intermediate · blockchain
Solidity and smart-contract security, by practice
Write, test and break smart contracts: Solidity from the storage model up, Foundry for tests and fuzzing, and the exploits that drained real protocols.
·
By Amit Chakraborty — Kolkata, India · Remote worldwide
What you will be able to do
Ship a tested, fuzzed ERC-20/721 contract to a testnet, and find the bug in someone else's.
Syllabus — 12 chapters
- 1. Remix, a wallet and your first deploy — Deploy a contract to a testnet from the browser and read the transaction that did it.
- 2. Storage, memory and calldata — Know where every variable lives and what each location costs in gas.
- 3. Functions, modifiers and events — Write an access-controlled contract that tells the outside world what it did.
- 4. Foundry: tests written in Solidity — Set up forge, write unit tests, and read a gas report.
- 5. Fuzzing and invariants — Let the tool find the input you did not think of, and state what must always stay true.
- 6. ERC-20 and ERC-721 with OpenZeppelin — Extend audited building blocks instead of rewriting them.
- 7. Upgradeable contracts and proxies — Choose between transparent, UUPS and no proxy at all, and know the storage-collision trap.
- 8. Re-entrancy and checks-effects-interactions — Reproduce the DAO hack in a test, then make it impossible.
- 9. Oracles, MEV and front-running — Understand why a price read on-chain can be manipulated inside one block.
- 10. Ethernaut and Damn Vulnerable DeFi, worked — Solve CTF levels and write each one up as an audit finding.
- 11. Reading an audit report — Turn a real audit into a checklist for your own code.
- 12. Gas optimisation that is worth it — Measure before and after, and stop at the changes that matter.
0 of 12 published. A new chapter every Saturday evening. Free to read.
Learn it free, elsewhere too
The documentation, videos, books and practice sites worth your time on this subject. All free. None of it is mine.