스마트 컨트랙트 감사 및 버그 바운티 초보자 가이드

### Web3 보안 시작하기: 스마트 계약 감사를 위한 초보자 가이드
* 👋 웹3.0 버그 바운티 분야에서 저의 학습 리소스와 경험을 공유하는 **스마트 컨트랙트 감사 초보자 로드맵**에 오신 것을 환영합니다.
* 📈 웹3.0 보안을 처음 접했음에도 불구하고 저는 **Code Arena의 콘테스트에 참가하여 상당한 성과**를 거두었고, 최근에는 **심각도가 높은 발견으로 3,000달러의 상금**을 받기도 했습니다.
* 💰 버그 바운티 플랫폼인 Code Arena는 기존 플랫폼과 다르게 운영되며, **지급금이 보장되고 경쟁이 적은 감사 대회**를 제공하기 때문에 초보자에게 이상적입니다.
* 💻 솔리디티에 대한 이해를 돕기 위해 **Ethernaut, Damn Vulnerable DeFi와 같은 CTF 챌린지**부터 시작하고, 기초 지식을 쌓기 위해 **freeCodeCamp의 Patrick Collins와 같은 튜토리얼**을 시청하는 것을 추천합니다.
* 📚 DeFi의 기본을 이해하는 것은 매우 중요하며, **teachyourselfcrypto.com과 같은 리소스**에서는 솔리디티 코드를 더 잘 해석하는 데 도움이 되는 필수 주제를 다루고 있습니다.
* 🔍 어느 정도 경험을 쌓은 후에는 **과거 감사 보고서를 읽고 다양한 취약점을 파악**하고 고유한 발견 사항과 중복된 발견 사항에 초점을 맞춰 감사 기술을 향상시키는 것이 중요합니다.
* 🌟 점점 더 많은 콘테스트가 개최되고 상금이 증가함에 따라 제 목표는 **계속해서 순위표에 오르면서 인사이트를 공유**하고 다른 사람들이 웹3.0 보안 분야에서 기회를 모색하도록 동기를 부여하는 것입니다.
* 🚀 스마트 컨트랙트에 대한 지식이 전혀 없는 상태에서 시작하여 빠르게 순위권에 오른 닥터 V와 같은 사람들이 보여준 것처럼 **"이 분야에서 빠르게 발전할 수 있습니다."**라고 말합니다.

코드 아레나와 같은 감사 경연 대회에서 빠르게 발전하는 모습에서 알 수 있듯이, 웹3.0 보안은 신인들에게 유리한 기회를 제공합니다.

hello hello welcome to my smart contract auditing beginner roadmap video where I'll be going over some of the learning resources I used and I'll talk about some of my experiences as well in the web3 bug bounty space. Now I am pretty new to web3 security, but I have recently made some good progress from participating in order contests on Code Arena. So, I thought it would be a good time to share some of that experience, and I think it'll be valuable for those who are new to the space to hear this from someone who's also relatively new, just to give that perspective, and more importantly, give hope to those people who want to start participating in this. I let them know that this is possible to make progress. There is a lot of opportunity here, and I think it'll become obvious as I go over some of the various opportunities and the things that are available for you if you want to get into web3 security. Just a bit of background about myself: I am a penetration tester in traditional cybersecurity, so my day-to-day is

performing network and web application penetration tests and writing reports. So, internal external network penetration tests, web application penetration tests, those are sort of the bread and butter of what I do day to day. I do understand a little bit about the crypto space, but nothing substantial before this, and I have not looked into web3 security before starting this. I did get my OSCP last year in case someone asks if the OSCP was helpful. Now, the most helpful thing was probably the try-harder mentality. I hate to say it, but being comfortable with feeling dumb is probably something that is very helpful when learning something new, and that mindset did help for me when going through some of the learning resources and reading reports that I didn't quite understand yet. So, I've been on Code Arena for two months and recently got my biggest payout on the platform for a high-severity finding, which was worth 3k, and I'm currently ranked 36 on the 60-day leaderboard with, in total, two high-severity findings and one medium-severity finding. Now, before I talk about the coder in the

stuff. I'll just quickly mention there is also another bug bounty platform in web 3, which is a munifi, and they are offering some very massive bounties, up to the 10 million for wormhole and maker dow, and some of these bounties have actually been paid out recently. So just a couple of months ago, the wormhole bug bounty paid out for 10 million dollars based on an uninitialized proxy issue. I mean, if you read this report, it's just like, are you serious? 10 million for this? I mean, this is pretty much straight out of a CTF, and this is as bad as leaving default creds on something exposed to the internet. Like, it's just that bad and relatively simple to find something like this. Paying out 10 million, it kind of goes to show that there's just not that many eyeballs in this space, and there's a lot of opportunity to be had, right? And also this one, which happened just two weeks ago, which is Aurora Labs paying out 6 million. These are some record-breaking

bug bounty rewards, and there's no way that you'll be able to find these types of rewards in the traditional bug bounty space. Where even places like Zorodium, if you want to go gray hat and you sell zero days from Microsoft, you only get around 1 million for those zero days, which I'm pretty sure is way harder to find compared to bugs in the Web 3 space. So, Code Arena is a pretty unique way to do bug bounties, where it's not strictly a bug bounty platform. They call it an audit contest. So, how that works is a contest will run between three to seven days, for example, and there will be a fixed price. Usually, the prices are between 30k to around 100k, and by the end of that one-week period, the full prize is guaranteed to be paid out to all the participants who submitted findings during that audit contest. Now, the prizes are shared between the findings that you submit, so if you submitted high-severity findings, you get a bigger share of the prize pool.

compared to mediums and lows, and you also get payouts if your submission is a duplicate. So essentially, when a duplicate happens, you just get a share of the price that is allocated to that particular finding. Overall, there is less competition on Code Arena. I mean, honestly, it feels like almost every round is like a very lucrative private bug bounty program. There are only about 200 participants on Code Arena who have ever received the prize off it, and every competition usually we get about 30 to 60 participants at the moment. Now last year, it was even less people, usually around 10 people per contest. So last year, people were really raking it in on Code Arena. Every competition is mostly based on a new project, so you're pretty much looking at a fresh code base. So you're almost guaranteed to find something on every competition, which is great for people who are new into the space. Where if you're looking at a traditional bug bounty, it's extremely hard to find anything, and when you actually find something, it's probably a duplicate finding. So fresh code base every

competition is really great for people who are new in the space. And I mean, you get paid for duplicates, so you're almost guaranteed to get paid out even if you are new. And the final good thing about Code Arena is all reports are public, so you get that feedback loop where you can see all the findings that other people submitted. Once the report is published, you can review those reports and continuously improve your process so you can start finding those bugs that you missed as well. So it kind of looks like this. Currently, there are two competitions running at this time. Both of those were, I think, three-day competitions and paying around $50,000 recently. The amount of contests has been going up on Code Arena as well. Sometimes the most I've seen is five contests running at the same time with hundreds of thousands of dollars in each of these contests. So for me, the learning resources I used were based on this. A very good blog post by C. Michelle on his blog How to Become a Smart Contract Auditor. He published

this post sometime last year, and based on that, there was a big influx of people who came to code arena. So, this is sort of the rough guideline of how I approached learning this material. He's currently ranked one on the all-time leaderboard with 1.1 million in awards, and he's been doing this for about just over a year full-time. I did see he made another blog post recently where he documented the hourly rate he was getting on code arena when he first started last year when there was less competition, even less than now. He was getting about three thousand dollars an hour, and currently, it's hovering around five hundred dollars an hour. So, based on that blog post, the main areas of focus for auditing smart contracts are learning about the solidity language, learning about DeFi basics, and also traditional finance basics. So, I'll go over some of the learning resources for each. For solidity, I would recommend people who are familiar with CTFs to go through these CTFs first to learn about the language and get your feet wet in this.

space, so there are essentially three main CTFs available. They are Damn Vulnerable DeFi, the Ethernaut challenges, and also Capture the Ether. For me, I looked at Damn Vulnerable DeFi first because that was just the first one I saw someone post on Twitter, which got me interested in the space. But I would actually recommend people do the Ethernaut challenges first because that's probably the easier of the three to get started with, and there are plenty of video walkthroughs of the Ethernaut challenges. One I would recommend is a D Squared, so he has all the Ethernaut challenge levels 1 to 26 on his YouTube channel. They're all about 20 to 30 minutes long, so very detailed walkthroughs. He also talks about his learning process as he does the challenges as well, so that's really great for the beginner. Capture the Ether is around the same level of difficulty as the Ethernaut challenges. I actually haven't done Capture the Ether; I just briefly looked at it and saw that it did have a lot of overlap between Ethernaut challenges, so I

didn't actually go through Capture the Ether challenges, but that's definitely one you can look into as well. And finally, there's the Damn Vulnerable DeFi challenge, which is probably the hardest of the three. I did most of the challenges in Damn Vulnerable DeFi, but I didn't finish them. I don't think it's necessary for you to do all the challenges, but just enough to get your feet wet and start to understand some of the vulnerabilities in Solidity. So, the next thing I would recommend is going through a Solidity tutorial if you're not very familiar with the language. I actually switched back and forth between doing the tutorial and also doing the CTF challenges because I found that was very helpful in first understanding something and then applying it in the CTF. So, a great Solidity tutorial you can go through is the one by Patrick Collins on freeCodeCamp. You can find the full videos on YouTube. He released a Python version earlier this year based on the Brownie framework, and recently he just uploaded a JavaScript framework version of that as

well, using hard hat and that one is over 30 hours long, so plenty of material to go through. Now, you don't need to go through all of the course if you are just interested in the security aspects. I think it's best for you to just get enough to understand the language to finish the CTF challenges, and then after that, you can always refer back to the tutorial if you don't understand something. You don't want to be trapped in tutorial hell here. Just go through, obtain the various pieces of information you need to complete your challenges, and then move on, and then use this as a reference point later on when you find you don't understand a particular concept. So for DeFi basics, a link that I saw shared around a lot is teachyourselfcrypto.com. The blog post from C. Michelle mentions these five points to understand from DeFi, which are token contracts, proxies, master chef, Aave, and Uniswap version two. So teachyourselfcrypto pretty much covers these topics, not to a very high technical detail, but to the level where

If you're not familiar with DeFi, then it'll pretty much get you up to speed on what the use case is, what is it actually trying to do, how the system is designed, and so forth. Because previously, when I first got into Code Arena and I was looking at the Solidity code, sometimes I just didn't even know what the hell I was looking at because I didn't understand the DeFi basics of what the code was actually trying to do. So, at least get yourself familiar with these five main points of DeFi for token contracts. You would also encounter them during CTFs and the free Code Camp Solidity tutorial for proxies. You will also encounter them in CTFs for the MasterChef algorithm. I would recommend you watching the synthetic staking rewards contract explain video on YouTube. This video is made by the Smart Contract Programmer. You can just search that title on YouTube, and you'll find that video series that'll pretty much explain the math behind the MasterChef contract and staking rewards, which is pretty hard to

understand if you are not that into math anymore, which probably most of us aren't. And finally, for the finance basics, the Khan Academy course is a good option to learn about traditional finance concepts. Now for me, I won't be able to give too much of a perspective on this because I actually came from a finance background before I moved to IT. So I don't know how much of that experience has actually helped me in the course of auditing Solidity and smart contracts. But I did briefly look at this course, and it does seem like a good course that's gonna pretty much cover most of the points that you need to understand. Now the course is pretty long, so I wouldn't recommend just doing all this in one go. Again, same as the Solidity tutorial, use this as a reference point to reference back to it rather than just viewing it all in one setting and then pretty much forgetting about it once you're done with the course. So after that, your training is done, and you'll want to start to apply what you

have learned in actual audit contests and reading previous audit reports to understand the findings that other people have found and just slowly build up that mental mind map of the various vulnerabilities that you may encounter. A great resource for actually getting into audit findings is Securium. So, Securium has a website where they have various blog posts where they talk about Ethereum 101, Solidity 101, security pitfalls, and best practices. All the techniques and audit findings, the most useful material I found on Securium, was the audit findings 101 and 102, which got me used to starting to read and understand past audit reports and start to digest some of this knowledge that was from the previous learning resources. Again, shout out to D Squared here, where he documented his journey going through the Securium material. If you find the Securium materials a bit dry to read through, I would definitely recommend watching these squares videos and then going back to reading the Securium findings. And finally, after you've gone through all that, you can start reading the

previous audit reports on code arena. So, a couple of tricks I used to understand these previous audit reports when I first started reading them is to go through the low-risk and non-critical issues findings first on those reports because those are very easy to understand. Even if you are very new and starting to understand those findings first will get you into participating in contests and start that positive feedback loop where you are continuously reading reports and applying what you learned in order contests. The next thing you want to do is try to understand the high and medium severity findings that are duplicate reports. So, essentially what that means is to find those findings where you see a bunch of different wardens have also found them. Then go to that particular GitHub repo and pull out the other wardens' findings and start to review those findings from multiple wardens' point of view because sometimes if you read a finding, if you don't quite understand it, that warden probably didn't describe it in a way that resonated with you. So

viewing the findings from different writers really helped to paint a clearer picture of what that finding actually is, and I found it really helped when the finding that was in the final report didn't make sense, but other wardens provided a better explanation for that particular finding. And finally, you will go to the high and medium findings that are unique findings. So, this is pretty much the ultimate goal when you're participating in code arena, is to start to find unique high and medium findings yourself. And the first step in doing that is understanding all those unique findings in the previous order reports. Now, this is pretty much still an ongoing process for me. In my last video, I mentioned I pretty much understood all the reports now, which is actually not true. That I came to find out recently because I did encounter some findings where I just really couldn't get my head around. So, this is still an ongoing process for me to understand these high and medium unique findings. So, this is sort of my progress on code arena so far for the first two months.

When I first started on Code Arena, I was only submitting QA and gas optimization reports for my first five to ten order contests. During this time, I was going through some of the learning resources I mentioned previously, reading past audit reports, and slowly building up that knowledge of previous findings. After two to three weeks of this, I started to notice some medium severity issues when I was just looking through the code. Now, I would just mention that for submitting QA and gas optimization reports, you may be tempted to run an automated tool such as Slither or just grab out the various points of interest and only submit those for the QA and gas optimizations, but I would recommend against it. So, I started off by doing that, running automated tools, and then just submitting those as my findings for the order competitions, but I found that it was more helpful to actually read the code manually yourself. Not because that is actually going to be better for you to find more QA or gas optimization findings, but reading more code and just literally like parsing it with your eyes is very

good in terms of getting more used to reading solidity and the various patterns it uses. So, once you start to read more previous audit reports, you'll literally start to pick up on these patterns during reading through the code. So, the purpose of reading through the code is one, to find these QA and gas optimization issues, and second of all, once you are more familiar with the previous audit findings, you'll be able to pick up on these patterns and actually slowly see where these potential medium severity findings are, which is what I found happened after about two to three weeks. I started to see some of these potential medium severity issues as I was looking for QA issues, and that was when I started submitting medium severity issues. After one month, I got my first medium severity issue confirmed, and that was for a payout of 290 or so dollars. So, I pretty much just repeated that process, kept reading more audit reports, and participating in order contests until about 1.5 months. I started to see some potential pathways for high severity findings, and I got my high severity finding.

confirmed recently, and that was amazingly a 3k payout, so super happy with the progress that I've made in just two months on this platform. I'm honestly pretty surprised, you know, for someone who is pretty new to this, to be able to get on the leaderboard and get a high-severity finding payout for this much just in two months. So, it kind of goes to show that the level of competition in web 3 bounties is not as high as traditional bug bounty platforms because in terms of skill, I mean, I would probably rate my web app and network penetration skills higher than my solidity auditing skills at the moment because just from the amount of time that I spent in traditional penetration tests, right? But however, I think if I tried my hand at a traditional bug bounty platform, I doubt I would be able to get the kind of payouts that I am getting now in web 3 instead. So, my future goals on Code Arena, I want to read all the past audit reports from Code Arena, so they have about a hundred

reports, and I've gone through about 30 to 40 of those reports already. So, I want to finish reading all of those reports in the next couple of months. I want to understand and categorize all the findings. So, in a previous video, I showed how I categorized the Securium findings. They had 200 of them, categorizing them into your notes, into buckets that are similar, sort of groupings of vulnerabilities. That really helped me understand the Securium findings. And also for these Code Arena findings, I've started to notice patterns. Like, I'll go over some findings in previous videos, and once my high-level severity finding report actually gets published, I'll talk more findings then. But pretty much, I have started to see patterns where similar findings happen very frequently in Code Arena contests. So, those are the findings that I am more focused on because you're more likely to find them, and they're easier to spot based on all the previous examples of vulnerable code that you can see in the previous order reports.

I also want to spend more time per audit contest, right? So, at the moment, I am devoting more time to reading these audit reports and learning rather than spending time per order contest. So, I'm potentially still leaving a lot of money on the table at this point just in terms of I'm not spending that much time on the contest itself. I'm trying to sort of blitz through the contest just to snipe all the low-hanging fruit issues that I can find very quickly, and I want to spend more time that I can devote into this on reading previous order reports, which I feel that is going to be providing me more value down the road and finding more unique high-severity and medium findings. And also, keep climbing the leaderboard. Currently, I am about 5k in rewards and 30-something on the 60-day leaderboard. I want to keep climbing the leaderboard and see how far I can push this. It's a pretty fun side project that I'm doing, and yeah, it's interesting and pretty motivating to be

getting these payouts, and finally, I want to share all my findings and experience on this YouTube channel of my progress on Code Arena. I think it's going to really help a lot of people get into the space and just leave a trail of breadcrumbs for people who want to up their skills in the Web3 security space and, yeah, get a share of the opportunity that is out there now. To close this off, a bit of motivation. So, this is a shout-out to Dr. V, who is relatively new in this field, and he has been making some massive progress, and really props to him for getting where he is today. So, you can see he posted this on the Code Arena Discord in February 2022. He's been in Code Arena for one month, and he's already on the leaderboard with 4.5k. Just four months previous to that, he was pretty much zero knowledge in smart contracts and Solidity. So, this is to show that it is possible to make really quick progress in this field. It's

not just me. I'm pretty surprised at how fast I've been able to climb the leaderboard on Code Arena, and you know other people are doing it too. So, this is just a bit of motivation for people who want to get in and are unsure of whether they can. So, you can see the potential opportunity here to climb the leaderboard pretty quickly and sort of make a name for yourself in Web3 security. And where is Drivi now? He is 10th on the leaderboard with 69k paid out this year. So, big props to him, and hope this is a motivation for people who are new to the space. It definitely motivated me as well, just to see someone has done it in the past, and they've done it with relative quickness. So, there it is, examples of people being pretty successful in this field in a relatively short period of time. So, to close this off, I am happy to answer any questions in the comments down below. I do look forward to providing you guys with more updates on my progress on Code.

arena on this channel, so subscribe if you want to see more videos on this. So yeah, that's it. Hope to see you guys in the arena. Reach out if you have any questions when you're going through any of the learning resources I mentioned. Do share your own experience as well, and I'll see you in the next video.

Beginner Roadmap to Smart Contract Auditing

Andy Li

Web3 보안에서 커리어 시작하기: 초보자를 위한 로드맵

0 보안을 향한 여정을 공유하며 Code Arena 대회를 통해 이룬 진전을 강조합니다.

또한 기록적인 버그 현상금이 제공되는 등 이 분야의 풍부한 기회에 대해 강조합니다.

또한 참가자들이 제출한 결과물을 바탕으로 상금을 공유할 수 있는 Code Arena의 독특한 감사 콘테스트 모델에 대해서도 설명합니다.

버그 바운티 헌팅을 위한 코드 아레나의 이점

코드 아레나는 경쟁이 적고 상금 규모가 커서 200명의 참가자만 상금을 받을 수 있습니다.

새로운 코드 베이스와 중복 찾기라는 플랫폼의 독특한 모델은 참가자에게 상금을 보장하기 때문에 초보자에게 이상적입니다.

점점 더 많은 대회와 상당한 상금을 제공하는 Code Arena는 공개 보고서와 상세한 챌린지 안내를 통해 귀중한 학습 리소스를 제공합니다.

솔리디티와 디파이 챌린지 시작하기

댐 취약한 디파이 챌린지는 솔리디티 취약점을 이해하기 위한 권장 챌린지 중 가장 어려운 챌린지입니다.

무료 코드 캠프에서 제공하는 패트릭 콜린스의 솔리디티 튜토리얼은 30시간이 넘는 분량으로, 파이썬과 자바스크립트 프레임워크 버전이 포함되어 있습니다.

com에서는 5가지 주요 탈중앙 금융 개념을 다루는 블로그 게시물을 제공하며, 스마트 컨트랙트 프로그래머의 YouTube 동영상에서는 마스터셰프 컨트랙트와 스테이킹 보상의 수학에 대해 설명합니다.

콘테스트와 이전 보고서를 통해 감사 결과를 이해하는 것은 취약점을 파악하는 데 매우 중요합니다.

Securium의 블로그 게시물과 감사 결과 101 및 102는 학습에 유용한 리소스입니다.

여러 감시자의 관점에서 위험도가 낮고 중복된 결과를 검토하면 복잡한 문제를 명확히 파악하는 데 도움이 되며, 고유한 고강도 및 중강도 결과를 식별하기 위해 노력하는 것이 궁극적인 목표입니다.

저자는 이전 감사 보고서를 읽고 솔리디티 코드의 패턴과 일반적인 문제를 파악하여 중간 및 높은 심각도의 발견을 이끌어냈습니다.

두 달 후, 심각도가 높은 이슈에 대해 3,000달러의 보상금을 받으면서 스스로도 놀랄 만한 성과를 거두었습니다.

저자는 Code Arena의 과거 감사 보고서를 모두 읽고, 발견 사항을 분류하고, 감사 콘테스트에 더 많은 시간을 투자하여 수입을 극대화하고 순위표에 오를 계획입니다.

0 보안 분야에 진출할 수 있도록 Code Arena 여정을 YouTube에서 공유할 계획입니다.

이 강연에서는 무지식 상태에서 불과 몇 달 만에 순위표 10위까지 오른 V 박사의 빠른 성장을 강조하며 이 분야에서 빠르게 성공할 수 있는 가능성을 보여줍니다.

이 강연자는 다른 사람들의 참여를 독려하며 질문에 답하고 학습 리소스를 제공합니다.