Loading...

smart-contract-security

Original：🇺🇸 English

Translated

Guide for EVM/solidity smart contract security work: vulnerability taxonomy, review workflow, and where to place resources in README.md.

1installs

Sourcegmh5225/awesome-web3-security

Added on2026-03-08

NPX Install

npx skill4agent add gmh5225/awesome-web3-security smart-contract-security

Tags

Translated version includes tags in frontmatter

smart-contract-security evm solidity vulnerability-audit web3-security

SKILL.md Content

View Translation Comparison →

Smart Contract Security (EVM / Solidity)

Scope

Use this skill when working on:

Solidity/EVM auditing resources
EVM vulnerability categories and examples
Tooling for contract analysis (static, dynamic, fuzzing)

Common Vulnerabilities (Cheat Sheet)

Reentrancy
Access control bugs
Price oracle manipulation
MEV / sandwich / frontrunning
Flash loan enabled logic flaws
Precision / rounding / decimal mismatch
Signature and permit mistakes (EIP-2612 / Permit2)
Upgradeability mistakes (UUPS / Transparent)

Recommended Review Workflow

Threat model: assets, trust boundaries, privileged roles
State machine: invariants, transitions, edge cases
Access control: ownership, roles, upgrade admin
External calls: reentrancy, callback surfaces, token hooks
Economic analysis: pricing, liquidity, oracle, incentives
Testing: unit tests + fuzzing + invariant tests
Reporting: severity, exploitability, PoC, remediation

Where to Add Links in README

New analyzers/fuzzers:
```
Development → Tools
```
or
```
Security
```
(choose primary)
Audit methodologies/standards:
```
Security
```

Practice labs/CTFs:

Security Starter Pack → CTFs / Practice

Audit report portfolios:
```
Security Starter Pack → Audit Reports
```

Notes

Keep additions:

English descriptions
Non-duplicated URLs
Minimal structural changes

Data Source

For detailed and up-to-date resources, fetch the full list from:

https://raw.githubusercontent.com/gmh5225/awesome-web3-security/refs/heads/main/README.md