Thread by @adrianhetman

How to make a jump from Web2 hacking to Web3 hacking?

This is the question I started getting over DMs and I decided to answer all of them in a form of a Twitter thread so other can learn to.

knowledge will be compressed so keep that in mind🙃

Here we go!

🧵👇

As with everything, you need solid foundations before leaping into anything advanced.

That's why I recommend reading upon how Ethereum works first.

github.com/ethereumbook/e…

This should give you a great overview of inner workings of Ethereum.

Next, Solidity!🐍

All Ethereum DApps rely on Smart Contracts (SC)

Knowing what they are, how to write them is a big step towards findings bugs

Solidity is the most popular language for SCs and @ProgrammerSmart created an awesome resources for learning the language.

solidity-by-example.org
...

...
Apart from the awesome website, he also creates YouTube videos on various Solidity/Security/DeFi topics.

It's worth checking it out!

youtube.com/channel/UCJWh7…

Apart from learning the language, it's also essential knowing the application landscape and what the hell is DeFi 💱

DeFi apps are one of the most popular Ethereum based applications.

Knowing what they are and how they work will help you with finding bugs.

One of the best resources to learn more about the topic is @finematics

Also check out @officer_cia guide to DeFi github.com/OffcierCia/DeF…

One of the most fun way to see and learn how to break applications is by completing CTFs.

Web3 also got you covered on this front and there are multiple CTFs worth checking out.

1 ethernaut.openzeppelin.com
2 capturetheether.com/challenges/
3 damnvulnerabledefi.xyz

When you have that knowledge and practice behind you, next step I could recommend is by reading Post Mortem on various hacks/bugs.

I already wrote few such articles on @immunefi where I covered for example Price Oracle manipulation

medium.com/immunefi/enzym…

It's also worth checking out reputable auditing firms like @trailofbits / @ConsenSysAudits / @OpenZeppelin / @peckshield and many others.

They always post something interesting and they make most of their audit reports public.

Reading such audit report is a knowledge mine⛏️🕯️

Having a dev/test env is a must for bug hunter

It's worth learning the basics of @HardhatHQ and @BrownieEth. Without them you won't go far with writing your own PoC.

Get familiar with Web3.js/Web3.py packages to be able to query Ethereum easily and manipulate transactions

👇

Some of the interesting security tools that can help you and improve your workflow are

1 Solidity Visual Developer
2 Surya
3 ethtx.info
4 github.com/dapphub/dappto…
5 seth

If you want to become a smart contract auditor, @cmichelio created an awesome blog post just about that.

It's worth giving it a read as you will find some valuable information.

cmichel.io/how-to-become-…

Here are other superb links you will find helpful that I didn't had a character count in previous tweets

1 useweb3.xyz
2 notonlyowner.com/learn/intro-se…
3 github.com/ConsenSys/ethe…
4 devansh.xyz/blockchain-sec…

Thread is not over 🧐

Armed with the knowledge and practice you are now prepared to start submitting bugs on bug bounty platforms like @immunefi.

If you want to know how to properly write your bug report (and you should!) Immunefi got you covered with the following article.🥷

medium.com/immunefi/a-hac…

I hope I you found the thread helpful to you and you will start making first steps towards Web3 Security.

I just want for you to be able to say "I know Web3 Hacking" in 2022 🦾

If you like the article, please retweet the first tweet

https://twitter.com/adrianhetman/status/1475550508354093072

and if you have any other interesting links or suggestions, please leave a comment 🙏✨

Immunefi just launched guide for learning Blockchain Security that I think is definitely worth sharing here.

@morphean_sec great job on the guide!

It also links to some resources I haven't linked in the original thread so it's worth checking out 🧐

medium.com/immunefi/hacki…