Curriculum·Freshman·F109
Third-Party Access and Delegated Control
3Commas, 2022. Exchange API keys belonging to users of a trading-bot service were leaked: on 28 December an anonymous party published about 10,000 and claimed they were a tenth of the 100,000 it held.
Lesson 1 opens on
The Ronin bridge, March 2022
The Ronin bridge required five of nine validator signatures to move funds. During a period of high transaction volume in late 2021, Sky Mavis obtained permission to sign on behalf of a validator operated by Axie DAO, in order to keep the network running. That permission, granted in November 2021, was intended to be temporary and was discontinued in December 2021.
The lessons
- F109-01The delegation mapEnumerate the five channels through which a third party can act on your behalfabout 24 min · opens on The Ronin bridge, March 2022
- F109-02API keysExplain why an API key bypasses authentication rather than passing itabout 31 min · opens on The 3Commas API key leak, 2022
- F109-03Session-based accessExplain why a stolen session bypasses authentication that has already succeededabout 24 min · opens on The Aggr browser extension, 2024
- F109-04Smart-account delegationDistinguish delegating authority to code from delegating it to people, and name what each one trustsabout 30 min · opens on Bybit and Safe{Wallet}, February 2025
- F109-05The delegation policyWrite a standing policy that decides grants in advance rather than at the moment of the requestabout 23 min · opens on Access that outlived its purpose
Labs
F109-L
Produce a complete inventory of every third party with any form of access to any account or wallet the learner controls. Revoke everything not actively in use. Evidence before and after. Learners routinely find approvals from protocols that no longer exist.