awesome-web3-security

一份为渗透测试人员和漏洞赏金猎人精心整理的 Web3 安全资料与资源列表。

If you find that some links are not working, you can simply replace the username with gmh5225. 
Or you can send an issue for me.

向以下所有项目致敬，完美的艺术作品 🫡

如何贡献？

• https://github.com/HyunCafe/contribute-practice
• https://docs.github.com/en/get-started/quickstart/contributing-to-projects

AI 智能体技能

本仓库提供了可用于 AI 智能体和编码助手的技能，例如 Cursor、OpenClaw、Claude Code、Codex CLI 以及其他兼容工具。安装技能即可获取有关 Web3 安全主题的专业知识。

在 learn-skills.dev 上查看

安装：

npx skills add https://github.com/gmh5225/awesome-web3-security --skill <skill-name>

可用技能：

技能	描述
mev-security	MEV 概念、常见攻击及缓解措施
awesome-web3-security-overview	理解并为该资源列表做出贡献
smart-contract-security	EVM/Solidity 智能合约安全
solana-security	Solana/Sealevel 安全研究
web3-security-tooling	安全工具（分析器、模糊测试器、反编译器）
wallet-security	钱包安全（MPC/TSS、密钥管理、钓鱼）

示例：

# Install smart contract security skill
npx skills add https://github.com/gmh5225/awesome-web3-security --skill smart-contract-security

# Install multiple skills
npx skills add https://github.com/gmh5225/awesome-web3-security --skill solana-security --skill wallet-security

安全入门包

• CTF / 练习

  • https://capturetheether.com/ [Capture the Ether]
  • https://ethernaut.openzeppelin.com/ [The Ethernaut]
  • https://www.damnvulnerabledefi.xyz/ [Damn Vulnerable DeFi]
  • https://blockchain-ctf.securityinnovation.com/#/ [Security Innovation Blockchain CTF]
  • https://github.com/nccgroup/GOATCasino [GOAT Casino]
  • https://github.com/paradigm-operations/paradigm-ctf-2021 [Paradigm CTF]
  • https://github.com/blockthreat/blocksec-ctfs [Blocksec CTFs]
  • https://ciphershastra.com/ [ciphershastra CTF]
  • https://github.com/SunWeb3Sec/DeFiVulnLabs [DeFiVulnLabs]
  • https://quillctf.super.site/ [QuillCTF]
  • https://www.vulnmachines.com/ [Vulnmachines]
  • https://www.web3pwn.com/ [Web3Pwn]

• 测试网 / 水龙头

  • https://sepolia.dev/ [Sepolia 资源]
  • https://faucet.circle.com/ [Circle 水龙头 (Sepolia USDC)]

• 思维导图

  • https://www.xmind.net/m/2zbPP7/ [常见漏洞思维导图]
  • https://coggle.it/diagram/YqLzaiSABzXD4UnZ/t/smart-contract-auditor [审计员思维导图]
  • https://xmind.works/share/zfdeD07U [工具思维导图]

• 入门工具

  • https://github.com/Quillhash/Web3-Security-Tools [Web3-Security-Tools]
  • https://remix-project.org/ [Remix]

• 博客 / 事后分析

  • https://medium.com/immunefi [Immunefi]
  • https://blog.openzeppelin.com/security-audits/ [OpenZeppelin]
  • https://quillaudits.medium.com/ [QuillAudits]
  • https://blog.solidityscan.com/ [SolidityScan]
  • https://medium.com/@Beosin_com [Beosin]
  • https://neptunemutual.medium.com/ [Neptune Mutual]
  • https://blocksecteam.medium.com/ [BlockSec]
  • https://www.certik.com/resources/blog [CertiK]
  • https://mouse-run.beehiiv.com [mouse-run]

• 漏洞赏金

  • https://immunefi.com/ [Immunefi]
  • https://hackenproof.com/programs [HackenProof]
  • https://code4rena.com/ [Code4rena]
  • https://gitcoin.co/explorer [Gitcoin]
  • https://hackerone.com [HackerOne]
  • https://spearbit.com/ [Spearbit]
  • https://app.sherlock.xyz/ [Sherlock]
  • https://audits.sherlock.xyz/contests [Sherlock 竞赛]
  • https://saloon.finance/ [The Saloon]
  • https://hats.finance/ [Hats Finance]
  • https://secure3.io/ [Secure3]
  • https://app.secure3.io/ [Secure3 竞赛]
  • https://securr.tech/ [Securr]
  • https://r.xyz/ [Remedy]
  • https://hunt.r.xyz/ [Remedy Hunt]
  • https://www.vigilseek.com/bug-bounty [Vigilseek (漏洞赏金聚合器)]
  • https://cantina.xyz/ [Cantina]

• 新闻通讯 / 合集

  • https://newsletter.blockthreat.io/ [BlockThreat]
  • https://rekt.news/ [REKT]
  • https://weekinethereumnews.com/ [Week in Ethereum News]
  • https://quillaudits.substack.com/ [HashingBits]
  • https://web3sec.news [Web3sec.news]

• 演讲 / 视频

  • https://www.youtube.com/watch?v=lJQwuyW4t-k [IWCON-S22]
  • http://www.youtube.com/watch?v=P8LXLoTUJ5g [LiveOverflow]
  • https://www.youtube.com/watch?v=zcJmWr5_GOc [Web3 安全思维]
  • https://www.youtube.com/watch?v=QSmtVR0aniI [Web3 中的安全与漏洞]
  • https://www.youtube.com/playlist?list=PLox242_JhiuEe64LzW1M8XpiQ2-N5bZsX [播放列表]
  • https://www.youtube.com/watch?v=A5s9aez43Co&list=PLO5VPQH6OWdXKPThrch6U0imGdD3pHLXi [Damn Vulnerable DeFi CTF]
  • https://www.youtube.com/watch?v=cOP9z9XWjwc [攻击授权]
  • https://www.youtube.com/watch?v=TmZ8gH-toX0 [审计智能合约]
  • https://www.youtube.com/watch?v=gyMwXuJrbJQ [32 小时课程]

• 学习 Solidity

  • https://cryptozombies.io/ [CryptoZombies]
  • https://www.learnweb3.io/ [LearnWeb3]
  • https://www.smartcontract.engineer/ [Smart Contract Engineer]
  • https://solidity-by-example.org/ [Solidity by Example]
  • https://www.web3.university/ [Web3 University]
  • https://www.useweb3.xyz/ [useWeb3]

• 审计报告

  • https://github.com/chainsulting/Smart-Contract-Security-Audits [Chainsulting]
  • https://code4rena.com/reports [Code4rena 报告]
  • https://consensys.net/diligence/audits/ [Consensys]
  • https://github.com/Quillhash/QuillAudit_Reports [QuillAudits]
  • https://github.com/spearbit/portfolio/tree/master/pdfs [Spearbit]
  • https://github.com/sherlock-protocol/sherlock-reports [Sherlock]
  • https://github.com/0xNazgul/Blockchain-Security-Audit-List [审计列表]
  • https://github.com/shieldify-security/audits-portfolio [Shieldify]

• 认证

  • https://secops.group/certified-blockchain-practitioner [CBP]
  • https://blockchaintrainingalliance.com/products/cbsp [CBSP]