Tooling in Smart Contract Auditing, Patrick Introduces Static Analysis. Using Slither by Trail of Bits to find bugs without executing code. Duration: 6min

6. Tooling: Aderyn

Introducing Aderyn: a static analysis tool for smart contracts, built with Rust by Alex Roan. Duration: 2min

7. Tooling: Solidity Visual Developer

Patrick goes over additional useful tools like Solidity Metics and Solidity Visual Developer. Duration: 3min

8. Recon: Reading Docs

Puppy Raffle Audit Walkthrough - Main Branch Details. Patrick explains raffle documentation, functions, and entry requirements. Duration: 2min

9. Recon: Reading the Code

Navigate PuppyRaffle codebase, player entry points, keyboard shortcuts. Duration: 5min

10. Recon: Reading Docs II

In this lesson Patrick continues reading through the docs and even smell a bug! Duration: 3min

11. sc-exploits-minimized

Introducing the sc-exploits-minimized repo, a compilation of common smart contract vulnerability examples. Duration: 2min

12. Exploit: Denial of Service

Explore a DoS attack using a minimalistic DOS contract. Learn how loops and arrays can make a protocol unusable. Duration: 7min

13. Case Study: DoS

Joined by Owen, we look into 2 case studies of real life DoS attacks: GMX V2 and the Bridges Exchange. Duration: 21min

14. DoS PoC

Puppy Raffle Denial of Service Attack - Identify and Test. Main focus: Unfair cost increase for late entrants, disadvantaging new players. Duration: 8min

15. DoS: Reporting

How to create a DOS security review report. Step-by-step process including title, root cause, impact, severity, likelihood, and mitigation strategy. Duration: 8min

16. DoS: Mitigation

How to Remove Duplicates from Arrays with Patrick Duration: 3min

17. Exploit: Business Logic Edge Case

Patrick discusses the potential impacts of a user entering PuppyRaffle with a smart contract. Duration: 3min

18. Recon: Refund

Continuing our Recon of PuppyRaffle with the Refund function. Duration: 3min

19. Exploit: Reentrancy

Reentrancy Attack in PuppyRaffle: Deposit-Withdraw Loop Steals Funds Duration: 14min

20. Reentrancy: Remix Example

Patrick shows a hacker draining a user's balance via Remix using re-entrancy exploit. Duration: 4min

21. Reentrancy: Mitigation

Fixing Re-Entrancy in Smart Contracts:CEI Pattern, Lock Variables & Non-Reentrant Modifier Duration: 4min

22. Menace To Society

DeFi reentrancy attacks: Importance of understanding past hacks for security pros; The DAO hack case study. Duration: 5min

23. Reentrancy: Recap

Patrick recaps reentrancy vulnerabilities and discusses prevention such as checks-effects-interactions (CEI) and non-reentrant modifiers. Duration: 3min

24. Reentrancy: PoC

Identify & exploit smart contract re-entrancy vulnerability for PuppyRaffle. Demo of POC with a hypothetical attacker contract. Discuss prevention methods. Duration: 8min

25. Recon: Continued

Smart contract codebase analysis, focusing on PuppyRaffle's selectWinner function. Checking timestamp, players, raffle status, winner calculation concern. Duration: 5min

26. Exploit: Weak Randomness

Dive into PuppyRaffle's weak randomness. Patrick emphasizes use of secure sources like Chainlink VRF. Duration: 4min

27. Weak Randomness: Multiple Issues

Blockchain timestamps, previous block hashes, and transaction senders are unsuitable for secure random number generation. Use more reliable methods instead. Duration: 4min

28. Case Study: Weak Randomness

NFT product Mebits attacked, obtained rare NFT worth almost $1M; weak security measures. Duration: 7min

29. Weak Randomness: Mitigation

Chainlink VRF for trustless randomness in apps, Patrick explains. No to alternative methods. Duration: 1min

30. Exploit: Integer Overflow

Bug in smart contract due to arithmetic overflow; demonstrates with Solidity code & offers solutions. Duration: 8min

31. Integer Overflow: Mitigation

Fixing Solidity Arithmetic Issues: Use Newer Version Duration: 2min

32. Exploit: Unsafe Casting

Overflow issue: Loss of significant digits due to uint64 casting from uint256, leading to lost fees. Importance of identifying & fixing in audit reports. Duration: 4min

33. Recon II

Patrick continues his reconnaissance of PuppyRaffle! Duration: 11min

34. Exploit: Mishandling Of ETH

Identifying the mishandling of ETH in PuppyRaffle and outlining issue with relying on .balance in contract accounting. Duration: 3min

35. Mishandling of ETH: Minimized

How ETH Misuse Leads to Smart Contract Vulnerability, Patrick Explains Solutions Duration: 6min

36. Case Study: Mishandling of ETH

SushiSwap attack: Poor handling of ETH led to a real-life attack, causing significant monetary loss. Read detailed case study. Duration: 3min

37. Recon III

PuppyRaffle walkthrough continues, covering functions & exploits. Go through code multiple times for understanding. Identify areas for improvement. Duration: 7min

38. Answering Our Questions

Going back through the notes we left ourselves and answering some of the questions we'd asked! Duration: 4min

39. Info and Gas Findings

Improving code quality through an audit: Use specific Solidity versions, define constants, check library security, make storage variables immutable. Duration: 5min

40. Pit Stop

Conducting Code Quality Test Using Slither & Aderyn Tools; Practice Tips Given by Patrick. Duration: 2min

41. Slither Walkthrough

Slither is a static analysis tool that is useful for securing smart contracts. A walkthrough of its use. Duration: 13min

42. Aderyn Walkthrough

A brief walkthrough of Aderyn and how to use it to supercharge your smart contract security reviews. Duration: 3min

43. Test Coverage

Code Coverage Check Using Foundry, Aderyn & Slither Duration: 1min

44. Phase 4: Reporting Primer

Learn report writing for security reviews & effective communication in bug bounties with Patrick. Master competitive audits & finding submission. Duration: 3min

45. What is a Competitive Audit?

Competitive Audits - Discover Bugs, Win Rewards! Get started with Patrick's guidance, perfect for aspiring smart contract security professionals. Duration: 5min

46. Codehawks

Join CodeHawks for Competitive Audits & practice. Live competitions, real $$$. Duration: 3min

47. Submitting a Competitive Audit Finding

Patrick demonstrates how to submit findings in a competitive audit, emphasizing the importance of building your auditing portfolio. Duration: 4min

48. Reporting Templates

Introducing some useful templates and processes for audit reporting. Duration: 3min

49. Reporting: Floating Pragma

Walkthrough of the floating pragma informational finding report. Duration: 2min

50. Reporting: Incorrect Solc Version

Quick walkthrough of reporting an incorrect solc version. Duration: 2min

51. Reporting: Unchanged State Variables Should be Immutable or Constant

Learn how to track gas consumption and identify where improvements can be made. Focus on gas optimization techniques and proper variable scoping. Duration: 2min

52. Reporting: Zero Address Check

Patrick explains zero address check and walks through reporting it. Duration: 1min

53. Reporting: Storage Variables in Loops Should be Cached

Optimize gas usage via caching store variables in loops, read memory instead of storage for efficiency. Duration: 2min

54. Reporting Findings We'll Cover Later

Audit Findings: MEV Attacks & Refund Function - To be covered later (Section 7.5) Duration: 1min

55. Reporting Reentrancy

How to write a security review finding for a reentrancy vulnerability including a mitigation recommendation. Duration: 8min

56. Reporting: getActivePlayerindex

Walkthrough of a report for our getActivePlayerIndex edge case! Duration: 5min

57. Reporting: Should Follow CEI

Informational PuppyRaffle issue, improving code with CEI. Duration: 2min

58. Reporting: Weak Randomness

Auditing blockchain randomness, Patrick explains how weak randomness can be exploited and suggests using secure generators like Chainlink VRF. Duration: 6min

59. Reporting: Magic Numbers

Focus on Magic Numbers & Named Constants. Patrick provides Solidity examples & tips. Duration: 2min

60. Reporting: Integer Overflow

Patrick explains two security issues found in PuppyRaffle - integer overflow and unsafe cast. Offers detailed explanations & potential mitigations. Duration: 8min

61. Reporting: Smart Contract Wallet Reverts Winning

Winning smart lottery without fallback causes restart issues & gas waste; Suggested mitigation: mapping addresses to payouts, 'claim prize' function. Duration: 5min

62. Reporting: Mishandling Of ETH

Writing our report for ETH Mishandling in PuppyRaffle. Duration: 2min

63. Reporting: Missing Events And Remove Dead Code

A quick report for missing events and unused function in PuppyRaffle! Duration: 2min

64. Adding the Audit to Our Portfolio

Learn how to create an audit report using Markdown and Pandoc, including adding logos, formatting sections, and converting the report to a PDF. Duration: 6min

65. Exercises

Protecting Web3 Against Hacks & Attacks; Remix Exploits & DeFi Challenges. Presented by Patrick. Includes Exercises & Case Studies. Duration: 5min

66. Solodit

Solodit - a Web3 audit finding aggregator. Learn from other auditors' reports & excel in competitive contests. Duration: 4min

67. Wrapping Up

Raffle complete, tweeting your success, CodeHawks First Flights, rest & rewards encouraged. Duration: 2min

Section 5: TSwap

Duration: 5h 23min

Section 6: Thunder Loan

Duration: 4h 33min

Section 7: Boss Bridge

Duration: 2h 01min

Section 8: MEV & Governance

Duration: 1h 41min

Give us feedback!