A curated list of awesome Ethereum security references, guidance, tools, and more.
- Consensys Best Practices
- Solidity Security Considerations
- Comprehensive list of known attack vectors for Solidity
- Capture the Ether - A Capture The Flag style set of exploitable contracts at varying levels of difficulty.
- Ethernaut - A Capture The Flag style set of exploitable contracts at varying levels of difficulty.
- Hands on the Ethernaut CTF - Writeups for various Ethernaut CTF challenge contracts.
- Ethernaut - Naught Coin (ERC20) Exploitation - A writeup for NaughtCoin, a vulnerable ERC20 implementation, from the Ethernaut CTF.
- Blockchain Security Contacts - Email contact info for blockchain projects if you have security information to report
- Hacking Distributed - Emin Gün Sirer, a professor in Cornell Tech’s IC3 lab focused on blockchain security.
- Phil Does Security - Phil Daian, the software engineer and grad student behind KEVM, Hydra, and other Ethereum academic projects
- Trail of Bits - Cybersecurity R&D firm with a blockchain security practice
- REcon 2018 - Reverse Engineering Of Blockchain Smart Contracts
- HITB Amsterdam 2018 - Smashing Ethereum Smart Contracts for Fun and Profit
- CanSecWest 2018 - Blackhat Ethereum
- EkoParty 2017 - Automated Bug Finding for the Blockchain
- The Smartest Contract #15 - Trail of Bits’ Outlook on Security w/ JP Smith
- The Smartest Contract #8 - Smart Contract Security and Honeypots w/ Gerhard Wagner
- Zero Knowledge #29 - The DAO, the White Hat Hacker Group & Giveth w/ Griff Green
- Zero Knowledge #16 - Talking security with JP Smith from Trail of Bits
- Risky Business #488 - JP Smith about all things blockchain
- ethereum-graph-debugger - A graphical EVM debugger. Displays the entire program control flow graph.
- Slither - Slither can map method visibility and modifiers, state variables that are read and written, calls, and can print an inheritance graph of a smart contracts
- Solgraph - Generates DOT graphs with function control flow of a solidity contract
- Surya - Generates various visual outputs of function call graphs
- Remix - A browser-based Solidity IDE with linting features
- Solhint - A linter for both security and style-guide validations. It strictly adheres to the Solidity Style Guide.
- Solium - Another linter for both security and style-guide validations. Does not strictly adhere to the Solidity Style Guide.
- Echidna - The only available fuzzer for Ethereum software. Uses property testing to generate malicious inputs that break smart contracts
- Manticore - Symbolic execution tool for Ethereum smart contracts that includes detectors for common security flaws
- Mythril - Security analysis tool for Ethereum smart contracts built around detector modules
- Securify - Static analysis tools from ChainSecurity
- Slither - Static analysis framework with detectors for many common Solidity issues. It has taint and value tracking capabilities and is written in Python.
- KEVM - K Semantics of the Ethereum Virtual Machine (EVM)
- Manticore - Symbolic execution tool for EVM
- Ethersplay - A visual disassembler for EVM bytecode built on Binary Ninja
- ethereum-dasm - An EVM disassembler with static and dynamic analysis abilities, including function signature lookup
- evm-lab - Utilities for interacting with the Ethereum virtual machine
- IDA-EVM - An IDA plugin to view EVM instructions within IDA
- PyEVMAsm - An EVM assembler and disassembler with a CLI and a Python API
- Rattle - EVM binary static analysis framework. Produces SSA representations of EVM code.
- ETHSecurity
- Enterprise Ethereum Alliance Security Task Force
- Empire Hacking Slack and Empire Hacking
We welcome contributions that help curate this awesome list. Please refer to the contributing guidelines when submitting PRs. Thanks!