|
1 | 1 | # (Not So) Smart Contracts |
2 | 2 |
|
3 | | -This repository contains examples of common Ethereum smart contract vulnerabilities, including code from real smart contracts. |
4 | | -It also includes a repository and analysis of several [honeypots](honeypots/) |
| 3 | +This repository contains examples of common Ethereum smart contract vulnerabilities, including code from real smart contracts. Use Not So Smart Contracts to learn about EVM and Solidity vulnerabilities, as a reference when performing security reviews, and as a benchmark for security and analysis tools. |
| 4 | + |
| 5 | +## Features |
| 6 | + |
| 7 | +Not So Smart Contracts each include a standard set of information: |
| 8 | + |
| 9 | +* Description of the unique vulnerability type |
| 10 | +* Attack scenarios to exploit the vulnerability |
| 11 | +* Recommendations to eliminate or mitigate the vulnerability |
| 12 | +* Real-world contracts that exhibit the flaw |
| 13 | +* References to third-party resources with more information |
| 14 | + |
| 15 | +Bonus! We have also included a repository and analysis of several [honeypots](honeypots). |
5 | 16 |
|
6 | 17 | ## Vulnerabilities |
7 | 18 |
|
8 | | -- [Bad randomness](bad_randomness/): Contract attempts to get on-chain randomness, which can be manipulated by users |
9 | | -- [Denial of Service](denial_of_service/): Attacker stalls contract execution by failing in strategic way |
10 | | -- [Incorrect Interface](incorrect_interface/): Implementation uses different function signatures than interface |
11 | | -- [Integer Overflow](integer_overflow/): Arithmetic in Solidity (or EVM) is not safe by default |
12 | | -- [Forced Ether Reception](forced_ether_reception/): Contracts can be forced to receive Ether |
13 | | -- [Wrong Constructor Name](wrong_constructor_name/): Anyone can become owner of contract due to missing constructor |
14 | | -- [Race Condition](race_condition/): Transactions can be frontrun on the blockchain |
15 | | -- [Reentrancy](reentrancy/): Calling external contracts gives them control over execution |
16 | | -- [Unchecked External Call](unchecked_external_call/): Some Solidity operations silently fail |
17 | | -- [Unprotected Function](unprotected_function/): Failure to use function modifier allows attacker to manipulate contract |
18 | | -- [Variable Shadowing](variable%20shadowing/): Local variable name is identical to one in outer scope |
| 19 | +| Not So Smart Contract | Description | CWE(s) | |
| 20 | +| --- | --- | --- | |
| 21 | +| [Bad randomness](bad_randomness) | Contract attempts to get on-chain randomness, which can be manipulated by users | |
| 22 | +| [Denial of Service](denial_of_service) | Attacker stalls contract execution by failing in strategic way | |
| 23 | +| [Forced Ether Reception](forced_ether_reception) | Contracts can be forced to receive Ether | |
| 24 | +| [Incorrect Interface](incorrect_interface) | Implementation uses different function signatures than interface | |
| 25 | +| [Integer Overflow](integer_overflow) | Arithmetic in Solidity (or EVM) is not safe by default | |
| 26 | +| [Race Condition](race_condition) | Transactions can be frontrun on the blockchain | |
| 27 | +| [Reentrancy](reentrancy) | Calling external contracts gives them control over execution | |
| 28 | +| [Unchecked External Call](unchecked_external_call) | Some Solidity operations silently fail | |
| 29 | +| [Unprotected Function](unprotected_function) | Failure to use function modifier allows attacker to manipulate contract | |
| 30 | +| [Variable Shadowing](variable%20shadowing/) | Local variable name is identical to one in outer scope | |
| 31 | +| [Wrong Constructor Name](wrong_constructor_name) | Anyone can become owner of contract due to missing constructor | |
19 | 32 |
|
20 | 33 | ## Credits |
21 | 34 |
|
|
0 commit comments