A curated list of Smart Contract Security materials and resources For Researchers

👾 my notes on decentralized protocols (e.g., oracles, bridges, honeypots, cryptography, decompilers, static analysis, bounties)

We are systematizing everything we know about Solana security into one structured resource: the Solana Security Strategy. It’s a field-tested knowledge base for teams building serious products — packed with practical guidance, reference links, and strategy templates.

Open-source intelligence archive of crypto scam operations — internal chats, admin panels, victim records, and infrastructure data for research and investigation

Here we collect and discuss for Smart contract security & Blockchain researches and tools - contributions are welcome.

A curated collection of tools, frameworks, and methodologies for testing and verifying Solidity smart contracts.

A fun script to steal Ether from wallets suffering from insufficient entropy during key generation.

Blockchain Challenges Collection

List of the public smart contract audit reports and security reviews performed by Hexens.

RugWatch is a real-time Solana rugpull and honeypot detection bot. It monitors new token launches across major DEX ecosystems, analyzes on-chain risk signals (authorities, liquidity, trading rules), and alerts via Telegram and Discord with a clear risk score.

Password-Authentication-Prototype

BlockChain Security

Static solidity smart contracts scanner written in Python

A complete Web3 security toolkit combining AI-powered token auditing, ML-based deployer reputation scoring, and live Etherscan V2 data. Includes static analysis for rugpull detection, RandomForest reputation modeling, contract-fetching automation, and Solidity on-chain registries for transparent, reproducible security insights.

A lightweight static analysis engine for Solidity smart contracts. Extracts code features, detects dangerous patterns (delegatecall, tx.origin, call.value), computes heuristic risk scores, and classifies contracts into Low/Medium/High risk levels. Includes multiple example vulnerabilities and a clean CLI for rapid security assessment.

My Blockchain auditing service

A deep technical article exploring how AI, feature engineering, and static smart-contract analysis uncover rugpull risks before humans detect them. Covers Solidity pattern mining, mint abuse detection, blacklist/fee manipulation signals, ML-inspired scoring models, and how to quantify ERC-20 token scam probability.

👾 my foundry framework and detailed solutions for each ethernaut level

A hybrid Solidity + Python security toolkit that analyzes ERC-20 token contracts using static pattern extraction and ML-inspired scoring. Detects mint backdoors, blacklist controls, fee manipulation, trading locks, and rugpull mechanics. Outputs interpretable risk scores, labels, and structured features for deeper analysis.

EOS dApp Security Incident Analysis Demo

AI-powered real-time smart contract scanner that connects Machine Learning with Etherscan V2 to analyze newly deployed contracts instantly. Fetches verified Solidity code, performs static risk analysis, computes ML-driven deployer trust scores, and generates full security intelligence pipelines for Web3 threat detection.

A crowdfunding platform on blockchain

A deep technical exploration of how malicious smart-contract developers weaponize fee logic in ERC-20 tokens. Covers dynamic tax flipping, hidden sell traps, fee obfuscation, whitelist-based bypasses, liquidity-drain funnels, attack timelines, forensic analysis, mathematical modeling, and ML-powered detection strategies for tax abuse.

A cross-chain intelligence toolkit that maps suspicious smart-contract deployers across Ethereum, BSC, Arbitrum, and Base. Fetches deployer histories using Scan V2 APIs, builds a structured NetworkX graph, extracts ML-ready behavioral features, and assigns heuristic risk scores to identify scam clusters and malicious deployment patterns.

Bytecode Truth, Not Source is a deep technical exploration of why smart-contract source code cannot be trusted as the ground truth for security. This repository shows how compiler optimizations, hidden assembly, proxies, and unreachable logic make verified Solidity misleading, and why only EVM bytecode reveals actual on-chain behavior.

Here is a summary and navigation hub to all the audits I've conducted and I'm allowed to show.

Everything related to blockchain security

No description provided.

Notes about Ethereum, Smart contracts and DApps

Governance, Risk and Compliance (GRC), Information Security, Blockchain Security, Blockchain Forensics