Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
A complete checklist for auditing and pentesting blockchain applications. This covers pre-deployment security best practices, the three pentest phases, and 37 smart contract weakness classes mapped to the SWC Registry. Built by the team that audits contracts before they hit mainnet.
What's inside?
Two checklists in one, across 15 device and infrastructure types:
The best-practices checklist - endorsement policies, IAM, HSMs for key storage, PAM for privileged actions, TPMs for sensitive execution, mutual TLS, MFA, SIEM, and secrets-store discipline.
The pentest phases - information gathering and threat modeling, followed by testing, discovery (API, static and dynamic analysis, network and app vuln assessments), and exploitation.
The smart contract checklist - 37 tests mapped to SWC entries: reentrancy, integer overflow, tx.origin auth, delegatecall to untrusted callees, floating pragma, incorrect constructor name, and the rest, plus the tool stack (Mythril, MythX, Echidna, Manticore, Oyente, Securify, SmartCheck).
What you’ll learn
By the end, you'll be able to:
Design a blockchain app that treats keys, contracts, and access control as separately hostile threat surfaces.
Audit a Solidity contract for the weakness classes that keep showing up in DeFi exploit post-mortems.
Pick the right static analysis and fuzzing tool for what you're testing.
Run a full pre-mainnet audit process that catches reentrancy, delegatecall abuse, and constructor mistakes before they're immutable.
Set up ongoing security discipline around HSMs, SIEM, and MFA that actually holds up on-chain.
The global blockchain market is projected to hit $20 billion by 2024, and 69% of banks are already experimenting with it. That's a lot of untested code holding real money.
Who’s this for?
Read this if you're a…
Web3 founder or CTO shipping smart contracts and want a checklist.
Solidity engineer preparing a contract for external audit and wants to fix the obvious stuff.
DeFi or NFT security lead responsible for user funds and prefer belt, braces, and formal verification.