awesome-web3-security

Uma lista curada de materiais e recursos de Segurança Web3 para Pentesters e Caçadores de Bugs.

If you find that some links are not working, you can simply replace the username with gmh5225. 
Or you can send an issue for me.

Respeite todos os projetos abaixo, verdadeiras obras de arte 🫡

Como contribuir?

• https://github.com/HyunCafe/contribute-practice
• https://docs.github.com/en/get-started/quickstart/contributing-to-projects

Skills para Agentes de IA

Este repositório fornece skills que podem ser usadas com agentes de IA e assistentes de programação, como Cursor, OpenClaw, Claude Code, Codex CLI e outras ferramentas compatíveis. Instale as skills para obter conhecimento especializado sobre tópicos de segurança Web3.

Ver em learn-skills.dev

Instalação:

npx skills add https://github.com/gmh5225/awesome-web3-security --skill <skill-name>

Skills Disponíveis:

Skill	Descrição
mev-security	Conceitos de MEV, ataques comuns e mitigações
awesome-web3-security-overview	Entendendo e contribuindo para esta lista de recursos
smart-contract-security	Segurança de smart contracts EVM/Solidity
solana-security	Pesquisa de segurança em Solana/Sealevel
web3-security-tooling	Ferramentas de segurança (analisadores, fuzzers, decompiladores)
wallet-security	Segurança de carteiras (MPC/TSS, gerenciamento de chaves, phishing)

Exemplo:

# Install smart contract security skill
npx skills add https://github.com/gmh5225/awesome-web3-security --skill smart-contract-security

# Install multiple skills
npx skills add https://github.com/gmh5225/awesome-web3-security --skill solana-security --skill wallet-security

Pacote Inicial de Segurança

• CTFs / Prática

  • https://capturetheether.com/ [Capture the Ether]
  • https://ethernaut.openzeppelin.com/ [The Ethernaut]
  • https://www.damnvulnerabledefi.xyz/ [Damn Vulnerable DeFi]
  • https://blockchain-ctf.securityinnovation.com/#/ [Security Innovation Blockchain CTF]
  • https://github.com/nccgroup/GOATCasino [GOAT Casino]
  • https://github.com/paradigm-operations/paradigm-ctf-2021 [Paradigm CTF]
  • https://github.com/blockthreat/blocksec-ctfs [Blocksec CTFs]
  • https://ciphershastra.com/ [ciphershastra CTF]
  • https://github.com/SunWeb3Sec/DeFiVulnLabs [DeFiVulnLabs]
  • https://quillctf.super.site/ [QuillCTF]
  • https://www.vulnmachines.com/ [Vulnmachines]
  • https://www.web3pwn.com/ [Web3Pwn]

• Testnets / Faucets

  • https://sepolia.dev/ [Recursos do Sepolia]
  • https://faucet.circle.com/ [Faucet da Circle (Sepolia USDC)]

• Mapas Mentais

  • https://www.xmind.net/m/2zbPP7/ [Mapa Mental de Vulnerabilidades Comuns]
  • https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor [Mapa Mental do Auditor]
  • https://xmind.works/share/zfdeD07U [Mapa Mental de Ferramentas]

• Ferramentas Iniciais

  • https://github.com/Quillhash/Web3-Security-Tools [Web3-Security-Tools]
  • https://remix-project.org/ [Remix]

• Blogs / Postmortems

  • https://medium.com/immunefi [Immunefi]
  • https://blog.openzeppelin.com/security-audits/ [OpenZeppelin]
  • https://quillaudits.medium.com/ [QuillAudits]
  • https://blog.solidityscan.com/ [SolidityScan]
  • https://medium.com/@Beosin_com [Beosin]
  • https://neptunemutual.medium.com/ [Neptune Mutual]
  • https://blocksecteam.medium.com/ [BlockSec]
  • https://www.certik.com/resources/blog [CertiK]
  • https://mouse-run.beehiiv.com [mouse-run]

• Bug Bounties

  • https://immunefi.com/ [Immunefi]
  • https://hackenproof.com/programs [HackenProof]
  • https://code4rena.com/ [Code4rena]
  • https://gitcoin.co/explorer [Gitcoin]
  • https://hackerone.com [HackerOne]
  • https://spearbit.com/ [Spearbit]
  • https://app.sherlock.xyz/ [Sherlock]
  • https://audits.sherlock.xyz/contests [Concursos Sherlock]
  • https://saloon.finance/ [The Saloon]
  • https://hats.finance/ [Hats Finance]
  • https://secure3.io/ [Secure3]
  • https://app.secure3.io/ [Concursos Secure3]
  • https://securr.tech/ [Securr]
  • https://r.xyz/ [Remedy]
  • https://hunt.r.xyz/ [Remedy Hunt]
  • https://www.vigilseek.com/bug-bounty [Vigilseek (Agregador de Bug Bounty)]
  • https://cantina.xyz/ [Cantina]

• Newsletters / Coleções

  • https://newsletter.blockthreat.io/ [BlockThreat]
  • https://rekt.news/ [REKT]
  • https://weekinethereumnews.com/ [Week in Ethereum News]
  • https://quillaudits.substack.com/ [HashingBits]
  • https://web3sec.news [Web3sec.news]

• Palestras / Vídeos

  • https://www.youtube.com/watch?v=lJQwuyW4t-k [IWCON-S22]
  • http://www.youtube.com/watch?v=P8LXLoTUJ5g [LiveOverflow]
  • https://www.youtube.com/watch?v=zcJmWr5_GOc [Mentalidade de Segurança Web3]
  • https://www.youtube.com/watch?v=QSmtVR0aniI [Segurança e Vulnerabilidades em Web3]
  • https://www.youtube.com/playlist?list=PLox242_JhiuEe64LzW1M8XpiQ2-N5bZsX [Playlist]
  • https://www.youtube.com/watch?v=A5s9aez43Co&list=PLO5VPQH6OWdXKPThrch6U0imGdD3pHLXi [Damn Vulnerable DeFi CTF]
  • https://www.youtube.com/watch?v=cOP9z9XWjwc [Atacando a Autorização]
  • https://www.youtube.com/watch?v=TmZ8gH-toX0 [Auditar um Smart Contract]
  • https://www.youtube.com/watch?v=gyMwXuJrbJQ [Curso de 32 Horas]

• Aprender Solidity

  • https://cryptozombies.io/ [CryptoZombies]
  • https://www.learnweb3.io/ [LearnWeb3]
  • https://www.smartcontract.engineer/ [Smart Contract Engineer]
  • https://solidity-by-example.org/ [Solidity by Example]
  • https://www.web3.university/ [Web3 University]
  • https://www.useweb3.xyz/ [useWeb3]

• Relatórios de Auditoria

  • https://github.com/chainsulting/Smart-Contract-Security-Audits [Chainsulting]
  • https://code4rena.com/reports [Relatórios Code4rena]
  • https://consensys.net/diligence/audits/ [Consensys]
  • https://github.com/Quillhash/QuillAudit_Reports [QuillAudits]
  • https://github.com/spearbit/portfolio/tree/master/pdfs [Spearbit]
  • https://github.com/sherlock-protocol/sherlock-reports [Sherlock]
  • https://github.com/0xNazgul/Blockchain-Security-Audit-List [Lista de Auditorias]
  • https://github.com/shieldify-security/audits-portfolio [Shieldify]

• Certificações

  • https://secops.group/certified-blockchain-practitioner [CBP]
  • https://blockchaintrainingalliance.com/products/cbsp [CBSP]