Skip to content

awesome-blockchain-security-learning-resources.md

Latest commit

 

History

History
138 lines (122 loc) · 8.95 KB

awesome-blockchain-security-learning-resources.md

File metadata and controls

138 lines (122 loc) · 8.95 KB
Raw

Awesome Blockchain / Smart Contract Security Learning Resources

Blockchain security covers Web3 / smart-contract auditing (mostly Ethereum EVM and Solidity, plus Vyper, Move, Cairo, Solana Rust), protocol-level attacks (consensus, MEV, bridges), wallet and key-management security, and cryptographic primitives (zero-knowledge, threshold signatures). Smart-contract auditing is one of the highest-paying specializations in security as of 2024-2026.

ToC

  1. Books
  2. Videos
  3. Free/Paid Courses
  4. Free/Paid Labs & CTFs
  5. Blockchain Security Tools
  6. Certifications
  7. Blogs/Articles

Books

  1. Mastering Ethereum by Andreas M. Antonopoulos, Gavin Wood (free on GitHub)
  2. Mastering Bitcoin by Andreas M. Antonopoulos (3rd Ed, free)
  3. Hands-On Smart Contract Development with Solidity and Ethereum by Kevin Solorio et al. (O'Reilly)
  4. Solidity Documentation (free, always-current)
  5. Ethereum Smart Contract Security Best Practices by ConsenSys (free)
  6. The Blockchain Developer by Elad Elrom (Apress)
  7. Foundation Handbook of ZK by ZK Hack community (free)

Videos

  1. Smart Contract Programmer
  2. Patrick Collins - Full Foundry / Solidity course (free, 30+ hours)
  3. Owen (officer_cia) / Web3 security streams
  4. Secureum Bootcamp videos
  5. DeFi Security Summit talks
  6. ETH Security Community calls
  7. Trail of Bits YouTube
  8. Immunefi Whitehat Interviews

Free/Paid Courses

Free

  1. Cyfrin Updraft (free, Solidity + security, by Patrick Collins) - Highly recommended starter.
  2. Secureum Bootcamp (RACE / A-MAZE-X) archives
  3. SpeedRunEthereum - Solidity-focused hands-on.
  4. Solidity by Example
  5. ConsenSys Academy free content
  6. CryptoZombies - Solidity basics, gamified.
  7. Chainshot / Alchemy University
  8. Rareskills GitHub learning materials
  9. Foundry Book (free, by Paradigm)

Paid

  1. Cyfrin Updraft Security & Auditing track (paid certificates)
  2. Extropy - Blockchain Security Training
  3. Rareskills bootcamps
  4. ZK Hack courses and workshops
  5. Solana Cookbook / Solana Foundation training
  6. Web3 certifications by ConsenSys / INE (emerging)

Free/Paid Labs & CTFs

  1. Ethernaut by OpenZeppelin - Classic Solidity CTF.
  2. Damn Vulnerable DeFi (Foundry edition) - Industry-standard DeFi challenges.
  3. Capture The Ether (archived but still available)
  4. Paradigm CTF archives
  5. Secureum RACE and A-MAZE-X archives
  6. QuillCTF by QuillAudits
  7. Cipher School / Cipher Shastra
  8. Node Guardians
  9. Solana CTF by Neodyme
  10. ZK CTFs (ZK Hack Puzzles, 0xPARC)
  11. More Damn Vulnerable Protocols (Bridges, AMMs) - search by community

Blockchain Security Tools

Static / dynamic analysis (Solidity / EVM)

  1. Slither by Trail of Bits - The de-facto Solidity static analyzer.
  2. Mythril by ConsenSys - Symbolic execution for EVM.
  3. Echidna by Trail of Bits - Property-based fuzzer.
  4. Medusa by Trail of Bits - Go-based smart-contract fuzzer.
  5. Manticore by Trail of Bits - Binary / smart-contract symbolic execution.
  6. Foundry (forge test + invariant testing)
  7. Hardhat + smock + hardhat-chai-matchers
  8. Scribble by ConsenSys - Spec annotation + runtime checks.
  9. solhint / solium - Linting.
  10. Halmos by a16z - Symbolic testing for Foundry.

Formal verification

  1. Certora Prover
  2. K framework / KEVM
  3. Runtime Verification
  4. SMTChecker (built into Solidity compiler)

Monitoring / defense

  1. OpenZeppelin Defender - Secure operations platform.
  2. Forta Network - Decentralized monitoring and detection bots.
  3. Tenderly - Transaction simulation + monitoring.
  4. Blockaid / GoPlus Security - Wallet-layer threat detection.
  5. Hexagate / Hypernative - Real-time risk detection.
  6. Chainalysis / TRM Labs - On-chain investigations and compliance.

Wallet / key security

  1. Safe (Gnosis Safe) - Multi-sig standard.
  2. Fireblocks / Qredo - MPC wallets.
  3. Ledger / Trezor hardware wallets
  4. Web3-signer, Frame, Rabby

Dev / testing frameworks

  1. Foundry (Forge, Cast, Anvil, Chisel)
  2. Hardhat
  3. Brownie (Python, now Ape)
  4. Remix IDE

Non-EVM chains

  1. Cargo-audit, Sealevel / Solana security tools by Neodyme, OtterSec
  2. Move Prover (Aptos/Sui)

Certifications

  1. Blockchain Council - Certified Smart Contract Auditor (CSCA)
  2. Cyfrin Updraft - Security Researcher badge
  3. Secureum Bootcamp - top-ranked RACE finishers gain recognition instead of formal certs
  4. EC-Council Certified Blockchain Professional (CBP)
  5. ConsenSys Academy Developer / Auditor tracks
  6. (ISC)2 / ISACA are piloting emerging Web3 modules; check availability

Note: The industry largely values bug-bounty track record, published audit reports, and CTF rankings (Code4rena, Sherlock, Secureum) far more than certifications.

Blogs/Articles

  1. Ethereum Foundation security blog
  2. Trail of Bits blog (blockchain category)
  3. OpenZeppelin blog
  4. ConsenSys Diligence blog + best practices
  5. Rekt.news - DeFi exploit post-mortems.
  6. DeFiLlama - Hacks page
  7. samczsun blog
  8. paradigm.xyz research
  9. a16z crypto research
  10. Immunefi Medium / whitehat reports
  11. Code4rena reports and findings
  12. Sherlock audits / protocols
  13. Spearbit portfolio reports
  14. OtterSec (Solana audits)
  15. ZK Hack and 0xPARC research
  16. Awesome Ethereum Security GitHub
  17. SWC Registry - Smart Contract Weakness Classification (archived but still referenced)
  18. DASP Top 10 - Decentralized Application Security Project
  19. OWASP Smart Contract Top 10