Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/jcsec-security/solidity-security-course-resources

Course material about common vulnerabilities, security and audits of Solidity smart contracts that I use during my lectures
https://github.com/jcsec-security/solidity-security-course-resources

audit beginner bug bugbounty contract ethereum evm security smart smart-contracts smartcontract solidity vulnerabilities

Last synced: 3 months ago
JSON representation

Course material about common vulnerabilities, security and audits of Solidity smart contracts that I use during my lectures

Awesome Lists containing this project

README 

        
# Solidity Security and Auditing Examples



Welcome to the Solidity Security and Auditing Examples repository! This collection contains a variety of practical examples and exercises that I use during my lectures on Solidity security and auditing. These resources are tailored for students who possess a 🌱 beginner 🌱 level of practical knowledge in the Solidity language and smart contract development. If you're ready to take the next step and delve into the realm of security, you're in the right place.



## Repository Structure



This repository is organized into the following sections:



### 🐛 Basic Examples 🐛



This section contains extremely simplified contracts, almost like code snippets, that highlight individual security issues. It's an excellent starting point for your journey. Read about each of the issues, and then dive into the code to identify the bugs. You can even challenge yourself by crafting your own Proof of Concept (PoC) solutions.



### 🐣 Exercises 🐣



In the "Exercises" section, you'll find slightly more advanced contracts that include some structure. While the majority of the code is redacted, these exercises simulate the appearance of real smart contracts. They're designed to give you a taste of what real-world contracts might look like and set you on your bug-hunting path.



### 💪 Faillapop Mock-Audit Environment 💪



Here, you'll discover a complete protocol comprising multiple contracts that interact with one another. Unlike a traditional Capture The Flag (CTF) approach, this environment mirrors a fully functional real-world protocol that is seeking *your* audit. While many vulnerabilities follow basic patterns, this environment offers you the chance to mimic the audit of a larger codebase, compared to the exercises in the previous section.



Some of the code snippets may draw heavily from open-source resources. If you believe you deserve credit for any of these snippets, my sincere apologies. Please reach out to me so I can properly acknowledge you by adding your name and GitHub details to the relevant section.



## Collaboration



On September 2023 the [NICS lab](https://www.nics.uma.es/) research group from the [University of Malaga](https://www.uma.es/) agreed to help improving this repository as part of their efforts on Open Source collaboration. In particular, with new versions of the Faillapop mock-audit environment, both improving the initial codebase and extending its features.



> [!IMPORTANT]  

> Special thanks to Marco Lopez ([TW](https://twitter.com/Marcologonz), [LD](https://linkedin.com/in/marcologonz)) who took on this workload as part of his dissertation and to NICS Lab's researcher Isaac Agudo who supported and pushed for the initiative to come to success.



## Contribution and Contact



I encourage you to make the most of this material. If you find it useful, feel free to share by linking to this repository. Your feedback is invaluable! If you have suggestions, corrections, or would like to contribute in any way, please don't hesitate to reach out:



- Telegram: @jcr_auditor

- Email:  [email protected]



Thank you for exploring this repository, and happy bug hunting!