How to Audit a Smart Contract | Can you find the Solidity Security Vulnerabilities?
Vložit
- čas přidán 18. 06. 2022
- We learn the auditing 101 of smart contracts, and understand basic tooling for doing an audit, like slither, echidna, mythx, etc. At the end of this, we will know the audit process, the basics of how to conduct one, and how to interact with auditors. This works for solidity, vyper, or even rust smart contracts! (Although, the tooling isn't the same for every language!)
👩🏻💻 Code: github.com/PatrickAlphaC/hard...
👆👆👆👆👆👆
The code has even MORE links from the video!
🔐 Secureum: secureum.substack.com/p/audit...
✍️ Blog: (Coming Soon)
🔥 Latest freeCodeCamp Ultimate video: • Learn Blockchain, Soli...
Check out these articles to learn about some of these tools and start your journey as a smart contract engineer!
👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇
📕How to Become a Blockchain Engineer: betterprogramming.pub/how-to-...
✍️Top 10 Resources, Tutorials, and Follows: dev.to/patrickalphac/top-10-s...
👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆
✅✅ Donate ✅✅
I use donated funds to spend money on making fun & informational videos.
ETH/Polygon/Avalanche/EVM Chains Wallet address:
0x9680201d9c93d65a3603d2088d125e955c73BD65
Or, optionally:
- patrickalphac.eth (ETH Only)
😸😸Join the community!😸😸
Chainlink developers discord: / discord
Twitter: / patrickalphac
Medium: / patrick.collins_58673
TikTok: / patrickalphac
Twitch Stream Uploads & Shorts: / @patrickalphac-alt
Twitch: / patrickalphac
All thoughts and opinions are my own. - Zábava
![Eminem - Houdini [Official Music Video]](http://i.ytimg.com/vi/22tVWwmTie8/mqdefault.jpg)
When do you sleep? You really are brilliant. I'm on hour 19 of your fantastic 32 hour tutorial. And I just saw on linkedin the post of this new video. I congratulate you. You are a genius and I thank you for all you are doing for the ecosystem. We need more people like you that despite what is currently happening with the drop in prices, you put your chest out because you know that it is not just about a token, but about all the value that decentralization represents. In the end... time will prove right all of us who believe in a fairer and more egalitarian system.
Thanks for the kind words fren!
I’m definitely no genius. I started making content because it was the only way for topics to solidify themselves in my head.
The past few weeks since the course came out have been the best sleep in a while ahah. Sleep and recharging is important!
But yes, we need more people to focus on what matters so we can scale.
Which 32 hour tutorial you are talking about. I need to know
@@raj-nq8ke hi! the one that Patrick made to teach us everything about smart contracts: czcams.com/video/gyMwXuJrbJQ/video.html
@@raj-nq8ke freecodecamp solidity
@@PatrickAlphaC do you have an apustaja neon sign that you're keeping hidden somewhere
So you actually follow the results of twitter polls on your timeline!
Thanks for doing so
I’m all about delivering for the peeps fren :)
Hello Patrick,
Hope you are well, and hope you will extend this series in depth. I went thru all of your tutorials, built some top notch projects, now i figure its time to deal with security.
Thanks
Awesome video Patrick!
Love your content 🤩
More people need to pay attention to smart contract auditing - very important and profitable area for developers!
You're an Absolute Legend, Patrick.
Cheers from Brazil!
💪🔥❤️
You sir have a talent for creating and explaining very complex content in a very easy to understand way, I have been jumping around learning resources for a long time and not once did I come across a single video that outlines the most important bits one needs to sort out in order to pursue these challenges.
I wanna add one thing to whoever might be reading this and was looking for any additional advice that could help them, I really can’t stress enough how important it is to also master note taking and especially revising it with each contract.
There’s so much more bugs out there..
YES!
Master note taking :)
You’ve earned a new sub. Great job and thank you for sharing your knowledge
Great video and explanation. Thanks for the resources as well. Very helpful.
Really helpful. High quality content. Thanks for sharing
This is so valuable!
Faboulous! Thank you so much!👍👍
You're the best, learned a ton of things from this video
For more enquiries, reach out⬆️⬆️⬆️..
Very magical and incredible. I was researching and learning about smart contract auditing recently. At that time, I didn't search for related content on my CZcams. So, of course, I searched for a lot of knowledge about contract auditing on Google Search.
The author's video is recommended on my CZcams homepage today, and this video is 100% what I want. That is amazing.
Finally, thanks to Patrick, this video addresses all my questions about smart contract auditing, it's worth watching many times, and you don't need to pause and take notes.
Thanks fren 💪
@@PatrickAlphaC Are there any tools here for Gas analysis? Thank you.
@@saneryee1431 do -gas with the hardhat gas plugin
@@PatrickAlphaC Thanks.
because of you, i'm running a solidity audit company
LETS GOOOOO!!! Good luck fren!!!
Man you are the most helpful l!
This video is definitely the best one in Crypto tech area!
Thanks fren
For more enquiries, reach out⬆️⬆️⬆️..
Yeah am that Indian who's learning from you this time
superb content! keep it up sir..
For more enquiries, reach out⬆️⬆️⬆️..
Happy to meet u in Denver eth
Sensei, Should I start my journey in web 3 bug bounty or traditional bug bounty? Thanks for the awesome content. Liked and Subbed!
thank you~~
Only 10k views??? This is gold
You are amazing. This is very helpful. Patrick, I chose to use MythX as opposed to Slither or Echidna. Anything that I would be missing out on?
MythX is great as a paid service, but it’s good to do your own analysis first!
For more enquiries, reach out⬆️⬆️⬆️..
Patrick, you are simply the best man! currently studying your Solidity course! is there a chance you make a RUST Smart Contract programming course as well? or even a paid version for it? Thank you
I’ve only done the basics of rust contracts… maybe one day
@@PatrickAlphaC can you share a link to the rust contracts basic? and thks again for this amazing content
@@andrewpan3047 czcams.com/video/7l1P3xzr7Jo/video.html
Dam this is gold man (or should I say bitcoin, haha). Thanks!
lol. Good one.
Epiccc
100k.... we need the merch with the Frog Coder on It 👩🏻💻 👩🏻💻 👩🏻💻 👩🏻💻
Done. 100% will do that at 100k
Amazing video youre killing it, now pls devs fix bitcoin price >:(
Please make tutorial for cross chain bridge 🍄🚀
Great and very helpful content. Just a gentle clarification, fuzzing is a slightly different analysis method than symbolic execution, which makes Echidna not a symbolic execution tool. Nonetheless, your video provides valuable insights into auditing contracts. Thanks!
Yes! This video is a bit older I have it corrected in newer videos
I am curious about ecdsa verifying when connecting and signing a wallet at the frontend. Can you teach me the process of getting the wallet request from the backend and going to the contract using Go Lang's package?
That was fast!
You ask I deliver
How we can deploy a contract in multiple networks (solana, bnb, eth) _ in this case user be able to transfer asset by the all networks
Hello patrick, any hint of how to solve this and install slither correctly without using virtualenv
The term 'slither' is not recognized as the name of a cmdlet
getting this when trying to use slither. thankyou!
Is data structures are important to build smart contract with solidity?
In a situation whereby, you clone into a project and it doesn't have both package.json file and the node_modules, how do you go about this? The project itself has dependencies
100k Subscriber Idea: RubberduckExplaining while jumping out of a plane!
I would watch that😂
Thanks for such amazing content 💃
OH. MY. GOD. This idea
Please make a clone tutorial,
Like MATIC,solana, Decentraland or axie infinity ♾️🚀
Please make tutorial for EstateRegistry API Decentraland to creating editable and updateble nft land
Thanks Patrick for the video tutorial,
But it seems I can not run slither in windows since solc-select don't support windows yet..😑
Thanks, have you more info about subject?
If someone is trying to find flaws to existing contracts, is there a decompiler that actually is able to decompile to readable contracts. I am on some DeFi projects and would like to be able to see if they have done their job properly.
There are some, they are in beta tho ethervm.io/decompile
7:35 Slither
Can you give info which version of eth-security-toolbox you used? It's always good to append version number to used containers, because the recent seems to be broken (echidna fails with Permission denied: 'crytic-export')
ahhhhhh.... Yes I should of added that. Could you make an issue on the repo?
Patrick do you think that is better work always whit new version of solidity?
Or is okay work whit the version that we know or been worked before?
A lot of the newer versions have “better” stuff. But if you’re doing low level stuff, stick with what you know. Each version has slight differences.
Ideally tho, you learn the new stuff and use the new stuff
Thanks - super new to smart contract security. I have installed slither-analyzer but when I try and run it it says slither command not found. Not sure if I need to add Slither to my PATH on Mac.
Python version: 3.8.2
PIP3 version 23.1.2
It looks like I have Slither version 0.9.3 but nothing runs and I can't run slither --version. "-bash: slither: command not found"
Hi Patrick, my name is Gabi and I am a Blockchain & Software developer, I am trying to grow my channel where I am sharing my knowledge about Web3 development, I really love your videos and you inspired my to continue learning until I came to a level where I can teach things myself to other people ! Thank you ! ❤
Awesome! Keep it up!
Subbed
my slither not install correctly, is there any way to fix that
Patrick , Thank u so much for the fcc js 32 hours course , but can i ask u why do i struggle following the project and i have hard time understand solidity and hardhat , is that normal ? and what do i need to do to master this ?
You'd have to get more specific about what you're stuggling with. But sometimes, you just need more practice!
@@PatrickAlphaC is it okay to do bad smart contract and mistakes at first ? also can i ask u how many years it took u to be able to make good solidity codes ?
@@razorjhon2622 Sure! Just don't deploy them to mainnet and ask users to use them!
It took a couple years, but it's a process where even now, I still try to get better every day.
Where would a complete beginner to coding start? I'd like to eventually become a web 3 dev but I'm pretty sure I need to learn the basics first. Thanks
Check the description of the video - one of those two links I point too(with the 👆emoji) is what you want!
@@PatrickAlphaC awesome thank you
Hello patrick, thank you for video tutorial, I had already install slither, but command not found in terminal, I am using vscode with nodejs and python integration, what should I do? thank you
anyone can help me?
Could you make a question on stack exchange eth? Thanks
Hey there. Thanks for your awesom videos. Now im working as a IT System Engineer and getting into the security field (blue team). Now I know python because of my IT degree and im trying to get into web3 a bit. Now my question: Do i need to learn javascript for web3 or is it also viable to use python? If it goes to fullstack web/dapp then javascript is probably a must. But I in the future want to do security audits, is there a way around javascript or are most of the dapps... running with javascript. (ofc I need to learn solidity :P)
If you know python, use python. You 100% don’t need to know javascript. I think knowing JS is good if you want to make websites, and that’s really it
@@PatrickAlphaC thank you very much for your advice. Really appreciate that you answer such questions. Love your vids
For more enquiries, reach out⬆️⬆️⬆️..
👍
Is this the same with Validators task?
What do you mean?
hi patrick ,, i am new in the space .your Audit a Smart Contract process can be apply for solana ?
The methods can, but not the tools
@@PatrickAlphaC thanks
For more enquiries, reach out⬆️⬆️⬆️..
hey there, is your Full Blockchain course is still valid after ETH merge like everything in that course good to go? or there are some changes to be made? if yes then please tell me which part i have to skip or do extra research on now.. i will really appreciate
100% good to go :)
Follow along in the course, and I'll give you tips at every corner
For more enquiries, reach out⬆️⬆️⬆️..
When I run slither it exits with Command failed with exit code 255 rather than 31, but it still shows the static analysis messages. Does this make any difference? Am I doing anything incorrectly?
Could you make this a question on stack exchange ETH with more information and then drop it here?
hello, where are you 😔 i started watching 32hours lesson 2days ago
Good :)
I'm a new subscriber from india✋ I do not have any knowledge about coding and I want to be a ethical hacker but now I got to know about smart contract hacking. Could u please tell me from where do I start. Smart contract audit or basics following ethical hacking course?
Start with smart contracts fren!
For more enquiries, reach out⬆️⬆️⬆️..For more enquiries, reach out⬆️⬆️⬆️..
Hi Patrick,
I have a doubt, blockchain seems to be having a bad period, many people say that blockchain developers will have to diversify skills to have job opportunities.
What do you think about? Do I need to worry?
(question for everyone)
Always go back to fundamentals.
What is the value proposition of the technology? If the answer is compelling to you, then you yourself will know if there will be future opportunity.
To me, the value prop of blockchain is a completely remastered financial system of accountability and transparency, with smart contracts at the core. To me, that means it's here to stay.
Given two financial institutions, one where everything is transparent and one where they just tell you to trust them, which one are you going to pick?
@@PatrickAlphaC Thanks for making me think, you're right. I'm taking your fcc blockchain js course it's gold thanks 🙏🏼
what is a coder frog supposed to be???
You!
what is the difference between your 32h javascript tutorial and the 16h python one? I am a backend person who dislikes working with js and I would like to know if the difference between the two courses is important enough to make me start the js one instead of the python one.
If you like python, do the python one!
I wrote this article to help explain the difference. medium.com/@patrick.collins_58673/learn-blockchain-development-in-one-of-these-two-videos-c7db210b98fd
For more enquiries, reach out⬆️⬆️⬆️..
@@PatrickAlphaC Thanks
Where are the instructions to get started with docker? I'm on windows 7 and installed version 19 toolbox and it gave me kitematic (alpha) and docker quickstart terminal and im trying to figure out how get the daemon started
This is a good starting point: docs.docker.com/desktop/install/windows-install/
For more enquiries, reach out⬆️⬆️⬆️..
i get error's when I try to run "yarn slither" all my dependencies are installed.
Error Command failed with exit code 255
You’d need to make an issue on the repo with more information. Thanks!
ethernaut doesn't work for me, I keep getting this error: Uncaught TypeError: Cannot assign to read only property 'chainId' of object '#'. It seems to have something to do with NextJS because I get that same error if I run the default Next JS boilerplate project, it seems like it doesn't like my metamask extension in brave
turns out it is a brave issue, you need to set the default wallet to None in brave to get rid of this error
For more enquiries, reach out⬆️⬆️⬆️..
smart contract audits is difficult
Hey, I am getting the error "slither: error: unrecognized arguments: @chainlink=node_modules/@chainlink'" how i can fix that please ?
You have to add imports to the slither command, or download hardhat so slither compiles with hardhat. Can you ask on stack exchange ETH and then post a link to the question here?
when a new exploit or bug is discovered, are they updated?
It can get tricky… but yes - they have to be. If you don’t deploy an upgrade ability though you have to migrate all users to a new contract
For more enquiries, reach out⬆️⬆️⬆️..
I learnt your brilliant Freecodecamp Web3 Solidity course.. it's gave a shape to my knowledge on Blockchain..
We have a seperate discord channel for learning this course, and we solve bugs, we helping eachother.. i think, you once visited.
now we expect some advance projects with advance concepts to learn from you, which helps us to improve skills
Please I want to learn smart contract auditing. And am a complete beginner
Take the Cyfrin Updraft security course!
"Failed building wheel for pysha3" when I try to install "pip solc-select". searched google can't find. Can someone help ?
Your environment is not set probably. Try installing wheels.
@@AmerJarada I downgraded Python from 3.11 to 3.10. Working fine now.
Error: There are no open workspace folders to run slither on. No matter what OS i use no matter what python version i use i keep on getting here, if this passes it brings like 11 errors asking if I'm in the right directory, does anyone know the cause? I'm going crazy atp
Could you ask on stack exchange ETH or the slither GitHub?
why do you alwasys promote frog so much ? any specific reason ?
I just like the frog
For more enquiries, reach out⬆️⬆️⬆️..
last commit be like: nah
thanks for the tutorial !!
but when i run slither ./contracts , it says:
Error: Source "@openzeppelin/contracts/token/ERC20/ERC20.sol" not found: File no
t found.
could you help me on this ? thanks Patrick !
Dear Patrick, I know it is totally out of the blue, but I need your help. I have a project I'm building and I need your help. I can't afford you but all I want is an estimate and tech stack, and general feedback on what it takes to build a project like this. Can I send you a pitchdeck and could you give me 15 minutes of your time to give some feedback? Your biggest fan.
Thanks for the kind words. I'm really swamped myself and generally can't give project feedback for free.
@@PatrickAlphaC No worries. Thanks anyway.
For more enquiries, reach out⬆️⬆️⬆️..
Hi Patrick - is it possible to send you a message on Twitter? FYSA, looking for some coder guidance.
Feel free to ask in public!
@@PatrickAlphaC Question is more career based, so feel better asking privately. If not, no worries, appreciate all your content and value-added materials.
For more enquiries, reach out⬆️⬆️⬆️..
thanks Jeff Bezos i really appreciate learning from you
I decided Amazon was overrated
hi i am a 15 year old guy studying your flash loan video on aave and posting the transaction on testnet network rinkeby tells me in the vsc terminal command not found so i kindly wanted to ask you if you would give me one day we can connect on google meet for a call and solve the problem together. thank you. very kind would you give me an email from you to stay in touch and decide the day of the call? I care a lot