Web3 Exploitation Fundamentals: Navigating Security in Decentralized Systems
Smart contract exploitation with Foundry and Hardhat: reentrancy, front-running, signatures, proxies and the defenses that actually hold.
- Chapters
- 21 chapters
- Total reading time
- 8 h of reading
- Written
- 2024–2025
0 of 21 read
Chapters, in order
- 1 Pentesting Web3: Setting Up a Smart Contract Testing Environment Web3 transforms the internet with decentralization via blockchain, empowering users over data and security. This article covers blockchain basics, smart contracts, security risks, common vulnerabilities, and lays groundwork for upcoming articles on Web3 attacks and secure development practices
- 2 Exploiting Predictable Randomness in Ethereum Smart Contracts This chapter examines how attackers can exploit predictable randomness in a lottery contract, using Ganache to simulate the attack. It highlights the vulnerability of on-chain randomness and suggests secure solutions like Chainlink VRF.
- 3 Refunds Gone Wrong: How Access Control Flaws Can Drain Your Contract This article explores a smart contract access control vulnerability using the Magic Item Shop example. By demonstrating an exploit due to missing ownership checks, we highlight the importance of verifying caller authorization, rigorous testing, and secure coding practices to protect contracts.
- 4 The Traitor Within: Reentrancy Attacks Explained and Resolved This chapter explores reentrancy attacks in Ethereum, showcasing vulnerabilities in smart contracts and how they can be exploited using Foundry for testing. We demonstrate the attack strategy, implement a fix to secure the contract, and emphasize best practices for robust Solidity development.
- 5 Simulating Front-Running Attacks in Ethereum: A Deep Dive with Foundry and Anvil This article explores front-running vulnerabilities in Ethereum smart contracts using the BiomechanicalRace case study. It simulates attacks with Anvil, Cast, and a custom validator, analyzing gas price impacts and proposing secure design solutions like commit-reveal schemes to prevent exploits.
- 6 Breaking the Bet: Simulating Flash Loan Attacks in Decentralized Systems Explore how flash loan vulnerabilities impact decentralized systems through the DragonBet contract. Learn about AMMs, token pricing, and manipulation strategies. Dive into a simulated attack and discover key techniques to secure smart contracts against exploitation.
- 7 From Front-Running to Sandwich Attacks: An Advanced Look at MEV Exploits In this chapter, we explored the mechanics of Sandwich Attacks using a vulnerable smart contract. We deployed the contract, simulated a victim's transaction, and automated the attack with a Python bot. Key takeaways include understanding slippage, private relayers, and dynamic pricing as defenses.
- 8 Breaking the Bank: Exploiting Integer Underflow in Smart Contracts This chapter explores an integer underflow vulnerability in the DecentralizedBank contract. Using Anvil and a Bash script, we simulate an attack where the attacker inflates their balance due to a logic flaw and withdraws 5 ETH, showcasing the importance of proper validation in smart contracts.
- 9 Secrets in the Open: Unpacking Solidity Storage Vulnerabilities This chapter explores Solidity's storage vulnerabilities, showcasing how attackers exploit them and proposing solutions like hashing, off-chain storage, and dynamic secrets to secure smart contracts.
- 10 The Magic and Mayhem of delegatecall: A Deep Dive into Solidity’s Most Powerful Feature delegatecall is a powerful Solidity feature enabling one contract to execute another’s code while using its own storage. This flexibility allows for upgradable designs but poses risks like storage overwrites and exploits. Learn how it works, its pitfalls, and how to mitigate them effectively.
- 11 Transparent Proxies: The Key to Upgradeable Contracts Without Breaking a Sweat Transparent Proxies allow smart contracts to be upgraded without changing their address, forwarding calls to implementation contracts while preserving state. In this chapter, we deployed, interacted with, and upgraded a proxy, exploring its architecture and benefits.
- 12 UUPS Proxies: A Double-Edged Sword – Efficient Upgrades, Hidden Risks In this chapter, we explore UUPS Proxies, their efficiency, and security trade-offs compared to Transparent Proxies. We break down their architecture, deployment, and common vulnerabilities. We also examine Beacon, Minimal, and Diamond Proxies, analyzing their risks and real-world use cases. 🚀
- 13 selfdestruct Unleashed: How to Hack Smart Contracts and Fix Them Explore how Ethereum’s powerful selfdestruct function can be exploited to bypass deposit restrictions and drain smart contract funds. This guide breaks down a real-world attack, explains the vulnerability, and provides actionable steps to secure contracts against similar exploits.
- 14 Hacking ERC-20: Pentesting the Most Common Ethereum Token Standard ERC-20 tokens power Ethereum, but poor implementations can be riddled with vulnerabilities. From integer overflows to reentrancy and front-running attacks, pentesters must scrutinize contracts. This chapter explores key flaws, exploits, and Foundry-based testing to break and secure ERC-20 tokens. 🚀
- 15 Strengthening Smart Contracts: Unit Testing, Fuzzing, and Invariant Testing with Foundry We explore unit testing, fuzzing, and invariant testing in smart contracts to detect vulnerabilities and enhance security before deployment, using Foundry for automated and effective testing.
- 16 Fuel for the Ritual: Gas Mechanics and Misfires in Web3 Learn how poor gas management can break smart contracts, open attack vectors, and waste resources. We explore real examples, test cases, and practical tips to help you audit and optimize gas usage like a pro—without burning your mana.
- 17 Slither: Your First Line of Defense in Smart Contract Security Slither: A powerful static analysis tool that scans smart contracts for vulnerabilities, maps attack surfaces, and visualizes code relationships—essential for efficient security auditing and penetration testing of blockchain applications.
- 18 Beyond the CLI: Hacking Smart Contracts with the Slither API Discover the power of Slither's API for in-depth smart contract auditing. Learn how to build custom detectors, enhance output with Rich, and uncover hidden vulnerabilities beyond standard static analysis.
- 19 Understanding Ethereum Signatures - The Foundation of Web3 Security Deep dive into Ethereum's cryptographic signature system, ECDSA, secp256k1, signature anatomy (r, s, v), and practical examples of signing, verifying, and securing Web3 authentication flows.
- 20 Transaction Signatures vs Message Signatures: Understanding the Difference Deep dive into RLP encoding, EIP-191 versioning, and the security differences between on-chain transaction signatures and off-chain message signatures in Ethereum.
- 21 Meta-Transactions: Gasless UX and New Attack Vectors Deep dive into meta-transaction architecture, EIP-2771 trusted forwarders, relayer patterns, and the security implications of gasless transaction execution in Ethereum.