Beginner Roadmap to Smart Contract Auditing

[@haruxe5140]

This video couldn't come at a better time! Documentation is so limited in the auditing space, you are the goat Andy 🐐

[@andyli]

thanks mate, appreciate it! 🐐

[@udoma8]

Yes, I agree with you. There is limited resources in the auditing space. Thanks Andy, will be looking forward to more crumbs from you.

[@danielcawley1051]

hey im a 14 year old that is in tutorial hell right now, ive learned solidity + react js for 8 months now so after learning security (which I already know the basics of - e.g. reentrancy), I can make money :) Thank you so much for inspiring me, I really appreciate the work your put into these videos

[@andyli]

It is amazing you are getting into this at 14 years old, THAT is inspiring

[@danielcawley1051]

follow up, I've completed ethernaut and damn vulnerable defi and I'm just about to finish off completing secureum and then I'm gonna jump into it

[@andyli]

Awesome, see you in the arena 🚀

[@luigixb1]

@@danielcawley1051 Thats awesome man!

[@danielcawley1051]

@@luigixb1 something even more awesome is that ive recently got my first payout and ive earned 91$, i just need to keep this up

[@laiyintam6349]

5k bounty and 2 high severity on first 2 months, awesome!

[@andyli]

Thanks!

[@devotedros]

@laiyintam6349 Could u share ur discord ?

[@devotedros]

@laiyintam6349 Could u share ur discord ?

[@Studiom44]

Been searching high and low for the info you've shared here! Thank you so much!!!

[@andyli]

Glad it was helpful!

[@PaladinOfWeb3]

Always wanted to find a way to link my cyberspace career and my cryptospace hobby, glad the algorithm made me pass through your channel.

[@andyli]

hail to the algorithm

[@baroonjha3160]

This is the video I'm awaiting for.Thanks Andy ,Great video .

[@andyli]

Cheers!

[@alaazingi5784]

Hello Andy, I am 2nd year computer science student and learning solidity was a hobby for me that evolved into deep interest. Thank you for really educational videos they are helping me a lot to break into auditing.

[@andyli]

awesome, glad to hear!

[@natanaelconcha92]

Been waiting on a video like this, it's fairly new so not many people talk about it

[@andyli]

True

[@maryonacross03]

selamlar sizin bu videonuz olmasaydı ilerlemem daha zor olacaktı herşey için teşekkürler.

[@Rudra0x01]

This is very helpful video, as this field are very limited of resources.

[@tangflx]

your video is gold! keep up the good work!

[@andyli]

Thank you, appreciate it!

[@tangflx]

@@andyli I might kickstart bug bounty career bcoz of u. Thanks!!

[@andyli]

Nice, good luck!

[@mlntdtechbae]

I'm so glad I decided to learn SM development & auditing! Currently learning via's Patrick's course. These kinds of rewards/payouts are very encouraging, lol.

[@andyli]

Nice! Rewards did go down a by recently though

[@mlntdtechbae]

@@andyli Good to know. Only makes me want to learn faster, lol.

[@Machinebrains2Mcd]

This is so amazingly put together will study your advice + opinions to gain better understanding solidity security audits grinding my way thanks Andy

[@andyli]

Glad it was helpful!

[@vomivore]

Thanks for taking time to make this feedback!

[@andyli]

no prob!

[@matthewlee112]

Fool, now I will be able to audit smart contracts too!

[@andyli]

Yeah? But I have a 2 month head start 😈

[@matthewlee112]

@@andyli im gonna borrow the time stone

[@erictee6950]

Keep it up Andy !

[@andyli]

🙌

[@morganweaver4230]

ABout to start an auditing fellowship, this is fantastic. Rally good specific resources and general commentary on the learning process in auditing--because security is a really complex and technical field in tech, let alone crypto.

[@andyli]

Nice one, getting into a auditing fellowship. Which company was it?

[@thomash5390]

Very cool - how did you find the fellowship?

[@andyli]

It might be this yacademy.dev

[@bobbychase5616]

such a banger video! so fun to watch the success from learning a new thing i wonder if the hassle of traditional bug bounty led you to crypto auditing or was it general interest. im still on my oscp journey so i hope this space isnt too crowded by the time i jump in. cheers!

[@andyli]

Thanks! I stumbled onto this randomly when I saw a someone post about the Damn Vulnerable Defi CTF on twitter. I doubt it will be crowded anytime soon

[@digitalchinmay263]

How to actually write reports of low risk issues in code4rena submissions ?

[@andyli]

have a look at the previous audit reports to get some ideas

[@tangjunnz]

thank you so much, awesome 👍👍

[@andyli]

👍👍

[@abdulhaqmohammed]

This is the exact thing I was looking for. Thank you so much Andy👍

[@andyli]

Glad it was helpful!

[@rahulpujari5601]

What a beautiful detailed roadmap! Thanks so much for sharing Andy 👌

[@andyli]

Glad you enjoyed!

[@ethisfreedom]

I hope it gets crowded! We need more security!

[@MichelLedig]

please keep going with the channel u are helping me build my journey so much. If karma exists this shit will go back twice to you Much love from Brasil!

[@andyli]

💯 more to come!

[@ashhadali7592]

incredible video i like it hope u create more on methodology

[@andyli]

Thanks! I will think about how to create a video on methodology

[@ashhadali7592]

@@andyli waiting create live auditing video also Thanks in advance u done great job

[@PetritK10]

That's what I wanted for 2023 :D

[@andyli]

😀

[@ms-ej4gd]

Best roadmap. Subscribed

[@ayushmanthapa_onion]

this is great andy! thanks alot

[@andyli]

🙏

[@yufang173]

Awesome, thanks!

[@andyli]

👍

[@garyb99]

You have awesome content! Keep up the good work

[@andyli]

Thanks!

[@samratgupta8487]

Great video thanks😇

[@andyli]

🙌

[@jrsantos1737]

Oh man, i read the article of legendary auditor C.Michel, he says it will take years before reviews will become useful for newbies in coding. Ouch that hurts! Im currently on 3rd month of javascript study coming from accounting background. Somehow i touch the finance concepts of derivatives during college years, this might help me to shift to smart contract auditor. Wish me luck!

[@andyli]

Yeah, finance concepts will help a lot. Good luck!

[@devabdee]

Thank you so much for creating this video.Really helpful. May God bless you. Also, Can you pls make a video on how to submit the findings? I actually didn't understood how submitting works. Do I need to make pull request or just copy and paste the part of the code before and after?One video on that would be really helpful. Thanks again

[@andyli]

Have you registered to become a Warden yet? Once you get confirmed, you submit findings directly on the code4rena website.

[@marquisebrown2397]

Thank You, amazing video !

[@andyli]

Thanks!

[@marquisebrown2397]

Once I finish Ethernaut do you think that’s enough info to get started on Code 4 Rena ?

[@andyli]

@@marquisebrown2397 also read the secureum findings

[@marquisebrown2397]

@@andyli Thank you, do you know where I could get more than 1 Rinkeby test network ETH ?

[@francoisguyot789]

Amazing content

[@andyli]

Thanks!

[@akshayaileni5258]

Any video how to do this whole process. Like spotting and reporting and stuff.

[@lacag-lacag]

Thank u man been waiting this video alot but i wanna ask what kind of laptop do i need to participate the bugs is it ok 4GB ram

[@andyli]

4GB is fine, you only need to browse GitHub and a text editor

[@katelibra]

Awesome 🤩

[@andyli]

Thanks 🤗

[@MartinMarchev]

Thanks for this amazing video! Both useful and inspiring!

[@andyli]

Glad it was helpful!

[@하동현-d5e]

Finally!

[@andyli]

First comment 😊

[@evmlionel]

Thanks for sharing! Since this space is so fast-paced, is there anything you would change for 2023?

[@andyli]

Not really, the learning resources are the same. Perhaps learn Foundry instead of Hardhat

[@internetkids5813]

Great video

[@andyli]

ty!

[@S0L4RW4V3]

I took about a year off from bug bounties after multiple dups @.@ or nothing for days like a big noob. Time really became precious after my former employer reduced by seniority & Tbh i was discoraged but knew that i just needed to improve so i began to study for htb's cpts. I will sit the exam soon and pass :D. After that my plan is to spam my application again.However, In the mean time , i wanted to reenter the bug bounty space. T.t i just miss "researching" lol and immunifi was an option. This is my first time hearing about code4rena and im excired to befome a warden. Lol sorry for the dump..mainly this is a thankyou for sharing

[@andyli]

Nice, good luck hunting!

[@adriapajaresaguilera572]

This is gold

[@andyli]

thanks!

[@dhom440]

Many thanks for the video, I like your process 👍

[@andyli]

Thank you! Cheers!

[@apostle5135]

yay ! another video :D

[@andyli]

:D

[@lagrariscale8567]

if i have no cyber security experience and i have little knowledge on solidity . is there any chance me finding bugs on code arena ?

[@andyli]

it will just take you a bit longer to start finding bugs, start with the solidity tutorial

[@ashhadali7592]

@@andyli how much solidity is need to find bugs

[@nang88]

🐐 video

[@andyli]

🙌

[@James-li3ro]

Im a web developer tryna break into security. would you suggest knowing about traditional pentesting before moving on to web3 security?

[@andyli]

I don't think it is necessary, there are some concepts that help but I wouldn't consider them prerequisites

[@James-li3ro]

Thanks bro! Really thorough video. I appreciate your comment. Are you still working on traditional pentesting?

[@andyli]

Yep, I only do bug bounties part time

[@digitalchinmay263]

Hey Andy, Can we get the notes of your secureum findings' classification. It will help us a lot.

[@andyli]

github.com/andyfeili/SecureumFindings

[@RJX_777]

Hey Andy, is there a specific reason why you recommend doing CTF before learning solidity tutorial? Right now Im doing Solidity tutorial first, but it's not sticking very well and am confused by all the different little rules. Thinking about just jumping into CTF based on this video. Thanks

Hey, how about you now? I learned solidity a few days ago and have the same question.

[@EUU100]

Thank you so much!

[@andyli]

No problem!

[@lllllIllIl.IIIlllIll]

Ty for the video, is this still up to date?

[@devadevans700]

Thank u😍

[@andyli]

No problem!

[@gideonnwankwo999]

see you at the arena..... noobie here

[@mujtabaaltayib7417]

thank you so much

[@andyli]

👍

[@web3studynotes]

Hello Andy, thank you for sharing this! Super helpful!! Do you currently provide any 1:1 consulting service on security contract audit?

[@andyli]

Do you mean teaching or private audits?

[@web3studynotes]

@@andyli teaching. I am currently looking for help to break into web3 security space. Please let me know if you are available. Thanks!

[@andyli]

Yeah can do. Feel free to reach out on twitter or any of the other social links on the channel

[@TripleA679]

Hi, is this roadmap still relevant now at 2024?.

[@miraclemaxwell9988]

I’m learning ethical hacking can I combine with this?

[@vns1111]

hi andy is thier a way to remove swepper bot

[@andyli]

Not sure what you mean by swepper bot

[@RS-nc5qx]

Is it best to go the developers route or cybersecurity for this? This is all a bit of everything.

[@andyli]

You can learn this directly if it is what you want to do

[@chibatomosuke5080]

Do you have link of this slide?

[@andyli]

found it! docs.google.com/presentation/d/1Zx9DoS4wTAfu7d2WSSQHuVp3c1hwO3mOS3K76EbhIAE

[@chibatomosuke5080]

@@andyli coool! You should add to description.Thanks!

[@ashhadali7592]

will u create video how to perform auditing new in this field

[@andyli]

go through the learning resources listed here and read past audit reports

[@MrJCollector]

Can i ask how do you join code4rena as a bug hunter?

[@andyli]

fill out this form and join the Discord channel code4rena.com/warden-registration/

[@niclans82]

Hi Andy, your video pique my interest to learn about smart contract hacking /auditing. Do you think a total beginner in coding can follow through your guide and be good at this? Would it be possible?

[@andyli]

Yeah it is possible. You will just need to spend more time on the Solidity tutorial - it is 32 hours long and assumes no prior knowledge.

[@niclans82]

@@andyli thanks a lot for your feedback Andy. Yeah, thinking of being good at understanding Solidity basics first before going further. My goal is to start as a smart contract developer and then gradually learning to be a smart contract auditor. I see many possibilities in Web3 and I hope to be ready to capilitalize once the bulls take over from the bear market.

[@MrNike95]

May i ask you that im on my journey for the oscp in 2023 is it worth it or should i focus on web3 security and start learning the fundamentals ? and What kinda job can i work after that .I watched some videos and it looks very interesting

[@andyli]

You can work as a security engineer in web3, try some CFTs and see if you like this type of work.

[@SKardasisLJC4E]

Did you have to become a Solidity developer first, in order to be able to find bugs?

[@andyli]

not necessarily, I am not a Solidity developer

[@SKardasisLJC4E]

@@andyli Thanks Andy. This actually gives me hope.

[@0xfoster958]

Hey Andy, do you take students or are you open to mentoring?

[@andyli]

Open to exploring taking students or mentoring. Reach out on discord or twitter

[@keccak32]

hey Andy! I am just starting. Is this Roadmap relevant for now or any updates?

[@andyli]

Yep still relevant, thinking of doing an updated version though

[@keccak32]

@@andyli Do it please

[@liongames7078]

Do you need a computer science knowledge and be really good at math

[@andyli]

Programming knowledge and math helps.

[@dishalroy5948]

How much time it takes to complete all the topics

[@andyli]

took me about 5-6 months

[@madhuvarun2790]

What is QA?

[@andyli]

Quality assurance or low severity issues

[@castmate8778]

Is this still effective in 2024? 😢

[@MoKamal1490]

+1

[@steveaxel6333]

nice

[@andyli]

Cheers

[@saikatkarmakar955]

capture the ether is not working anymore

[@andyli]

ah might be because Rinkeby testnet is deprecated

[@patricksfeir6947]

I think it's extremely hard to get a job as an entry level smart contract auditor, they all go for seniors.

[@andyli]

Some firms are hiring juniors, but you're right it is generally harder to get junior positions in any industry due to more competition

[@theviperxxsy1041]

smart contract Auditor is hard job in the world and very very difficult

[@andyli]

yeah difficult but worth it

[@jd-yf6he]

Hey buddy, do u have a discord or telegram group ?

[@andyli]

There is a discord link on the channel description

[@dixiegolden3681]

Great video! Thank you man

[@andyli]

thanks!