OWASP Top 10 2025 Explained for Crypto and Fintech Web Apps

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. OWASP's Top 10:2025 adds Software Supply Chain Failures and Mishandling of Exceptional Conditions, folds SSRF into Broken Access Control and lifts Security Misconfiguration to #2. For crypto apps, test them where money moves: withdrawals, deposits and admin actions.

Watch: OWASP Top 10 2025 Explained for Crypto and Fintech Web Apps 1:42

Video transcript

The OWASP Top 10 for 2025 is final. For crypto apps, test each risk where money moves: withdrawals, deposits and admin actions.

Two categories are new: software supply chain failures at number three, and mishandling of exceptional conditions at number ten. Server-side request forgery folds into broken access control, and misconfiguration climbs to second.

Supply chain failures are rare in the data but have the highest average exploit and impact scores. OWASP attributes Bybit's 1.5 billion dollar theft to a supply chain attack in wallet software.

Guardian's public reports show these in crypto: a keeper endpoint anyone could call, rate limits that could not tell clients apart, one key holding three roles, and deposits a crash could leave uncredited.

Scanners help, but OWASP says tools cannot comprehensively detect the Top 10. Test money flows directly: replay requests with a lower role, send unsigned webhooks, and kill workers mid-flow.

OWASP ranks risks for all apps. A crypto platform should rank fixes by what can move funds: withdrawals and admin actions first, then anything that credits balances, your build, your cloud, and your alerts.

Guardian's web application pentest maps and tests every function at every privilege level. For continuous coverage, Managed Security runs Helix, Guardian's AI auditor, and only human-verified findings reach you.

Read the full article for how to test each category, or talk to Guardian at guardian.security.

The OWASP Top 10 is OWASP's awareness document for the most critical web application security risks. The 2025 edition is its eighth.

It went up first as a release candidate. OWASP removed that label from the 2025 site on December 24, 2025, and now calls it "the most current released version."

This is the web list. The OWASP Smart Contract Top 10 is a separate project for contract code. Most crypto platforms need both.

What Changed From 2021

OWASP counts two new categories and one consolidation.

New at #3: Software Supply Chain Failures, which widens 2021's Vulnerable and Outdated Components.
New at #10: Mishandling of Exceptional Conditions, covering error handling, logic errors and failing open.
Merged: server-side request forgery (SSRF), 2021's #10, now sits inside Broken Access Control.
Up: Security Misconfiguration, from #5 to #2.
Down: Cryptographic Failures (#2 to #4), Injection (#3 to #5), Insecure Design (#4 to #6).
Renamed: Authentication Failures (#7) and Security Logging and Alerting Failures (#9) keep their ranks.

Eight categories come from contributed testing data. A practitioner survey promoted two more: supply chain failures, and logging and alerting.

Supply chain failures have the fewest occurrences in the data. OWASP notes they also have "the highest average exploit and impact scores from CVEs."

The 2025 List for Crypto Apps

Each category, with one example from a crypto or fintech web app.

#	Category	What it is	Crypto example
A01	Broken Access Control	Users act outside their permissions; now includes SSRF	Swap an account ID, read another user's KYC files
A02	Security Misconfiguration	Insecure settings, defaults or cloud permissions	Rate limits keyed to the load balancer's IP
A03	Software Supply Chain Failures	Compromised dependencies, builds or distribution	Bybit's $1.5B loss, per OWASP
A04	Cryptographic Failures	Missing or weak cryptography, or leaked keys	Sequencer traffic over plaintext ws://
A05	Injection	Untrusted input run as code or queries, including XSS	Token name runs as script in a support dashboard
A06	Insecure Design	Missing or ineffective control design	One key holds the relayer, watcher and teller roles
A07	Authentication Failures	An invalid user is accepted as legitimate	Stolen admin session withdraws with no second factor
A08	Software or Data Integrity Failures	Untrusted code or data treated as trusted	Forged deposit webhook credits a balance
A09	Security Logging and Alerting Failures	Attacks go unlogged, or logged with no alert	A drain to a new address pages no one
A10	Mishandling of Exceptional Conditions	Errors leave the system in an unknown or open state	Deposit acknowledged, then lost in a crash

Examples From Real Reviews

Several of those examples come from Guardian's public reports. The rest are from OWASP or are typical of crypto apps.

Access control. In Guardian's Synthetix LP vault keeper review (M-03), a keeper endpoint had no authorizer, API key or IAM check. Anyone on the internet could invoke it.

Misconfiguration. In Ethereal (M-02), a proxy setting was off. HTTP and WebSocket requests resolved to the load balancer's IP, so rate limits could not tell clients apart.

Supply chain. OWASP's own A03 page says Bybit's 2025 theft of $1.5 billion "was caused by a supply chain attack in wallet software."

Cryptography. In Ethereal (M-01), a sequencer listener connected over unencrypted ws://. Anyone on the same network could read the traffic.

Design. In Guardian's Synthetix withdrawal flow review (H-14), one key held the relayer, watcher and teller roles. The deployment config expected three watchers and a 2-of-3 quorum.

Authentication. In Longshot (M-18), a stolen admin session could call the admin withdraw route directly, with no step-up second factor.

Integrity. A08 includes insufficient verification of data authenticity. Payment webhooks are exactly that kind of data; see webhook security for crypto payments.

Exceptional conditions. In the Synthetix withdrawal flow (M-16), deposits were acknowledged before processing. A crash in between meant funds could arrive onchain and never be credited.

How to Test Each Category

Scanners help, but OWASP says tools cannot comprehensively detect the Top 10. It "discourages any claims of full coverage."

A01: replay every request with a second account and a lower role.
A02: check cloud, proxy and header settings against a hardened baseline.
A03: inventory dependencies and CI actions, and match advisories against them.
A04: confirm TLS on every hop, including internal websockets and queues.
A05: put markup in every user-controlled field an admin later views.
A06: threat model withdrawals, approvals and key roles before code.
A07: try withdrawals, new addresses and admin actions without step-up 2FA.
A08: send unsigned and replayed webhooks; check third-party scripts for integrity.
A09: run a test attack and confirm someone gets paged.
A10: kill workers mid-flow and confirm balances fail closed.

For test cases by flow, see web application pentesting for crypto and fintech.

Remediation Priorities

OWASP ranks risks across all kinds of applications. A crypto platform should rank them by what can move funds.

Value-moving routes: access control and step-up authentication on withdrawals and admin actions (A01, A07).
Anything that credits balances: verify events, process each once, fail closed (A08, A10).
Build and dependencies: lock CI permissions and act on advisories fast (A03).
Cloud and proxies: least-privilege IAM, no public storage, correct client IPs (A02).
Alerts: page someone on new withdrawal addresses, key use and admin logins (A09).

Then cover the rest. For a full standard, OWASP points to its ASVS, which is "designed to be verifiable and tested."

Running an AI assistant? OWASP keeps a separate list for those; see our LLM pentesting checklist.

How Guardian Tests Web Apps

Guardian's web application pentest maps the app function by function at every privilege level, then tests each one.

It covers authentication, authorization, value-moving flows, business logic and input handling. It also covers the client side: XSS, injection, CSRF and bundle supply chain.

Source access is strongly recommended, so nothing user-reachable is missed. API and infrastructure pentests cover the services and cloud behind the app.

For continuous coverage, Managed Security runs Helix, Guardian's AI auditor, across your contracts, backend, infrastructure and web app. Only human-verified findings reach you, each with a fix PR.

It also matches new vulnerability disclosures against your stack, and an engineer confirms any exposure.

Frequently Asked Questions

Is the OWASP Top 10 2025 final?

Yes. It was first published as a release candidate, and OWASP removed that label from the 2025 site on December 24, 2025. The project page now calls 2025 the most current released version.

What are the new categories in the OWASP Top 10 2025?

Software Supply Chain Failures (#3), which expands 2021's Vulnerable and Outdated Components, and Mishandling of Exceptional Conditions (#10). Server-side request forgery, 2021's #10, was folded into Broken Access Control.

Is it the same as the OWASP Smart Contract Top 10?

No. The OWASP Top 10 covers web applications. The OWASP Smart Contract Top 10 is a separate list for contract code, covering risks such as access control, oracle manipulation and reentrancy. Most crypto platforms need both.

Does covering the OWASP Top 10 make an app secure?

No. OWASP calls the list an awareness document and only a starting place, and it discourages claims of full coverage. For a testable standard it points to the ASVS. Test the business logic in money flows directly.

Sources

Test your app against the 2025 list

Guardian attacks the flows where a wrong answer costs money, from login to withdrawal, and keeps testing them as your app changes.

Talk to Guardian Explore Managed Security