
![Smart_Contract_Auditor_RoadMap](https://user-images.githubusercontent.com/54918791/174233728-015bd233-1df9-49fb-a6a3-2af970d90b60.png)  


Available at: https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor  
PDF: [Smart Contract Auditor.pdf](https://github.com/razzorsec/AuditorsRoadmap/files/8934042/Smart.Contract.Auditor.pdf)

### Step by Step Approach  

* [Mastering Ethereum](https://github.com/ethereumbook/ethereumbook)  
* Proof of Work vs Proof of Stake
* Solidity Fundamentals
  * [Solidity Documentation](https://docs.soliditylang.org/en/latest/)
  * [Solidity Docs](https://docs.soliditylang.org/en/v0.8.13/index.html)
  * [Smart Contract Programmer - Solidity 0.8](https://www.youtube.com/playlist?list=PLO5VPQH6OWdVQwpQfw9rZ67O6Pjfo6q-p)
  * Connect Missing Dots with Secureum
    * [Secureum Solidity 101](https://secureum.substack.com/p/solidity-101?s=r)
    * [Secureum Solidity 201](https://secureum.substack.com/p/solidity-201?s=r)

* Gas Optimizations
  * [Aggregated Tricks by pcaversaccio and Harikrishnan Mulackal](https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/6)
  * [Kaden: Gas Optimization Tips](https://betterprogramming.pub/how-to-write-smart-contracts-that-optimize-gas-spent-on-ethereum-30b5e9c5db85)
  * [Juan: Advanced Gas Optimizations](https://dev.to/juanxavier/advanced-gas-optimizations-tips-for-solidity-1j2f)

* Smart Contract Testing
  * [Hardhat](https://hardhat.org/guides/waffle-testing.html)
  * [Better Programming Hub](https://betterprogramming.pub/the-complete-hands-on-hardhat-tutorial-9e23728fc8a4)
  * [Code Eater (Hindi)](https://www.youtube.com/watch?v=vuqhHOx6188&list=PLgPmWS2dQHW9mucRpDVe16j9Qn74ZXqcD&index=5)
  * [Foundry](https://github.com/foundry-rs/foundry)
  * [Tenderly](https://tenderly.co/)

* [ERC Standards]()
  * [Token Standards](https://ethereum.org/en/developers/docs/standards/tokens/)ERC20, ERC721, ERC777, ERC1155, ERC4626, BEP20
  * Other Standards: [ERC2981](https://eips.ethereum.org/EIPS/eip-2981)

* [Openzeppelin Helper Libraries/Contracts](https://github.com/OpenZeppelin/openzeppelin-contracts)

* Upgradeable Contracts
  * [Smart Contract Programmer - Upgradeable Contracts](https://www.youtube.com/watch?v=JgSj7IiE4jA&t=157s)
  * [Smart Contract Programmer - Risks of Upgradeable Contracts](https://www.youtube.com/watch?v=XmxfB5JOt1Q&t=3s)
  * [Different Proxy Patterns - EIPs 897, 1822, 1967, 1538, 2535](https://ethereum-blockchain-developer.com/110-upgrade-smart-contracts/00-project/)

* Attack Vectors
  * [Secureum Security Pitfalls 101](https://secureum.substack.com/p/security-pitfalls-and-best-practices-101?s=r)
  * [Secureum Security Pitfalls 201](https://secureum.substack.com/p/security-pitfalls-and-best-practices-201?s=r)
  * [SWC Registry](https://swcregistry.io/)
  * [Smart Contract Programmer - Hack Solidity](https://www.youtube.com/watch?v=4Mm3BCyHtDY&list=PLO5VPQH6OWdWsCgXJT9UuzgbC8SPvTRi5)
  * [Kaden: Smart Contract Attack Vectors](https://github.com/KadenZipfel/smart-contract-attack-vectors)

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)
  * [Ethernaut](https://ethernaut.openzeppelin.com/)
  * [Capture The Ether](https://capturetheether.com/)
  * Read Walkthroughs

* DeFi
  * [Finematics - DeFi](https://www.youtube.com/watch?v=pWGLtjG-F5c&list=PLjrTIwaNiTwn39tg3sR_bPBWGHoznv47D)
  * [Smart Contract Programmer - DeFi](https://www.youtube.com/watch?v=qB2Ulx201wY&list=PLO5VPQH6OWdX-Rh7RonjZhOd9pb9zOnHW)
  * Well known protocols: Uniswap v2/v3, Compound, Curve, Aave, Balancer.
  * [Stablecoins](https://blog.chain.link/what-are-stablecoins/) => [Algorithmic Stablecoins](https://cointelegraph.com/altcoins-for-beginners/a-beginner-s-guide-on-algorithmic-stablecoins)
  * Staking Rewards, Vaults

* DeFi Attack Vectors
  * Flash Loan => Price Oracle Manipulation
  * Front-Running => Sandwich attacks
  * Rug Pulls => Unlimited Token Allowance

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)  
  * [Damn Vulnerable DeFi](https://www.damnvulnerabledefi.xyz/)
  * Read Walkthroughs

* Postmortems
  * [Immunefi](https://medium.com/@immunefi)
  * [BlockSec](https://blocksecteam.medium.com/)
  * [SlowMist](https://slowmist.medium.com/)
  * [Rekt News](https://rekt.news/)
  * [PeckShield](https://twitter.com/peckshield)
  * [Mudit Gupta](https://twitter.com/mudit__gupta)
  * [Samczun](https://twitter.com/samczsun)

* Report Reading
  * [Secureum Audit Findings 101](https://secureum.substack.com/p/audit-findings-101?s=r)
  * [Secureum Audit Findings 201](https://secureum.substack.com/p/audit-findings-201?s=r)
  * Trail of Bits, Consensys, Openzeppelin, QuillAudits

* Security Standards & Checklists
  * [Rari-Capital Solcurity](https://github.com/Rari-Capital/solcurity)
  * [SCSVS](https://github.com/securing/SCSVS)

* Tools
  * [VS Code IDE](https://code.visualstudio.com/)
  * [Slither](https://github.com/crytic/slither)
  * [Mythril](https://github.com/ConsenSys/mythril)
  * [Mythx](https://mythx.io/)
  * [Echidna](https://github.com/crytic/echidna)
  * [Manticore](https://github.com/trailofbits/manticore)
  * [Surya](https://github.com/ConsenSys/surya)
  * [Scribble](https://github.com/ConsenSys/scribble)
  * [BlockSec ETH/BSC Tx Analysis](https://versatile.blocksecteam.com/tx) 
  * [ethtx ETH Tx Analysis](https://ethtx.info/)
  
* Continue Learning
  * [Ethereum Yellow Paper](https://github.com/ethereum/yellowpaper)
  * [Ethereum Improvement Proposals (EIPs)](https://eips.ethereum.org/)
  * [Eth Research](https://ethresear.ch/)
  * NewsLetters - Blockthreat, HashingBits
  * Communities
    * Immunefi, Secureum, Blockchain Pentesting( discord )  
    * Eth Security Community (Telegram)
  * Be Active on Twitter


This roadmap provides a step by step approach to become an Ethereum Smart Contract Auditor

Ethereum Smart Contract Auditor Roadmap


Blockchain has emerged from the once shadowy world of cryptocurrency to become [the most in-demand skill in 2020](https://business.linkedin.com/talent-solutions/blog/trends-and-research/2020/most-in-demand-hard-and-soft-skills), according to LinkedIn. The promise of blockchain is huge. And large companies are continuing to hire and expand their blockchain teams, incl. Facebook, Amazon, Microsft, EY, Deloitte, IBM, and Oracle, to name a few. So, it should be well worth the effort to become familiar with how blockchain works, what its perceived benefits are, and as a developer starting building on top of them. 

Over the past few years, I’ve been helping and on-boarding new team members and developers into the blockchain space. This helped me to collect blogs, links, materials, and resources and see which worked well for everyone’s learning journey. It’s time to share that with a broader audience. This guide provides a starting point for developers who’re keen to learn more about blockchain and development on top of Ethereum. It will be opinionated and not contain a full list of everything available. But rather, a concise list of highly recommended options, from my own experiences. 

1. Blockchain foundations
1. Ethereum 101
1. Ethereum Development, Smart contracts & DApps 

# 1. Blockchain foundations 

New to blockchain? Let's start with a bit of the history and its foundations that motivated the creation and development of blockchain.

- [A Cyberphunk's Manifesto](https://www.activism.net/cypherpunk/manifesto.html), Eric Hughes
- [Why decentralization matters](https://onezero.medium.com/why-decentralization-matters-5e3f79f7638e), Chris Dixon
- [The Promise of the Blockchain](https://vimeo.com/161183966) (VIDEO), Vinay Gupta
- [The shift from open platforms to digital commons](http://www.bollier.org/blog/shift-open-platforms-digital-commons), David Bollier
- [Deconfusing decentralization](https://youtu.be/7S1IqaSLrq8) (VIDEO), Greg Slepak


# 2. Ethereum 101 

Now that we have an understanding where we're coming from, let's dive in a little bit deeper into the fundamental components & building blocks.

- [Bitcoin Whitepaper](https://bitcoin.org/bitcoin.pdf), Satoshi Nakamoto - the original whitepaper that started the current trend in blockchain technology: Bitcoin: A Peer-to-Peer Electronic Cash System
- [Ethereum Whitepaper](https://ethereum.org/en/whitepaper/), Vitalik Buterin - a next-generation smart contract & decentralized application platform
- [Ethereum Yellowpaper](https://ethereum.github.io/yellowpaper/paper.pdf), Gavin Wood - a more technical version of the Ethereum whitepaper
- [Smart Contracts](https://www.fon.hum.uva.nl/rob/Courses/InformationInSpeech/CDROM/Literature/LOTwinterschool2006/szabo.best.vwh.net/smart.contracts.html), Nick Szabo
- [Ethereum in 25 mins](https://youtu.be/mCzyDLanA7s) (VIDEO), Vitalik Buterin
- [How does Ethereum work, anyway](https://www.preethikasireddy.com/post/how-does-ethereum-work-anyway), Preethi Kasireddy
- [Mastering Ethereum](https://amzn.to/2VZvfz8) (BOOK), Andreas M. Antonopoulos, Gavin Wood. Or view on [Github](https://github.com/ethereumbook/ethereumbook)
- [How Proof of Stake Ethereum Works](https://stonecoldpat.substack.com/p/how-proof-of-stake-ethereum-works), Patrick McCorry


# 3. Ethereum Development 


Once you've gone through all (or at least most) of the above, you should have a solid grasp of all the concepts. So now we can finally move on to the fun part: actually building stuff! 

To get a full, comprehensive overview of the Ethereum development landscape, check out:
- [Ethereum Developers](https://ethereum.org/en/developers/)
- [The full ConsenSys developer tool list](https://github.com/ConsenSys/ethereum-developer-tools-list)

The Ethereum portal covers sections per programming language, to help you filter out what's relevant for you. Though JavaScript is most commonly used, I'd start with something that you're already familiar with, to flatten the learning curve. Use the above only for future reference. As mentioned previously, I'm trying to keep it simple and offer a few recommended options, from my own experiences. Feel free to discover, try, and learn everything from the developer portals, once you've covered these.

## Other resources

Explore this site to learn more from 

- [🎓 Courses](https://www.useweb3.xyz/courses)
- [📚 Books](https://www.useweb3.xyz/books)
- [💻 Tutorials](https://www.useweb3.xyz/tutorials)
- [🏗️ Starter kits](https://www.useweb3.xyz/starter-kits)
- And more..


This guide provides a starting point for developers who’re keen to learn more about Web3

Beginners Guide to Web3


## What is a smart contract?

Smart contracts are the backbone of decentralized applications (DApps) and Web3. A smart contract is a simple program that lives on a blockchain network (such as Ethereum). They're actually not that smart. And nothing like a (legal) contract. They’re more like an executable piece of code that requires input or an trigger from an external source. They can validate those input conditions and if correct, execute their own logic to update the state on a blockchain.

## Benefits

They often serve the following purposes:
- Store and maintain data
- Manage relationships with users, or other contracts

Benefits of smart contracts are
- Immutable - once deployed none can change them
- Composable - they’re public and anyone can interact with them, or build on top of them. Much like public APIs

## Resources

The following resources have been the most popular resources on the site for a long time. These are all highly recommend to start learning about Solidity


### 1. Official Solidity website
The most obvious resources is ofcourse the official website and documentation of the Solidity team itself. The Solidity team covers all the core concepts and fundamentals of Solidity and smart contracts in general. Highly recommended

https://soliditylang.org/


### 2. Solidity by Example
The second one on the list is Solidity by Example. A great collection of more pratical examples, incl. source code and supporting videos.

https://solidity-by-example.org/


### 3. CryptoZombies 
CryptoZombies is an interactive school that teaches you all things technical about blockchains. A fun and interactive way to write smart contracts in Solidity by making your own crypto-collectibles game.

https://cryptozombies.io/


### 4. Speedrun Ethereum

Speedrun Ethereum helps you get to the next level. It teaches you how to build on Ethereum; the superpowers and the gotchas while you build up your Web3 portfolio. If you like this, also make sure to check out the other work of the amazing [Austin Griffith](https://twitter.com/austingriffith) such as [ETH-build](https://eth.build/) and [Scaffold-eth](https://scaffoldeth.io/).

https://speedrunethereum.com/


### 5. Smart Contract Best Practices 

Smart contracts are complex instruments that have the authority to allocate high-value resources between complex systems. Often working autonomously. With huge financial loss at risk. This makes them critical components in these systems. Development of such components requires thoughtful design, solid engineering practices, rigorous testing and a strong security mindset. This document provides a baseline knowledge of security considerations.

https://consensys.github.io/smart-contract-best-practices/


## Other resources

If you'd like to read more, make sure to checkout all the other [Solidity](/tags/smart%20contracts) resources on the site.

Solidity is a programming language designed for developing smart contracts that run on Ethereum. It's the most in demand skill in the Web3 space. These are the best resources to help you learn more about it.

Best resources to learn Solidity


Blockchain and smart contract development are still relatively new and highly experimental. They require a different engineering mindset than traditional web, or app development where ‘move fast and break things’ has become the norm. 

Blockchain development is much more like hardware, or financial service development. Smart contracts are complex instruments that offer the possibility to have self-enforcing contracts including transparent, tamper-proof, and immutable information. They have the authority to allocate high-value resources between complex systems. Often working autonomously. With huge financial loss at risk. This makes smart contracts critical components in these systems. Development of such components requires more investment, design, and effort upfront. Solid engineering practices, rigorous testing, and a strong security mindset. 

In a series of blog posts, I’m planning to go through several patterns, practices, and principles that can be applied to blockchain and smart contract development to reduce the risks associated with it. 


# Clean Code 

![WTFs/minute](../assets/images/wtfs-minute.jpeg)

In this first article, I’ll cover more general engineering practices based on the concepts of Clean Code. Clean code is a well-known concept within the software development industry. [Robert C Martin, also known as 'Uncle Bob' wrote the famous handbook](https://amzn.to/30RsoKk). Its principles go back to even the earlier concepts of the Agile manifesto and software craftsmanship. It’s a knowledge base for the way we think, write, and read code. Build on decades of wisdom in software development. 

> *“Truth can only be found in one place: the code“* - Robert C. Martin 

Clean code is code that is easy to read. Easy to understand. And easy to maintain. Clean code is an attempt to make sense of the complexity of systems that we’re dealing with. It’s a defense mechanism that can provide guidance when you’re not sure how a change would affect the codebase. While there’s valid criticism on the handbook and the examples are considered outdated, the principles are still very relevant. Especially for object-oriented languages, such as Solidity. They apply to designing and writing secure, open, and immutable code, such as smart contracts.  

# Practices

## Naming
The naming of contracts, functions, or variables should reveal the intention, why it exists, and how it is used. If a name requires comments to explain, then it doesn’t reveal its intent. 

Be consistent in your naming throughout your code. Especially when you’re working with a large codebase. Use the same names for abstract concepts, throughout multiple contracts. 

Use pronounceable names. 

Use searchable names.

> *"There are only two hard things in Computer Science: cache invalidation and naming things."* - Phil Karlton

**References**
- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/1-naming)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)


## Structure & Ordering 

Ordering helps readers identify which functions they can call and to find the constructor and fallback definitions easier.

### Order of Layout 

Layout contract elements in the following order:

1. Pragma statements
1. Import statements
1. Interfaces
1. Libraries
1. Contracts

Inside each contract, library or interface, use the following order:

1. Type declarations
1. State variables
1. Events
1. Functions

### Ordering of Functions 

Functions should be grouped according to their visibility and ordered:

1. constructor
1. receive function (if exists)
1. fallback function (if exists)
1. external
1. public
1. internal
1. private

Explicitly label the visibility of functions and state variables. Functions can be specified as being `external`, `public`, `internal`, or `private`. Please understand the differences between them.

### Ordering of Modifiers

The modifier order for a function should be:

1. Visibility
1. Mutability
1. Virtual
1. Override
1. Custom modifiers

**References**
- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/2-structure)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)


## Documentation & Natspec 

Solidity contracts can have a form of comments that provide rich documentation to others reading the code as well as end-users. This is called the Ethereum Natural Language Specification Format, or [NatSpec](https://solidity.readthedocs.io/en/latest/natspec-format.html).

This documentation is segmented into developer-focused messages and end-user-facing messages. These messages may be shown to the end-user (the human) at the time that they will interact with the contract (i.e. sign a transaction).

It is recommended that Solidity contracts are fully annotated using NatSpec for all public interfaces (everything in the ABI).

**References**
- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/3-documentation)
- [NatSpec](https://solidity.readthedocs.io/en/latest/natspec-format.html)


## Formatting 

Reading code should be like reading this blog, an article, or a book. It should be well formatted. The Solidity style guide provides guidance for writing Solidity code. The goal for it is not to be the right or only way, but to be consistent. 

Consistency can be enforced by using a linter. This not only provides formatting and style guide validation but also includes security validation.

Linters for Solidity
- [Ethlint](https://github.com/duaraghav8/Ethlint) (formerly Solium)
- [Solhint](https://github.com/protofire/solhint) 
- [VS Code Solidity](https://github.com/juanfranblanco/vscode-solidity/)

Use a regular linter for your dapp development (e.g. eslint, depending on your language).

**References**
- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/4-formatting)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)


## Contracts & Data structures 

- Contracts expose behavior and hide data (in abstraction. Not actually hiding data from others. No data on the blockchain is actually hidden, see chapter Contracts). This makes it easy to add new kinds of objects without changing existing behaviors. It also makes it hard to add new behaviors to existing objects.

- Data structures expose data and have no significant behavior. This makes it easy to add new behaviors to existing data structures but makes it hard to add new data structures to existing functions.

Clear separation of the two is important, due to the contract’s immutability. If you want to add logic or deploy new contracts, you want to be able to utilize the existing data structures. Separating the two can be done by storage contracts. We’ll cover these in more detail in another blog post. 


## Systems 

Keep it Simple Stupid ('KISS'). Complexity increases the likelihood of errors and unexpected behavior. Contracts should have one responsibility, and only one reason to change, supporting the Single Responsibility Principle. It's one of the most important concepts in OO design.

Keep your contracts small. Every line of code in a smart contract costs money to execute and storing data is expensive. A best practice is to store a pointer to data in a smart contract, rather than storing the data itself. For example, data can be stored using decentralized data storage providers such as IPFS.

Modularize your contracts to keep them small and utilize existing standards & libraries (see 'Standards & Libraries'). 

The same applies to functions. Functions should do one thing. They should do it well. They should do it only.

On blockchain everything is public. Private data and variables within a smart contract are not actually private. "Private" means within the execution scope of the contract, but the data is public and can be read by anyone. Keep this in mind when designing your programs.

Only use blockchain and smart contracts for the parts that need to be decentralized. 

> *"The first rule of functions is that they should be small. The second rule of functions is that they should be smaller than that."* - Robert C. Martin 


## Standards & Libraries 

An intrinsic feature of smart contracts is its composability. Turning every contract into a component and potential building block that others can leverage. A lot of these building blocks exist already and standards ensure the ease of use and development. The most well-known standard was created for the emerging token ecosystem and the exchanges serving it: the ERC20 standard.

Before you dive in and start writing your own, custom smart contracts, it’s wise to check if any standards or open-source components exist. If such standard contracts exist and are properly tested and audited, they can minimize the risk in your programs.

- Ethereum Improvement Proposals (EIPs) describe standards for the Ethereum platform, including contract standards. [Finalized ERC's](https://eips.ethereum.org/erc#final)
- [OpenZeppelin Contracts](https://openzeppelin.com/contracts/)


## Error handling 

Exceptions are a crucial part of modern software engineering. They require special treatment and can be extremely powerful. Instead of fighting them, we should try to leverage them, as an unhandled exception may cause unexpected behavior. 

When an exception is thrown in Solidity code, all state changes are rolled back and further execution is halted. Luckily, exception handling is built into Solidity (since 0.6). This is only available for external calls. 

Provide enough context with your exception to determine the source and cause of your error. 

Try to write tests that throw these exceptions.

Don’t return null. Don’t pass null to functions.

Guard Checks can help that the behavior of a smart contract and its input parameters are as expected.

Use `assert()`, `require()`, `revert()` properly. **assert** should be used to test for internal errors, and check invariants.
**require** should be used to test that inputs, contract state variables, or return values from external contracts are valid. 

If a transaction doesn’t have enough gas to execute, the out of gas error is not caught.


## Testing 

![Test my code](../assets/images/test-my-code.jpeg)

The same rules for clean code, apply to testing. Clean tests are tests that are easy to read. Easy to understand. And easy to maintain. Tests help you keep your code flexible, maintainable, and reusable. They validate the behaviors, reduce the risks of making unintended changes, and save time debugging and writing your code. 

### F.I.R.S.T

- **Fast** — Test should fast enough so that you want to run them frequently. It should help speed up your development process, not hinder it
- **Independent** — Tests should be independent of each other and able to run in any order
- **Repeatable** — Tests should be repeatable in any environment
- ** Self-validating** — Tests should a clear (boolean) output if it passes. 
- **Timely** — Tests need to be written in a timely fashion. Just before the production code. 

### AAA

The AAA (Arrange-Act-Assert) pattern is one of the most common standards in software testing. It suggests dividing your tests into the corresponding sections: arrange, act, and assert. Each one of them is responsible for the part in which they are named after.

- **Arrange** - The code required to set-up your test
- **Act** - Invocation of the method being tested
- **Assert** - Check whether the expectations are met

Use only one assert per test.

### Separation of tests 

- **Unit tests** determine whether an individual unit of source-code is fit for use. This is typically a single function, tested with different parameters to ensure it returns the expected values.
- **Integration tests** determine if independently developed units of software work correctly when they are connected. For smart contracts, this means interactions between different components of a single contract, or across multiple contracts.

### Test coverage 

Writing good tests to ensure your app is working as intended is not enough. If you're not measuring anything, it's hard to say exactly how much of your code is being tested. Test coverage (or code coverage) is a useful tool for finding untested parts of a codebase. 

There is much debate over how much should be covered. Just your best judgment, but aim for as high as possible. Untested code could do anything and result in unexpected behavior.

### Testing Tools 

- [Buidler](https://buidler.dev/) -  A task runner for Ethereum smart contract developers that allows you to deploy your contracts, run your tests and debug your code
- [OpenZeppelin Test environment](https://docs.openzeppelin.com/test-environment/) - Test Environment is a smart contract testing library: it provides utilities that help you write tests, but it doesn’t run your tests for you. Works with Mocha 
- [Brownie](https://github.com/eth-brownie/brownie) - A Python-based development and testing framework for smart contracts targeting the Ethereum Virtual Machine
- [Truffle](https://www.trufflesuite.com/truffle) - A development environment, testing framework and asset pipeline for blockchains using the Ethereum Virtual Machine (EVM)
- [Ganache](https://www.trufflesuite.com/ganache) - A personal blockchain for Ethereum development you can use to deploy contracts, develop your applications, and run tests
- [Solidity-coverage](https://github.com/sc-forks/solidity-coverage) (formerly Solcover) - Code coverage for Solidity smart-contracts


## Security & code analysis 

Static code analysis is the analysis of software that is performed without actually executing the program. In most cases the analysis is performed on some version of the source code. Anlaysis is usually performed by an automated tool (e.g. Sonarqube).

Analysis tools for smart contracts help identify smart contract vulnerabilities. These tools run a suite of vulnerability detectors and print out a summary of any issues found. 

### Analysis Tools

- [Echidna](https://github.com/crytic/echidna) - Ethereum smart contract fuzzer
- [Manticore](https://github.com/trailofbits/manticore) - Symbolic execution tool
- [Mythril](https://github.com/ConsenSys/mythril) - Security analysis tool for EVM bytecode
- [Oyente](https://github.com/melonproject/oyente) - An Analysis Tool for Smart Contracts
- [Slither](https://github.com/crytic/slither) - Static Analyzer for Solidity

### Gas Optimization

Optimizing gas costs can be a worthwhile endeavor, to reduce costs both for your own deployments, as well as for your end-users. Network usage is progressively increasing, with current gas costs at its peak. As the ecosystem continues to grow, so too will the value of gas optimization. We’ll cover these in more detail in another blog post. 

Analyzing your code can be done by using [eth-gas-reporter](https://github.com/cgewecke/eth-gas-reporter). It prints estimates of gas costs per function, or of each deployed contract. 



## Continuous Integration 

While not part of the clean code principles, continuous integration (‘CI’) has become a fundamental practice for any type software development. One of the key benefits of integrating regularly is that you can detect errors quickly and locate them more easily. 

It is based on a set of key principles.

- Keep a single repository where all the code lives and where anyone can obtain the current and previous versions (e.g. Git)
- Automate the build process so that anyone can use it to build directly from the sources (e.g. Truffle teams, Travis CI)
- Automate your tests so that anyone can run a full test suite at any time (see chapter Testing)
- Make sure anyone can view the results and get the latest executable from the build process

> *"Continuous Integration doesn’t get rid of bugs, but it does make them dramatically easier to find and remove."* - Martin Fowler

![Ship all the code](../assets/images/ship-all-the-code.jpeg)


## Further Reading 

Check out my [Clean Contracts](https://github.com/wslyvh/clean-contracts) repo for supporting code example from each chapter.

- [Clean Code](https://amzn.to/30RsoKk), Robert C. Martin
- [Solidity Patterns](https://fravoll.github.io/solidity-patterns/), Fravoll 
- [Ethereum Smart Contract Best Practices](https://consensys.github.io/smart-contract-best-practices), ConsenSys
- [Best Practices for Smart Contract Development](https://yos.io/2019/11/10/smart-contract-development-best-practices/), Yos Riady

Blockchain and smart contract development require solid engineering practices, rigorous testing, and a strong security mindset. This guide covers several patterns, practices, and principles to reduce the risks associated with it.

Clean Contracts - a guide on smart contract patterns & practices


Increase safety and transparency for DeFi through a community-driven product risk history and scoring resource.

DeFi Risk Tools & Resources


This handbook is for people who are interested in exploring the vision behind “Web3”, and who wish to acquire in-demand skills that are essential to realizing that vision.  

A Handbook for Smart Contract Development

Learn Solidity

Free resources to learn about Zero Knowledge Proofs (ZKPs) and Cryptography

Road to ZK


Web3 is about the next evolution of the web. A web that is more open, transparent and permissionless and runs on decentralized infrastructure such as blockchains. Global and decentralized applications (DApps) that anyone can interact with. They often have native assets integrated (such as Ether) to transact value, but are not just about money or payments. These decentralized applications offer a range of digitial services, such as storage, bandwidth and computation without any risk of downtime, censorship, fraud, or 3rd-party interference.

## Benefits

- **Open** - in that they are built from open-source software, by an open and accessible community of developers and executed in full view of the world. 
- **Trustless** - in that the network itself allows participants to interact publicly, or privately without a trusted third party
- **Permissionless** - in that anyone, both users and suppliers, can participate without authorisation from a governing body


## Opportunities

- Financial Tools (payments, fund raising, lending, borrowing,..)
- Identity solutions (self-sovereign, decentralized identifiers,..) 
- More secure voting and governance mechanisms
- Efficient resources management (CO2 tracking, smart grid’s,..)
- Digital ownership registries (e.g. land, collectibles, NFT’s,..)
- Supply chain tracking


## Web3 Development

[useWeb3](https://www.useweb3.xyz/) is a learning platform for developers to explore and learn about Web3. Whether you’re a new dev getting your hands dirty for the first time, or a seasoned developer making the transition into the Web3 space. 

Explore the latest resources, tutorials, challenges, tools, courses and boilerplates and start learning. Once you’re ready, browse the job board to land a job at some of the leading companies that work on core, open-source infrastructure, products, tools, frameworks, DAO's, etc.


## Further reading

- [A Cyberphunk's Manifesto](https://www.activism.net/cypherpunk/manifesto.html), Eric Hughes
- [The Meaning of Decentralization](https://medium.com/@VitalikButerin/the-meaning-of-decentralization-a0c92b76a274), Vitalik Buterin
- [Why decentralization matters](https://onezero.medium.com/why-decentralization-matters-5e3f79f7638e), Chris Dixon
- [What Is Web 3.0 & Why It Matters](https://medium.com/fabric-ventures/what-is-web-3-0-why-it-matters-934eb07f3d2b), Max Mersch and Richard Muirhead
- [What exactly is Web3?](https://youtu.be/l44z35vabvA), Juan Benet (VIDEO)


Web3 is about the next evolution of the web. A web that is more open, transparent and decentralized.

Web3 Guides

📖 Best resources to learn Solidity

📖 Learn Solidity

📖 Road to ZK

Newsletter