Auditing Smart Contracts: Solidity & Security

Learning Goal: Master the science and art of smart contract security auditing. By the end of this curriculum, you will possess a deep, production-ready understanding of the Ethereum Virtual Machine (EVM) mechanics, write highly secure Solidity smart contracts, identify and exploit complex vulnerabilities (including Reentrancy and Flash Loan manipulations), utilize advanced automated tooling, and compile industry-grade manual auditing reports.

Prerequisites

• Basic understanding of command-line tools (terminal/shell).
• Prior exposure to programming concepts (variables, loops, functions, and object-oriented design in languages like JavaScript, Python, or C++).
• No prior smart contract security or assembly knowledge is required.

Estimated Study Time

• Total Course Duration: ~22 Hours (includes video runtimes, hands-on coding exercises, setting up security toolchains, analyzing report repositories, and performing mock audits).

Module 1: Blockchain & Ethereum Fundamentals

In this module, you will master the underlying computation engine of decentralized networks. Rather than focusing on high-level cryptocurrency concepts, you will dive directly into the technical implementation of the Ethereum Virtual Machine (EVM), its state-transition model, execution logic, and how EVM-compatible code operates globally across a distributed peer-to-peer network.

Recommended Videos

Ethereum Virtual Machine(EVM) Full Crash Course | EVM Working | Deep Dive Into Ethereum

@uttam_singhk37:1110,232

Ethereum Virtual Machine(EVM) Full Crash Course | EVM Working | Deep Dive Into Ethereum

This comprehensive section covers the foundational concepts of the Ethereum Virtual Machine. The EVM was designed in 2013 by Vitalik Buterin and Gavin Wood, inspired by BitTorrent's decentralized architecture. A virtual machine simulates computer operations by isolating components, enabling multiple virtual computers on a single physical machine. Unlike native programs that directly access hardware, virtual machines use their own computational resources. Bytecode serves as a platform-independent

@uttam_singhk · 37:11

• Why this video: This video directly bridges the gap highlighted in the curriculum review by providing a highly technical, end-to-end breakdown of the EVM's design space. It explores how the EVM processes transactions, executes bytecode operations, and acts as a global, decentralized state engine.

The Ethereum Virtual Machine (EVM): A Complete Technical Guide

@0xOwenThurm35:1610,100

The Ethereum Virtual Machine (EVM): A Complete Technical Guide

The Ethereum Virtual Machine (EVM) operates using four distinct data storage areas: the stack (a LIFO structure for 32-byte words used for computation), memory (a dynamic 32-byte word space with a free memory pointer at 0x40 initially pointing to 0x80), call data (read-only input data cheaper to access), and storage (permanent, expensive 32-byte word storage organized as Patricia Merkle tries). These areas interact through opcodes—single-byte hexadecimal instructions like PUSH, POP, MSTORE, MLOA

@0xOwenThurm · 35:16

• Why this video: A rigorous developer-centric breakdown of the EVM storage architectures. It explores the physical execution limits, costs, and behaviors of Stack, Memory, Storage, and Calldata. Understanding these data locations is critical, as wrong gas optimizations or incorrect data persistence choices are a primary source of smart contract bugs.

Ethereum Virtual Machine (EVM) Explained: Architecture and Function

@Quicknode05:3216,628

Ethereum Virtual Machine (EVM) Explained: Architecture and Function

The Ethereum Virtual Machine (EVM) is a globally distributed, Turing-complete virtual machine maintained by all node runners in the Ethereum blockchain network, which executes smart contracts written in Solidity by converting them into bytecode with opcodes, where each operation consumes gas (a fee-based resource) and maintains the blockchain's state using a Merkle Patricia Trie structure.

@Quicknode · 05:32

• Why this video: A visual architectural breakdown of the EVM that maps how nodes achieve consensus over executing smart contract bytecode. It serves as an excellent mental anchor for the state-machine execution flow.

Module 1 Knowledge Checkpoint

• Understand the exact technical difference between Stack, Memory, Storage, and Calldata within EVM architecture.
• Explain how Solidity code is compiled to EVM bytecode and executed via opcodes.
• Describe how global consensus is maintained across thousands of independent nodes running identical state calculations.

Module 2: Solidity Programming Foundations

This module transitions from theory to practical software construction. You will learn the mechanics of the Solidity programming language, starting with basic syntactic layouts, advancing to storage variable layouts, and mastering security-critical access control modifier patterns and class inheritance.

Recommended Videos

Solidity Smart Contract Tutorial: Beginner's Guide to Blockchain Development with CryptoZombies – Coding a DApp on Ethereum

@EatTheBlocks02:18:1557,905

Solidity Smart Contract Tutorial: Beginner's Guide to Blockchain Development with CryptoZombies – Coding a DApp on Ethereum

Solidity is a programming language for writing smart contracts on the Ethereum blockchain, featuring state variables for data storage, functions for logic execution, structs for complex data structures, arrays for collections, and events for external communication; developers must understand gas costs, overflow/underflow prevention using SafeMath libraries, and access control modifiers like onlyOwner to create secure and efficient smart contracts.

@EatTheBlocks · 02:18:15

• Why this video: Solves the crucial review gap of requiring a cohesive, English-language beginner course. It walks through Solidity fundamentals (mappings, structs, arrays, functions, and state inheritance) step-by-step using a practical, project-based engineering approach.

Solidity Crash Course - Smart Contract Developer Tutorial #3

@DappUniversity14:3121,921

Solidity Crash Course - Smart Contract Developer Tutorial #3

This video teaches how to implement function modifiers in Solidity smart contracts to control access and behavior. The instructor demonstrates creating custom modifiers like 'only owner' that restrict function calls to specific accounts by comparing the caller's address (using MSG.sender) with a stored owner address, and implementing time-based access control using block.timestamp to restrict function execution to specific time windows. These modifiers help enforce business logic and security ru

@DappUniversity · 14:31

• Why this video: Focuses explicitly on the implementation of function modifiers. Understanding how custom modifiers execute code before and after core logical functions is critical to analyzing and writing robust access control frameworks.

Inheritance | Solidity 0.8

@smartcontractprogrammer03:5915,994

Inheritance | Solidity 0.8

In Solidity, inheritance allows child contracts to reuse parent contract code while customizing specific functions. To enable function customization, parent contracts must declare functions as 'virtual', and child contracts must use the 'override' keyword when redefining those functions. Functions not overridden in the child contract remain accessible from the parent, enabling multiple levels of inheritance where each level can override functions from its parent.

@smartcontractprogrammer · 03:59

• Why this video: Explains inheritance syntax and override rules in Solidity 0.8.x. Auditors must understand how state compiles in parent-child relations to trace hidden overrides or scope visibility issues.

Module 2 Knowledge Checkpoint

• Write, compile, and deploy a basic smart contract in the Remix IDE using state variables and custom view/pure functions.
• Create and apply custom modifiers (modifier onlyOwner) to restrict administrative state updates.
• Implement multi-tier contract inheritance patterns using correct is, virtual, and override syntax.

Module 3: Common Smart Contract Vulnerabilities

Security auditing is the practice of structured offensive analysis. In this module, you will study how common code patterns manifest as devastating system-wide vulnerabilities. You will dissect reentrancy execution patterns, examine access-control bypasses, and study the mechanics of flash loan manipulation vectors.

Recommended Videos

How to Hack Smart Contracts With Reentrancy

@DappUniversity07:3335,657

How to Hack Smart Contracts With Reentrancy

This section demonstrates the complete reentrancy attack using Solidity code. The bank smart contract uses mappings to track user balances, with deposit and withdrawal functions. The vulnerability lies in the withdrawal function, which sends ether before updating the balance mapping. An attacker creates a malicious smart contract that calls deposit and withdrawal simultaneously. The contract's receive function triggers when it receives ether, allowing it to call withdrawal again within the same

@DappUniversity · 07:33

• Why this video: This video fulfills the review request for isolated, code-level vulnerability walkthroughs. It demonstrates a complete, step-by-step reentrancy exploit on a vulnerable contract in real-time, showing how an attacker drains contract assets through mapping updates that happen too late.

Smart Contracts Hacking: ReEntrancy Attack in Solidity Explained with EASY Examples

@JohnnyTime13:094,364

Smart Contracts Hacking: ReEntrancy Attack in Solidity Explained with EASY Examples

This comprehensive section covers the complete lifecycle of reentrancy attacks in smart contracts. It begins with explaining the fundamental vulnerability where contracts send Ether before updating balances, enabling recursive function calls. The section then demonstrates practical exploitation through a step-by-step simulation: deploying a vulnerable EtherBank contract, setting up initial deposits, writing and deploying a malicious attack contract, and executing the attack to drain funds. The d

@JohnnyTime · 13:09

• Why this video: Breaks down the conceptual "timing gap" inside EVM transaction execution that enables recursive reentrancy attacks. It clearly illustrates how the violation of the Checks-Effects-Interactions design pattern occurs.

Read-Only Reentrancy: Solidity Security Explained (0.8) + Foundry Demo

@smartcontractprogrammer19:5513,979

Read-Only Reentrancy: Solidity Security Explained (0.8) + Foundry Demo

A read-only reentrancy attack exploits the fact that when a contract calls another contract (like Curve's remove_liquidity), the receiving contract's receive() function executes before the original call finishes, allowing an attacker to read inflated or stale state values (such as virtual price) during the intermediate execution phase, which can be leveraged to manipulate reward calculations or other dependent logic in target contracts.

@smartcontractprogrammer · 19:55

• Why this video: Takes the student beyond classic reentrancy into a highly complex, modern attack vector: Read-Only Reentrancy. Shows how third-party contracts querying state mid-execution can be misled, resulting in downstream exploits (e.g., pricing manipulation).

Flash Loans, and Attacks -- explained

@TheDefiant21:1716,880

Flash Loans, and Attacks -- explained

Flash loans are zero-risk blockchain loans that exist only within a single transaction, enabling borrowers to access large amounts of collateral temporarily without upfront payment, as the transaction is automatically reverted if repayment fails. While originally designed for legitimate purposes like arbitrage, flash loans have been exploited to manipulate price oracles in DeFi protocols, allowing attackers to artificially inflate asset values and drain protocols of millions of dollars. The Nove

@TheDefiant · 21:17

• Why this video: Introduces flash loans, exploring how capital can be borrowed without collateral to perform complex oracle manipulations and multi-protocol arbitrage attacks in a single block transaction.

Module 3 Knowledge Checkpoint

• Detail the chronological execution steps of a reentrancy attack on an unshielded transfer function.
• Design and apply the Checks-Effects-Interactions (CEI) layout to prevent reentrancy without relying on gas-intensive locking structures.
• Explain how flash loan attacks exploit temporary liquidity imbalances to manipulate decentralized price feeds (Oracles).

Module 4: Security Tooling & Static Analysis

Relying on manual review alone is insufficient for modern decentralized systems. This module focuses on the automated side of auditing. You will learn how to integrate industrial static analysis tools (Slither, Mythril) and construct complex automated unit tests and fuzzing suites utilizing the robust Foundry developer environment.

Recommended Videos

Solidity/Ethereum Smart Contract Audit using Slither - Blockchain Security #4

@fuzzinglabs13:486,367

Solidity/Ethereum Smart Contract Audit using Slither - Blockchain Security #4

Slither is a Python-based static analysis tool developed by Trail of Bits that analyzes Ethereum smart contracts by compiling them into EVM bytecode and translating it to an intermediate representation (Slither IR) to detect security vulnerabilities such as arbitrary Ether sends, reentrancy attacks, and constructor-related issues; the tool provides detailed reports with line numbers, vulnerability severity levels (impact and confidence), and links to explanatory documentation, making it essentia

@fuzzinglabs · 13:48

• Why this video: A comprehensive, hands-on tutorial showing how to compile, configure, run, and interpret reports using the Python-based Slither static analysis framework to catch semantic bugs before code deployment.

Ethereum Smart Contract Analysis & Solidity Audit using Mythril - Blockchain Security #2

@fuzzinglabs17:0511,409

Ethereum Smart Contract Analysis & Solidity Audit using Mythril - Blockchain Security #2

Mythril is an automated static analysis tool for detecting security vulnerabilities in Ethereum smart contracts written in Solidity, capable of identifying common issues such as integer overflow/underflow, reentrancy vulnerabilities, and dependencies on predictable environment variables like block.timestamp, enabling developers to quickly identify and fix security flaws in their smart contracts.

@fuzzinglabs · 17:05

• Why this video: Explains symbolic execution analysis using Mythril. It teaches students how Mythril evaluates code-path invariants to discover deep architectural bugs that bypass traditional linter/static tools.

How to Write Basic Tests | Testing with Foundry

@smartcontractprogrammer09:2914,284

How to Write Basic Tests | Testing with Foundry

This tutorial demonstrates how to write basic tests in Foundry for Solidity smart contracts, covering test setup using the setup() function to deploy fresh contracts before each test, writing passing tests with assertEqual to verify expected outcomes, creating failing tests to expect errors like underflow, and utilizing options like --vvv for detailed test output and --gas-report for gas consumption analysis.

@smartcontractprogrammer · 09:29

• Why this video: Teaches you how to write local, high-performance unit tests natively in Solidity using Foundry. This approach avoids the complex JavaScript wrappers typical of Hardhat setups.

Fuzzing Solidity/Ethereum Smart Contract using Foundry/Forge

@fuzzinglabs03:074,727

Fuzzing Solidity/Ethereum Smart Contract using Foundry/Forge

Foundry is a comprehensive toolchain for Ethereum smart contract development that includes built-in fuzzing capabilities. The framework organizes projects into contracts and test folders, with setup functions initializing contract instances. The core fuzzing mechanism uses property testing, generating random inputs and verifying assertions across multiple executions. By default, Foundry runs 256 test iterations, but this can be configured in foundry.toml. Key VM cheatsheet functions like vm.assu

@fuzzinglabs · 03:07

• Why this video: Demonstrates boundaries-testing via Forge's built-in fuzzing engine. It teaches you how to supply random parameters automatically to identify edge-case overflow/underflow state transitions.

Module 4 Knowledge Checkpoint

• Run Slither locally, triage generated warnings, and successfully configure custom rule filters to ignore false positives.
• Build a local Foundry testing workspace and execute basic Forge assertions to verify secure state changes.
• Implement an automated fuzzing test that supplies randomized input parameters to isolate edge cases inside arithmetic operations.

Module 5: Professional Auditing & Real-World Case Studies

In this final module, you will synthesize your foundational and tooling skills into a professional manual audit workflow. You will learn how to analyze specifications, structure codebase walkthroughs, trace data-flows, and draft clear, actionable security findings for clients and audit contests.

Recommended Videos

Auditing Smart Contracts - Security Review of Ethereum Applications

@MuditGuptaBlockchain02:36:0520,673

Auditing Smart Contracts - Security Review of Ethereum Applications

A comprehensive approach to auditing Ethereum smart contracts involves first reviewing non-code resources to understand project intent, then creating a threat model to identify potential attack vectors, followed by systematic code review focusing on value transfer functions, line-by-line analysis for logic bugs and security vulnerabilities, and finally using automated tools like Slither to supplement manual review. Key vulnerabilities to watch for include reentrancy attacks, oracle manipulation,

@MuditGuptaBlockchain · 02:36:05

• Why this video: An unmatched, live masterclass from an industry-leading security researcher. This video demonstrates the manual auditing methodology in real-time, showing how to read non-code project artifacts, map system designs, find edge cases, and think from the perspective of an attacker.

GTDA Method: A Systematic Approach to Smart Contract Auditing

@0xOwenThurm45:4115,130

GTDA Method: A Systematic Approach to Smart Contract Auditing

The GTDA (Goals, Tags, Diagrams, Attack) method is a systematic approach to smart contract auditing that emphasizes deep codebase understanding before vulnerability hunting. The first three phases focus on building context: setting clear goals based on system features, marking potential issues with tags without immediate investigation, and creating diagrams to visualize complex execution paths. Only after thoroughly understanding the codebase should auditors enter the attack phase, applying thei

@0xOwenThurm · 45:41

• Why this video: Teaches a structured approach to manual audits using the GTDA (Goals, Tags, Diagrams, Attack) method. This systematic strategy ensures comprehensive code coverage, preventing auditors from overlooking critical pathways.

$100,000 in Bug Bounty 💸 by learning Smart Contract Auditing from CODE4RENA Reports!

@fuzzinglabs10:339,241

$100,000 in Bug Bounty 💸 by learning Smart Contract Auditing from CODE4RENA Reports!

Academic researchers developed a comprehensive methodology for analyzing smart contract vulnerabilities by examining 516 bugs from Code4Arena and similar sources. They created a dedicated repository containing structured datasets, CSV classifications, configuration files for security tools (Slither, Foundry, Mythril), and detailed markdown reports. This systematic approach enables researchers to identify patterns in vulnerability occurrence, understand the distribution of different bug types, an

@fuzzinglabs · 10:33

• Why this video: Highlights the best educational resource for auditors: real audit reports. It shows how to dissect Code4rena competitive findings databases to spot recurring vulnerabilities in decentralized finance (DeFi) protocols.

Module 5 Knowledge Checkpoint

• Outline the complete stages of a professional audit, from analyzing specifications through to draft preparation and client triage.
• Draft a professional vulnerability finding complete with Description, Impact, Proof of Concept (PoC) code, and Remediation.
• Contrast private auditing firms with crowdsourced public audit contests (e.g., Code4rena, Sherlock) regarding scope, strategy, and incentives.

Course Map

Key People Index

• Mudit Gupta (@MuditGuptaBlockchain): Chief Information Security Officer (CISO) at Polygon, a leading EVM-compatible scaling network. Renowned security researcher who regularly performs live auditive walk-throughs and incident response post-mortems on multi-million dollar exploits.
• Owen Thurm (@0xOwenThurm): Creator of the GTDA (Goals, Tags, Diagrams, Attack) method. His work focuses on establishing standardized processes for auditing, moving the industry away from ad-hoc manual code reviews.
• Patrick Collins (@PatrickAlphaC): Lead Developer Advocate and Security Educator at Cyfrin Audits. Well-known for his comprehensive, highly technical Web3 security courses, testing guidelines, and work promoting crowdsourced smart contract security.
• Johnny Time (@JohnnyTime): Web3 developer, security researcher, and independent trainer who provides educational materials focused on exploiting and securing smart contracts.

Final Self-Assessment

Achieve operational auditing capabilities by completing the following checklist:

• EVM Mechanics: Can you explain the physical storage layout differences between dynamic and static variables in EVM storage slots?
• Secure Syntactic Layouts: Can you identify the vulnerabilities in compiling code using outdated compiler pragmas (e.g., <0.8.0) without utilizing a safe math framework?
• Reentrancy Shielding: Can you confidently implement both a state-level nonReentrant inheritance guard and trace correct Checks-Effects-Interactions flows on dynamic calls?
• Access Controls: Can you read and auditing inheritance maps to confirm parent functions do not accidentally expose internal states via public visibilities?
• Static Analysis Workflow: Can you execute automated security scans using Slither via CLI and map warning outputs directly to code vectors?
• Unit Tests with Forge: Can you write a functional Proof of Concept (PoC) exploit inside a Foundry unit test to demonstrate an asset-drain vector?
• Flash Loan Defense: Can you analyze a protocol's price oracle and identify if it relies purely on unsafe spot liquidity pools instead of TWAP/Chainlink price feeds?
• Professional Documentation: Can you draft a clear severity rating (Critical/High/Medium/Low) for an identified state-override vulnerability using standard CVSS threat mapping?