How to Audit a Smart Contract | Can you find the Solidity Security Vulnerabilities?

Подписаться 88 тыс.

Просмотров 65 тыс.

50% 1

We learn the auditing 101 of smart contracts, and understand basic tooling for doing an audit, like slither, echidna, mythx, etc. At the end of this, we will know the audit process, the basics of how to conduct one, and how to interact with auditors. This works for solidity, vyper, or even rust smart contracts! (Although, the tooling isn't the same for every language!)
👩🏻‍💻 Code: github.com/PatrickAlphaC/hard...
👆👆👆👆👆👆
The code has even MORE links from the video!
🔐 Secureum: secureum.substack.com/p/audit...
✍️ Blog: (Coming Soon)
🔥 Latest freeCodeCamp Ultimate video: • Learn Blockchain, Soli...
Check out these articles to learn about some of these tools and start your journey as a smart contract engineer!
👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇
📕How to Become a Blockchain Engineer: betterprogramming.pub/how-to-...
✍️Top 10 Resources, Tutorials, and Follows: dev.to/patrickalphac/top-10-s...
👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆
✅✅ Donate ✅✅
I use donated funds to spend money on making fun & informational videos.
ETH/Polygon/Avalanche/EVM Chains Wallet address:
0x9680201d9c93d65a3603d2088d125e955c73BD65
Or, optionally:
- patrickalphac.eth (ETH Only)
😸😸Join the community!😸😸
Chainlink developers discord: / discord
Twitter: / patrickalphac
Medium: / patrick.collins_58673
TikTok: / patrickalphac
Twitch Stream Uploads & Shorts: / @patrickalphac-alt
Twitch: / patrickalphac
All thoughts and opinions are my own.

Развлечения

Опубликовано:

18 июн 2022

Ссылка:

Скачать:

Готовим ссылку...

Добавить в:

Мой плейлист

Посмотреть позже

Комментарии : 166

@nipperipper4625 2 года назад

Hello Patrick, Hope you are well, and hope you will extend this series in depth. I went thru all of your tutorials, built some top notch projects, now i figure its time to deal with security. Thanks

@javierdash1 2 года назад

When do you sleep? You really are brilliant. I'm on hour 19 of your fantastic 32 hour tutorial. And I just saw on linkedin the post of this new video. I congratulate you. You are a genius and I thank you for all you are doing for the ecosystem. We need more people like you that despite what is currently happening with the drop in prices, you put your chest out because you know that it is not just about a token, but about all the value that decentralization represents. In the end... time will prove right all of us who believe in a fairer and more egalitarian system.

@PatrickAlphaC 2 года назад

Thanks for the kind words fren! I’m definitely no genius. I started making content because it was the only way for topics to solidify themselves in my head. The past few weeks since the course came out have been the best sleep in a while ahah. Sleep and recharging is important! But yes, we need more people to focus on what matters so we can scale.

@raj-nq8ke 2 года назад

Which 32 hour tutorial you are talking about. I need to know

@javierdash1 2 года назад

@@raj-nq8ke hi! the one that Patrick made to teach us everything about smart contracts: ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-gyMwXuJrbJQ.html

@luce36 2 года назад

@@raj-nq8ke freecodecamp solidity

@unpopulartrip5827 2 года назад

@@PatrickAlphaC do you have an apustaja neon sign that you're keeping hidden somewhere

@0xharambe 2 года назад

Awesome video Patrick! Love your content 🤩 More people need to pay attention to smart contract auditing - very important and profitable area for developers!

@nothinglastsforever0000 2 года назад

You’ve earned a new sub. Great job and thank you for sharing your knowledge

@sebby868 2 года назад

Great video and explanation. Thanks for the resources as well. Very helpful.

@coder8515 Год назад

Really helpful. High quality content. Thanks for sharing

@EduardoNicoleit 2 года назад

You're an Absolute Legend, Patrick. Cheers from Brazil!

@PatrickAlphaC 2 года назад

💪🔥❤️

@cryptopat2214 Год назад

You sir have a talent for creating and explaining very complex content in a very easy to understand way, I have been jumping around learning resources for a long time and not once did I come across a single video that outlines the most important bits one needs to sort out in order to pursue these challenges. I wanna add one thing to whoever might be reading this and was looking for any additional advice that could help them, I really can’t stress enough how important it is to also master note taking and especially revising it with each contract. There’s so much more bugs out there..

@PatrickAlphaC Год назад

YES! Master note taking :)

@harrytr.277 2 года назад

This is so valuable!

@SK-vg3mw Год назад

Faboulous! Thank you so much!👍👍

@dreadrobertscanady1285 2 года назад

So you actually follow the results of twitter polls on your timeline! Thanks for doing so

@PatrickAlphaC 2 года назад

I’m all about delivering for the peeps fren :)

@comosaycomosah Год назад

Man you are the most helpful l!

@quanit6428 Год назад

You're the best, learned a ton of things from this video

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@saneryee1431 2 года назад

Very magical and incredible. I was researching and learning about smart contract auditing recently. At that time, I didn't search for related content on my RU-vid. So, of course, I searched for a lot of knowledge about contract auditing on Google Search. The author's video is recommended on my RU-vid homepage today, and this video is 100% what I want. That is amazing. Finally, thanks to Patrick, this video addresses all my questions about smart contract auditing, it's worth watching many times, and you don't need to pause and take notes.

@PatrickAlphaC 2 года назад

Thanks fren 💪

@saneryee1431 2 года назад

@@PatrickAlphaC Are there any tools here for Gas analysis? Thank you.

@PatrickAlphaC 2 года назад

@@saneryee1431 do -gas with the hardhat gas plugin

@saneryee1431 2 года назад

@@PatrickAlphaC Thanks.

@arabcrypto 2 года назад

Happy to meet u in Denver eth

@ivanlagade Год назад

superb content! keep it up sir..

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@zerocool2765 Год назад

Sensei, Should I start my journey in web 3 bug bounty or traditional bug bounty? Thanks for the awesome content. Liked and Subbed!

@tw7613781 2 года назад

thank you~~

@hudieldf 2 года назад

This video is definitely the best one in Crypto tech area!

@PatrickAlphaC 2 года назад

Thanks fren

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@hypemoon Год назад

because of you, i'm running a solidity audit company

@PatrickAlphaC Год назад

LETS GOOOOO!!! Good luck fren!!!

@sbanerjee2005 2 года назад

You are amazing. This is very helpful. Patrick, I chose to use MythX as opposed to Slither or Echidna. Anything that I would be missing out on?

@PatrickAlphaC 2 года назад

MythX is great as a paid service, but it’s good to do your own analysis first!

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@woojin7009 2 года назад

I am curious about ecdsa verifying when connecting and signing a wallet at the frontend. Can you teach me the process of getting the wallet request from the backend and going to the contract using Go Lang's package?

@magnetto90 2 года назад

Only 10k views??? This is gold

@holo406 2 года назад

Patrick, you are simply the best man! currently studying your Solidity course! is there a chance you make a RUST Smart Contract programming course as well? or even a paid version for it? Thank you

@PatrickAlphaC 2 года назад

I’ve only done the basics of rust contracts… maybe one day

@andrewpan3047 2 года назад

@@PatrickAlphaC can you share a link to the rust contracts basic? and thks again for this amazing content

@PatrickAlphaC 2 года назад

@@andrewpan3047 ru-vid.com/video/%D0%B2%D0%B8%D0%B4%D0%B5%D0%BE-7l1P3xzr7Jo.html

@mehrdad1068 2 года назад

Please make tutorial for cross chain bridge 🍄🚀

@ordigen_brc20 7 месяцев назад

Yeah am that Indian who's learning from you this time

@mehrdad1068 2 года назад

How we can deploy a contract in multiple networks (solana, bnb, eth) _ in this case user be able to transfer asset by the all networks

@markeljan 2 года назад

Epiccc

@mahtabnorouzi9683 Год назад

Great and very helpful content. Just a gentle clarification, fuzzing is a slightly different analysis method than symbolic execution, which makes Echidna not a symbolic execution tool. Nonetheless, your video provides valuable insights into auditing contracts. Thanks!

@PatrickAlphaC Год назад

Yes! This video is a bit older I have it corrected in newer videos

@asfandamin8170 Год назад

Hello patrick, any hint of how to solve this and install slither correctly without using virtualenv The term 'slither' is not recognized as the name of a cmdlet getting this when trying to use slither. thankyou!

@David-rz4vc 2 года назад

Dam this is gold man (or should I say bitcoin, haha). Thanks!

@alirazzaq1541 2 года назад

lol. Good one.

@Ryan-xq3kl 2 года назад

Amazing video youre killing it, now pls devs fix bitcoin price >:(

@dani3l898 Год назад

In a situation whereby, you clone into a project and it doesn't have both package.json file and the node_modules, how do you go about this? The project itself has dependencies

@yourdailyblockchain Год назад

Thanks - super new to smart contract security. I have installed slither-analyzer but when I try and run it it says slither command not found. Not sure if I need to add Slither to my PATH on Mac. Python version: 3.8.2 PIP3 version 23.1.2 It looks like I have Slither version 0.9.3 but nothing runs and I can't run slither --version. "-bash: slither: command not found"

@Brian-vs9sd 2 года назад

If someone is trying to find flaws to existing contracts, is there a decompiler that actually is able to decompile to readable contracts. I am on some DeFi projects and would like to be able to see if they have done their job properly.

@PatrickAlphaC 2 года назад

There are some, they are in beta tho ethervm.io/decompile

@arfazshaikh907 2 года назад

100k.... we need the merch with the Frog Coder on It 👩🏻‍💻 👩🏻‍💻 👩🏻‍💻 👩🏻‍💻

@PatrickAlphaC 2 года назад

Done. 100% will do that at 100k

@Elwin-uu1qi 2 года назад

Thanks Patrick for the video tutorial, But it seems I can not run slither in windows since solc-select don't support windows yet..😑

@unaiiglesias9901 2 года назад

Thanks, have you more info about subject?

@iirekm Год назад

Can you give info which version of eth-security-toolbox you used? It's always good to append version number to used containers, because the recent seems to be broken (echidna fails with Permission denied: 'crytic-export')

@PatrickAlphaC Год назад

ahhhhhh.... Yes I should of added that. Could you make an issue on the repo?

@nikhilmore3771 2 года назад

Is data structures are important to build smart contract with solidity?

@mehrdad1068 2 года назад

Please make tutorial for EstateRegistry API Decentraland to creating editable and updateble nft land

@mehrdad1068 2 года назад

Please make a clone tutorial, Like MATIC,solana, Decentraland or axie infinity ♾️🚀

@dadatimileyin_ Год назад

my slither not install correctly, is there any way to fix that

@nobody-bt7mu 2 года назад

That was fast!

@PatrickAlphaC 2 года назад

You ask I deliver

@fasfasdfa6886 2 года назад

Patrick do you think that is better work always whit new version of solidity? Or is okay work whit the version that we know or been worked before?

@PatrickAlphaC 2 года назад

A lot of the newer versions have “better” stuff. But if you’re doing low level stuff, stick with what you know. Each version has slight differences. Ideally tho, you learn the new stuff and use the new stuff

@Skylla54 2 года назад

100k Subscriber Idea: RubberduckExplaining while jumping out of a plane! I would watch that😂 Thanks for such amazing content 💃

@PatrickAlphaC 2 года назад

OH. MY. GOD. This idea

@giskalia3629 Год назад

Hello patrick, thank you for video tutorial, I had already install slither, but command not found in terminal, I am using vscode with nodejs and python integration, what should I do? thank you

@giskalia3629 Год назад

anyone can help me?

@PatrickAlphaC Год назад

Could you make a question on stack exchange eth? Thanks

@razorjhon2622 Год назад

Patrick , Thank u so much for the fcc js 32 hours course , but can i ask u why do i struggle following the project and i have hard time understand solidity and hardhat , is that normal ? and what do i need to do to master this ?

@PatrickAlphaC Год назад

You'd have to get more specific about what you're stuggling with. But sometimes, you just need more practice!

@razorjhon2622 Год назад

@@PatrickAlphaC is it okay to do bad smart contract and mistakes at first ? also can i ask u how many years it took u to be able to make good solidity codes ?

@PatrickAlphaC Год назад

@@razorjhon2622 Sure! Just don't deploy them to mainnet and ask users to use them! It took a couple years, but it's a process where even now, I still try to get better every day.

@cleverblocks6422 2 года назад

Hi Patrick, my name is Gabi and I am a Blockchain & Software developer, I am trying to grow my channel where I am sharing my knowledge about Web3 development, I really love your videos and you inspired my to continue learning until I came to a level where I can teach things myself to other people ! Thank you ! ❤

@PatrickAlphaC 2 года назад

Awesome! Keep it up!

@DetectingCymru Год назад

Subbed

@remingtonsmith1372 Год назад

When I run slither it exits with Command failed with exit code 255 rather than 31, but it still shows the static analysis messages. Does this make any difference? Am I doing anything incorrectly?

@PatrickAlphaC Год назад

Could you make this a question on stack exchange ETH with more information and then drop it here?

@sl5946 2 года назад

Where would a complete beginner to coding start? I'd like to eventually become a web 3 dev but I'm pretty sure I need to learn the basics first. Thanks

@PatrickAlphaC 2 года назад

Check the description of the video - one of those two links I point too(with the 👆emoji) is what you want!

@sl5946 2 года назад

@@PatrickAlphaC awesome thank you

@rocco_zero Год назад

hey there, is your Full Blockchain course is still valid after ETH merge like everything in that course good to go? or there are some changes to be made? if yes then please tell me which part i have to skip or do extra research on now.. i will really appreciate

@PatrickAlphaC Год назад

100% good to go :) Follow along in the course, and I'll give you tips at every corner

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@dcg348 2 года назад

hi patrick ,, i am new in the space .your Audit a Smart Contract process can be apply for solana ?

@PatrickAlphaC 2 года назад

The methods can, but not the tools

@dcg348 2 года назад

@@PatrickAlphaC thanks

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@masudrahman253 Год назад

7:35 Slither

@UnsentPH 2 года назад

Is this the same with Validators task?

@PatrickAlphaC 2 года назад

What do you mean?

@IcEtEa1843 2 года назад

Hey there. Thanks for your awesom videos. Now im working as a IT System Engineer and getting into the security field (blue team). Now I know python because of my IT degree and im trying to get into web3 a bit. Now my question: Do i need to learn javascript for web3 or is it also viable to use python? If it goes to fullstack web/dapp then javascript is probably a must. But I in the future want to do security audits, is there a way around javascript or are most of the dapps... running with javascript. (ofc I need to learn solidity :P)

@PatrickAlphaC 2 года назад

If you know python, use python. You 100% don’t need to know javascript. I think knowing JS is good if you want to make websites, and that’s really it

@IcEtEa1843 2 года назад

@@PatrickAlphaC thank you very much for your advice. Really appreciate that you answer such questions. Love your vids

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@AmerJarada Год назад

Hey, I am getting the error "slither: error: unrecognized arguments: @chainlink=node_modules/@chainlink'" how i can fix that please ?

@PatrickAlphaC Год назад

You have to add imports to the slither command, or download hardhat so slither compiles with hardhat. Can you ask on stack exchange ETH and then post a link to the question here?

@mattjaf Год назад

Where are the instructions to get started with docker? I'm on windows 7 and installed version 19 toolbox and it gave me kitematic (alpha) and docker quickstart terminal and im trying to figure out how get the daemon started

@PatrickAlphaC Год назад

This is a good starting point: docs.docker.com/desktop/install/windows-install/

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@californiasunshine956 2 года назад

I'm a new subscriber from india✋ I do not have any knowledge about coding and I want to be a ethical hacker but now I got to know about smart contract hacking. Could u please tell me from where do I start. Smart contract audit or basics following ethical hacking course?

@PatrickAlphaC 2 года назад

Start with smart contracts fren!

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..For more enquiries, reach out⬆️⬆️⬆️..

@robotframework101 2 года назад

👍

@deanmajidy6197 2 года назад

i get error's when I try to run "yarn slither" all my dependencies are installed. Error Command failed with exit code 255

@PatrickAlphaC 2 года назад

You’d need to make an issue on the repo with more information. Thanks!

@theviperxxsy1041 Год назад

smart contract audits is difficult

@user-hr8iz9lb3g 2 года назад

what is the difference between your 32h javascript tutorial and the 16h python one? I am a backend person who dislikes working with js and I would like to know if the difference between the two courses is important enough to make me start the js one instead of the python one.

@PatrickAlphaC 2 года назад

If you like python, do the python one! I wrote this article to help explain the difference. medium.com/@patrick.collins_58673/learn-blockchain-development-in-one-of-these-two-videos-c7db210b98fd

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@user-hr8iz9lb3g Год назад

@@PatrickAlphaC Thanks

@edwassermann8368 2 года назад

what is a coder frog supposed to be???

@PatrickAlphaC 2 года назад

You!

@zulfiqar7967 2 года назад

I learnt your brilliant Freecodecamp Web3 Solidity course.. it's gave a shape to my knowledge on Blockchain.. We have a seperate discord channel for learning this course, and we solve bugs, we helping eachother.. i think, you once visited. now we expect some advance projects with advance concepts to learn from you, which helps us to improve skills

@mikeha Год назад

ethernaut doesn't work for me, I keep getting this error: Uncaught TypeError: Cannot assign to read only property 'chainId' of object '#'. It seems to have something to do with NextJS because I get that same error if I run the default Next JS boilerplate project, it seems like it doesn't like my metamask extension in brave

@mikeha Год назад

turns out it is a brave issue, you need to set the default wallet to None in brave to get rid of this error

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@HAHAHAHAHAHAHAHAHAAAAAA Год назад

Error: There are no open workspace folders to run slither on. No matter what OS i use no matter what python version i use i keep on getting here, if this passes it brings like 11 errors asking if I'm in the right directory, does anyone know the cause? I'm going crazy atp

@PatrickAlphaC Год назад

Could you ask on stack exchange ETH or the slither GitHub?

@mattiauliano2534 Год назад

Hi Patrick, I have a doubt, blockchain seems to be having a bad period, many people say that blockchain developers will have to diversify skills to have job opportunities. What do you think about? Do I need to worry? (question for everyone)

@PatrickAlphaC Год назад

Always go back to fundamentals. What is the value proposition of the technology? If the answer is compelling to you, then you yourself will know if there will be future opportunity. To me, the value prop of blockchain is a completely remastered financial system of accountability and transparency, with smart contracts at the core. To me, that means it's here to stay. Given two financial institutions, one where everything is transparent and one where they just tell you to trust them, which one are you going to pick?

@mattiauliano2534 Год назад

@@PatrickAlphaC Thanks for making me think, you're right. I'm taking your fcc blockchain js course it's gold thanks 🙏🏼

@nedonviews5182 5 месяцев назад

Please I want to learn smart contract auditing. And am a complete beginner

@PatrickAlphaC 5 месяцев назад

Take the Cyfrin Updraft security course!

@thileepanilankumaran6840 Год назад

"Failed building wheel for pysha3" when I try to install "pip solc-select". searched google can't find. Can someone help ?

@AmerJarada Год назад

Your environment is not set probably. Try installing wheels.

@thileepanilankumaran6840 Год назад

@@AmerJarada I downgraded Python from 3.11 to 3.10. Working fine now.

@matiasbraconi825 Год назад

when a new exploit or bug is discovered, are they updated?

@PatrickAlphaC Год назад

It can get tricky… but yes - they have to be. If you don’t deploy an upgrade ability though you have to migrate all users to a new contract

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@trueman8413 Год назад

hello, where are you 😔 i started watching 32hours lesson 2days ago

@PatrickAlphaC Год назад

Good :)

@badboy-ox6my Год назад

why do you alwasys promote frog so much ? any specific reason ?

@PatrickAlphaC Год назад

I just like the frog

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@8koi245 2 года назад

last commit be like: nah

@nickeast4853 3 месяца назад

thanks for the tutorial !! but when i run slither ./contracts , it says: Error: Source "@openzeppelin/contracts/token/ERC20/ERC20.sol" not found: File no t found. could you help me on this ? thanks Patrick !

@jackpaperhands Год назад

Dear Patrick, I know it is totally out of the blue, but I need your help. I have a project I'm building and I need your help. I can't afford you but all I want is an estimate and tech stack, and general feedback on what it takes to build a project like this. Can I send you a pitchdeck and could you give me 15 minutes of your time to give some feedback? Your biggest fan.

@PatrickAlphaC Год назад

Thanks for the kind words. I'm really swamped myself and generally can't give project feedback for free.

@jackpaperhands Год назад

@@PatrickAlphaC No worries. Thanks anyway.

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@smokinted6492 Год назад

Hi Patrick - is it possible to send you a message on Twitter? FYSA, looking for some coder guidance.

@PatrickAlphaC Год назад

Feel free to ask in public!

@smokinted6492 Год назад

@@PatrickAlphaC Question is more career based, so feel better asking privately. If not, no worries, appreciate all your content and value-added materials.

@kovychchat__my_Teleqram_id Год назад

For more enquiries, reach out⬆️⬆️⬆️..

@EastXwesT Год назад

thanks Jeff Bezos i really appreciate learning from you

@PatrickAlphaC Год назад

I decided Amazon was overrated

@andreapetteno4432 2 года назад

hi i am a 15 year old guy studying your flash loan video on aave and posting the transaction on testnet network rinkeby tells me in the vsc terminal command not found so i kindly wanted to ask you if you would give me one day we can connect on google meet for a call and solve the problem together. thank you. very kind would you give me an email from you to stay in touch and decide the day of the call? I care a lot