# Enhancing Security Against DeFi Front-End Attacks

**URL:** <https://forum.balancer.fi/t/enhancing-security-against-defi-front-end-attacks/5552>\
**Category:** General Chat\
**Created:** [February 7, 2024, 4:54pm UTC](https://forum.balancer.fi/t/enhancing-security-against-defi-front-end-attacks/5552 "2024-02-07T16:54:59Z")\
**Posts on this page:** 1\
**Page:** 1

<div class="post-metadata">

**Author:** ![WhiteHatDegen](https://avatars.discourse-cdn.com/v4/letter/w/2bfe46/32.png) [@WhiteHatDegen](https://forum.balancer.fi/u/WhiteHatDegen)\
**Post date:** [February 7, 2024, 4:54pm UTC](https://forum.balancer.fi/t/enhancing-security-against-defi-front-end-attacks/5552/1 "2024-02-07T16:54:59Z")

</div>

**TLDR:**

- Over the last 6 months the number of Front-End Attacks increased
- Users lost money because they interacted with malicious smart contracts
- We propose a system of linking DApp URLs to a list of owner verified smart contracts
- This way users can ensure to interact with the official smart contract of a domain
- We will make this available in MetaMask as a snap for smooth UX
- Happy to receive any feedback

**Goals**  
As active users of the Balancer app, we’ve noticed the rising risk of Front-End Attacks for new users of DeFi. [Balancer](https://decrypt.co/197953/balancer-frontend-hit-by-dns-attack-over-250k-stolen), [Galxe](https://coinmarketcap.com/academy/article/web3-platform-galxe-hit-by-dollar160k-frontend-attack-same-hackers-behind-balancer), [Curve](https://cointelegraph.com/news/curve-finance-exploit-experts-dissect-what-went-wrong) experienced Front-End attacks and even security heavyweight [Ledger’s](https://cointelegraph.com/news/ledger-reimburse-connect-kit-exploit) frontend library was replaced with a malicious version.

Solutions until now, have always gone back to thorough user education and careful transaction behavior, just like this guide from [Binance](https://www.binance.com/en/blog/community/a-note-on-curve-finance-and-preventing-dns-attacks-584383509573613582). However, we think there should be better solutions to guide user behavior and make DeFi more safe without the need to read through thick manuals.

**Means**  
We propose the following solution, but are happy to receive any feedback on that topic.

1. Linking DApp URLs to Verified Smart Contracts: The system associates Balancer DApp URL with a verified list of smart contracts. This list, updated by the Balancer team, will provide users the confidence that we are interacting with the official, secure smart contracts when using the app: e.g. With protection enabled, only whitelisted smart contract addresses (e.g. 0x0xBA1…2C8) will be interactable on [Balancer](https://app.balancer.fi/#/)

2. Enriching the Smart Contract Metadata with trust attestations like Twitter Account, Legal Entity Identifier for DAOs with legal entity, Contact Details and even on-chain data like transaction count and volume within the last 24h.

3. Integration with MetaMask: To make the experience even smoother, we are integrating this security feature directly into MetaMask (via Snaps). Imagine the peace of mind knowing that, as we use Balancer with MetaMask, we’re protected from potential Front-End Attacks.

**About Us**  
If you are involved as a DeFi Builder we are excited to connect!  
Access for [Early Users via Telegram Group](https://t.me/onchaintrust)  
More Info: [https://www.onchaintrust.org/](https://www.onchaintrust.org/)