A curated list of awesome Ethereum security references, guidance, tools, and more.
- Consensys Best Practices
- Solidity Security Considerations
- Comprehensive list of known attack vectors for Solidity
- Decentralized Application Security Project
- Hands on the Ethernaut CTF - Writeups for various Ethernaut CTF challenge contracts.
- Ethernaut - Naught Coin (ERC20) Exploitation - A writeup for a vulnerable ERC20 implementation from the Ethernaut CTF.
- EtherHack CTF Writeup - A writeup for EtherHack CTF challenges.
- Blockchain Security Contacts - Security contact info for blockchain projects
- Hacking Distributed - Emin Gün Sirer, professor in Cornell Tech’s IC3 lab focused on blockchain security.
- Phil Does Security - Phil Daian, grad student behind KEVM, Hydra, and other Ethereum academic projects
- Trail of Bits - Cybersecurity R&D firm with a blockchain security practice
- Martin Holst Swende - Martin Swende, programmer and appsec consultant
| Title | Conference | Year |
|---|---|---|
| Predicting Random Numbers in Ethereum Smart Contracts | OWASP AppSec | 2018 |
| Blockchain Autopsies - Analyzing Smart Contract Deaths | Blackhat USA | 2018 |
| Rattle - an EVM binary analysis framework | reCON | 2018 |
| Blackhat Ethereum | CanSecWest | 2018 |
| Smashing Ethereum Smart Contracts for Fun and Profit | HITB Amsterdam | 2018 |
| Automatic Bug Finding for the Blockchain | EkoParty | 2017 |
- The Smartest Contract #15 - Trail of Bits’ Outlook on Security w/ JP Smith
- The Smartest Contract #8 - Smart Contract Security and Honeypots w/ Gerhard Wagner
- Zero Knowledge #29 - The DAO, the White Hat Hacker Group & Giveth w/ Griff Green
- Zero Knowledge #16 - Talking security with JP Smith from Trail of Bits
- Risky Business #488 - JP Smith about all things blockchain
- ethereum-graph-debugger - A graphical EVM debugger. Displays the entire program control flow graph.
- Slither - Slither can map method visibility and modifiers, state variables that are read and written, calls, and can print the inheritance graph of a smart contract
- Solgraph - Generates DOT graphs with function control flow of a solidity contract
- Surya - Generates various visual outputs of function call graphs
- sol-function-profiler - Solidity contract function profiler
- Remix - A browser-based Solidity IDE with linting features
- Solhint - A linter for both security and style-guide validations. It strictly adheres to the Solidity Style Guide.
- Solium - Another linter for both security and style-guide validations. Does not strictly adhere to the Solidity Style Guide.
- Echidna - The only available fuzzer for Ethereum software. Uses property testing to generate malicious inputs that break smart contracts
- Manticore - Symbolic execution tool for Ethereum smart contracts that includes detectors for common security flaws
- Mythril OSS - Open-source security analysis tool for Ethereum smart contracts built around detector modules
- Securify - Static analysis tool from ChainSecurity
- Slither - Static analysis framework, written in Python, with detectors for many common Solidity issues
- KEVM - K Semantics of the Ethereum Virtual Machine (EVM)
- Manticore - Symbolic execution tool for EVM
- abi-decompiler - Ethereum (EVM) smart contracts reverse engineering helper utility
- ethereum-dasm - An EVM disassembler with static and dynamic analysis abilities, including function signature lookup
- Ethersplay - A visual disassembler for EVM bytecode built on Binary Ninja
- evm-lab - Utilities for interacting with the Ethereum virtual machine
- IDA-EVM - IDA plugin to view EVM instructions
- pyevmasm - EVM assembler and disassembler with a CLI and a Python API
- Rattle - EVM binary static analysis framework. Produces SSA representations of EVM code.
- ETHSecurity
- Enterprise Ethereum Alliance Security Task Force
- Empire Hacking Slack, Empire Hacking, and Trail of Bits Ethereum security office hours
We welcome contributions that help curate this awesome list. Please refer to the contributing guidelines when submitting PRs. Thanks!