The goal of this repository is to create the most clear and concise collection of smart contract attack vectors, to improve overall ecosystem security.
- Front-Running AKA Transaction-Ordering Dependence
- DoS with Block Gas Limit
- DoS with (Unexpected) revert
- Forcibly Sending Ether to a Smart Contract
- Insufficient Gas Griefing
- Reentrancy
- Honeypot
- Integer Overflow and Underflow
- Timestamp Dependence
- Authorization Through tx.origin
- Floating Pragma
- Function Default Visibility
- Outdated Compiler Version
- Unchecked Call Return Value
- Unprotected Ether Withdrawal
- Unprotected Selfdestruct Instruction
- State Variable Default Visibility
- Uninitialized Storage Pointer
- Assert Violation
- Use of Deprecated Functions
- Delegatecall to Untrusted Callee
- Signature Malleability
- Incorrect Constructor Name
- Shadowing State Variables
- Weak Sources of Randomness from Chain Attributes
- Missing Protection against Signature Replay Attacks
- Requirement Validation
- Write to Arbitrary Storage Location
- Incorrect Inheritance Order
- Arbitrary Jump with Function Type Variable
- Presence of Unused Variables
- Unexpected Ether Balance
- Unencrypted Secrets
- Faulty Contract Detection
- Unclogged Blockchain Reliance
- Inadherence to Standards
- Unprotected Callback
- https://github.com/ethereum/wiki/wiki/Safety
- https://swcregistry.io/
- https://eprint.iacr.org/2016/1007.pdf
- https://www.dasp.co/
- https://consensys.github.io/smart-contract-best-practices/
- https://github.com/sigp/solidity-security-blog
- https://solidity.readthedocs.io/en/latest/bugs.html
If you notice any mistakes, typos or missing attacks/vulnerabilities, please feel free to open an issue or pull request. All contributions are very much appreciated.
Special thanks to RobertMCForster for many excellent contributions.