
![Smart_Contract_Auditor_RoadMap](https://user-images.githubusercontent.com/54918791/174233728-015bd233-1df9-49fb-a6a3-2af970d90b60.png)  


Available at: https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor  
PDF: [Smart Contract Auditor.pdf](https://github.com/razzorsec/AuditorsRoadmap/files/8934042/Smart.Contract.Auditor.pdf)

### Step by Step Approach  

* [Mastering Ethereum](https://github.com/ethereumbook/ethereumbook)  
* Proof of Work vs Proof of Stake
* Solidity Fundamentals
  * [Solidity Documentation](https://docs.soliditylang.org/en/latest/)
  * [Solidity Docs](https://docs.soliditylang.org/en/v0.8.13/index.html)
  * [Smart Contract Programmer - Solidity 0.8](https://www.youtube.com/playlist?list=PLO5VPQH6OWdVQwpQfw9rZ67O6Pjfo6q-p)
  * Connect Missing Dots with Secureum
    * [Secureum Solidity 101](https://secureum.substack.com/p/solidity-101?s=r)
    * [Secureum Solidity 201](https://secureum.substack.com/p/solidity-201?s=r)

* Gas Optimizations
  * [Aggregated Tricks by pcaversaccio and Harikrishnan Mulackal](https://forum.openzeppelin.com/t/a-collection-of-gas-optimisation-tricks/19966/6)
  * [Kaden: Gas Optimization Tips](https://betterprogramming.pub/how-to-write-smart-contracts-that-optimize-gas-spent-on-ethereum-30b5e9c5db85)
  * [Juan: Advanced Gas Optimizations](https://dev.to/juanxavier/advanced-gas-optimizations-tips-for-solidity-1j2f)

* Smart Contract Testing
  * [Hardhat](https://hardhat.org/guides/waffle-testing.html)
  * [Complete hands on Hardhat tutorial](https://dev.to/rodrigoherrerai/the-complete-hands-on-hardhat-tutorial-3kbd)
  * [Code Eater (Hindi)](https://www.youtube.com/watch?v=vuqhHOx6188&list=PLgPmWS2dQHW9mucRpDVe16j9Qn74ZXqcD&index=5)
  * [Foundry](https://github.com/foundry-rs/foundry)
  * [Tenderly](https://tenderly.co/)

* [ERC Standards]()
  * [Token Standards](https://ethereum.org/en/developers/docs/standards/tokens/)ERC20, ERC721, ERC777, ERC1155, ERC4626, BEP20
  * Other Standards: [ERC2981](https://eips.ethereum.org/EIPS/eip-2981)

* [Openzeppelin Helper Libraries/Contracts](https://github.com/OpenZeppelin/openzeppelin-contracts)

* Upgradeable Contracts
  * [Smart Contract Programmer - Upgradeable Contracts](https://www.youtube.com/watch?v=JgSj7IiE4jA&t=157s)
  * [Smart Contract Programmer - Risks of Upgradeable Contracts](https://www.youtube.com/watch?v=XmxfB5JOt1Q&t=3s)
  * [Different Proxy Patterns - EIPs 897, 1822, 1967, 1538, 2535](https://ethereum-blockchain-developer.com/110-upgrade-smart-contracts/00-project/)

* Attack Vectors
  * [Secureum Security Pitfalls 101](https://secureum.substack.com/p/security-pitfalls-and-best-practices-101?s=r)
  * [Secureum Security Pitfalls 201](https://secureum.substack.com/p/security-pitfalls-and-best-practices-201?s=r)
  * [SWC Registry](https://swcregistry.io/)
  * [Smart Contract Programmer - Hack Solidity](https://www.youtube.com/watch?v=4Mm3BCyHtDY&list=PLO5VPQH6OWdWsCgXJT9UuzgbC8SPvTRi5)
  * [Kaden: Smart Contract Attack Vectors](https://github.com/KadenZipfel/smart-contract-attack-vectors)

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)
  * [Ethernaut](https://ethernaut.openzeppelin.com/)
  * [Capture The Ether](https://capturetheether.com/)
  * Read Walkthroughs

* DeFi
  * [Finematics - DeFi](https://www.youtube.com/watch?v=pWGLtjG-F5c&list=PLjrTIwaNiTwn39tg3sR_bPBWGHoznv47D)
  * [Smart Contract Programmer - DeFi](https://www.youtube.com/watch?v=qB2Ulx201wY&list=PLO5VPQH6OWdX-Rh7RonjZhOd9pb9zOnHW)
  * Well known protocols: Uniswap v2/v3, Compound, Curve, Aave, Balancer.
  * [Stablecoins](https://blog.chain.link/what-are-stablecoins/) => [Algorithmic Stablecoins](https://cointelegraph.com/altcoins-for-beginners/a-beginner-s-guide-on-algorithmic-stablecoins)
  * Staking Rewards, Vaults

* DeFi Attack Vectors
  * Flash Loan => Price Oracle Manipulation
  * Front-Running => Sandwich attacks
  * Rug Pulls => Unlimited Token Allowance

* [CTFs](https://github.com/blockthreat/blocksec-ctfs)  
  * [Damn Vulnerable DeFi](https://www.damnvulnerabledefi.xyz/)
  * Read Walkthroughs

* Postmortems
  * [Immunefi](https://medium.com/@immunefi)
  * [BlockSec](https://blocksecteam.medium.com/)
  * [SlowMist](https://slowmist.medium.com/)
  * [Rekt News](https://rekt.news/)
  * [PeckShield](https://twitter.com/peckshield)
  * [Mudit Gupta](https://twitter.com/mudit__gupta)
  * [Samczun](https://twitter.com/samczsun)

* Report Reading
  * [Secureum Audit Findings 101](https://secureum.substack.com/p/audit-findings-101?s=r)
  * [Secureum Audit Findings 201](https://secureum.substack.com/p/audit-findings-201?s=r)
  * Trail of Bits, Consensys, Openzeppelin, QuillAudits

* Security Standards & Checklists
  * [Rari-Capital Solcurity](https://github.com/Rari-Capital/solcurity)
  * [SCSVS](https://github.com/securing/SCSVS)

* Tools
  * [VS Code IDE](https://code.visualstudio.com/)
  * [Slither](https://github.com/crytic/slither)
  * [Mythril](https://github.com/ConsenSys/mythril)
  * [Mythx](https://mythx.io/)
  * [Echidna](https://github.com/crytic/echidna)
  * [Manticore](https://github.com/trailofbits/manticore)
  * [Surya](https://github.com/ConsenSys/surya)
  * [Scribble](https://github.com/ConsenSys/scribble)
  * [BlockSec ETH/BSC Tx Analysis](https://versatile.blocksecteam.com/tx) 
  
* Continue Learning
  * [Ethereum Yellow Paper](https://github.com/ethereum/yellowpaper)
  * [Ethereum Improvement Proposals (EIPs)](https://eips.ethereum.org/)
  * [Eth Research](https://ethresear.ch/)
  * NewsLetters - Blockthreat, HashingBits
  * Communities
    * Immunefi, Secureum, Blockchain Pentesting( discord )  
    * Eth Security Community (Telegram)
  * Be Active on Twitter


This roadmap provides a step by step approach to become an Ethereum Smart Contract Auditor

Ethereum Smart Contract Auditor Roadmap

In Crypto, there are a lot of applications that haven’t found product-market fit. But there is also a handful of applications that have a product market fit and are growing stably

Guide on Crypto Applications Product Market Fit

This guide provides instructions on How to Protect Your Crypto Wallet 95% of the Time

How to Protect Your Crypto Wallet 95% of the Time


Blockchain has emerged from the once shadowy world of cryptocurrency to become [the most in-demand skill in 2020](https://business.linkedin.com/talent-solutions/blog/trends-and-research/2020/most-in-demand-hard-and-soft-skills), according to LinkedIn. The promise of blockchain is huge. And large companies are continuing to hire and expand their blockchain teams, incl. Facebook, Amazon, Microsoft, EY, Deloitte, IBM, and Oracle, to name a few. So, it should be well worth the effort to become familiar with how blockchain works, what its perceived benefits are, and as a developer starting building on top of them. 

Over the past few years, I’ve been helping and on-boarding new team members and developers into the blockchain space. This helped me to collect blogs, links, materials, and resources and see which worked well for everyone’s learning journey. It’s time to share that with a broader audience. This guide provides a starting point for developers who’re keen to learn more about blockchain and development on top of Ethereum. It will be opinionated and not contain a full list of everything available. But rather, a concise list of highly recommended options, from my own experiences. 

1. Blockchain foundations
1. Ethereum 101
1. Ethereum Development, Smart contracts & DApps 

# 1. Blockchain foundations 

New to blockchain? Let's start with a bit of the history and its foundations that motivated the creation and development of blockchain.

- [A Cyberphunk's Manifesto](https://www.activism.net/cypherpunk/manifesto.html), Eric Hughes
- [Why decentralization matters](https://onezero.medium.com/why-decentralization-matters-5e3f79f7638e), Chris Dixon
- [The Promise of the Blockchain](https://vimeo.com/161183966) (VIDEO), Vinay Gupta
- [The shift from open platforms to digital commons](http://www.bollier.org/blog/shift-open-platforms-digital-commons), David Bollier
- [Deconfusing decentralization](https://youtu.be/7S1IqaSLrq8) (VIDEO), Greg Slepak


# 2. Ethereum 101 

Now that we have an understanding where we're coming from, let's dive in a little bit deeper into the fundamental components & building blocks.

- [Bitcoin Whitepaper](https://bitcoin.org/bitcoin.pdf), Satoshi Nakamoto - the original whitepaper that started the current trend in blockchain technology: Bitcoin: A Peer-to-Peer Electronic Cash System
- [Ethereum Whitepaper](https://ethereum.org/en/whitepaper/), Vitalik Buterin - a next-generation smart contract & decentralized application platform
- [Ethereum Yellowpaper](https://ethereum.github.io/yellowpaper/paper.pdf), Gavin Wood - a more technical version of the Ethereum whitepaper
- [Smart Contracts](https://www.fon.hum.uva.nl/rob/Courses/InformationInSpeech/CDROM/Literature/LOTwinterschool2006/szabo.best.vwh.net/smart.contracts.html), Nick Szabo
- [Ethereum in 25 mins](https://youtu.be/mCzyDLanA7s) (VIDEO), Vitalik Buterin
- [How does Ethereum work, anyway](https://www.preethikasireddy.com/post/how-does-ethereum-work-anyway), Preethi Kasireddy
- [Mastering Ethereum](https://amzn.to/2VZvfz8) (BOOK), Andreas M. Antonopoulos, Gavin Wood. Or view on [Github](https://github.com/ethereumbook/ethereumbook)
- [How Proof of Stake Ethereum Works](https://stonecoldpat.substack.com/p/how-proof-of-stake-ethereum-works), Patrick McCorry


# 3. Ethereum Development 


Once you've gone through all (or at least most) of the above, you should have a solid grasp of all the concepts. So now we can finally move on to the fun part: actually building stuff! 

To get a full, comprehensive overview of the Ethereum development landscape, check out:
- [Ethereum Developers](https://ethereum.org/en/developers/)
- [The full ConsenSys developer tool list](https://github.com/ConsenSys/ethereum-developer-tools-list)

The Ethereum portal covers sections per programming language, to help you filter out what's relevant for you. Though JavaScript is most commonly used, I'd start with something that you're already familiar with, to flatten the learning curve. Use the above only for future reference. As mentioned previously, I'm trying to keep it simple and offer a few recommended options, from my own experiences. Feel free to discover, try, and learn everything from the developer portals, once you've covered these.

## Other resources

Explore this site to learn more from 

- [🎓 Courses](https://www.useweb3.xyz/courses)
- [📚 Books](https://www.useweb3.xyz/books)
- [💻 Tutorials](https://www.useweb3.xyz/tutorials)
- [🏗️ Starter kits](https://www.useweb3.xyz/starter-kits)
- And more..


This guide provides a starting point for developers who’re keen to learn more about Web3

Beginners Guide to Web3


## What is a smart contract?

Smart contracts are the backbone of decentralized applications (DApps) and Web3. A smart contract is a simple program that lives on a blockchain network (such as Ethereum). They're actually not that smart. And nothing like a (legal) contract. They’re more like an executable piece of code that requires input or an trigger from an external source. They can validate those input conditions and if correct, execute their own logic to update the state on a blockchain.

## Benefits

They often serve the following purposes:
- Store and maintain data
- Manage relationships with users, or other contracts

Benefits of smart contracts are
- Immutable - once deployed none can change them
- Composable - they’re public and anyone can interact with them, or build on top of them. Much like public APIs

## Resources

The following resources have been the most popular resources on the site for a long time. These are all highly recommend to start learning about Solidity


### 1. Official Solidity website
The most obvious resources is ofcourse the official website and documentation of the Solidity team itself. The Solidity team covers all the core concepts and fundamentals of Solidity and smart contracts in general. Highly recommended

https://soliditylang.org/


### 2. Solidity by Example
The second one on the list is Solidity by Example. A great collection of more practical examples, incl. source code and supporting videos.

https://solidity-by-example.org/


### 3. CryptoZombies 
CryptoZombies is an interactive school that teaches you all things technical about blockchains. A fun and interactive way to write smart contracts in Solidity by making your own crypto-collectibles game.

https://cryptozombies.io/


### 4. Speedrun Ethereum

Speedrun Ethereum helps you get to the next level. It teaches you how to build on Ethereum; the superpowers and the gotchas while you build up your Web3 portfolio. If you like this, also make sure to check out the other work of the amazing [Austin Griffith](https://twitter.com/austingriffith) such as [ETH-build](https://eth.build/) and [Scaffold-eth](https://scaffoldeth.io/).

https://speedrunethereum.com/


### 5. Smart Contract Best Practices 

Smart contracts are complex instruments that have the authority to allocate high-value resources between complex systems. Often working autonomously. With huge financial loss at risk. This makes them critical components in these systems. Development of such components requires thoughtful design, solid engineering practices, rigorous testing and a strong security mindset. This document provides a baseline knowledge of security considerations.

https://consensys.github.io/smart-contract-best-practices/


## Other resources

If you'd like to read more, make sure to checkout all the other [Solidity](/tags/smart%20contracts) resources on the site.

Solidity is a programming language designed for developing smart contracts that run on Ethereum. It's the most in demand skill in the Web3 space. These are the best resources to help you learn more about it.

Best resources to learn Solidity


Blockchain and smart contract development are still relatively new and highly experimental. They require a different engineering mindset than traditional web, or app development where ‘move fast and break things’ has become the norm.

Blockchain development is much more like hardware, or financial service development. Smart contracts are complex instruments that offer the possibility to have self-enforcing contracts including transparent, tamper-proof, and immutable information. They have the authority to allocate high-value resources between complex systems. Often working autonomously. With huge financial loss at risk. This makes smart contracts critical components in these systems. Development of such components requires more investment, design, and effort upfront. Solid engineering practices, rigorous testing, and a strong security mindset.

In a series of blog posts, I’m planning to go through several patterns, practices, and principles that can be applied to blockchain and smart contract development to reduce the risks associated with it.

# Clean Code

In this first article, I’ll cover more general engineering practices based on the concepts of Clean Code. Clean code is a well-known concept within the software development industry. [Robert C Martin, also known as 'Uncle Bob' wrote the famous handbook](https://amzn.to/30RsoKk). Its principles go back to even the earlier concepts of the Agile manifesto and software craftsmanship. It’s a knowledge base for the way we think, write, and read code. Build on decades of wisdom in software development.

> _“Truth can only be found in one place: the code“_ - Robert C. Martin

Clean code is code that is easy to read. Easy to understand. And easy to maintain. Clean code is an attempt to make sense of the complexity of systems that we’re dealing with. It’s a defense mechanism that can provide guidance when you’re not sure how a change would affect the codebase. While there’s valid criticism on the handbook and the examples are considered outdated, the principles are still very relevant. Especially for object-oriented languages, such as Solidity. They apply to designing and writing secure, open, and immutable code, such as smart contracts.

# Practices

## Naming

The naming of contracts, functions, or variables should reveal the intention, why it exists, and how it is used. If a name requires comments to explain, then it doesn’t reveal its intent.

Be consistent in your naming throughout your code. Especially when you’re working with a large codebase. Use the same names for abstract concepts, throughout multiple contracts.

Use pronounceable names.

Use searchable names.

> _"There are only two hard things in Computer Science: cache invalidation and naming things."_ - Phil Karlton

**References**

- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/1-naming)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)

## Structure & Ordering

Ordering helps readers identify which functions they can call and to find the constructor and fallback definitions easier.

### Order of Layout

Layout contract elements in the following order:

1. Pragma statements
1. Import statements
1. Interfaces
1. Libraries
1. Contracts

Inside each contract, library or interface, use the following order:

1. Type declarations
1. State variables
1. Events
1. Functions

### Ordering of Functions

Functions should be grouped according to their visibility and ordered:

1. constructor
1. receive function (if exists)
1. fallback function (if exists)
1. external
1. public
1. internal
1. private

Explicitly label the visibility of functions and state variables. Functions can be specified as being `external`, `public`, `internal`, or `private`. Please understand the differences between them.

### Ordering of Modifiers

The modifier order for a function should be:

1. Visibility
1. Mutability
1. Virtual
1. Override
1. Custom modifiers

**References**

- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/2-structure)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)

## Documentation & Natspec

Solidity contracts can have a form of comments that provide rich documentation to others reading the code as well as end-users. This is called the Ethereum Natural Language Specification Format, or [NatSpec](https://solidity.readthedocs.io/en/latest/natspec-format.html).

This documentation is segmented into developer-focused messages and end-user-facing messages. These messages may be shown to the end-user (the human) at the time that they will interact with the contract (i.e. sign a transaction).

It is recommended that Solidity contracts are fully annotated using NatSpec for all public interfaces (everything in the ABI).

**References**

- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/3-documentation)
- [NatSpec](https://solidity.readthedocs.io/en/latest/natspec-format.html)

## Formatting

Reading code should be like reading this blog, an article, or a book. It should be well formatted. The Solidity style guide provides guidance for writing Solidity code. The goal for it is not to be the right or only way, but to be consistent.

Consistency can be enforced by using a linter. This not only provides formatting and style guide validation but also includes security validation.

Linters for Solidity

- [Ethlint](https://github.com/duaraghav8/Ethlint) (formerly Solium)
- [Solhint](https://github.com/protofire/solhint)
- [VS Code Solidity](https://github.com/juanfranblanco/vscode-solidity/)

Use a regular linter for your dapp development (e.g. eslint, depending on your language).

**References**

- [Code example](https://github.com/wslyvh/clean-contracts/tree/master/4-formatting)
- [Solidity Style guide](https://solidity.readthedocs.io/en/latest/style-guide.html)

## Contracts & Data structures

- Contracts expose behavior and hide data (in abstraction. Not actually hiding data from others. No data on the blockchain is actually hidden, see chapter Contracts). This makes it easy to add new kinds of objects without changing existing behaviors. It also makes it hard to add new behaviors to existing objects.

- Data structures expose data and have no significant behavior. This makes it easy to add new behaviors to existing data structures but makes it hard to add new data structures to existing functions.

Clear separation of the two is important, due to the contract’s immutability. If you want to add logic or deploy new contracts, you want to be able to utilize the existing data structures. Separating the two can be done by storage contracts. We’ll cover these in more detail in another blog post.

## Systems

Keep it Simple Stupid ('KISS'). Complexity increases the likelihood of errors and unexpected behavior. Contracts should have one responsibility, and only one reason to change, supporting the Single Responsibility Principle. It's one of the most important concepts in OO design.

Keep your contracts small. Every line of code in a smart contract costs money to execute and storing data is expensive. A best practice is to store a pointer to data in a smart contract, rather than storing the data itself. For example, data can be stored using decentralized data storage providers such as IPFS.

Modularize your contracts to keep them small and utilize existing standards & libraries (see 'Standards & Libraries').

The same applies to functions. Functions should do one thing. They should do it well. They should do it only.

On blockchain everything is public. Private data and variables within a smart contract are not actually private. "Private" means within the execution scope of the contract, but the data is public and can be read by anyone. Keep this in mind when designing your programs.

Only use blockchain and smart contracts for the parts that need to be decentralized.

> _"The first rule of functions is that they should be small. The second rule of functions is that they should be smaller than that."_ - Robert C. Martin

## Standards & Libraries

An intrinsic feature of smart contracts is its composability. Turning every contract into a component and potential building block that others can leverage. A lot of these building blocks exist already and standards ensure the ease of use and development. The most well-known standard was created for the emerging token ecosystem and the exchanges serving it: the ERC20 standard.

Before you dive in and start writing your own, custom smart contracts, it’s wise to check if any standards or open-source components exist. If such standard contracts exist and are properly tested and audited, they can minimize the risk in your programs.

- Ethereum Improvement Proposals (EIPs) describe standards for the Ethereum platform, including contract standards. [Finalized ERC's](https://eips.ethereum.org/erc#final)
- [OpenZeppelin Contracts](https://openzeppelin.com/contracts/)

## Error handling

Exceptions are a crucial part of modern software engineering. They require special treatment and can be extremely powerful. Instead of fighting them, we should try to leverage them, as an unhandled exception may cause unexpected behavior.

When an exception is thrown in Solidity code, all state changes are rolled back and further execution is halted. Luckily, exception handling is built into Solidity (since 0.6). This is only available for external calls.

Provide enough context with your exception to determine the source and cause of your error.

Try to write tests that throw these exceptions.

Don’t return null. Don’t pass null to functions.

Guard Checks can help that the behavior of a smart contract and its input parameters are as expected.

Use `assert()`, `require()`, `revert()` properly. **assert** should be used to test for internal errors, and check invariants.
**require** should be used to test that inputs, contract state variables, or return values from external contracts are valid.

If a transaction doesn’t have enough gas to execute, the out of gas error is not caught.

## Testing

The same rules for clean code, apply to testing. Clean tests are tests that are easy to read. Easy to understand. And easy to maintain. Tests help you keep your code flexible, maintainable, and reusable. They validate the behaviors, reduce the risks of making unintended changes, and save time debugging and writing your code.

### F.I.R.S.T

- **Fast** — Test should fast enough so that you want to run them frequently. It should help speed up your development process, not hinder it
- **Independent** — Tests should be independent of each other and able to run in any order
- **Repeatable** — Tests should be repeatable in any environment
- ** Self-validating** — Tests should a clear (boolean) output if it passes.
- **Timely** — Tests need to be written in a timely fashion. Just before the production code.

### AAA

The AAA (Arrange-Act-Assert) pattern is one of the most common standards in software testing. It suggests dividing your tests into the corresponding sections: arrange, act, and assert. Each one of them is responsible for the part in which they are named after.

- **Arrange** - The code required to set-up your test
- **Act** - Invocation of the method being tested
- **Assert** - Check whether the expectations are met

Use only one assert per test.

### Separation of tests

- **Unit tests** determine whether an individual unit of source-code is fit for use. This is typically a single function, tested with different parameters to ensure it returns the expected values.
- **Integration tests** determine if independently developed units of software work correctly when they are connected. For smart contracts, this means interactions between different components of a single contract, or across multiple contracts.

### Test coverage

Writing good tests to ensure your app is working as intended is not enough. If you're not measuring anything, it's hard to say exactly how much of your code is being tested. Test coverage (or code coverage) is a useful tool for finding untested parts of a codebase.

There is much debate over how much should be covered. Just your best judgment, but aim for as high as possible. Untested code could do anything and result in unexpected behavior.

### Testing Tools

- [OpenZeppelin Test environment](https://docs.openzeppelin.com/test-environment/) - Test Environment is a smart contract testing library: it provides utilities that help you write tests, but it doesn’t run your tests for you. Works with Mocha
- [Brownie](https://github.com/eth-brownie/brownie) - A Python-based development and testing framework for smart contracts targeting the Ethereum Virtual Machine
- [Truffle](https://trufflesuite.com/truffle) - A development environment, testing framework and asset pipeline for blockchains using the Ethereum Virtual Machine (EVM)
- [Ganache](https://trufflesuite.com/ganache/) - A personal blockchain for Ethereum development you can use to deploy contracts, develop your applications, and run tests
- [Solidity-coverage](https://github.com/sc-forks/solidity-coverage) (formerly Solcover) - Code coverage for Solidity smart-contracts

## Security & code analysis

Static code analysis is the analysis of software that is performed without actually executing the program. In most cases the analysis is performed on some version of the source code. Anlaysis is usually performed by an automated tool (e.g. Sonarqube).

Analysis tools for smart contracts help identify smart contract vulnerabilities. These tools run a suite of vulnerability detectors and print out a summary of any issues found.

### Analysis Tools

- [Echidna](https://github.com/crytic/echidna) - Ethereum smart contract fuzzer
- [Manticore](https://github.com/trailofbits/manticore) - Symbolic execution tool
- [Mythril](https://github.com/ConsenSys/mythril) - Security analysis tool for EVM bytecode
- [Oyente](https://github.com/melonproject/oyente) - An Analysis Tool for Smart Contracts
- [Slither](https://github.com/crytic/slither) - Static Analyzer for Solidity

### Gas Optimization

Optimizing gas costs can be a worthwhile endeavor, to reduce costs both for your own deployments, as well as for your end-users. Network usage is progressively increasing, with current gas costs at its peak. As the ecosystem continues to grow, so too will the value of gas optimization. We’ll cover these in more detail in another blog post.

Analyzing your code can be done by using [eth-gas-reporter](https://github.com/cgewecke/eth-gas-reporter). It prints estimates of gas costs per function, or of each deployed contract.

## Continuous Integration

While not part of the clean code principles, continuous integration (‘CI’) has become a fundamental practice for any type software development. One of the key benefits of integrating regularly is that you can detect errors quickly and locate them more easily.

It is based on a set of key principles.

- Keep a single repository where all the code lives and where anyone can obtain the current and previous versions (e.g. Git)
- Automate the build process so that anyone can use it to build directly from the sources (e.g. Truffle teams, Travis CI)
- Automate your tests so that anyone can run a full test suite at any time (see chapter Testing)
- Make sure anyone can view the results and get the latest executable from the build process

> _"Continuous Integration doesn’t get rid of bugs, but it does make them dramatically easier to find and remove."_ - Martin Fowler

## Further Reading

Check out my [Clean Contracts](https://github.com/wslyvh/clean-contracts) repo for supporting code example from each chapter.

- [Clean Code](https://amzn.to/30RsoKk), Robert C. Martin
- [Solidity Patterns](https://fravoll.github.io/solidity-patterns/), Fravoll
- [Ethereum Smart Contract Best Practices](https://consensys.github.io/smart-contract-best-practices), ConsenSys
- [Best Practices for Smart Contract Development](https://yos.io/2019/11/10/smart-contract-development-best-practices/), Yos Riady


Blockchain and smart contract development require solid engineering practices, rigorous testing, and a strong security mindset. This guide covers several patterns, practices, and principles to reduce the risks associated with it.

Clean Contracts - a guide on smart contract patterns & practices


Navigating conversations and understanding key concepts in web3 sometimes requires its own terminology. In this regard, web3 is not just a technological shift, but also a cultural one.

This guide will provide you with the **most essential terms** to decode the language and become a web3 citizen. It is tailored to provide you with clear and concise definitions for the unique terms that define this industry.

Dive in, discover, and enhance your fluency in the unique lexicon of the web3 industry. (-:

If you want to contribute to the glossary, [have a look on Github](https://github.com/wslyvh/useWeb3/tree/main).

## Glossary a-z

- **Airdrop**  
  Distribution of free tokens, usually to promote a product or incentivise early users

- **Altcoin**  
  Alternative coin, any cryptocurrency other than Bitcoin

- **AMM**  
  Automated Market Maker, popular mechanism among decentralized exchanges (DEXes) involving liquidity pools instead of an orderbook-based system

- **Anon**  
  Anonymous, entity that wishes to remain anonymous or pseudonymous

- **Beacon Chain**  
  Ethereum’s proof-of-stake (PoS) consensus layer

- **Bridge**  
  Service that transfers tokens between multiple blockchains (cross-chain)

- **BUIDL**  
  Term to describe the web3 building ethos, even despite a bear market, inspired by HODL

- **CeFi**  
  Centralized finance, the “traditional” finance sector, in contrast to DeFi (decentralized finance)

- **CEX**  
  Centralized Exchange, app for swapping tokens run by a company, often used for fiat exchange; in contrast to DEX (Decentralized Exchange)

- **Cypherpunks**  
  Cypher + punks, movement originating in the early 90s, emphasizing the need for privacy in the digital age, enforced by cryptography

- **DAO**  
  Decentralized Autonomous Organization, blockchain-based organizations that are owned and governed by their members via tokens

- **DApp**  
  Decentralized Application, blockchain-based services that use smart contracts in their backend and thus have a distributed nature, without the need for intermediaries

- **DeFi**  
  Decentralized Finance, general term for decentralized services in the financial sector, that are permissionless and globally available, e.g., DEXes (decentralized exchanges) or lending protocols

- **Degen**  
  Degenerate, term for a person that is deeply involved in crypto or a specific sector, e.g., DeFi Degens

- **DEX**  
  Decentralized Exchange, blockchain-based app for swapping tokens that use smart contracts to be permissionless

- **Diamond Hands**  
  Holding a digital asset through very volatile times

- **DYOR**  
  Do Your Own Research, principle of self-verification instead of trusting others

- **EIP**  
  Ethereum Improvement Proposal, a process to describe standards for the Ethereum platform

- **ERC**  
  Ethereum Request for Comments, form of EIP to specify application layer standards; the most popular ones are ERC20 for fungible tokens and ERC721 for non-fungible tokens

- **EVM**  
  Ethereum Virtual Machine, the environment in which all Ethereum accounts and smart contracts live, the EVM defines the rules for computing a new valid state from block to block

- **Exchange**  
  An application that allows users to buy and sell crypto assets

- **Exit Scam**  
  Scenario in which a project or a part of a team steals the investors’ money and leaves

- **Explorer**  
  Webpage that displays information about the transaction history of a blockchain

- **Faucet**  
  Service that dispenses free tokens, usually for test networks

- **Flippening**  
  Term to describe a pivotal change in price or perception, e.g., when the market cap of a token exceeds the one of another token

- **FOMO**  
  Fear Of Missing Out, term to describe the feeling of not being included in something, e.g., a crypto investment or news

- **Fork**  
  Split of a blockchain or project due to technical issues or a dispute

- **FUD**  
  Fear, Uncertainty and Doubt, the opposite of FOMO

- **Gas**  
  Term for the fee that Ethereum transactions cost; it is used to reward validators and prevents malicious use of the blockchain

- **Genesis Block**  
  The first block recorded in a blockchain

- **Gm**  
  Good morning, form of greetings in crypto communities; due to the global nature of web3 it can be used at any time of the day

- **Hash**  
  Function that can be used to map data of arbitrary size to fixed-size values, e.g., for encryption, cryptographic hash functions are used in many parts of the web3 industry

- **HODL**  
  A frequent term referring to a strict buy-and-hold strategy, became famous after a misspelling in the bitcointalk forum in 2013

- **ICO**  
  Initial coin offering, the process of selling tokens when launching a new crypto project, inspired by the initial public offering (IPO) for stocks.

- **JOMO**  
  Joy Of Missing Out, converting FOMO into a positive feeling

- **KYC**  
  Know Your Customer, a process to verify the identity of customers; often used by centralized exchanges or entities

- **Layer 1**  
  Base blockchain architecture that serves as the foundation for other layers, also called mainnet, e.g., Ethereum

- **Layer 2**  
  Built on top of layer 1, usually for scaling purposes, e.g., Optimism

- **Minting**  
  Process of creating new token(s)

- **Mixer**  
  Decentralized Application that “mixes” tokens to cover their transaction history, used for private transactions

- **NFT**  
  Non-Fungible Token, a type of token that is not interchangeable or divisible, in contrast to fungible tokens; often used for digital collectibles

- **Node**  
  An instance holding a copy of the blockchain, it is connected to other nodes, synchronizing the blockchain and thus forming the network

- **OG**  
  Original Gangster, a person who was very early involved in crypto or a specific project

- **Oracle**  
  Data bridge to bring real-world information onto the blockchain

- **P2P**  
  Peer-to-peer, referring to a transaction between two people without other (central) parties involved

- **Rollups**  
  Popular type of layer 2, scaling solution that uses transaction bundling (“rolling up”) transactions before publishing them to the main chain

- **Rug Pull**  
  Scenario in which a team abandons a project and/or removes its liquidity, similar to exit scams

- **SBTs**  
  Soul-Bound-token, type of NFT that is non-transferrable

- **Smart contract**  
  Programs that run on the blockchain that follow the "if this then that" logic, they execute themselves when certain conditions are met

- **Snapshot**  
  Record of a blockchain at a particular block height, also the name of a popular DAO voting tool

- **Solidity**  
  Smart Contract Programming Language, created for the Ethereum blockchain but popular for other chains as well

- **Stablecoin**  
  A cryptocurrency that is pegged to another asset, mostly USD

- **Staking**  
  Process of locking tokens to contribute to validation in a proof of stake blockchain

- **Token**  
  Representation of a digital asset on a blockchain

- **TVL**  
  Total Value Locked, equivalent of USD locked in a blockchain or protocol, often used as an indicator in DeFi, e.g. in lending protocols

- **Validator**  
  Virtual entity participating in the consensus of a proof of stake blockchain, they participate in producing blocks and validating transactions

- **WAGMI**  
  Acronym for “We're All Gonna Make It”, expression used to show an optimistic attitude about the future of web3

- **Whale**  
  An entity holding a large amount of cryptocurrency, sometimes even a significant part of a project

- **Whitepaper**  
  Document that is released with new crypto projects to explain the details of the project.

- **ZKP**  
  Zero-Knowledge-Proof, cryptographic mechanism to verify an information without revealing it, often used for scaling solutions of privacy applications


The glossary provides you with definitions for the most important terms to navigate the web3 landscape.

Crypto glossary – important terms to navigate web3


Increase safety and transparency for DeFi through a community-driven product risk history and scoring resource.

DeFi Risk Tools & Resources


## What is DeFi?

Decentralised Finance (DeFi) is a term for web3 applications in the financial sector. They replicate the services of traditional financial service providers on a decentralised infrastructure, allowing permissionless access.

They thus promise access to financial services without the need for a bank account or verification by a central provider, leading to greater financial inclusion. On the other hand, most of the volume is currently created by experienced DeFi users. Some individuals are even creating scam DApps, so be careful.

DeFi is one of the main use cases of web3. Especially during the so-called "DeFi Summer" in 2020, there was an explosion in the use and popularity of DeFi applications. Most of the DeFi market is on Ethereum, but many applications are now on multiple chains. These typically allow for lower transaction costs.

If you want to contribute to the guide, [have a look on Github](https://github.com/wslyvh/useWeb3/tree/main).

### Some of the characteristics of DeFi:

- **Permissionless**: Use your wallet instead of a bank account. Thanks to the peer-to-peer structure, there is no centralized entity that controls decision-making. However, your funds are your own responsibility.
- **Global**: It doesn’t matter where you are, DeFi is a global phenomenon.
- **Fast**: Transactions are finished rapidly compared to bank transfers, especially for cross-border transfers.
- **Pseudonymous**: People act through their wallet addresses, no personal information needed.
- **Transparent**: Transactions are public, though, and often the code of the applications is open-source.

DeFi essentially extends the "digital money" premise of bitcoin beyond simply making payments with digital currency. DeFi applications allow you to trade crypto, create derivatives, borrow and lend, earn interest or buy insurance. In the next section, we will explain the broader areas of DeFi.

Some intro pages and learning resources to start your DeFi journey:

- [_Ethereum.org DeFi intro page_](https://ethereum.org/en/defi)
- [_Rekt news_](https://rekt.news/de/)
- [_Finematics Youtube channel_](https://www.youtube.com/c/Finematics)
- [_The Defiant news_](https://thedefiant.io/)
- [_Bankless Podcast and newsletter_](https://www.bankless.com/)
- [_DeFi course by the University of Nicosia_](https://www.unic.ac.cy/blockchain/free-mooc/)

## Areas of DeFi

DeFi applications are designed to do the same things as traditional financial service providers. As a result, there is a wide variety of DApps that qualify as such. In fact, some use cases are only created thanks to the nature of smart contracts.

- **Payments**: low-cost (cross-border) transactions with crypto, e.g. using stablecoins
- **Swapping (DEXes)**: “Decentralized Exchanges” allow for trading of digital assets, e.g. Uniswap
- **Bridging**: Similar to DEXes, but among multiple chains (cross-chain transfers), e.g. HOP
- **Lending and borrowing**: Get a loan or earn interest for providing your tokens, e.g. AAVE
- **Decentralized staking**: Participate in the consensus of proof-of-stake protocols and earn interest, e.g. Rocketpool
- **Derivatives**: Trade or create options, futures or other synthetics assets, e.g. Synthetix
- **Insurance**: Buy coverage for risks with automated claims, e.g. Nexus Mutual
- **Fundraising / grants**: Collect funds for your project by a decentralized crowd or get distributed a grant, e.g. Juicebox
- **Bets / prediction markets**: Create bets with tokens and forecast future events

There are many other DeFi application areas, and some that are still unexplored. To dive deeper, you can check out DeFi DApps and metrics on these websites:

- [_DeFiLlama, popular DeFi explorer_](https://defillama.com/)
- [_DeBank wallet explorer_](https://debank.com/)
- [_Alchemy DeFi DApps list_](https://www.alchemy.com/top/defi-dapps)
- [_Tokenterminal industry metrics_](https://tokenterminal.com/terminal)
- [_Blockchain.com DeFi explorer_](https://www.blockchain.com/explorer/defi)
- [_Bad debt lending metrics_](https://bad-debt.riskdao.org/)

Some DeFi use cases are just waiting for someone to build them! DeFi applications can be a great playground, whether you're a new developer getting your hands dirty for the first time, or a seasoned developer making the transition to the web3 space.

There are different areas for developers within DeFi: you can specialize in writing smart contracts for DeFi, researching the dynamics of a DApp, or building user-friendly interfaces for interacting with them. As DeFi DApps often deal with a lot of capital, they require strong security measures, hence developers specializing in DeFi security.

You can find a lot of DeFi DApps tutorials on useweb3. Check them out [here](https://www.useweb3.xyz/search?page=1&q=DeFi&size=100):

- [_DeFi Developer roadmap GitHub repo_](https://github.com/OffcierCia/DeFi-Developer-Road-Map)
- [_Uniswap V2 contract walkthrough_](https://ethereum.org/en/developers/tutorials/uniswap-v2-annotated-code)
- [_DeFi Hack coding challenges_](https://www.defihack.xyz/)
- [_Rareskills Uniswap V2 book_](https://www.rareskills.io/uniswap-v2-book)
- [_Rareskills Compound V3 book_](https://www.rareskills.io/compound-v3-book)

## DeFi Security

One of the biggest risks in DeFi is the loss of funds due to hacks and other security issues. In recent years, there have been hacks that have drained up to $600 million from DeFi applications. Therefore, becoming a DeFi security specialist can be a promising career path.

Security breaches, such as hacks or exploits, can result in significant financial losses for users and damage to the platform's reputation. By focusing on DeFi security, you can help mitigate these risks and protect users' assets.

Learn more about DeFi hacks and how to prevent them:

- [_Rekt leaderboard_](https://rekt.news/leaderboard/)
- [_DeFi Exploit timeline_](https://chainsec.io/defi-hacks/)
- [_GitHub DeFi risk tools_](https://github.com/defi-defense-dao/defi-risk-tools-list)
- [_Damn Vulnerable DeFi code challenges_](https://www.damnvulnerabledefi.xyz/)
- [_DeFi Risk Tools & Resources Guide_](https://github.com/defi-defense-dao/defi-risk-tools-list)
- [_Blockchain Threat Intelligence Newsletter_](https://newsletter.blockthreat.io/archive)

## Degen Glossary

When you’re new to DeFi, you will probably encounter some specific vocabulary. We have summarized the most important terms for you. Find more terms about web3 in general in the crypto glossary.

- **APR / APY**:  
  Annual Percentage Rate / Annual Percentage Yield, measures the interest or yield earned over a year

- **Aggregators**:  
  Platforms that bundle multiple sources for optimal trade execution, e.g., DEX aggregators

- **Arbitrage**:  
  Term to describe the exploiting of price differences for profit across different markets

- **ATH**:  
  All-Time High, the highest price an asset has ever reached

- **Bonding Curve**:  
  Formula for determining the price of assets in a decentralized exchange

- **CDP**:  
  Collateralized Debt Position, a system for creating crypto-collateralized stablecoins, first created by Maker for the DAI stablecoin

- **Collateral**:  
  Assets pledged to secure loans in DeFi protocols

- **Degen**:  
  Degenerate, term for a person that is deeply involved in DeFi or another sector

- **Flash Loan**:  
  Taking out an uncollateralized loan and repaying it immediately, typically within a single transaction, e.g. to exploit arbitrage opportunities

- **Frontrunning**:  
  Type of MEV, prioritizing one's own transactions to profit from others' trades

- **Impermanent Loss**:  
  Loss experienced by liquidity providers due to volatility of the underlying assets

- **Liquidity Mining / Yield Farming**:  
  Systematically provide liquidity to DeFi protocols to earn interest, often in multiple layers

- **Liquidity Pools**:  
  Pools of crypto assets used for decentralized liquidity provisioning on platforms like DEXes

- **LP Token**:  
  Liquidity Provider Tokens represent ownership in a liquidity pool, usually in a DEX, they can be redeemed for their stake in the pool plus the fees earned

- **MEV**:  
  Maximal Extractable Value, the profit miners or validators can make by including, excluding or reordering transactions, sometimes called “invisible tax”

- **Pump and Dump**:  
  Coordinated market manipulation to inflate and then sell off tokens

- **Rebalancing**:  
  Adjusting portfolio allocations to maintain the desired strategy, e.g., rebalancing positions according to market capitalization

- **Rug Pull**:  
  Scenario in which a team abandons a project and/or removes its liquidity, similar to exit scams

- **Sandwich attack**:  
  An exploitative trading strategy where an attacker sandwiches a swap between two transactions to make a profit

- **Slippage**:  
  Price difference between the expected and actual execution price of a trade

- **Stablecoin**:  
  A cryptocurrency that is pegged to another asset, mostly USD

- **Synthetic Assets**:  
  Financial instruments that synthetically replicate a certain strategy, including real-world assets or other cryptocurrencies, e.g., leveraged ETH

- **TVL**:  
  Total Value Locked, equivalent of USD locked in a blockchain or protocol, often used as an indicator in DeFi, e.g., in lending protocols

- **TVL Ratio**:  
  Ratio of a protocol's Total Value Locked to its market capitalization, an indicator to evaluate the valuation of a protocol


DeFi is one of the key areas in web3: the guide introduces the concept and provides resources for using and developing DeFi applications.

Intro to DeFi – How to navigate the Degen world


This handbook is for people who are interested in exploring the vision behind “Web3”, and who wish to acquire in-demand skills that are essential to realizing that vision.  

A Handbook for Smart Contract Development

Learn Solidity

Free resources to learn about Zero Knowledge Proofs (ZKPs) and Cryptography

Road to ZK

During the recent bull run, people have paid 100 dollars in gas fees for transactions on Ethereum. Here are 4 ways you can reduce your gas fees by 5 times:

4 ways to reduce⛽️Gas Fee paid to Ethereum blockchain.


Web3 is about the next evolution of the web. A web that is more open, transparent and permissionless and runs on decentralized infrastructure such as blockchains. Global and decentralized applications (DApps) that anyone can interact with. They often have native assets integrated (such as Ether) to transact value, but are not just about money or payments. These decentralized applications offer a range of digital services, such as storage, bandwidth and computation without any risk of downtime, censorship, fraud, or 3rd-party interference.

## Benefits

- **Open** - in that they are built from open-source software, by an open and accessible community of developers and executed in full view of the world. 
- **Trustless** - in that the network itself allows participants to interact publicly, or privately without a trusted third party
- **Permissionless** - in that anyone, both users and suppliers, can participate without authorisation from a governing body


## Opportunities

- Financial Tools (payments, fund raising, lending, borrowing,..)
- Identity solutions (self-sovereign, decentralized identifiers,..) 
- More secure voting and governance mechanisms
- Efficient resources management (CO2 tracking, smart grid’s,..)
- Digital ownership registries (e.g. land, collectibles, NFT’s,..)
- Supply chain tracking


## Web3 Development

[useWeb3](https://www.useweb3.xyz/) is a learning platform for developers to explore and learn about Web3. Whether you’re a new dev getting your hands dirty for the first time, or a seasoned developer making the transition into the Web3 space. 

Explore the latest resources, tutorials, challenges, tools, courses and boilerplates and start learning. Once you’re ready, browse the job board to land a job at some of the leading companies that work on core, open-source infrastructure, products, tools, frameworks, DAO's, etc.


## Further reading

- [A Cyberphunk's Manifesto](https://www.activism.net/cypherpunk/manifesto.html), Eric Hughes
- [The Meaning of Decentralization](https://medium.com/@VitalikButerin/the-meaning-of-decentralization-a0c92b76a274), Vitalik Buterin
- [Why decentralization matters](https://onezero.medium.com/why-decentralization-matters-5e3f79f7638e), Chris Dixon
- [What Is Web 3.0 & Why It Matters](https://medium.com/fabric-ventures/what-is-web-3-0-why-it-matters-934eb07f3d2b), Max Mersch and Richard Muirhead
- [What exactly is Web3?](https://youtu.be/l44z35vabvA), Juan Benet (VIDEO)


Web3 is about the next evolution of the web. A web that is more open, transparent and decentralized.

What is Web3


A set of resources for those seeking to understand, go deeper, and build with all things zero knowledge: powerful, foundational technologies that hold the keys to blockchain scalability, and which represent the future of privacy-preserving applications — including applications in crypto/web3 — and countless other innovations to come. 

A set of resources for those seeking to understand, go deeper, and build with all things zero knowledge

Web3 Guides

📖 Best resources to learn Solidity

📖 Crypto glossary – important terms to navigate web3

📖 Learn Solidity

Newsletter