└── README.md /README.md: -------------------------------------------------------------------------------- 1 | BlockChain-Security-List 2 | About cryptocurrency security. (reverse, exploit, fuzz..) 3 | 4 | 欢迎加入！此List会跟踪最新情报实时更新。 5 | 6 | ![alt text](https://www.slowmist.com/eth214_res/img/logo.png) ![alt text](https://avatars3.githubusercontent.com/u/25600994?s=400&u=5e75ba9b340d3148fd9b75ac6da7df7f1b47c4d7&v=4) 7 | 8 | ## Tools 9 | 10 | [mythril](https://github.com/ConsenSys/mythril) - Security analysis tool for Ethereum smart contracts 11 | 12 | [manticore](https://github.com/trailofbits/manticore) - Symbolic execution tool 13 | 14 | [Slither](https://trailofbits.wufoo.com/forms/m1qfujq31qyj9ee/) - Slither combines a set of proprietary static analyses on Solidity 15 | 16 | [Porosity](https://github.com/comaeio/porosity) - Decompiler and Security Analysis tool for Blockchain-based Ethereum Smart-Contracts 17 | 18 | [Echidna](https://github.com/trailofbits/echidna) - Ethereum fuzz testing framework 19 | 20 | [Oyente](https://github.com/melonproject/oyente) - An Analysis Tool for Smart Contracts 21 | 22 | [Porosity](https://github.com/comaeio/porosity) - Decompiler and Security Analysis tool for Blockchain-based Ethereum Smart-Contracts. 23 | 24 | [Mythril](https://github.com/ConsenSys/mythril) - Security analysis tool for Ethereum smart contracts. 25 | 26 | [MAIAN](https://github.com/MAIAN-tool/MAIAN) - Automatic tool for finding trace vulnerabilities in Ethereum smart contracts. 27 | 28 | [Echidna](https://github.com/trailofbits/echidna) - Ethereum fuzz testing framework. 29 | 30 | [Manticore](https://github.com/trailofbits/manticore) - Manticore uses symbolic execution to simulate complex multi-contract and multi-transaction attacks against EVM bytecode. 31 | 32 | [Ethersplay](https://github.com/trailofbits/ethersplay) - A graphical EVM disassembler with advanced features. (Binja) 33 | 34 | [Oyente](https://github.com/melonproject/oyente) - An automatic EVM code analyzer based on symbolic execution and Z3 SMT solver. 35 | 36 | [IDA-EVM](https://github.com/trailofbits/ida-evm) - IDA Processor Module for the Ethereum Virtual Machine. 37 | 38 | [Evmdis](https://github.com/arachnid/evmdis) - EVM disassembler. 39 | 40 | [Securify](https://securify.ch/) - Formal Verification of Ethereum Smart Contracts. 41 | 42 | [Rattle](https://trailofbits.wufoo.com/forms/m1qfujq31qyj9ee/) - Rattle is an EVM static analyzer that analyzes the EVM bytecode directly for vulnerabilities. 43 | 44 | [Slither](https://trailofbits.wufoo.com/forms/m1qfujq31qyj9ee/) - Static analyses on Solidity. 45 | 46 | [Diligence](https://consensys.net/diligence/) - Security Services, Tools and Best Practices for the Ethereum Ecosystem. 47 | [fuildai](https://fluidai.co/) - Fluid is an AI that can automatically find and fix fatal security vulnerabilities in Smart Contracts. 48 | 49 | ## Blogs 50 | [区块链安全专题智库](https://bcsec.org/) 51 | 52 | [PeckShield Inc. - Blog](https://www.peckshield.com/blog.html) 53 | 54 | [Security Archives - Ethereum Blog](https://blog.ethereum.org/category/security/) 55 | 56 | [Blockchain-sec](https://blockchain-sec.com/) 57 | 58 | [猎豹移动区块链中心](https://www.cmcmbc.com/zh-cn/blog/) 59 | 60 | [隐形人真忙-区块链安全](https://blog.csdn.net/u011721501/article/category/7483965) 61 | 62 | [Trailofbits-blockchain](https://blog.trailofbits.com/category/blockchain/) 63 | 64 | [blackhat](https://cansecwest.com/slides/2018/Blackhat%20Ethereum%20%20Ryan%20Stortz%20and%20Jay%20Little,%20Trail%20of%20Bits,%20Inc.pdf) - Blackhat Ethereum. 65 | 66 | [solidified](https://medium.com/solidified/parity-hack-how-it-happened-and-its-aftermath-9bffb2105c0) - Parity hack. 67 | 68 | [arvanaghi 1](https://arvanaghi.com/blog/reversing-ethereum-smart-contracts/) - Reversing ethereum smart contracts. 69 | 70 | [arvanaghi 2](https://arvanaghi.com/blog/reversing-ethereum-smart-contracts-pt2/) - Reversing ethereum smart contracts 2. 71 | 72 | [ret2](https://blog.ret2.io/2018/05/16/practical-eth-decompilation/) - Practical ETH decompilation. 73 | 74 | [loom-network](https://medium.com/loom-network/how-to-secure-your-smart-contracts-6-solidity-vulnerabilities-and-how-to-avoid-them-part-1-c33048d4d17d) - 6 vulnerabilities and how to avoid them part 1. 75 | 76 | [ETH assembly](https://medium.com/@xJonathan/reverse-engineering-ethereum-smart-contract-lets-talk-assembly-10c38b8e3c2) - Lets talk assembly. 77 | 78 | [radare2](https://blog.positive.com/reversing-evm-bytecode-with-radare2-ab77247e5e53) - Reversing EVM bytecode with radare2. 79 | 80 | [Etherum security tools](https://blog.trailofbits.com/2018/03/23/use-our-suite-of-ethereum-security-tools/) - Trailofbits Ethereum security tools. 81 | 82 | [Hackernoon](https://hackernoon.com/scanning-ethereum-smart-contracts-for-vulnerabilities-b5caefd995df) - Analyzing Ethereum smart contracts for vulnerabilities. 83 | 84 | [nccgroup](https://www.nccgroup.trust/us/our-research/discovering-smart-contract-vulnerabilities-with-goatcasino/?style=Cyber+Security) - Discovering Smart Contract Vulnerabilities with GOATCasino. 85 | 86 | [Arseny Reutov](https://blog.positive.com/predicting-random-numbers-in-ethereum-smart-contracts-e5358c6b8620) - Predicting Random Numbers in Ethereum Smart Contracts. 87 | 88 | [funfair](https://funfair.io/randomness-is-a-big-deal/) - Randomness is a big deal. 89 | 90 | ## Training 91 | 92 | [Ethernaut](https://ethernaut.zeppelin.solutions/level/0x6545df87f57d21cb096a0bfcc53a70464d062512) - The ethernaut is a Web3/Solidity based wargame. 93 | 94 | [GOATCasino](https://github.com/nccgroup/GOATCasino) - GOATCasino is a Truffle project which deploys a set of intentionally vulnerable smart contracts. 95 | 96 | ## Events 97 | 98 | [Blockchain-Graveyard](https://magoo.github.io/Blockchain-Graveyard/) 99 | 100 | [Coindesk](https://www.coindesk.com/?s=) //search keyword,like 'hack'、'attack'... 101 | 102 | [36kr-tag-anquan](https://36kr.com/tags/anquan) 103 | 104 | [cnn-bitcoin-crime](https://www.ccn.com/bitcoin-crime/) 105 | 106 | [scmagazineuk-cryptocurrency](https://www.scmagazineuk.com/cryptocurrency/topic/48080/) 107 | 108 | ## Vulnerabilities 109 | 110 | [DASP](http://www.dasp.co/) 111 | 112 | [Smart Contract Best Practices](https://github.com/ConsenSys/smart-contract-best-practices) 113 | 114 | [BitcoinWiki-Weaknesses](https://en.bitcoin.it/wiki/Weaknesses) 115 | 116 | [BitcoinWiki-CVEs](https://en.bitcoin.it/wiki/Common_Vulnerabilities_and_Exposures) 117 | 118 | [Go-ethereum issue vuln](https://github.com/ethereum/go-ethereum/issues?utf8=%E2%9C%93&q=label%3Avuln) 119 | 120 | [Examples of Solidity security issues ](https://github.com/trailofbits/not-so-smart-contracts) 121 | 122 | [Scanning-ethereum-smart-contracts-for-vulnerabilities](https://hackernoon.com/scanning-ethereum-smart-contracts-for-vulnerabilities-b5caefd995df) 123 | 124 | [Smart Contract Security](https://blog.ethereum.org/2016/06/10/smart-contract-security/) 125 | 126 | [Solidity Security Considerations](http://solidity.readthedocs.io/en/latest/security-considerations.html) 127 | 128 | ## MISC 129 | 130 | [dasp](http://dasp.co/) - Decentralized Application Security Project (or DASP) Top 10 of 2018. 131 | 132 | [Not so smart conracts](https://github.com/trailofbits/not-so-smart-contracts) - Examples of Solidity security issues. 133 | 134 | [EVM opcodes](https://github.com/trailofbits/evm-opcodes) - Ethereum opcodes and instruction reference. 135 | 136 | ## Threats 137 | 138 | [Go-ethereum issue bug](https://github.com/ethereum/go-ethereum/issues?q=is%3Aopen+is%3Aissue+label%3Abug) 139 | 140 | [Solidity issue bug](https://github.com/ethereum/solidity/issues?utf8=%E2%9C%93&q=label%3Abug+) 141 | 142 | [Reddit ethereum](https://www.reddit.com/r/ethereum/) 143 | 144 | [Bitcointalk](https://bitcointalk.org/index.php?board=6.0) 145 | 146 | [Stackexchange ethereum security](https://ethereum.stackexchange.com/questions/tagged/security) 147 | 148 | [Stackexchange bitcoin security](https://bitcoin.stackexchange.com/questions/tagged/security) 149 | 150 | ## Paper 151 | 152 | [区块链安全分析报告](https://bcsec.org/blockchainsecurity_v1.pdf) 153 | 154 | [区块链安全生存指南](https://chaitin.cn/cn/download/blockchain_security_guide_20180507.pdf) 155 | 156 | [Hacking Blockchain](https://www.rsaconference.com/writable/presentations/file_upload/fon4-t11_hacking_blockchain.pdf) 157 | 158 | [BGP hijacking](https://en.wikipedia.org/wiki/BGP_hijacking) 159 | 160 | [Safe-wallet-white-paper](https://www.cmcmbc.com/zh-cn/blog/research/2018-04-18/79.html) 161 | 162 | [Blockchains-how-to-steal-millions-in-264-operations](https://research.kudelskisecurity.com/2018/01/16/blockchains-how-to-steal-millions-in-264-operations/) 163 | 164 | [Quantum attacks on Bitcoin, and how to protect against them](https://arxiv.org/pdf/1710.10377.pdf) 165 | 166 | [Eclipse Attacks on Bitcoin’s Peer-to-Peer Network](http://cs-people.bu.edu/heilman/eclipse/) 167 | 168 | [Smarter](https://eprint.iacr.org/2016/633.pdf) - Making Smart Contracts Smarter. 169 | 170 | [Yellow Paper](https://ethereum.github.io/yellowpaper/paper.pdf) - Ethereum: a secure decentralised generalised transaction ledger. 171 | 172 | ## Reports 173 | 174 | [New allowAnyone Bug Identified in Multiple ERC20 Smart Contracts](https://peckshield.com/2018/05/29/eosOOB/) 175 | 176 | [Analyzing and Reproducing the EOS Out-of-Bound Write Vulnerability in nodeos](https://peckshield.com/2018/05/29/eosOOB/) 177 | 178 | [Audit report of iohk’s etc wallet](https://research.kudelskisecurity.com/2018/01/26/audit-report-of-iohks-etc-wallet/) 179 | 180 | [Audit report of the waves platform](https://research.kudelskisecurity.com/2017/10/10/audit-report-of-the-waves-platform/) 181 | 182 | ## Awesomes 183 | 184 | [solidity-audit-checklist](https://github.com/miguelmota/solidity-audit-checklist) 185 | 186 | [EOS bp nodes security checklist](https://github.com/slowmist/eos-bp-nodes-security-checklist) 187 | 188 | [pentesting-ethereum-dapps](https://arvanaghi.com/blog/pentesting-ethereum-dapps/) 189 | 190 | [awesome](https://github.com/sindresorhus/awesome) 191 | 192 | [awesome ethereum](https://github.com/btomashvili/awesome-ethereum) 193 | 194 | [awesome ethereum virtual machine](https://github.com/pirapira/awesome-ethereum-virtual-machine) 195 | 196 | ## Jobs 197 | [Slowmist](https://www.slowmist.com/) 198 | 199 | [Ethercasts](https://jobs.ethercasts.com/) 200 | 201 | [Solidified](https://solidified.io/) 202 | 203 | [codementor](https://www.codementor.io/solidity-developers) 204 | 205 | [iosiro](https://www.iosiro.com/) 206 | 207 | ## The author 208 | I'M ， 209 | Thanks to all blockchain security researchers 210 | 211 | --------------------------------------------------------------------------------