Introduction

Etherscan

  • A block explorer analysis tool
  • Lets you view any and all transcations on the blockchain
  • Available for both the mainnet and testnet

Remix

  • A Browser based IDE for Solidity

Primitive Datatypes in Solidity

  • int : integer (signed integer)
  • uint : unsigned integer (uint8, uint16, uint256=unint)
  • bool : Boolean (true or false)
  • address : Ethereum Address

Variables in Solidity

  1. Local Variables

    • Declared inside a function
    • Not stored on the blockchain

  2. State Variables

    • Declared outside a function
    • Stored on the blockchain

  3. Global variables

    • It provides information about the blockchain
    • e.g msg.sender, msg.value, msg.data, block.timestamp

Simple addition program using solidity

pragma solidity ^0.8.0;

contract MyContract {
   unint public number1; //state variable

   function myFunction() public {
      unint num; //local variable
   }

   function newFunction() public return (uint, address) {
      uint num1 = 12;
      uint num2 = 13;
      number1 = num1 + num2;
      address myAddress = msg.sender; //global variable
      return (number1, myAddress); 
   }
}

View and pure

Constructor

Mapping

Blockchain Forensics Tool

Blockchain Explorers:

Smart contract Decompilers

Browser Extensions:

Rug Checker Tools

Txn Visualization Tools

Toke Flow Visualizer:

Miscellaneous tools

Common Vulnerabilities in Smart Contracts

Price Oracle Manipulation

Message call with hardcoded gas amount

Hash Collisions with multiple variable length arguments

DoS with Block Gas List

Insufficient Gas Griefing

Missing protection against Signature Replay Attacks

Lack of Proper Signature verification

Weak Sources of Randomness from chain attributes

Signature Malleability

Authorization through tx.origin

Recentrancy

Code with no effects

Unencrypted Privated Data On-Chain

Integer Overflow and Underflow

Floating Pragma

Unchecked Call Return Value

Unprotected SELFDESTRUCT Instruction

State Variable Default Visibility

Unintialized Storage pointer

Use of Deprecated Solidity Functions

DoS with Failed Call

Blogs & Reports

CTFs Platform | Web3

Bug Hunting Platform | Web3

Smart Contract and Audit Reports | Web3

Smart Contract Auditing Tools

Testing Frameworks:

Fuzzers::

VS Code Extensions

Linters and Formatters:

Visualization Tools:

Dynamics Analysis & Static Analysis:

Auditing Books and Guides:

Wallet Security