Poster: Don’t Trust, Verify: Empowering Last-Mile Security and Privacy in Web3 Weihong Wang imec-DistriNet, KU Leuven Leuven, Belgium weihong.wang@kuleuven.be Tom Van Cutsem imec-DistriNet, KU Leuven Leuven, Belgium tom.vancutsem@kuleuven.be Abstract—The bridging of Web2 and Web3 infrastructure is a crucial step towards a fully decentralized internet. However, participating in blockchain systems can be a significant barrier for most users due to factors such as the high cost of operation and the computational resources required. To interact with the blockchain, Web3 application builders rely on endpoint API services, which can cause centralization issues in terms of privacy, availability, and security. In response, the community has turned to light nodes as a potential solution for resource-constrained clients such as smartphones and browsers to facilitate involve- ment. In this paper, we provide an overview of recent studies in light nodes, along with an analysis of light client implementations in Ethereum and their improvements. We conclude with a call for further development of light node technology to enable broader and more diverse participation in decentralized systems. Index Terms—Web3, Blockchain networks, Light clients I. INTRODUCTION Web3, also known as the Decentralized Web, is a vision for the next generation of Web applications where users can have stronger ownership over their data and identity, supported by blockchain technology. However, transitioning to Web3 from the current web (Web2) poses several challenges [1]. Many low-capacity remote clients, such as mobile wallets, lack the ability to run a full blockchain node due to the computational and storage requirements involved in downloading and verify- ing all transactions recorded by the chain on the first-time bootstrapping process. As a result, users have increasingly relied on trusted intermediaries, such as Infura and Alchemy. These companies offer JSON-RPC services, which is a remote procedure call (RPC) protocol that utilizes JavaScript Object Notation (JSON) to serialize data and send requests to a server. By using these services, users can access blockchain networks with reduced friction. However, the reliance on intermediaries creates multiple challenges that can negatively impact the privacy, availabil- ity, and security goals of Web3 [2]. Specifically, interme- diaries have unrestricted access to transaction requests and sensitive data from end-users, including IP addresses, which can jeopardize user privacy. Moreover, intermediaries have the ability to control the content displayed on the blockchain [1], which can affect the availability of data and undermine its reliability. Finally, there is no guarantee that the data returned by intermediaries is accurate or tamper-proof, which can compromise the security of transactions and user assets. While using trusted intermediaries can provide users with a better user experience, it is essential to find solutions that provide an optimal balance between minimizing user hardware requirements and maintaining privacy and security. In this paper, we focus on the current infrastructure that bridges Web2 and Web3 from the perspective of decentralized applications (DApps) builders. As builders are responsible for providing end-users with access to blockchain content and interactions, it’s crucial that we understand the privacy, availability and security implications of current approaches. Our long-term goal is to make access to Web3 seamless for Web clients while minimizing the trust assumptions. II. PROBLEM STATEMENT In this section, we will discuss the current infrastructure for bridging Web2 and Web3 and discuss in detail how it can cause privacy concerns, availability challenges, and security threats. A. Current Infrastructure for Bridging Web2 and Web3 Payment-based. Wallets play a critical role in Web3 by providing a secure way to manage blockchain assets and facilitating interactions with decentralized ap