awesome-web3-security

A curated list of Web3 Security materials and resources for Pentesters and Bug Hunters.

If you find that some links are not working, you can simply replace the username with gmh5225. 
Or you can send an issue for me.

Show respect to all the projects below, perfect works of art 🫡

How to contribute?

• https://github.com/HyunCafe/contribute-practice
• https://docs.github.com/en/get-started/quickstart/contributing-to-projects

Skills for AI Agents

This repository provides skills that can be used with AI agents and coding assistants such as Cursor, OpenClaw, Claude Code, Codex CLI, and other compatible tools. Install skills to get specialized knowledge about Web3 security topics.

View on learn-skills.dev

Installation:

npx skills add https://github.com/gmh5225/awesome-web3-security --skill <skill-name>

Available Skills:

Skill	Description
mev-security	MEV concepts, common attacks, and mitigations
awesome-web3-security-overview	Understanding and contributing to this resource list
smart-contract-security	EVM/Solidity smart contract security
solana-security	Solana/Sealevel security research
web3-security-tooling	Security tooling (analyzers, fuzzers, decompilers)
wallet-security	Wallet security (MPC/TSS, key management, phishing)

Example:

# Install smart contract security skill
npx skills add https://github.com/gmh5225/awesome-web3-security --skill smart-contract-security

# Install multiple skills
npx skills add https://github.com/gmh5225/awesome-web3-security --skill solana-security --skill wallet-security

Security Starter Pack

• CTFs / Practice

  • https://capturetheether.com/ [Capture the Ether]
  • https://ethernaut.openzeppelin.com/ [The Ethernaut]
  • https://www.damnvulnerabledefi.xyz/ [Damn Vulnerable DeFi]
  • https://blockchain-ctf.securityinnovation.com/#/ [Security Innovation Blockchain CTF]
  • https://github.com/nccgroup/GOATCasino [GOAT Casino]
  • https://github.com/paradigm-operations/paradigm-ctf-2021 [Paradigm CTF]
  • https://github.com/blockthreat/blocksec-ctfs [Blocksec CTFs]
  • https://ciphershastra.com/ [ciphershastra CTF]
  • https://github.com/SunWeb3Sec/DeFiVulnLabs [DeFiVulnLabs]
  • https://quillctf.super.site/ [QuillCTF]
  • https://www.vulnmachines.com/ [Vulnmachines]
  • https://www.web3pwn.com/ [Web3Pwn]

• Testnets / Faucets

  • https://sepolia.dev/ [Sepolia Resources]
  • https://faucet.circle.com/ [Circle Faucet (Sepolia USDC)]

• Mindmaps

  • https://www.xmind.net/m/2zbPP7/ [Common Vulnerabilities MindMap]
  • https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor [Auditor MindMap]
  • https://xmind.works/share/zfdeD07U [Tools MindMap]

• Starter Tools

  • https://github.com/Quillhash/Web3-Security-Tools [Web3-Security-Tools]
  • https://remix-project.org/ [Remix]

• Blogs / Postmortems

  • https://medium.com/immunefi [Immunefi]
  • https://blog.openzeppelin.com/security-audits/ [OpenZeppelin]
  • https://quillaudits.medium.com/ [QuillAudits]
  • https://blog.solidityscan.com/ [SolidityScan]
  • https://medium.com/@Beosin_com [Beosin]
  • https://neptunemutual.medium.com/ [Neptune Mutual]
  • https://blocksecteam.medium.com/ [BlockSec]
  • https://www.certik.com/resources/blog [CertiK]
  • https://mouse-run.beehiiv.com [mouse-run]

• Bug Bounties

  • https://immunefi.com/ [Immunefi]
  • https://hackenproof.com/programs [HackenProof]
  • https://code4rena.com/ [Code4rena]
  • https://gitcoin.co/explorer [Gitcoin]
  • https://hackerone.com [HackerOne]
  • https://spearbit.com/ [Spearbit]
  • https://app.sherlock.xyz/ [Sherlock]
  • https://audits.sherlock.xyz/contests [Sherlock Contests]
  • https://saloon.finance/ [The Saloon]
  • https://hats.finance/ [Hats Finance]
  • https://secure3.io/ [Secure3]
  • https://app.secure3.io/ [Secure3 Contests]
  • https://securr.tech/ [Securr]
  • https://r.xyz/ [Remedy]
  • https://hunt.r.xyz/ [Remedy Hunt]
  • https://www.vigilseek.com/bug-bounty [Vigilseek (Bug Bounty Aggregator)]
  • https://cantina.xyz/ [Cantina]

• Newsletters / Collections

  • https://newsletter.blockthreat.io/ [BlockThreat]
  • https://rekt.news/ [REKT]
  • https://weekinethereumnews.com/ [Week in Ethereum News]
  • https://quillaudits.substack.com/ [HashingBits]
  • https://web3sec.news [Web3sec.news]

• Talks / Videos

  • https://www.youtube.com/watch?v=lJQwuyW4t-k [IWCON-S22]
  • http://www.youtube.com/watch?v=P8LXLoTUJ5g [LiveOverflow]
  • https://www.youtube.com/watch?v=zcJmWr5_GOc [Web3 Security Mindset]
  • https://www.youtube.com/watch?v=QSmtVR0aniI [Security and Vulnerabilities in Web3]
  • https://www.youtube.com/playlist?list=PLox242_JhiuEe64LzW1M8XpiQ2-N5bZsX [Playlist]
  • https://www.youtube.com/watch?v=A5s9aez43Co&list=PLO5VPQH6OWdXKPThrch6U0imGdD3pHLXi [Damn Vulnerable DeFi CTF]
  • https://www.youtube.com/watch?v=cOP9z9XWjwc [Attacking Authorization]
  • https://www.youtube.com/watch?v=TmZ8gH-toX0 [Audit a Smart Contract]
  • https://www.youtube.com/watch?v=gyMwXuJrbJQ [32-Hour Course]

• Learn Solidity

  • https://cryptozombies.io/ [CryptoZombies]
  • https://www.learnweb3.io/ [LearnWeb3]
  • https://www.smartcontract.engineer/ [Smart Contract Engineer]
  • https://solidity-by-example.org/ [Solidity by Example]
  • https://www.web3.university/ [Web3 University]
  • https://www.useweb3.xyz/ [useWeb3]

• Audit Reports

  • https://github.com/chainsulting/Smart-Contract-Security-Audits [Chainsulting]
  • https://code4rena.com/reports [Code4rena Reports]
  • https://consensys.net/diligence/audits/ [Consensys]
  • https://github.com/Quillhash/QuillAudit_Reports [QuillAudits]
  • https://github.com/spearbit/portfolio/tree/master/pdfs [Spearbit]
  • https://github.com/sherlock-protocol/sherlock-reports [Sherlock]
  • https://github.com/0xNazgul/Blockchain-Security-Audit-List [Audit List]
  • https://github.com/shieldify-security/audits-portfolio [Shieldify]

• Certifications

  • https://secops.group/certified-blockchain-practitioner [CBP]
  • https://blockchaintrainingalliance.com/products/cbsp [CBSP]