blockchains-security-toolkit/advanced_expert/bug_hunting

bug hunting smart contracts

tl; dr

initial questions

• list external and public functions.
• when and where external call happens and what changes.
• check payable functions.
• how functions are accessed (permissions by who).
• follow the flow for transfers.

look for common vulnerabilities

• reentrancy with flashloans, fallbacks, payables.
• access control.
• arithmetic errors.

create an environment for testing

• static analysis
• fuzzing and poc exploits (use foundry)

---

cool resources

• solidity bugs by version

cool bug bounty platforms

• immunefi
• hackenproof
• bountycaster
• certik
• remedy

cool communities

• eth rangers
• security alliance
• the red guild