Skip to content

Latest commit

 

History

History
88 lines (65 loc) · 2.37 KB

README.md

File metadata and controls

88 lines (65 loc) · 2.37 KB
Raw

This is Practice Audit Directory

Listed reports will be either from tutorials or exercises.

This is a way that can be used to approach the web3 Audit.

Theory

Types of Web3 Projects

  • Decentralized Finance (DeFi)
  • NFTs (Non-Fungible Tokens)
  • DAOs (Decentralized Autonomous Organizations)
  • Metaverse and Virtual Worlds
  • Gaming and Play-to-Earn (P2E)
  • Decentralized Cloud Storage
  • Identity and Reputation Systems
  • Social and Content Platforms

ERC Protocols

  • ERC-20: Token standard for fungible tokens (e.g., USDC, DAI)
  • ERC-721: Non-fungible tokens (NFTs)
  • ERC-1155: Multi-token standard for fungible and non-fungible tokens
  • ERC-4337: Account abstraction for smart wallets

Famous Projects

  • Uniswap (DeFi/AMM)
  • Axie Infinity (Gaming/P2E)
  • Aave (DeFi/Lending)
  • OpenSea (NFT Marketplace)
  • Ethereum Name Service (Identity/Domain Names)
  • Decentraland (Metaverse)

Arsenal

Languages and Frameworks

  • Solidity: Main language for Ethereum smart contracts
  • Rust: Used for projects like Solana and Polkadot
  • Cairo: Starknet smart contract language
  • Vyper: Python-based smart contract language

Tools

  • Foundry: Development framework for Solidity
  • Hardhat: Ethereum development environment
  • EVM (Ethereum Virtual Machine): Core runtime for Ethereum contracts
  • Starknet: Layer 2 solution using Zero-Knowledge rollups for scalability

Problems

Security Issues

  • Reentrancy attacks
  • Integer overflows/underflows
  • Access control vulnerabilities
  • Phishing and front-running

Gas Optimization

  • Efficient loop usage
  • Minimizing storage reads/writes
  • Using memory over storage when possible

Exercise

Shadow Audit

  • Practice shadow auditing code from live projects

CTFs (Capture the Flag)

  • Participate in Web3 and Solidity-based CTFs

Practice Labs

  • Use platforms like Ethernaut, Damn Vulnerable DeFi, and others

Self-Hosted Problems

  • Set up local environments and create custom problems for practice

Real Live Audits

  • Audit live contracts from bug bounty programs or platforms like Code4rena

Bug Bounty

  • Participate in programs like Immunefi, HackenProof, etc.

Read

  • Hackes
  • Challenges