How to Audit a Smart Contract | Can you find the Solidity Security Vulnerabilities?

We learn the auditing 101 of smart contracts, and understand basic tooling for doing an audit, like slither, echidna, mythx, etc. At the end of this, we will know the audit process, the basics of how to conduct one, and how to interact with auditors. This works for solidity, vyper, or even rust smart contracts! (Although, the tooling isn't the same for every language!)
👩🏻‍💻 Code: github.com/PatrickAlphaC/hard...
👆👆👆👆👆👆
The code has even MORE links from the video!
🔐 Secureum: secureum.substack.com/p/audit...
✍️ Blog: (Coming Soon)
🔥 Latest freeCodeCamp Ultimate video: • Learn Blockchain, Soli...
Check out these articles to learn about some of these tools and start your journey as a smart contract engineer!
👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇👇
📕How to Become a Blockchain Engineer: betterprogramming.pub/how-to-...
✍️Top 10 Resources, Tutorials, and Follows: dev.to/patrickalphac/top-10-s...
👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆👆
✅✅ Donate ✅✅
I use donated funds to spend money on making fun & informational videos.
ETH/Polygon/Avalanche/EVM Chains Wallet address:
0x9680201d9c93d65a3603d2088d125e955c73BD65
Or, optionally:
- patrickalphac.eth (ETH Only)
😸😸Join the community!😸😸
Chainlink developers discord: / discord
Twitter: / patrickalphac
Medium: / patrick.collins_58673
TikTok: / patrickalphac
Twitch Stream Uploads & Shorts: / @patrickalphac-alt
Twitch: / patrickalphac
All thoughts and opinions are my own.

[@0xharambe]

Awesome video Patrick! Love your content 🤩 More people need to pay attention to smart contract auditing - very important and profitable area for developers!

[@javierdash1]

When do you sleep? You really are brilliant. I'm on hour 19 of your fantastic 32 hour tutorial. And I just saw on linkedin the post of this new video. I congratulate you. You are a genius and I thank you for all you are doing for the ecosystem. We need more people like you that despite what is currently happening with the drop in prices, you put your chest out because you know that it is not just about a token, but about all the value that decentralization represents. In the end... time will prove right all of us who believe in a fairer and more egalitarian system.

[@PatrickAlphaC]

Thanks for the kind words fren! I’m definitely no genius. I started making content because it was the only way for topics to solidify themselves in my head. The past few weeks since the course came out have been the best sleep in a while ahah. Sleep and recharging is important! But yes, we need more people to focus on what matters so we can scale.

[@raj-nq8ke]

Which 32 hour tutorial you are talking about. I need to know

[@javierdash1]

@@raj-nq8ke hi! the one that Patrick made to teach us everything about smart contracts: kzbin.info/www/bejne/naqwqIurf9eVgLM

[@luce36]

@@raj-nq8ke freecodecamp solidity

[@unpopulartrip5827]

@@PatrickAlphaC do you have an apustaja neon sign that you're keeping hidden somewhere

[@nipperipper4625]

Hello Patrick, Hope you are well, and hope you will extend this series in depth. I went thru all of your tutorials, built some top notch projects, now i figure its time to deal with security. Thanks

[@nothinglastsforever0000]

You’ve earned a new sub. Great job and thank you for sharing your knowledge

[@sebby868]

Great video and explanation. Thanks for the resources as well. Very helpful.

[@coder8515]

Really helpful. High quality content. Thanks for sharing

[@harrytr.277]

This is so valuable!

[@dreadrobertscanady1285]

So you actually follow the results of twitter polls on your timeline! Thanks for doing so

[@PatrickAlphaC]

I’m all about delivering for the peeps fren :)

[@EduardoNicoleit]

You're an Absolute Legend, Patrick. Cheers from Brazil!

[@PatrickAlphaC]

💪🔥❤️

[@SK-vg3mw]

Faboulous! Thank you so much!👍👍

[@quanit6428]

You're the best, learned a ton of things from this video

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@cryptopat2214]

You sir have a talent for creating and explaining very complex content in a very easy to understand way, I have been jumping around learning resources for a long time and not once did I come across a single video that outlines the most important bits one needs to sort out in order to pursue these challenges. I wanna add one thing to whoever might be reading this and was looking for any additional advice that could help them, I really can’t stress enough how important it is to also master note taking and especially revising it with each contract. There’s so much more bugs out there..

[@PatrickAlphaC]

YES! Master note taking :)

[@comosaycomosah]

Man you are the most helpful l!

[@ivanlagade]

superb content! keep it up sir..

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@hypemoon]

because of you, i'm running a solidity audit company

[@PatrickAlphaC]

LETS GOOOOO!!! Good luck fren!!!

[@arabcrypto]

Happy to meet u in Denver eth

[@hudieldf]

This video is definitely the best one in Crypto tech area!

[@PatrickAlphaC]

Thanks fren

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@saneryee1431]

Very magical and incredible. I was researching and learning about smart contract auditing recently. At that time, I didn't search for related content on my KZbin. So, of course, I searched for a lot of knowledge about contract auditing on Google Search. The author's video is recommended on my KZbin homepage today, and this video is 100% what I want. That is amazing. Finally, thanks to Patrick, this video addresses all my questions about smart contract auditing, it's worth watching many times, and you don't need to pause and take notes.

[@PatrickAlphaC]

Thanks fren 💪

[@saneryee1431]

​@@PatrickAlphaC Are there any tools here for Gas analysis? Thank you.

[@PatrickAlphaC]

@@saneryee1431 do -gas with the hardhat gas plugin

[@saneryee1431]

@@PatrickAlphaC Thanks.

[@zerocool2765]

Sensei, Should I start my journey in web 3 bug bounty or traditional bug bounty? Thanks for the awesome content. Liked and Subbed!

[@magnetto90]

Only 10k views??? This is gold

[@tw7613781]

thank you~~

[@ordigen_brc20]

Yeah am that Indian who's learning from you this time

[@mehrdad1068]

Please make tutorial for cross chain bridge 🍄🚀

[@Ryan-xq3kl]

Amazing video youre killing it, now pls devs fix bitcoin price >:(

[@woojin7009]

I am curious about ecdsa verifying when connecting and signing a wallet at the frontend. Can you teach me the process of getting the wallet request from the backend and going to the contract using Go Lang's package?

[@mehrdad1068]

How we can deploy a contract in multiple networks (solana, bnb, eth) _ in this case user be able to transfer asset by the all networks

[@David-rz4vc]

Dam this is gold man (or should I say bitcoin, haha). Thanks!

[@alirazzaq1541]

lol. Good one.

[@sbanerjee2005]

You are amazing. This is very helpful. Patrick, I chose to use MythX as opposed to Slither or Echidna. Anything that I would be missing out on?

[@PatrickAlphaC]

MythX is great as a paid service, but it’s good to do your own analysis first!

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@mahtabnorouzi9683]

Great and very helpful content. Just a gentle clarification, fuzzing is a slightly different analysis method than symbolic execution, which makes Echidna not a symbolic execution tool. Nonetheless, your video provides valuable insights into auditing contracts. Thanks!

[@PatrickAlphaC]

Yes! This video is a bit older I have it corrected in newer videos

[@asfandamin8170]

Hello patrick, any hint of how to solve this and install slither correctly without using virtualenv The term 'slither' is not recognized as the name of a cmdlet getting this when trying to use slither. thankyou!

[@holo406]

Patrick, you are simply the best man! currently studying your Solidity course! is there a chance you make a RUST Smart Contract programming course as well? or even a paid version for it? Thank you

[@PatrickAlphaC]

I’ve only done the basics of rust contracts… maybe one day

[@andrewpan3047]

@@PatrickAlphaC can you share a link to the rust contracts basic? and thks again for this amazing content

[@PatrickAlphaC]

@@andrewpan3047 kzbin.info/www/bejne/bZ2UgWaur9dqgNE

[@yourdailyblockchain]

Thanks - super new to smart contract security. I have installed slither-analyzer but when I try and run it it says slither command not found. Not sure if I need to add Slither to my PATH on Mac. Python version: 3.8.2 PIP3 version 23.1.2 It looks like I have Slither version 0.9.3 but nothing runs and I can't run slither --version. "-bash: slither: command not found"

[@markeljan]

Epiccc

[@dani3l898]

In a situation whereby, you clone into a project and it doesn't have both package.json file and the node_modules, how do you go about this? The project itself has dependencies

[@nikhilmore3771]

Is data structures are important to build smart contract with solidity?

[@arfazshaikh907]

100k.... we need the merch with the Frog Coder on It 👩🏻‍💻 👩🏻‍💻 👩🏻‍💻 👩🏻‍💻

[@PatrickAlphaC]

Done. 100% will do that at 100k

[@mehrdad1068]

Please make a clone tutorial, Like MATIC,solana, Decentraland or axie infinity ♾️🚀

[@nobody-bt7mu]

That was fast!

[@PatrickAlphaC]

You ask I deliver

[@mehrdad1068]

Please make tutorial for EstateRegistry API Decentraland to creating editable and updateble nft land

[@iirekm]

Can you give info which version of eth-security-toolbox you used? It's always good to append version number to used containers, because the recent seems to be broken (echidna fails with Permission denied: 'crytic-export')

[@PatrickAlphaC]

ahhhhhh.... Yes I should of added that. Could you make an issue on the repo?

[@Brian-vs9sd]

If someone is trying to find flaws to existing contracts, is there a decompiler that actually is able to decompile to readable contracts. I am on some DeFi projects and would like to be able to see if they have done their job properly.

[@PatrickAlphaC]

There are some, they are in beta tho ethervm.io/decompile

[@dadatimileyin_]

my slither not install correctly, is there any way to fix that

[@fasfasdfa6886]

Patrick do you think that is better work always whit new version of solidity? Or is okay work whit the version that we know or been worked before?

[@PatrickAlphaC]

A lot of the newer versions have “better” stuff. But if you’re doing low level stuff, stick with what you know. Each version has slight differences. Ideally tho, you learn the new stuff and use the new stuff

[@Elwin-uu1qi]

Thanks Patrick for the video tutorial, But it seems I can not run slither in windows since solc-select don't support windows yet..😑

[@unaiiglesias9901]

Thanks, have you more info about subject?

[@Skylla54]

100k Subscriber Idea: RubberduckExplaining while jumping out of a plane! I would watch that😂 Thanks for such amazing content 💃

[@PatrickAlphaC]

OH. MY. GOD. This idea

[@remingtonsmith1372]

When I run slither it exits with Command failed with exit code 255 rather than 31, but it still shows the static analysis messages. Does this make any difference? Am I doing anything incorrectly?

[@PatrickAlphaC]

Could you make this a question on stack exchange ETH with more information and then drop it here?

[@giskalia3629]

Hello patrick, thank you for video tutorial, I had already install slither, but command not found in terminal, I am using vscode with nodejs and python integration, what should I do? thank you

[@giskalia3629]

anyone can help me?

[@PatrickAlphaC]

Could you make a question on stack exchange eth? Thanks

[@cleverblocks6422]

Hi Patrick, my name is Gabi and I am a Blockchain & Software developer, I am trying to grow my channel where I am sharing my knowledge about Web3 development, I really love your videos and you inspired my to continue learning until I came to a level where I can teach things myself to other people ! Thank you ! ❤

[@PatrickAlphaC]

Awesome! Keep it up!

[@KingsGuardVids]

Subbed

[@razorjhon2622]

Patrick , Thank u so much for the fcc js 32 hours course , but can i ask u why do i struggle following the project and i have hard time understand solidity and hardhat , is that normal ? and what do i need to do to master this ?

[@PatrickAlphaC]

You'd have to get more specific about what you're stuggling with. But sometimes, you just need more practice!

[@razorjhon2622]

@@PatrickAlphaC is it okay to do bad smart contract and mistakes at first ? also can i ask u how many years it took u to be able to make good solidity codes ?

[@PatrickAlphaC]

@@razorjhon2622 Sure! Just don't deploy them to mainnet and ask users to use them! It took a couple years, but it's a process where even now, I still try to get better every day.

[@masudrahman253]

7:35 Slither

[@rocco_zero]

hey there, is your Full Blockchain course is still valid after ETH merge like everything in that course good to go? or there are some changes to be made? if yes then please tell me which part i have to skip or do extra research on now.. i will really appreciate

[@PatrickAlphaC]

100% good to go :) Follow along in the course, and I'll give you tips at every corner

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@sl5946]

Where would a complete beginner to coding start? I'd like to eventually become a web 3 dev but I'm pretty sure I need to learn the basics first. Thanks

[@PatrickAlphaC]

Check the description of the video - one of those two links I point too(with the 👆emoji) is what you want!

[@sl5946]

@@PatrickAlphaC awesome thank you

[@dcg348]

hi patrick ,, i am new in the space .your Audit a Smart Contract process can be apply for solana ?

[@PatrickAlphaC]

The methods can, but not the tools

[@dcg348]

@@PatrickAlphaC thanks

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@IcEtEa1843]

Hey there. Thanks for your awesom videos. Now im working as a IT System Engineer and getting into the security field (blue team). Now I know python because of my IT degree and im trying to get into web3 a bit. Now my question: Do i need to learn javascript for web3 or is it also viable to use python? If it goes to fullstack web/dapp then javascript is probably a must. But I in the future want to do security audits, is there a way around javascript or are most of the dapps... running with javascript. (ofc I need to learn solidity :P)

[@PatrickAlphaC]

If you know python, use python. You 100% don’t need to know javascript. I think knowing JS is good if you want to make websites, and that’s really it

[@IcEtEa1843]

@@PatrickAlphaC thank you very much for your advice. Really appreciate that you answer such questions. Love your vids

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@AmerJarada]

Hey, I am getting the error "slither: error: unrecognized arguments: @chainlink=node_modules/@chainlink'" how i can fix that please ?

[@PatrickAlphaC]

You have to add imports to the slither command, or download hardhat so slither compiles with hardhat. Can you ask on stack exchange ETH and then post a link to the question here?

[@UnsentPH]

Is this the same with Validators task?

[@PatrickAlphaC]

What do you mean?

[@mattjaf]

Where are the instructions to get started with docker? I'm on windows 7 and installed version 19 toolbox and it gave me kitematic (alpha) and docker quickstart terminal and im trying to figure out how get the daemon started

[@PatrickAlphaC]

This is a good starting point: docs.docker.com/desktop/install/windows-install/

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@user-hr8iz9lb3g]

what is the difference between your 32h javascript tutorial and the 16h python one? I am a backend person who dislikes working with js and I would like to know if the difference between the two courses is important enough to make me start the js one instead of the python one.

[@PatrickAlphaC]

If you like python, do the python one! I wrote this article to help explain the difference. medium.com/@patrick.collins_58673/learn-blockchain-development-in-one-of-these-two-videos-c7db210b98fd

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@user-hr8iz9lb3g]

@@PatrickAlphaC Thanks

[@mattiauliano2534]

Hi Patrick, I have a doubt, blockchain seems to be having a bad period, many people say that blockchain developers will have to diversify skills to have job opportunities. What do you think about? Do I need to worry? (question for everyone)

[@PatrickAlphaC]

Always go back to fundamentals. What is the value proposition of the technology? If the answer is compelling to you, then you yourself will know if there will be future opportunity. To me, the value prop of blockchain is a completely remastered financial system of accountability and transparency, with smart contracts at the core. To me, that means it's here to stay. Given two financial institutions, one where everything is transparent and one where they just tell you to trust them, which one are you going to pick?

[@mattiauliano2534]

@@PatrickAlphaC Thanks for making me think, you're right. I'm taking your fcc blockchain js course it's gold thanks 🙏🏼

[@zulfiqar7967]

I learnt your brilliant Freecodecamp Web3 Solidity course.. it's gave a shape to my knowledge on Blockchain.. We have a seperate discord channel for learning this course, and we solve bugs, we helping eachother.. i think, you once visited. now we expect some advance projects with advance concepts to learn from you, which helps us to improve skills

[@robotframework101]

👍

[@californiasunshine956]

I'm a new subscriber from india✋ I do not have any knowledge about coding and I want to be a ethical hacker but now I got to know about smart contract hacking. Could u please tell me from where do I start. Smart contract audit or basics following ethical hacking course?

[@PatrickAlphaC]

Start with smart contracts fren!

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..For more enquiries, reach out⬆️⬆️⬆️..

[@mikeha]

ethernaut doesn't work for me, I keep getting this error: Uncaught TypeError: Cannot assign to read only property 'chainId' of object '#'. It seems to have something to do with NextJS because I get that same error if I run the default Next JS boilerplate project, it seems like it doesn't like my metamask extension in brave

[@mikeha]

turns out it is a brave issue, you need to set the default wallet to None in brave to get rid of this error

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@nedonviews5182]

Please I want to learn smart contract auditing. And am a complete beginner

[@PatrickAlphaC]

Take the Cyfrin Updraft security course!

[@HAHAHAHAHAHAHAHAHAAAAAA]

Error: There are no open workspace folders to run slither on. No matter what OS i use no matter what python version i use i keep on getting here, if this passes it brings like 11 errors asking if I'm in the right directory, does anyone know the cause? I'm going crazy atp

[@PatrickAlphaC]

Could you ask on stack exchange ETH or the slither GitHub?

[@edwassermann8368]

what is a coder frog supposed to be???

[@PatrickAlphaC]

You!

[@deanmajidy6197]

i get error's when I try to run "yarn slither" all my dependencies are installed. Error Command failed with exit code 255

[@PatrickAlphaC]

You’d need to make an issue on the repo with more information. Thanks!

[@trueman8413]

hello, where are you 😔 i started watching 32hours lesson 2days ago

[@PatrickAlphaC]

Good :)

[@thileepanilankumaran6840]

"Failed building wheel for pysha3" when I try to install "pip solc-select". searched google can't find. Can someone help ?

[@AmerJarada]

Your environment is not set probably. Try installing wheels.

[@thileepanilankumaran6840]

@@AmerJarada I downgraded Python from 3.11 to 3.10. Working fine now.

[@theviperxxsy1041]

smart contract audits is difficult

[@matiasbraconi825]

when a new exploit or bug is discovered, are they updated?

[@PatrickAlphaC]

It can get tricky… but yes - they have to be. If you don’t deploy an upgrade ability though you have to migrate all users to a new contract

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@badboy-ox6my]

why do you alwasys promote frog so much ? any specific reason ?

[@PatrickAlphaC]

I just like the frog

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@8koi245]

last commit be like: nah

[@nickeast4853]

thanks for the tutorial !! but when i run slither ./contracts , it says: Error: Source "@openzeppelin/contracts/token/ERC20/ERC20.sol" not found: File no t found. could you help me on this ? thanks Patrick !

[@jackpaperhands]

Dear Patrick, I know it is totally out of the blue, but I need your help. I have a project I'm building and I need your help. I can't afford you but all I want is an estimate and tech stack, and general feedback on what it takes to build a project like this. Can I send you a pitchdeck and could you give me 15 minutes of your time to give some feedback? Your biggest fan.

[@PatrickAlphaC]

Thanks for the kind words. I'm really swamped myself and generally can't give project feedback for free.

[@jackpaperhands]

@@PatrickAlphaC No worries. Thanks anyway.

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@smokinted6492]

Hi Patrick - is it possible to send you a message on Twitter? FYSA, looking for some coder guidance.

[@PatrickAlphaC]

Feel free to ask in public!

[@smokinted6492]

@@PatrickAlphaC Question is more career based, so feel better asking privately. If not, no worries, appreciate all your content and value-added materials.

[@kovychchat__my_Teleqram_id]

For more enquiries, reach out⬆️⬆️⬆️..

[@EastXwesT]

thanks Jeff Bezos i really appreciate learning from you

[@PatrickAlphaC]

I decided Amazon was overrated

[@andreapetteno4432]

hi i am a 15 year old guy studying your flash loan video on aave and posting the transaction on testnet network rinkeby tells me in the vsc terminal command not found so i kindly wanted to ask you if you would give me one day we can connect on google meet for a call and solve the problem together. thank you. very kind would you give me an email from you to stay in touch and decide the day of the call? I care a lot