propagation through knowledge graphs in the Web3 ecosystem. We also extend our findings to practical applications, providing valuable insights for Web3 community stakeholders and creating an extensive dataset that includes 695,642 versions ofWeb3 packages and 270,217,326 dependency links. This research is aimed at reinforcing the foundation of Web3 development, promoting enhanced security practices, and supporting informed decision-making within the DApp landscape.
What problem does this paper attempt to address?