Beginner's Guide to Smart Contract Auditing and Bug Bounties

Web3 security offers lucrative opportunities for newcomers, as demonstrated by rapid progress in audit contests like Code Arena.

### Getting Started in Web3 Security: A Beginner's Guide to Smart Contract Auditing
* 👋 Welcome to the beginner roadmap for smart contract auditing, where I share my **learning resources and experiences** in the web3 bug bounty space.
* 📈 Despite being new to web3 security, I've made significant progress by participating in contests on Code Arena, earning a recent payout of **$3,000 for a high-severity finding**.
* 💰 The bug bounty platform, Code Arena, operates differently from traditional platforms, offering **audit contests with guaranteed payouts and less competition**, making it **ideal for newcomers**.
* 💻 I recommend starting with CTF challenges like **Ethernaut** and **Damn Vulnerable DeFi** to grasp Solidity, alongside tutorials such as Patrick Collins' on freeCodeCamp, to build **foundational knowledge**.
* 📚 Understanding DeFi basics is crucial, and resources like teachyourselfcrypto.com cover **essential topics** that can help you **interpret Solidity code better**.
* 🔍 After gaining some experience, it's vital to **read past audit reports** to understand various vulnerabilities and improve your auditing skills, focusing on both **unique and duplicate findings**.
* 🌟 With a growing number of contests and increasing payouts, my goal is to **continue climbing the leaderboard** while sharing insights and motivating others to **explore opportunities in web3 security**.
* 🚀 "It's possible to make **quick progress in this field**," as demonstrated by others like Dr. V, who **rapidly ascended the leaderboard** after starting with **zero knowledge** in smart contracts.

hello hello welcome to my smart contract auditing beginner roadmap video where I'll be going over some of the learning resources I used and I'll talk about some of my experiences as well in the web3 bug bounty space. Now I am pretty new to web3 security, but I have recently made some good progress from participating in order contests on Code Arena. So, I thought it would be a good time to share some of that experience, and I think it'll be valuable for those who are new to the space to hear this from someone who's also relatively new, just to give that perspective, and more importantly, give hope to those people who want to start participating in this. I let them know that this is possible to make progress. There is a lot of opportunity here, and I think it'll become obvious as I go over some of the various opportunities and the things that are available for you if you want to get into web3 security. Just a bit of background about myself: I am a penetration tester in traditional cybersecurity, so my day-to-day is

performing network and web application penetration tests and writing reports. So, internal external network penetration tests, web application penetration tests, those are sort of the bread and butter of what I do day to day. I do understand a little bit about the crypto space, but nothing substantial before this, and I have not looked into web3 security before starting this. I did get my OSCP last year in case someone asks if the OSCP was helpful. Now, the most helpful thing was probably the try-harder mentality. I hate to say it, but being comfortable with feeling dumb is probably something that is very helpful when learning something new, and that mindset did help for me when going through some of the learning resources and reading reports that I didn't quite understand yet. So, I've been on Code Arena for two months and recently got my biggest payout on the platform for a high-severity finding, which was worth 3k, and I'm currently ranked 36 on the 60-day leaderboard with, in total, two high-severity findings and one medium-severity finding. Now, before I talk about the coder in the

stuff. I'll just quickly mention there is also another bug bounty platform in web 3, which is a munifi, and they are offering some very massive bounties, up to the 10 million for wormhole and maker dow, and some of these bounties have actually been paid out recently. So just a couple of months ago, the wormhole bug bounty paid out for 10 million dollars based on an uninitialized proxy issue. I mean, if you read this report, it's just like, are you serious? 10 million for this? I mean, this is pretty much straight out of a CTF, and this is as bad as leaving default creds on something exposed to the internet. Like, it's just that bad and relatively simple to find something like this. Paying out 10 million, it kind of goes to show that there's just not that many eyeballs in this space, and there's a lot of opportunity to be had, right? And also this one, which happened just two weeks ago, which is Aurora Labs paying out 6 million. These are some record-breaking

bug bounty rewards, and there's no way that you'll be able to find these types of rewards in the traditional bug bounty space. Where even places like Zorodium, if you want to go gray hat and you sell zero days from Microsoft, you only get around 1 million for those zero days, which I'm pretty sure is way harder to find compared to bugs in the Web 3 space. So, Code Arena is a pretty unique way to do bug bounties, where it's not strictly a bug bounty platform. They call it an audit contest. So, how that works is a contest will run between three to seven days, for example, and there will be a fixed price. Usually, the prices are between 30k to around 100k, and by the end of that one-week period, the full prize is guaranteed to be paid out to all the participants who submitted findings during that audit contest. Now, the prizes are shared between the findings that you submit, so if you submitted high-severity findings, you get a bigger share of the prize pool.

compared to mediums and lows, and you also get payouts if your submission is a duplicate. So essentially, when a duplicate happens, you just get a share of the price that is allocated to that particular finding. Overall, there is less competition on Code Arena. I mean, honestly, it feels like almost every round is like a very lucrative private bug bounty program. There are only about 200 participants on Code Arena who have ever received the prize off it, and every competition usually we get about 30 to 60 participants at the moment. Now last year, it was even less people, usually around 10 people per contest. So last year, people were really raking it in on Code Arena. Every competition is mostly based on a new project, so you're pretty much looking at a fresh code base. So you're almost guaranteed to find something on every competition, which is great for people who are new into the space. Where if you're looking at a traditional bug bounty, it's extremely hard to find anything, and when you actually find something, it's probably a duplicate finding. So fresh code base every

competition is really great for people who are new in the space. And I mean, you get paid for duplicates, so you're almost guaranteed to get paid out even if you are new. And the final good thing about Code Arena is all reports are public, so you get that feedback loop where you can see all the findings that other people submitted. Once the report is published, you can review those reports and continuously improve your process so you can start finding those bugs that you missed as well. So it kind of looks like this. Currently, there are two competitions running at this time. Both of those were, I think, three-day competitions and paying around $50,000 recently. The amount of contests has been going up on Code Arena as well. Sometimes the most I've seen is five contests running at the same time with hundreds of thousands of dollars in each of these contests. So for me, the learning resources I used were based on this. A very good blog post by C. Michelle on his blog How to Become a Smart Contract Auditor. He published

this post sometime last year, and based on that, there was a big influx of people who came to code arena. So, this is sort of the rough guideline of how I approached learning this material. He's currently ranked one on the all-time leaderboard with 1.1 million in awards, and he's been doing this for about just over a year full-time. I did see he made another blog post recently where he documented the hourly rate he was getting on code arena when he first started last year when there was less competition, even less than now. He was getting about three thousand dollars an hour, and currently, it's hovering around five hundred dollars an hour. So, based on that blog post, the main areas of focus for auditing smart contracts are learning about the solidity language, learning about DeFi basics, and also traditional finance basics. So, I'll go over some of the learning resources for each. For solidity, I would recommend people who are familiar with CTFs to go through these CTFs first to learn about the language and get your feet wet in this.

space, so there are essentially three main CTFs available. They are Damn Vulnerable DeFi, the Ethernaut challenges, and also Capture the Ether. For me, I looked at Damn Vulnerable DeFi first because that was just the first one I saw someone post on Twitter, which got me interested in the space. But I would actually recommend people do the Ethernaut challenges first because that's probably the easier of the three to get started with, and there are plenty of video walkthroughs of the Ethernaut challenges. One I would recommend is a D Squared, so he has all the Ethernaut challenge levels 1 to 26 on his YouTube channel. They're all about 20 to 30 minutes long, so very detailed walkthroughs. He also talks about his learning process as he does the challenges as well, so that's really great for the beginner. Capture the Ether is around the same level of difficulty as the Ethernaut challenges. I actually haven't done Capture the Ether; I just briefly looked at it and saw that it did have a lot of overlap between Ethernaut challenges, so I

didn't actually go through Capture the Ether challenges, but that's definitely one you can look into as well. And finally, there's the Damn Vulnerable DeFi challenge, which is probably the hardest of the three. I did most of the challenges in Damn Vulnerable DeFi, but I didn't finish them. I don't think it's necessary for you to do all the challenges, but just enough to get your feet wet and start to understand some of the vulnerabilities in Solidity. So, the next thing I would recommend is going through a Solidity tutorial if you're not very familiar with the language. I actually switched back and forth between doing the tutorial and also doing the CTF challenges because I found that was very helpful in first understanding something and then applying it in the CTF. So, a great Solidity tutorial you can go through is the one by Patrick Collins on freeCodeCamp. You can find the full videos on YouTube. He released a Python version earlier this year based on the Brownie framework, and recently he just uploaded a JavaScript framework version of that as

well, using hard hat and that one is over 30 hours long, so plenty of material to go through. Now, you don't need to go through all of the course if you are just interested in the security aspects. I think it's best for you to just get enough to understand the language to finish the CTF challenges, and then after that, you can always refer back to the tutorial if you don't understand something. You don't want to be trapped in tutorial hell here. Just go through, obtain the various pieces of information you need to complete your challenges, and then move on, and then use this as a reference point later on when you find you don't understand a particular concept. So for DeFi basics, a link that I saw shared around a lot is teachyourselfcrypto.com. The blog post from C. Michelle mentions these five points to understand from DeFi, which are token contracts, proxies, master chef, Aave, and Uniswap version two. So teachyourselfcrypto pretty much covers these topics, not to a very high technical detail, but to the level where

If you're not familiar with DeFi, then it'll pretty much get you up to speed on what the use case is, what is it actually trying to do, how the system is designed, and so forth. Because previously, when I first got into Code Arena and I was looking at the Solidity code, sometimes I just didn't even know what the hell I was looking at because I didn't understand the DeFi basics of what the code was actually trying to do. So, at least get yourself familiar with these five main points of DeFi for token contracts. You would also encounter them during CTFs and the free Code Camp Solidity tutorial for proxies. You will also encounter them in CTFs for the MasterChef algorithm. I would recommend you watching the synthetic staking rewards contract explain video on YouTube. This video is made by the Smart Contract Programmer. You can just search that title on YouTube, and you'll find that video series that'll pretty much explain the math behind the MasterChef contract and staking rewards, which is pretty hard to

understand if you are not that into math anymore, which probably most of us aren't. And finally, for the finance basics, the Khan Academy course is a good option to learn about traditional finance concepts. Now for me, I won't be able to give too much of a perspective on this because I actually came from a finance background before I moved to IT. So I don't know how much of that experience has actually helped me in the course of auditing Solidity and smart contracts. But I did briefly look at this course, and it does seem like a good course that's gonna pretty much cover most of the points that you need to understand. Now the course is pretty long, so I wouldn't recommend just doing all this in one go. Again, same as the Solidity tutorial, use this as a reference point to reference back to it rather than just viewing it all in one setting and then pretty much forgetting about it once you're done with the course. So after that, your training is done, and you'll want to start to apply what you

have learned in actual audit contests and reading previous audit reports to understand the findings that other people have found and just slowly build up that mental mind map of the various vulnerabilities that you may encounter. A great resource for actually getting into audit findings is Securium. So, Securium has a website where they have various blog posts where they talk about Ethereum 101, Solidity 101, security pitfalls, and best practices. All the techniques and audit findings, the most useful material I found on Securium, was the audit findings 101 and 102, which got me used to starting to read and understand past audit reports and start to digest some of this knowledge that was from the previous learning resources. Again, shout out to D Squared here, where he documented his journey going through the Securium material. If you find the Securium materials a bit dry to read through, I would definitely recommend watching these squares videos and then going back to reading the Securium findings. And finally, after you've gone through all that, you can start reading the

previous audit reports on code arena. So, a couple of tricks I used to understand these previous audit reports when I first started reading them is to go through the low-risk and non-critical issues findings first on those reports because those are very easy to understand. Even if you are very new and starting to understand those findings first will get you into participating in contests and start that positive feedback loop where you are continuously reading reports and applying what you learned in order contests. The next thing you want to do is try to understand the high and medium severity findings that are duplicate reports. So, essentially what that means is to find those findings where you see a bunch of different wardens have also found them. Then go to that particular GitHub repo and pull out the other wardens' findings and start to review those findings from multiple wardens' point of view because sometimes if you read a finding, if you don't quite understand it, that warden probably didn't describe it in a way that resonated with you. So

viewing the findings from different writers really helped to paint a clearer picture of what that finding actually is, and I found it really helped when the finding that was in the final report didn't make sense, but other wardens provided a better explanation for that particular finding. And finally, you will go to the high and medium findings that are unique findings. So, this is pretty much the ultimate goal when you're participating in code arena, is to start to find unique high and medium findings yourself. And the first step in doing that is understanding all those unique findings in the previous order reports. Now, this is pretty much still an ongoing process for me. In my last video, I mentioned I pretty much understood all the reports now, which is actually not true. That I came to find out recently because I did encounter some findings where I just really couldn't get my head around. So, this is still an ongoing process for me to understand these high and medium unique findings. So, this is sort of my progress on code arena so far for the first two months.

When I first started on Code Arena, I was only submitting QA and gas optimization reports for my first five to ten order contests. During this time, I was going through some of the learning resources I mentioned previously, reading past audit reports, and slowly building up that knowledge of previous findings. After two to three weeks of this, I started to notice some medium severity issues when I was just looking through the code. Now, I would just mention that for submitting QA and gas optimization reports, you may be tempted to run an automated tool such as Slither or just grab out the various points of interest and only submit those for the QA and gas optimizations, but I would recommend against it. So, I started off by doing that, running automated tools, and then just submitting those as my findings for the order competitions, but I found that it was more helpful to actually read the code manually yourself. Not because that is actually going to be better for you to find more QA or gas optimization findings, but reading more code and just literally like parsing it with your eyes is very

good in terms of getting more used to reading solidity and the various patterns it uses. So, once you start to read more previous audit reports, you'll literally start to pick up on these patterns during reading through the code. So, the purpose of reading through the code is one, to find these QA and gas optimization issues, and second of all, once you are more familiar with the previous audit findings, you'll be able to pick up on these patterns and actually slowly see where these potential medium severity findings are, which is what I found happened after about two to three weeks. I started to see some of these potential medium severity issues as I was looking for QA issues, and that was when I started submitting medium severity issues. After one month, I got my first medium severity issue confirmed, and that was for a payout of 290 or so dollars. So, I pretty much just repeated that process, kept reading more audit reports, and participating in order contests until about 1.5 months. I started to see some potential pathways for high severity findings, and I got my high severity finding.

confirmed recently, and that was amazingly a 3k payout, so super happy with the progress that I've made in just two months on this platform. I'm honestly pretty surprised, you know, for someone who is pretty new to this, to be able to get on the leaderboard and get a high-severity finding payout for this much just in two months. So, it kind of goes to show that the level of competition in web 3 bounties is not as high as traditional bug bounty platforms because in terms of skill, I mean, I would probably rate my web app and network penetration skills higher than my solidity auditing skills at the moment because just from the amount of time that I spent in traditional penetration tests, right? But however, I think if I tried my hand at a traditional bug bounty platform, I doubt I would be able to get the kind of payouts that I am getting now in web 3 instead. So, my future goals on Code Arena, I want to read all the past audit reports from Code Arena, so they have about a hundred

reports, and I've gone through about 30 to 40 of those reports already. So, I want to finish reading all of those reports in the next couple of months. I want to understand and categorize all the findings. So, in a previous video, I showed how I categorized the Securium findings. They had 200 of them, categorizing them into your notes, into buckets that are similar, sort of groupings of vulnerabilities. That really helped me understand the Securium findings. And also for these Code Arena findings, I've started to notice patterns. Like, I'll go over some findings in previous videos, and once my high-level severity finding report actually gets published, I'll talk more findings then. But pretty much, I have started to see patterns where similar findings happen very frequently in Code Arena contests. So, those are the findings that I am more focused on because you're more likely to find them, and they're easier to spot based on all the previous examples of vulnerable code that you can see in the previous order reports.

I also want to spend more time per audit contest, right? So, at the moment, I am devoting more time to reading these audit reports and learning rather than spending time per order contest. So, I'm potentially still leaving a lot of money on the table at this point just in terms of I'm not spending that much time on the contest itself. I'm trying to sort of blitz through the contest just to snipe all the low-hanging fruit issues that I can find very quickly, and I want to spend more time that I can devote into this on reading previous order reports, which I feel that is going to be providing me more value down the road and finding more unique high-severity and medium findings. And also, keep climbing the leaderboard. Currently, I am about 5k in rewards and 30-something on the 60-day leaderboard. I want to keep climbing the leaderboard and see how far I can push this. It's a pretty fun side project that I'm doing, and yeah, it's interesting and pretty motivating to be

getting these payouts, and finally, I want to share all my findings and experience on this YouTube channel of my progress on Code Arena. I think it's going to really help a lot of people get into the space and just leave a trail of breadcrumbs for people who want to up their skills in the Web3 security space and, yeah, get a share of the opportunity that is out there now. To close this off, a bit of motivation. So, this is a shout-out to Dr. V, who is relatively new in this field, and he has been making some massive progress, and really props to him for getting where he is today. So, you can see he posted this on the Code Arena Discord in February 2022. He's been in Code Arena for one month, and he's already on the leaderboard with 4.5k. Just four months previous to that, he was pretty much zero knowledge in smart contracts and Solidity. So, this is to show that it is possible to make really quick progress in this field. It's

not just me. I'm pretty surprised at how fast I've been able to climb the leaderboard on Code Arena, and you know other people are doing it too. So, this is just a bit of motivation for people who want to get in and are unsure of whether they can. So, you can see the potential opportunity here to climb the leaderboard pretty quickly and sort of make a name for yourself in Web3 security. And where is Drivi now? He is 10th on the leaderboard with 69k paid out this year. So, big props to him, and hope this is a motivation for people who are new to the space. It definitely motivated me as well, just to see someone has done it in the past, and they've done it with relative quickness. So, there it is, examples of people being pretty successful in this field in a relatively short period of time. So, to close this off, I am happy to answer any questions in the comments down below. I do look forward to providing you guys with more updates on my progress on Code.

arena on this channel, so subscribe if you want to see more videos on this. So yeah, that's it. Hope to see you guys in the arena. Reach out if you have any questions when you're going through any of the learning resources I mentioned. Do share your own experience as well, and I'll see you in the next video.

Beginner Roadmap to Smart Contract Auditing

Andy Li

Starting a Career in Web3 Security: A Beginner's Roadmap

The speaker shares their journey into web3 security, highlighting progress made through Code Arena contests.

They emphasize the abundance of opportunities in the space, with record-breaking bug bounties being offered.

The unique audit contest model of Code Arena is also explained, where participants can share the prize pool based on their submitted findings.

The Benefits of Code Arena for Bug Bounty Hunting

Code Arena offers less competition and lucrative payouts, with only 200 participants ever receiving a prize.

The platform's unique model of fresh code bases and duplicate finding guarantees participants a payout, making it ideal for newcomers.

With increasing contests and significant prize money, Code Arena provides a valuable learning resource through public reports and detailed walkthroughs of challenges.

Getting Started with Solidity and DeFi Challenges

The Damn Vulnerable DeFi challenge is the hardest among the recommended challenges for understanding Solidity vulnerabilities.

A Solidity tutorial by Patrick Collins on freeCodeCamp, available on YouTube, offers over 30 hours of material, including Python and JavaScript framework versions.

com provides a blog post covering five key DeFi concepts, while the Smart Contract Programmer's YouTube video explains the math behind the MasterChef contract and staking rewards.

Understanding audit findings through contests and previous reports is crucial for identifying vulnerabilities.

Securium's blog posts and audit findings 101 and 102 are valuable resources for learning.

Reviewing low-risk and duplicate findings from multiple wardens' perspectives helps clarify complex issues, while striving to identify unique high and medium severity findings is the ultimate goal.

The author has been reading previous audit reports to identify patterns and common issues in Solidity code, leading to the discovery of medium and high-severity findings.

After two months, they achieved a $3k payout for a high-severity issue, surprising themselves with their progress.

The author plans to read all of Code Arena's past audit reports, categorize findings, and spend more time on audit contests to maximize their earnings and climb the leaderboard.

Progress and Opportunities in Web3 Security

The speaker plans to share their Code Arena journey on YouTube to help others enter the Web3 security space.

V's rapid progress from zero knowledge to 10th on the leaderboard in just a few months, demonstrating the potential for quick success in the field.

The speaker encourages others to join, offering to answer questions and provide learning resources.