View source for Citizen Guide to Being Safe in Web3

Any [[Citizen]] joining [[Neo Tokyo]] will commit to securing their crypto assets and looking out for their fellow Citizens. 

Web3, the decentralized web, presents unique opportunities and challenges for crypto users. As the value of your portfolio and the Neo Tokyo ecosystem grows, our Citizens will be targeted frequently. Ensuring security and privacy becomes paramount. This article aims to guide intermediate crypto users on how to operate safely in Web3, focusing on wallet management, smart contract permissions, and general security practices.

== Setup Notifications and Alerts ==
Before going any further, make sure to enable notifications for [[MintDefense]] via their X account and their discord server. MintDefense is the premiere Web3 security company created by Neo Tokyo Citizens.
* MintDefense on X: https://twitter.com/MintDefense
* MintDefense discord server: https://discord.gg/mintdefense
* MintDefense website: https://mintdefense.com/

== Understanding Hot and Cold Wallets ==

=== Hot Wallets ===

Hot wallets are connected to the internet and provide ease of access for day-to-day transactions. Examples include MetaMask, Trust Wallet, and other browser or mobile wallets. A hot wallet should not be used to store high-value assets, unless the wallet is being used as the intermediary to purchase or sell the valuable asset via an exchange or swap.

'''Pros:''' Easy access, user-friendly interfaces, and quick transactions. <br />
'''Cons:''' Higher risk of online attacks and vulnerabilities.

=== Cold Wallets ===

Cold wallets are offline storage solutions like hardware wallets (e.g., Ledger, Trezor) or paper wallets. Your cold wallet should function more like a bank vault, where your high value assets are stored long-term. Avoid signing transactions or granting contract permissions to your cold wallets.

'''Pros:''' Enhanced security, reduced risk of online hacks.
'''Cons:''' Less convenient for frequent transactions.

=== Best Practices ===
* Use hot wallets for small, daily transactions and cold wallets for the bulk of your assets.
* Regularly backup your wallet information securely.

== Managing Smart Contract Permissions ==
=== Importance of Revoking Permissions ===
Over time, your wallet may accumulate numerous permissions granted to various DApps and smart contracts, increasing vulnerability.

=== How to Revoke Permissions ===
Use tools like Etherscan or BscScan to view and revoke permissions:
* Connect your wallet.
* Navigate to the “Token Approvals” section.
* Review and revoke unnecessary permissions.

Alternatively, use https://revoke.cash

== Secure Transactions and Interactions ==
=== Verifying Smart Contracts ===
Always verify the authenticity of smart contracts:
* Check contract addresses against official sources.
* Use blockchain explorers to review contract code and audit reports.
=== Being Cautious with DApps ===
* Research DApps before use.
* Be wary of granting high-level permissions.

== Avoiding Scams and Phishing ==
=== Common Scams in Web3 ===
* Fake ICOs, airdrops, and giveaways.
* Pump-and-dump schemes.
* Impersonation scams.
* In Neo Tokyo, Citizens are often targeted to install early game demos.

=== Preventing Phishing Attacks ===
* Never share private keys or recovery phrases.
* Double-check URLs and email addresses.
* Use hardware wallets for an additional layer of security.

== Regular Security Audits ==

Perform regular audits of your wallet and transactions. Keep track of permissions granted and assets held. Utilize security services and tools available in the crypto ecosystem for ongoing monitoring.

== In Conclusion ==

Navigating Web3 safely requires vigilance, knowledge, and the right tools. By understanding the intricacies of hot and cold wallets, managing smart contract permissions, conducting secure transactions, and staying alert to scams, you can significantly reduce risks and enhance your Web3 experience. Remember, the crypto world is constantly evolving, and staying informed is key to operating safely in this dynamic environment.

''Note: Links on a publicly-editable Web3 wiki are a possible attack vector. This is not a comprehensive guide. It is intended to provide a general understanding of Web3 security. Do your own research.''