Andy Li

Personal notes on what I did as a security researcher on smart contract development. This one will be long, I think I will stop creating threads because threads are just a pain to read. The following lines are not bits of advice, they are things that worked for me, how i approached the field. Never try to copy/paste what you read on the internet, and try to tailor ideas to your mental models. ***** I want to emphasize, again, security researcher on SMART CONTRACT DEVELOPMENT, not blockchain. Why? Because some of the topics that I will list, do not require very deep knowledge. ***** Foundational: Understand how a blockchain works, consensus mechanisms, and the basics of cryptocurrencies. 🚦This requires knowledge sync from time to time. --- Smart Contract Platforms: Familiarize yourself with various chains and their differences: Roll-ups, side chains, L1, L2, L3 whatever. You need to know the basic differences. 🚦This requires knowledge sync from time to time. --- Learn Solidity, Vyper or whatever you want to be focused on to review as a researcer: For Ethereum, Solidity is the most widely used language. But you can also expand to other languages like Vyper. ❗️This one requires a very deep knowledge; do not stop learning in this category. ---- Hands-On Practice: Deploy Contracts: Start by writing and deploying simple contracts. Understand the full life-cycle of a development process. ❗️This one requires a very deep knowledge; do not stop learning in this category. --- Testing Frameworks: Learn tools like Foundry, and Hardhat to be able to test, deploy contracts and write PoCs. ❗️Do not stop learning in this category. --- Understand Common Vulnerabilities: Research common smart contract vulnerabilities. In this category, there are numerous resources that you can explore, the most used at the moment is solodit. ❗️Do not stop learning in this category. --- Advanced Tooling: Familiarize yourself with tools used for fuzzing, symbolic execution, invariant testing, mutant testing etc. 🚦This can be an extra once you reach a certain level of confidentiality on your basics. --- Communities: "It takes a village to raise a child" It is detrimental to be part of a group that exchanges ideas. I know that most of the security researchers might not like this, but the blockchain field evolves so much that we must collaborate more to divide the work to be able to hold the front. Divide et impera. --- Ethical Considerations: Never exploit vulnerabilities in real-world contracts without permission. The consequences, both legal and financial, can be immense. This is not discussed enough; the ethics of a Security Researcher should be like the Hippocratic Oath. --- Contribute: The blockchain community values open-source contributions. Sharing tools, findings, or writing about vulnerabilities can establish your reputation. --- Soft Skills: Like any other security role, being able to clearly communicate vulnerabilities, risks, and fixes to developers and stakeholders is crucial. Something that you might not like but you have to get better at. A security risk explained well is 50% fixed. There might be more, I might have a part 2 if I find more inspiration, I hope it makes sense. Stay safe, frens! 🪪