
Capture the Ether is a game in which you hack Ethereum smart contracts to learn about security.

It's meant to be both fun and educational.

This game is brought to you by @smarx, who blogs about smart contract development at Program the Blockchain.

Capture the Ether is a game in which you hack Ethereum smart contracts to learn about security.

Capture the Ether


Cipher Shastra is a playground where anyone can enhance their Security Skills by solving and learning from CTF like challenges. 

The playground is open source and anyone can contribute challenges to it
Twitter: @ciphershastra

Cipher Shastra


More and more DeFi projects on Ethereum are getting hacked. This is your chance to join the party.

Each challenge can be considered standalone. Depending on the challenge, you should either stop the system from working, steal as much funds as you can, or do some other unexpected things.

Put your black hat on, and break some DeFi projects on Ethereum!

Damn Vulnerable DeFi


At PHDays security conference a new contest called EtherHack was held, to solve all tasks which featured smart contract vulnerabilities.

Etherhack


Node Guardians is a gamified educational platform that creates lore-rich programming challenges for experienced Solidity, Huff, Cairo and Noir developers. Think of it as a skill-based RPG where developers can become familiar with specific stack components and a place where they can showcase their abilities. 

### Skills Upgrade

We have created a series of coding challenges called “quests” to engage smart contract developers, providing them with the knowledge to build safe and gas efficient applications. In addition to practical skills, we also provide theoretical knowledge about crypto history, technology and economics through building a library of articles that break down complex concepts of distributed systems & decentralized finance.


### Public Good

Node Guardians is a public good for developers and will always remain so. 
In addition to supporting the growth of cool ecosystems, we plan to make the platform sustainable by managing [infrastructure](https://infra.nodeguardians.io/) across various networks.

Rewarding non-contributing operators wastes funds, we prefer community-building and education.


Node Guardians is a gamified educational platform that creates lore-rich programming challenges for experienced Solidity, Cairo, Huff and Noir developers.

Node Guardians


The Ethernaut is a Web3/Solidity based wargame inspired on overthewire.org, played in the Ethereum Virtual Machine. Each level is a smart contract that needs to be 'hacked'.

The game is 100% open source and all levels are contributions made by other players. Do you have an interesting idea? PRs are welcome at github.com/OpenZeppelin/ethernaut.

A Web3 based wargame played in the Ethereum Virtual Machine

The Ethernaut

Teaching the next generation of smart contract developers and auditors. Learn from industry-leading experts how to build the next generation of web3 applications and level up your career.


Level up your web3 career through industry leading comprehensive courses

Cyfrin Updraft


We seek to support developers across the community to be able to nimbly build on top of the MetaMask ecosystem, while empowering employees to embrace Web3 mechanisms and contribute as “One ConsenSys”.

MetaMask Grants is an employee-led DAO with the mission of funding the development of high-value projects in the MetaMask ecosystem through a grants program.

Metamask Grants DAO


![Smart_Contract_Auditor_RoadMap](https://user-images.githubusercontent.com/54918791/174233728-015bd233-1df9-49fb-a6a3-2af970d90b60.png)  


Available at: https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor  
PDF: [Smart Contract Auditor.pdf](https://github.com/razzorsec/AuditorsRoadmap/files/8934042/Smart.Contract.Auditor.pdf)

### Step by Step Approach  

* [Mastering Ethereum](https://github.com/ethereumbook/ethereumbook)  
* Proof of Work vs Proof of Stake
* Solidity Fundamentals
  * [Solidity Documentation](https://docs.soliditylang.org/en/latest/)
  * [Solidity Docs](https://docs.soliditylang.org/en/v0.8.13/index.html)
  * [Smart Contract Programmer - Solidity 0.8](https://www.youtube.com/playlist?list=PLO5VPQH6OWdVQwpQfw9rZ67O6Pjfo6q-p)
  * Connect Missing Dots with Secureum
    * [Secureum Solidity 101](https://secureum.substack.com/p/solidity-101?s=r)
    * [Secureum Solidity 201](https://secureum.substack.com/p/solidity-201?s=r)

* Gas Optimizations
  * [Aggregated Tricks by pcaversaccio and Harikrishnan Mulackal](https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/6)
  * [Kaden: Gas Optimization Tips](https://betterprogramming.pub/how-to-write-smart-contracts-that-optimize-gas-spent-on-ethereum-30b5e9c5db85)
  * [Juan: Advanced Gas Optimizations](https://dev.to/juanxavier/advanced-gas-optimizations-tips-for-solidity-1j2f)

* Smart Contract Testing
  * [Hardhat](https://hardhat.org/guides/waffle-testing.html)
  * [Better Programming Hub](https://betterprogramming.pub/the-complete-hands-on-hardhat-tutorial-9e23728fc8a4)
  * [Code Eater (Hindi)](https://www.youtube.com/watch?v=vuqhHOx6188&list=PLgPmWS2dQHW9mucRpDVe16j9Qn74ZXqcD&index=5)
  * [Foundry](https://github.com/foundry-rs/foundry)
  * [Tenderly](https://tenderly.co/)

* [ERC Standards]()
  * [Token Standards](https://ethereum.org/en/developers/docs/standards/tokens/)ERC20, ERC721, ERC777, ERC1155, ERC4626, BEP20
  * Other Standards: [ERC2981](https://eips.ethereum.org/EIPS/eip-2981)

* [Openzeppelin Helper Libraries/Contracts](https://github.com/OpenZeppelin/openzeppelin-contracts)

* Upgradeable Contracts
  * [Smart Contract Programmer - Upgradeable Contracts](https://www.youtube.com/watch?v=JgSj7IiE4jA&t=157s)
  * [Smart Contract Programmer - Risks of Upgradeable Contracts](https://www.youtube.com/watch?v=XmxfB5JOt1Q&t=3s)
  * [Different Proxy Patterns - EIPs 897, 1822, 1967, 1538, 2535](https://ethereum-blockchain-developer.com/110-upgrade-smart-contracts/00-project/)

* Attack Vectors
  * [Secureum Security Pitfalls 101](https://secureum.substack.com/p/security-pitfalls-and-best-practices-101?s=r)
  * [Secureum Security Pitfalls 201](https://secureum.substack.com/p/security-pitfalls-and-best-practices-201?s=r)
  * [SWC Registry](https://swcregistry.io/)
  * [Smart Contract Programmer - Hack Solidity](https://www.youtube.com/watch?v=4Mm3BCyHtDY&list=PLO5VPQH6OWdWsCgXJT9UuzgbC8SPvTRi5)
  * [Kaden: Smart Contract Attack Vectors](https://github.com/KadenZipfel/smart-contract-attack-vectors)

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)
  * [Ethernaut](https://ethernaut.openzeppelin.com/)
  * [Capture The Ether](https://capturetheether.com/)
  * Read Walkthroughs

* DeFi
  * [Finematics - DeFi](https://www.youtube.com/watch?v=pWGLtjG-F5c&list=PLjrTIwaNiTwn39tg3sR_bPBWGHoznv47D)
  * [Smart Contract Programmer - DeFi](https://www.youtube.com/watch?v=qB2Ulx201wY&list=PLO5VPQH6OWdX-Rh7RonjZhOd9pb9zOnHW)
  * Well known protocols: Uniswap v2/v3, Compound, Curve, Aave, Balancer.
  * [Stablecoins](https://blog.chain.link/what-are-stablecoins/) => [Algorithmic Stablecoins](https://cointelegraph.com/altcoins-for-beginners/a-beginner-s-guide-on-algorithmic-stablecoins)
  * Staking Rewards, Vaults

* DeFi Attack Vectors
  * Flash Loan => Price Oracle Manipulation
  * Front-Running => Sandwich attacks
  * Rug Pulls => Unlimited Token Allowance

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)  
  * [Damn Vulnerable DeFi](https://www.damnvulnerabledefi.xyz/)
  * Read Walkthroughs

* Postmortems
  * [Immunefi](https://medium.com/@immunefi)
  * [BlockSec](https://blocksecteam.medium.com/)
  * [SlowMist](https://slowmist.medium.com/)
  * [Rekt News](https://rekt.news/)
  * [PeckShield](https://twitter.com/peckshield)
  * [Mudit Gupta](https://twitter.com/mudit__gupta)
  * [Samczun](https://twitter.com/samczsun)

* Report Reading
  * [Secureum Audit Findings 101](https://secureum.substack.com/p/audit-findings-101?s=r)
  * [Secureum Audit Findings 201](https://secureum.substack.com/p/audit-findings-201?s=r)
  * Trail of Bits, Consensys, Openzeppelin, QuillAudits

* Security Standards & Checklists
  * [Rari-Capital Solcurity](https://github.com/Rari-Capital/solcurity)
  * [SCSVS](https://github.com/securing/SCSVS)

* Tools
  * [VS Code IDE](https://code.visualstudio.com/)
  * [Slither](https://github.com/crytic/slither)
  * [Mythril](https://github.com/ConsenSys/mythril)
  * [Mythx](https://mythx.io/)
  * [Echidna](https://github.com/crytic/echidna)
  * [Manticore](https://github.com/trailofbits/manticore)
  * [Surya](https://github.com/ConsenSys/surya)
  * [Scribble](https://github.com/ConsenSys/scribble)
  * [BlockSec ETH/BSC Tx Analysis](https://versatile.blocksecteam.com/tx) 
  * [ethtx ETH Tx Analysis](https://ethtx.info/)
  
* Continue Learning
  * [Ethereum Yellow Paper](https://github.com/ethereum/yellowpaper)
  * [Ethereum Improvement Proposals (EIPs)](https://eips.ethereum.org/)
  * [Eth Research](https://ethresear.ch/)
  * NewsLetters - Blockthreat, HashingBits
  * Communities
    * Immunefi, Secureum, Blockchain Pentesting( discord )  
    * Eth Security Community (Telegram)
  * Be Active on Twitter


This roadmap provides a step by step approach to become an Ethereum Smart Contract Auditor

Ethereum Smart Contract Auditor Roadmap


Increase safety and transparency for DeFi through a community-driven product risk history and scoring resource.

DeFi Risk Tools & Resources

Explore the minds of world-class web3 hackers, smart contract protocol developers, startup founders, and cybersecurity specialists

Scraping Bits


Zero Knowledge is a podcast which goes deep into the tech that will power the emerging decentralised web and the community building this. Covering the latest in zero knowledge research and applications, the open web as well as future technologies and paradigms that promise to change the way we interact — and transact — with one another online.

Zero Knowledge is hosted by Anna Rose

Where we talk about zero knowledge research and the decentralised web

Zero Knowledge

EIP-6672 introduces an extension to ERC-721 standard, with an added feature of the creation of Multi-Redeemable NFTs. Learn how these tokens enable redemption in multiple scenarios, expanding the utility of NFTs.

A Comprehensive Guide to ERC-6672: Multi-Redeemable NFTs

A honeypot is a trap set to detect hackers. Reentrancy attack is one of the vulnerabilities that affects decentralized systems badly. To combat such threats, developers employ techniques like honeypots. It functions by luring potential attackers into revealing their tactics so that developers get valuable insights for improving security measures.

A Practical Guide on Honeypot Attacks in Smart Contracts


Using the project’s code base and test frameworks for trying exploits, written as unit tests.

This method has a few advantages:
- Sometimes contracts are deployed, but there isn’t solid info on finding them. Using the development team’s code base makes things easier because you don’t have to interact with deployed contracts.
- You can easily test contracts that are in scope for the bounties but haven’t been deployed yet. Forking the mainnet wouldn’t help you here.
- Sometimes project code bases already have tons of tests and scenarios ready. You just need to tweak a few lines of a unit test to test an exploit.
- Project development teams are familiar with their unit tests. A new unit test using the same practices is easier for them to validate than a stand-alone PoC (proof of concept).

Being able to quickly modify an existing test and check if an exploit works is a valuable asset to have in your toolkit.

This step-by-step guide will help you use developmental test code to validate smart contract exploits

A guide for reusing test code to validate smart contract exploits


One of the most exciting recent advances in the field of cryptographic proof systems is the development of STARKs. It comes in the wake of a booming blockchain industry, for which proof systems in general seem tailor-made: blockchain networks typically consist of mutually distrusting parties that wish to transact, or generally update collective state according to state evolution rules, using secret information. Since the participants are mutually distrusting, they require the means to verify the validity of transactions (or state updates) proposed by their peers. Zk-SNARKs are naturally equipped to provide assurance of computational integrity in this environment, as a consequence of their features:

- zk-SNARKs are (typically) universal, meaning that they are capable of proving the integrity of arbitrary computations;
- zk-SNARKs are non-interactive, meaning that the entire integrity proof consists of a single message;
- zk-SNARKs are efficiently verifiable, meaning that the verifier has an order of magnitude less work compared to naïvely re-running the computation;
- zk-SNARKs are zero-knowledge, meaning that they do not leak any information about secret inputs to the computation.

This tutorial series explains the mechanics of the STARK proof system. It is directed towards a technically-inclined audience with knowledge of basic maths and programming.

Anatomy of a STARK


From time to time, I receive messages asking me for advice on how to get started as a smart contract security auditor. While there are already articles written about this topic, most of them are just a collection of security-related articles which they throw at beginners, overwhelming them. I’ll provide a path that I would take if I had to do it all over again. This will be ETH specific (or more general EVM-specific) as most auditing work is currently still in this ecosystem.

At the end, I’ll also go over frequently asked questions that are related to auditing and getting your first job.

This guide provides a path on how to get started as a smart contract security auditor.

Become a smart contract auditor


Blockchain and smart contract development are still relatively new and highly experimental. They require a different engineering mindset than traditional web, or app development where ‘move fast and break things’ has become the norm.

Blockchain development is much more like hardware, or financial service development. Smart contracts are complex instruments that offer the possibility to have self-enforcing contracts including transparent, tamper-proof, and immutable information. They have the authority to allocate high-value resources between complex systems. Often working autonomously. With huge financial loss at risk. This makes smart contracts critical components in these systems. Development of such components requires more investment, design, and effort upfront. Solid engineering practices, rigorous testing, and a strong security mindset.

A guide on smart contract patterns & practices

Clean Contracts

This article walks you through a Capture the Flag (CTF) challenge on Fibonacci

Develop EVM assembly opcode logic for Fibonacci

Protocols that are meant to work with ERC20 tokens can face a number of different issues that at first glance aren't that obvious.

ERC20 Weirdness & Attacks Part 1


Your entire Ethereum (and almost every other blockchains) wallet is accessible by your private key, which is basically a random 256 bits long number. In fact, you could enter any 32 hex characters long key, and import an account to your Metamask for example. If you want to try this out, there are two ways: some websites like https://keys.lol/ allow you to see random private keys, and even compute their balance. However, I’d be tempted to think that if you use such websites to compute a private key, you’ll probably won’t be able to withdraw from one whose balance is not zero, as there’s a high chance the website installed a bot that filters the latter and instantly transfers the funds to another address, such as the website owner’s.

This article is an introduction to possible attacks against cryptography algorithms used in blockchains and is to arouse your curiosity about cryptography.

Ethereum private keys attacks


What is Formal Verification?
What is Symbolic Execution? 

Troy Interview: https://www.youtube.com/watch?v=H52U4ibkf5Q
Josselin Interview: https://www.youtube.com/watch?v=3pWYvtx_sjA

✍️ Article: https://medium.com/@patrickalphac/formal-verification-symbolic-execution-38e0ac9072eb
🗻 Code Examples: https://github.com/PatrickAlphaC/denver-security/tree/main
🟩 Comparing Symbolic Execution tools: https://hackmd.io/@SaferMaker/EVM-Sym-Exec
📚 Invariant vs Fuzz: https://ethereum.stackexchange.com/questions/144691/whats-the-difference-between-invariant-and-fuzz-testing
🛠️ Foundry Invariant: https://book.getfoundry.sh/forge/invariant-testing
🦔 Echidna: https://github.com/crytic/echidna


We look at formal verification & symbolic execution with two Trail of Bits Web3 security team members. Additionally, we review the value these techniques bring and compare them to other tools.

Formal Verification & Symbolic Execution | The Security Silver Bullet?


Wrapped ETH, or WETH, is one of Ethereum’s most popular smart contracts. While WETH serves a simple purpose, a significant portion of all Ethereum transactions depend on it. WETH now underpins large parts of DeFi. In this blog post, we prove critical safety guarantees and invariants within the WETH contract. We do so by leveraging Z3, a battle-tested SMT solver.

Proving the safety of the Wrapped ETH smart contract, using the Z3 Theorem Prover

Formally Verifying The World’s Most Popular Smart Contract


What are Fuzz tests?
What are invariant tests?
What are they for? 

The fuzz/invariant test suite is one we at Cyfrin use to find high-severity issues quickly before we jump into the manual review!

This is the new FLOOR for security in Web3. Please understand your invariants and write fuzz tests for them! 

✍️ Article: https://medium.com/@patrickalphac/fuzz-invariant-tests-the-new-bare-minimum-for-smart-contract-security-87ebe150e88c
👌 Using the Handler Method: https://mirror.xyz/horsefacts.eth/Jex2YVaO65dda6zEyfM_-DXlXhOWCAoSpOx5PLocYgw
📚 Invariant vs Fuzz: https://ethereum.stackexchange.com/questions/144691/whats-the-difference-between-invariant-and-fuzz-testing
🛠️ Foundry Invariant: https://book.getfoundry.sh/forge/invariant-testing
🦔 Echidna: https://github.com/crytic/echidna


What is fuzz testing? What are invariant tests? We introduce how to use these tools in Web3 & Solidity and explain why they are essential, especially for security. 

Fuzz / Invariant Tests | The New Bare Minimum For Smart Contract Security


I remember watching the events of the Poly Network hack and being at a loss for words. My mind began to fire off on all cylinders trying to piece together how it had happened. Blockchain-related hacks were quite common by this time, but this was one of the first that had made its way to my ears. And although the hacker returned the funds, the event itself was wild enough to be memorable, to spark my curiosity, and to set me on the path to become a hacker…again.

Blockchain hacking is one of the more elusive paths in cybersecurity, but taking it remains one of the best decisions I’ve ever made. It’s groundbreaking, challenging, and extremely rewarding, both intellectually and financially. I’ve had to get knee deep into the intricacies of how things work — something I didn’t do in other disciplines. Smart contract hacking is a form of art, and there’s nothing more beautiful than watching an exploit and the series of transactions that follow.

Being a whitehat hacker in the Web3 space feels a lot like being a superhero. Nothing beats the elation that comes from saving the common man millions of dollars, especially because many are just trying to get by in a system designed to fail them. The financial benefits that come from being at the forefront of technological breakthroughs aren’t bad, either. Bug bounties of up to 2.5 million USD are being paid out for critical bugs, and the average yearly salary at a blockchain security firm is $150,000.

To top it off, most of these opportunities are fully remote, meaning you can work from home.

Join me, Anon, on this path that very few walk. Join me in saving Web3 and becoming a legend. We need you to prevent the next big hack.

Join me, Anon, on this path that very few walk. Join me in saving Web3 and becoming a legend. We need you to prevent the next big hack.

Hacking the Blockchain: An Ultimate Guide


Picture this scenario: you’ve spent the entire day fruitlessly examining smart contract code. And now you’ve stumbled across a snippet of code that makes your Spidey-Senses tingle. You get excited. Could this be the bug that makes you a million dollars, turns you into a hall of fame legendary hacker, and changes your life forever?

But you’re not 100% sure. How can you tell if that potential vulnerability you just found is critical or non-critical?

You need to know if there’s a real issue at hand. You don’t want to sound the alarm bell for a false positive.

Enter the proof-of-concept (PoC). If the bug is valid, a PoC quickly confirms this.

Having a PoC will also make your bug report easier to follow and much more likely for the project to take it seriously. Not only do they know that the exploit is definitely real, but a PoC often demonstrates the magnitude of the potential damage, which helps to get bug hunters much, much larger rewards.

In this tutorial you’ll learn how to use a forked environment via Hardhat, to write a PoC for the Alchemix Access Control Exploit.

How to PoC your Bug Leads


This tutorial covers the basics of the science of cryptography. It explains how programmers and network professionals can use cryptography to maintain the privacy of computer data. Starting with the origins of cryptography, it moves on to explain cryptosystems, various traditional and modern ciphers, public key encryption, data integration, message authentication, and digital signatures.

This tutorial is meant for students of computer science who aspire to learn the basics of cryptography. It will be useful for networking professionals as well who would like to incorporate various cryptographic algorithms to ensure secure data communication over their networks.

This tutorial has been prepared with the view to make it useful for almost anyone who is curious about cryptography. A basic knowledge of computer science and a secondary level of mathematics knowledge is sufficient to make the most of this tutorial.

This tutorial covers the basics of the science of cryptography.

Learn Cryptography


As most of you probably have some crypto assets on your own, you might have heard of the words ‘public key’ and ‘private key’. In a blockchain network, the public key kind of works as your address. If anyone else in the network wants to send you some funds, he or she is going to send it to your public key. Your private key can be seen as your signature — whenever you like to make a transaction of funds, you prove that you are the one owning the private key belonging to your public key without showing it to anyone in the network. Participants of the network, who check your transaction, can prove that you, with your public key, are the owner of the private key, without even knowing what it is. Pretty cool! But how does this really work on a more fundamental level? Let’s dig a little bit into the theory.

This article gives an introduction to understanding elliptic curve cryptography and coding it.

Learn how to code elliptic curve cryptography


In this blog post, I’m going to cover the first scaffold-eth speed run project: creating a Staking dApp. If you want to know more about scaffold-eth and my current journey in the web3 world you should read my previous article: My journey in Web3 development: scaffold-eth.

The goal of the dApp
The end goal of the project is to mimic the Ethereum 2.0 staking contract. The requirements are pretty simple:
- allow anyone to stack ether and track their balance
- if a time and stack amount deadline have reached don’t allow - users to withdraw their fund (those found are used for a future project, like the Ethereum PoS)

A collection of EVM puzzles. Each puzzle consists on sending a successful transaction to a contract. The bytecode of the contract is provided, and you need to fill the transaction data that won’t revert the execution.

Let’s play EVM Puzzles


We'll walkthrough each encounter you will face by learning deal with them using bitwise operations alongside SLOAD and SSTORE to control the EVMs storage at will.

### Storage

Storage is a persistent mapping with 2^256 - 1 available 32 byte words for each contract. When you set a state variable’s value it stores it at the assigned slot where it will remain in the EVM unless overridden with another value of the same type.


Learn how the EVMs storage system works by interacting with it through smart contracts using solidity's inline assembly/yul, taking you a step closer to bridging the gap between high and low level programming!

A Low-Level Guide To Solidity's Storage Management


Imagine the following scenario: you just found a critical vulnerability that allows funds in a smart contract to be drained. The exploit, however, is complicated and requires multiple payload parameters to be set correctly for it to be effective or even profitable at all.

It quickly turns out that calculating optimal parameters by hand is infeasible, due to the complex nature of the exploit. And yet, you want to responsibly disclose a Proof of Concept (PoC) that maximizes the amount of funds that can be drained from the contract. Why? Because it’s often true that the greater the funds at risk, the higher the bug bounty reward.

In such a situation, linear programming can be an exceptionally helpful tool. This is an advanced tutorial for whitehats who are looking to take their hacking skills to the next level.

How to Get a Bigger Bounty by Optimizing Attack Parameters

Optimizing Attack Parameters


Numerical operations in solidity can result in precision loss, where the amount that is calculated, saved and returned is incorrect and typically lower than it should be. These bugs can disadvantage users of decentralized finance platforms and they can also sometimes be used by attackers to drain funds from such platforms.

Solidity computations can lead to some devious loss of precision errors

Precision Loss Errors


Flashbots Auction is awesome. It allows advanced Ethereum users to do things that were once practically impossible (at least for those of us who don’t operate several large Ethereum mining pools). With all the attention around MEV extraction bots, I’d forgive you for thinking that’s the only thing it’s good for. But this week I used it to recover a bag of ENS tokens (worth around $13k USD at the time) from a hacked account and returned them to their rightful owner. Sound like fun? Here’s how I did it.

Flashbots Auction is awesome. It allows advanced Ethereum users to do things that were once practically impossible

Recovering Assets with Flashbots


How we could have stopped tens of millions of $ from being stolen, and accidentally made 2.5K$

Reentrancy Guard 2.0


Don't just write require statements for a specific function; write require statements for your protocol. Function Requirements-Effects-Interactions + Protocol Invariants or the FREI-PI pattern can help make your contracts safer by forcing developers to focus on protocol level invariants in addition to function level safety.

A new pattern for DeFi Smart Contract Security

You're writing require statements wrong


A smart contract audit is a time-boxed security-based code review on your smart contract/web3 system. We teach you what to expect, what you need to know, and why you might need one.

We explain what a smart contract audit is, why you need one, what to expect, and everything else you might need to know.

Smart Contract Audit | Explained


Let me take you into the depths of the dark forest, where bleeding-edge smart contract bytecode obfuscation techniques are developed to keep your secrets hidden for longer.

How do you prevent MEV frontrunners from stealing your transactions, copying your smart contracts and understanding your strategies built into your smart contracts on-chain?

Smart Contract Obfuscation Techniques


Would you bet your firstborn that the contract you just deployed doesn’t have critical vulnerabilities? If you’re like me, the answer is a resounding ‘no’.
I’ve seen enough hacks in traditional software engineering to know that you can never be 100% sure. That is scary, but a combination of different techniques can get us pretty close to the desired level of confidence. SMTChecker is one of them.

A tool that performs formal verification of your contract: you define a specification and SMTChecker formally proves that the contract conforms to the spec.

SMTChecker: (almost) practical superpower


The SMTChecker is a formal verification module inside the Solidity compiler. Historically it has been complicated to run the SMTChecker on your own contracts, since you had to compile the compiler with an SMT/Horn solver, usually z3. We have been working on different solutions to this, and nowadays it is quite easy to run it.

Using SMTChecker formal verification module in Solidity compiler with  Remix & Dapptools

SMTChecker, Remix & Dapptools


Solidity is a high-level language for implementing smart contracts on Ethereum (and the blockchains) targeting the EVM. 

Solidity 101


In this series we try to demystify zero-knowledge proofs (ZKPs) for the rest of non-math nerds. Since writing [part 1](https://dev.to/tonyolendo/the-complete-full-stack-guide-to-getting-started-with-zero-knowledge-proofs-using-circom-and-zk-snarks-part-1-53gi), my thoughts on the subject have evolved. I’m more drawn to answering the following questions

- Can anyone be a ZK developer?
- Is there a simple path that we can define for anyone to get started in writing ZK circuits?

The simple answer to all the questions above is yes! Most assuredly, yes. How? Just learn [Circom](https://iden3.io/circom) and you’ll be well on your way.



You have 1 DAI.

Using a wallet's UI (like Metamask), you click enough buttons and fill enough text inputs to say that you're sending 1 DAI to 0xd8dA6BF26964aF9D7eEd9e03E53415D37aA96045 (that's vitalik.eth).

And hit send.

After some time the wallet says the transaction's been confirmed. All of sudden, Vitalik is now 1 DAI richer. WTF just happened?

Let's rewind. And replay in slow motion.

Ready?

A transaction is just a way to tell the Ethereum network that you, as a user, want to execute an action (e.g. sending 1 DAI). A wallet helps build such transaction in a relatively beginner-friendly way.

What happens when you send 1 DAI


Sign-In with Ethereum is a game-changer for user choice on the Internet.

Instead of submitting to "Big Login," users can now login using the same keys controlling their blockchain accounts--without an intermediary. This approach has the promise but not guarantee to rebalance power dynamics in favor of the user. With Sign-In with Ethereum, we open a path where large corporations can no longer strip a user's ability to access services nor spy on their actions.

Sign-In with Ethereum is an open standard for authentication developed entirely in the open, informed through public discourse with community members across dapps, apps, wallets, security firms, and far more. You can find all the meeting recordings and notes on login.xyz. This approach is a far cry from the closed development of proprietary identity systems found in tech giants or government vendors, rightfully protested by privacy and digital rights advocates.

In contrast, Sign-In with Ethereum (EIP-4361) defines an open creative commons (CC) signing format for Ethereum accounts to securely authenticate with any web-based services. It was built by the community with direct support from the Ethereum Foundation and ENS, with Spruce tapped to lead the charge late last year. I'm excited to discuss the significance of Sign-In with Ethereum, and how it is so much more than "Connect Wallet" for all builders in Web3.

Sign-In with Ethereum is a game-changer for user choice on the Internet. Instead of submitting to 'Big Login' users can now login using the same keys controlling their blockchain accounts--without an intermediary.

Why Sign-In with Ethereum is a Game-Changer


## TL;DR

- Zero-knowledge proofs (ZKPs) can cryptographically prove a statement is true without revealing the statement itself. They offer a new level of privacy in digital transactions, allowing for verification without compromising sensitive data.
- Zk-SNARKs, which stand for Succinct Non-interactive Arguments of Knowledge, are a type of ZKPs. ‘ Succinct’ and ‘Non-interactive’ highlight their efficient performance, while ‘Zero-knowledge’ refers to their privacy-enhancing feature. They are becoming increasingly important in the blockchain world, significantly improving both scalability & privacy.


Despite the growing importance of ZKPs, much of the existing information about them tends to be quite technical. This article provides a clear guide to ZKPs for the blockchain world.

Zero-Knowledge Proofs in Plain English


In this intermediate solidity tutorial I'll be building on the lego bricks of DeFi using Solidity and Hardhat. I'll be looking at how to interact with external contracts such as chainlink oracles and how to carry out swaps/trades on Uniswap v3. Then we will look at testing and deploying the contracts to the Ethereum kovan testnet.

There is more deatails and a full tutorial at https://jamesbachini.com/intermediate-solidity-tutorial/

The code from this tutorial is open-sourced at: https://github.com/jamesbachini/myVault/

00:00 Solidity Tutorial Intro
00:34 Hardhat & Dev Environment
02:38 Solidity Code
017:59 Hardhat Testing
21:33 Solidity Security
24:52 Hardhat Deployment
29:58 Conclusion

In this intermediate solidity tutorial I'll be building on the lego bricks of DeFi using Solidity and Hardhat.

Building On DeFi With Solidity & Hardhat


Let's learn how to optimize our contracts using the Dapptools debugger.

Debugging With Dapptools


A new series walking through the Ethernaut challenges using Hardhat and ethers.js

Ethernaut Challenge walkthrough


What are Fuzz tests?
What are invariant tests?
What are they for? 

The fuzz/invariant test suite is one we at Cyfrin use to find high-severity issues quickly before we jump into the manual review!

This is the new FLOOR for security in Web3. Please understand your invariants and write fuzz tests for them! 

✍️ Article: https://medium.com/@patrickalphac/fuzz-invariant-tests-the-new-bare-minimum-for-smart-contract-security-87ebe150e88c
👌 Using the Handler Method: https://mirror.xyz/horsefacts.eth/Jex2YVaO65dda6zEyfM_-DXlXhOWCAoSpOx5PLocYgw
📚 Invariant vs Fuzz: https://ethereum.stackexchange.com/questions/144691/whats-the-difference-between-invariant-and-fuzz-testing
🛠️ Foundry Invariant: https://book.getfoundry.sh/forge/invariant-testing
🦔 Echidna: https://github.com/crytic/echidna

The fuzz/invariant test suite is one we at Cyfrin use to find high-severity issues quickly before we jump into the manual review!

Fuzz & Invariant Tests | The secret to finding CRITICAL vulnerabilities faster


This series will explain how the Solidity exploit work and then explain how to protect your Solidity smart contract from it.

Hack Solidity


In this video you can see me working over 10h on hacking an Ethereum smart contract. The attack was done on a private chain, so no actual Ethereum users have been affected.

This was a challenge called `Montagy` from the Real World CTF 2019 competition.

Even though this was part of a competition, the methodology and technologies used are the tools used in real-life Ethereum hacking as well.

What Ethereum Smart Contract Hacking Looks Like

Live smart contract hacking


In this video I cover some of the more advanced testing features of Dapptools. Specifically I go over symbolic testing.

Symbolic Testing With Dapptools


The history of software development spans decades. We benefit from the best practices, design patterns, and nuggets of wisdom that has accumulated over half a century.

In contrast, smart contract development is just getting started. Ethereum and Solidity launched in 2015, only a handful of years ago.

The crypto space is an ever-growing uncharted territory. There’s no definitive stack of tools to build decentralized apps. There are no developer handbooks like Design Patterns or Clean Code for smart contracts. Information about tools and best practices are scattered all over the place.

You’re reading the missing guide I wish existed. It summarizes the lessons I’ve learned from writing smart contracts, building decentralized applications, and open source projects in the Ethereum ecosystem.

This guide summarizes the lessons I’ve learned from writing smart contracts, building decentralized applications, and open source projects in the Ethereum ecosystem.

Best Practices for Smart Contract Development


Nowadays there are countless well-made resources on how to learn blockchain development of all kinds and with different specializations in mind, however, it is still very hard to get guidance and personalized suggestions based on your interests. I am writing this guide in order to provide an aggregator of all the resources that I’ve found over the years, plus give some opinionated commentary on how to approach them and how to use them in order to maximize learning and practical understanding in order to get building cool things in the space as soon as possible.

This guide will focus on the Ethereum ecosystem as that’s where most developers and applications are. If you are interested in other ecosystems that are non-EVM compatible and are not L2s on Ethereum, then check out their respective documentation or guides written by their developer communities. Examples of other non-EVM compatible blockchains that are popular are Solana (Rust/Anchor), Polkadot (Rust/Substrate), Cosmos, Terra, and others. Most of these blockchains do or will support the EVM stack through various initiatives like Neon EVM (Solana), Moonbeam/Moonriver (Polkadot/Kusama), EVMOS (Cosmos), etc.

I really want this guide to become a community-sourced public good that everyone will be able to take advantage of. I will do my best to present it to the wider blockchain developer community to get constructive feedback, proofreading help, and insight into how to make it the best available guide available.

devpill.me


This repository contains examples of common Ethereum smart contract vulnerabilities, including code from real smart contracts. Use Not So Smart Contracts to learn about EVM and Solidity vulnerabilities, as a reference when performing security reviews, and as a benchmark for security and analysis tools.

(Not So) Smart Contracts


This document provides a baseline knowledge of security considerations for intermediate Solidity programmers. It is maintained by ConsenSys Diligence, with contributions from our friends in the broader Ethereum community.

A guide to Ethereum smart contract security best practices

Smart Contract Best Practices


This document contains a collection of design and programming patterns for the smart contract programming language Solidity in version 0.4.20. Note that newer versions might have changed some of the functionalities. Each pattern consists of a code sample and a detailed explanation, including background, implications and additional information about the patterns.

A compilation of patterns and best practices for the smart contract programming language Solidity

Solidity Patterns


This is my exhaustive personal opinions, brain dump, examples, guide, curated resources on web2/3 development.

No matter you're complete newbie to even web2 or web2/3 dev with some experience, hope you'll find this doc helpful to get comfortable with web3 development.


A very exhaustive third brain (personal opinions, examples, guide, curated resources) on web2/3 development / security

#security

🏆 Node Guardians

🎓 Cyfrin Updraft

🌐 Smart Contract Best Practices

Newsletter