Chapter 7: References & Further Reading
The field of Web3 security evolves rapidly. Stay up to date by regularly reviewing these definitive resources, vulnerability registries, and tool documentation.
Vulnerability Registries & Standards
-
SWC Registry (Smart Contract Weakness Classification):
https://swcregistry.io/
The equivalent of CWE for smart contracts. Contains detailed explanations, code examples, and remediation advice for common EVM vulnerabilities. -
ConsenSys Smart Contract Best Practices:
https://consensys.github.io/smart-contract-best-practices/
A comprehensive guide to security philosophy, known attacks, and software engineering practices for Ethereum. -
EEA (Enterprise Ethereum Alliance) Security Specifications:
https://entethalliance.org/
Secure Development Libraries
-
OpenZeppelin Contracts:
https://docs.openzeppelin.com/contracts/
The industry standard for secure smart contract development. Includes implementations for ERC20, ERC721, Access Control, and Reentrancy Guards. -
Solmate:
https://github.com/transmissions11/solmate
Gas-optimized, modern Solidity building blocks. An alternative to OpenZeppelin for advanced developers.
Auditing & Analysis Tools
-
Slither (Static Analysis):
https://github.com/crytic/slither
Documentation and GitHub repository for the Trail of Bits static analyzer. -
Echidna (Property-Based Fuzzing):
https://github.com/crytic/echidna
Fuzzer for generating inputs to falsify user-defined properties. -
Foundry (Testing Framework):
https://book.getfoundry.sh/
A blazing fast toolkit for Ethereum application development written in Rust. Excellent for testing, fuzzing, and invariant checks.
Further Reading & Learning Platforms
-
Ethernaut by OpenZeppelin:
https://ethernaut.openzeppelin.com/
A Web3/Solidity based wargame to learn smart contract security by hacking them. -
Damn Vulnerable DeFi:
https://www.damnvulnerabledefi.xyz/
Offensive security exercises specifically targeting DeFi primitives like Flash Loans, Oracles, and Governance.