A Five-Layer Threat Model for Modern Web3 Protocols

Your Security Model Is Missing Three Attack Layers

In 2016, a smart contract audit was a reasonable proxy for security. The adversarial surface of a DeFi protocol was essentially its Solidity code. If the code was correct, the protocol was approximately secure. The tooling the industry built - manual auditing firms, static analysis scanners, fuzzing frameworks - was designed for exactly that model.

That model no longer holds, and if your security strategy is still built around it, you are exposed in ways a traditional audit will never find. The protocols representing the largest targets today operate across five distinct attack layers, only two of which fall within the scope of a traditional smart contract audit. Autonomous AI agents manage treasury positions. LLM-driven governance modules route proposals. Off-chain computation pipelines feed price and risk data through integration layers written under deadline pressure. And every keyholder in your organisation is a potential target for a fabricated video call that costs $0.40 per minute to produce.

According to Immunefi's 2024 research, smart contract bugs - the primary focus of the traditional audit model - accounted for less than a quarter of total DeFi losses in 2024, down from over 80% in 2021. The threat model that justified your security spending was accurate then. The question is whether it still is.

This paper maps the five-layer threat model for modern Web3 protocols, identifies the specific attack classes each layer exposes, and describes the security stack you need to defend across all five dimensions.

The Five-Layer Web3 Threat Stack

The diagram below maps the modern attack surface from the highest-abstraction layer (your human operators) down to the mathematical foundations (the cryptographic primitives your keys depend on). Each layer can be exploited independently - but the most sophisticated attackers design attacks that compromise multiple layers simultaneously, using a failure in one to enable an attack in another. Understanding which layers you currently have covered - and which you do not - is the starting point for a complete security posture.

The Modern Web3 Threat Stack - traditional audit scope (Protocol + Cryptographic layers) vs. full modern threat model across all five layers

The two bottom layers - Protocol and Cryptographic - are where your existing security tooling is strongest. Smart contract audits, formal verification, and static analysis address Layer 4 directly. Post-quantum migration planning and careful key management address Layer 5. The gap is in the three layers above them: Human/Social, AI/Agent, and Integration/Bridge - where the majority of recent losses have occurred, and where no mature, standardised security methodology yet exists.

Layer One: Human and Social Attacks Are the First Vector Now

The human layer is the oldest attack surface in security, and the one most thoroughly absent from technical reviews. In February 2024, a finance employee at Arup wired $25 million following a deepfake video conference. No system was hacked. No credential was stolen. The attack was a fabricated video call, and it worked.

For your protocol, the human layer is disproportionately vulnerable compared to traditional financial institutions for two structural reasons. First, the concentration of signing authority: a 3-of-5 multisig treasury may have five keyholders, and compromising two is sufficient to drain it. In a bank, a fraudulent wire transfer requires defeating multiple independent teams, compliance systems, and correspondent banking relationships. In a DeFi protocol, it requires defeating two people. Second, those people are unusually easy to research. GitHub commit histories reveal your deployers. On-chain multisig data reveals your signer addresses and threshold requirements. Podcast appearances and conference talks provide the audio-visual training material needed to fabricate convincing impersonations of your leadership.

Onfido's 2024 Identity Fraud Report documented a 3,000% increase in deepfake fraud attempts over three years. Sumsub's analysis found a 10x increase in deepfake incidents specifically in the crypto sector between 2022 and 2023. These are production attack methods being applied against production targets today.

Defending this layer requires procedural controls, not technical ones. Establish a standing team policy: no key operation occurs based on a voice or video call alone, regardless of urgency or who appears to be asking. Require out-of-band verification for all signing actions. Use duress codes. Design your multisig thresholds to require a number of simultaneous social engineering successes that is implausibly large.

Layer Two: AI and Agent Attacks

The AI agent layer is the newest and least understood of the five, and it is growing faster than any security tooling can currently track. Autonomous agents managing on-chain capital grew from approximately $100 million in combined market capitalisation in Q1 2024 to over $8.5 billion by Q4 2024. If you are building with AI agents or deploying them to manage protocol operations, you are in territory that has no mature security playbook yet.

The attack classes here are structurally different from anything in the traditional smart contract security playbook. Prompt injection via external data is the baseline vector: any natural language input your agent processes - governance proposal text, news summaries, tool call responses - is a potential injection site. Perez and Ribeiro (2022) demonstrated near-100% injection success rates through documents that an LLM was tasked with processing.

The Freysa experiment in November 2024 - where a $47,000 AI agent was publicly broken in 481 prompts by redefining a function's semantics inside the agent's reasoning context rather than overriding its instructions - demonstrates the ceiling on prompt-based defences. There is no system prompt strong enough to guarantee security under adversarial pressure. The implication for your architecture is direct: agent reasoning must never be the last line of defence. Execution must be bounded by constraints the agent cannot reason its way around - on-chain policy contracts with hard value limits, minimum-authority key scopes, and time-locked challenge windows for high-value operations.

Multi-agent relay attacks extend this vulnerability to entire agent networks. Yang et al. (2024) documented near-complete downstream compromise from a single injected input in a simulated cooperative agent network. If you are deploying a network of specialised agents - analysis feeding execution feeding risk management - treat each inter-agent communication channel as an adversarial input surface, not a trusted internal channel.

Layer Three: Integration and Bridge Attacks

By total loss, the integration and bridge layer is the most expensive attack surface in Web3 history - and it is almost certainly outside your current audit scope. The top five bridge exploits alone - Ronin ($625M), Wormhole ($320M), Nomad ($190M), Multichain ($130M), Mango Markets oracle manipulation ($114M) - represent over $1.3 billion in losses, all from infrastructure that a traditional smart contract audit would not cover.

The structural driver is the computational mismatch between AI inference (which may require 50,000 requests per second at sub-100ms latency) and blockchain consensus (Ethereum L1 processes 15 transactions per second). That gap cannot be closed - it can only be bridged with off-chain integration layers. Nguyen et al. (2024) surveyed 47 AI-integrated blockchain deployments and found that 71% of exploits targeted the off-chain integration layer, not smart contract logic. The contracts were often correct. The connective tissue was not.

The specific vulnerability classes this layer exposes - broken API authentication, TOCTOU race conditions, cross-chain message replay, and dependency chain attacks - require security controls that are genuinely novel from the perspective of a smart contract auditor. Review your entire off-chain stack: REST APIs, event listeners, keeper bots, message bridges. Treat them as in-scope. The largest exploits in DeFi history targeted code that no auditor reviewed.

Layer Four: Protocol and Smart Contract Attacks

The protocol layer is the most technically mature in terms of security tooling, which is precisely why you should not treat it as solved. Mature tooling lowers the barrier to entry - static analysers and known vulnerability signatures are as accessible to attackers as to defenders. It also presents a new vulnerability class that did not exist in 2020: AI-generated smart contract code.

The "Asleep at the Keyboard" study (Pearce et al., 2022) found that approximately 40% of GitHub Copilot code suggestions in security-critical scenarios contained at least one identifiable vulnerability. If your team is using AI coding assistants for smart contract development, you are deploying that vulnerability rate into immutable on-chain code. A subtle logic error introduced by an AI code generator cannot be patched once deployed. It must either be exploited or remain latent indefinitely.

Protocol layer security is also the one area where formal verification provides a near-complete solution for specific vulnerability classes - and where adoption has been slowest relative to the economic incentive. Seventy-three percent of the most significant DeFi exploits between 2021 and 2024 occurred in protocols that had already been audited. Formal verification of core solvency, access control, and economic invariants would have provided mathematical guarantees, not audit opinions. If your protocol manages significant TVL and has not pursued formal verification, the expected value case is straightforward and the decision is not close.

Layer Five: Quantum Pressure on the Cryptographic Foundation

The cryptographic layer is unique in this threat model: the threat is currently low-probability but high-consequence, and the lead time required for orderly migration is already being consumed. ECDSA - the signature algorithm underlying every major blockchain, including every key your protocol relies on - is theoretically broken by Shor's algorithm running on a sufficiently powerful quantum computer. That computer does not yet exist, but NIST completed its post-quantum cryptography standardisation in 2024, providing the migration path for protocols that choose to start now.

The threat is not purely future. "Harvest now, decrypt later" attacks - where adversaries collect signed transactions today for decryption once quantum hardware matures - are active against high-value targets. For blockchain, the equivalent risk is the exposure of reused addresses: approximately 4 million Bitcoin and a comparable share of Ethereum wallets have exposed their public keys through transaction history, making them retrospectively vulnerable to a quantum attack at any future point. Begin your exposure inventory now, before this becomes a crisis migration.

Building the Security Stack Your Protocol Actually Needs

A protocol that defends all five layers requires five distinct security disciplines, each with different tooling, different expertise, and different cadence. Here is what each layer requires from your team concretely.

Human layer: Write a key management policy with out-of-band verification requirements and get every keyholder to sign it. Establish duress codes. Set your multisig thresholds above 2-of-3. Run quarterly security briefings for all keyholders. None of this requires new tooling - only standing operational discipline.

AI/Agent layer: Separate agent reasoning from execution entirely. Deploy on-chain policy contracts that enforce hard value limits the agent cannot override through reasoning. Scope agent signing authority to the minimum set of contracts required for its function. Time-lock operations above a defined value threshold. Red-team your agent's input surface with adversarial prompts on a defined schedule.

Integration layer: Bring all off-chain APIs, event listeners, and keeper bots into your audit scope. Authenticate every off-chain call with cryptographic signatures. Implement on-chain bounds checking on all AI-sourced values. Lock dependency versions and run automated supply chain audits in CI.

Protocol layer: Run smart contract audits, formal verification of core invariants, and AI-generated code review as three separate activities. Add Halmos to CI against your Foundry property tests today - it costs nothing and runs symbolically. For protocols above $10M TVL, commission targeted Certora verification of solvency and access control invariants before launch.

Cryptographic layer: Inventory all exposed public keys in your treasury and signing infrastructure. Evaluate NIST-standardised post-quantum algorithms for new deployments. Build key rotation mechanisms into treasury keys on an annual schedule. Track Ethereum and Bitcoin upgrade roadmaps for quantum-resistant account models.

The Security Disciplines Your Protocol Will Need by 2030

Three security disciplines that do not yet exist as standardised practice are required by the current trajectory of the ecosystem. Building awareness of them now positions your team to adopt them as they mature.

AI agent red-teaming as a distinct profession. Security testing for LLM-based autonomous agents requires different skills from smart contract auditing or application penetration testing. It requires adversarial knowledge of LLM behaviour, tool use patterns, multi-agent trust relationships, and on-chain execution semantics. As autonomous agents manage increasing capital, the demand for this expertise will outpace supply. Engaging specialists early gives your team access before the market for this skill becomes prohibitively competitive.

Integration layer security as a first-class audit scope. The current norm - auditing smart contracts and treating off-chain infrastructure as out of scope - is responsible for over $1.3 billion in documented losses. The audit scope must expand to include every off-chain component that influences on-chain state. Firms that do not offer this as a service cannot fully protect you.

Post-quantum migration tooling for smart contract protocols. NIST standards exist. On-chain tooling for post-quantum verification at protocol scale does not yet exist at production quality. Protocols that begin building migration capabilities now will be substantially better positioned than those that treat it as a future problem when the capability gap closes.