levblanc / web3-security-hardhat

Web3, Full Stack Solidity, Smart Contract & Blockchain development with JavaScript

My Web3 full stack Solicity smart contract & blockchain development journey along with
» this course from Patrick Collins

View Code · Check My Full Journey

Getting Started

1. Clone the repo

git clone https://github.com/levblanc/web3-security-hardhat.git

2. Install dependencies with yarn install or npm install

Usage

Slither

1. Check and make sure python3 & pip3 are installed

$ python3 --version
Python 3.9.9

$ pip3 --version
pip 21.3.1 from /opt/homebrew/lib/python3.9/site-packages/pip (python 3.9)

2. Install solc-select & set target Solidity version

# install solc-select
pip3 install solc-select

# install solidity compiler
solc-select install 0.8.17

# output
Installing '0.8.17'...
Version '0.8.17' installed.

# set solidity version
solc-select use 0.8.17

# output
Switched global version to 0.8.17

3. Install slither-analyzer

pip3 install slither-analyzer

# verify installation
slither --help

3. Run command to spin up slither check

yarn slither

Eth-Security-Toolbox

Official docs: https://github.com/trailofbits/eth-security-toolbox

1. Install docker on your machine
2. Pull docker image of eth-security-toolbox

docker pull trailofbits/eth-security-toolbox

3. Spin up toolbox shell

yarn toolbox

4. Run test

echidna-test /src/contracts/test/fuzzing/VaultFuzzTest.sol --contract VaultFuzzTest --config /src/contracts/test/fuzzing/config.yaml

5. Exit toolbox shell

exit

Lint Solidity files

# Lint only
yarn lint

# Lint & fix
yarn lint:fix

Code formatting

yarn format

Skills

• 
• 
• 
• 
• 
• 
• 
• 

Roadmap

• Learn about slither as a static and fast auditing tool
• Learn about eth-security-toolbox as an auditing toolkit and run with docker
• Learn about the standard auditing process
• Learn about known attacks and how to avoid them

Two Most Common Attacks:

• Reentrancy
• Oracle Manipulation

Before deployment:

1. ALWAYS run slither
2. Look MANUALLY for oracle manipulation examples or reentrancy
3. Don't get anything from a centralized location (use Chainlink oracle instead)