DeFi Developer Road Map

Here we collect and discuss the best DeFi & Blockchain researches and tools - contributions are welcome.

Feel free to submit a pull request, with anything from small fixes to translations, docs or tools you'd like to add.

• Disclaimer: All information (tools, links, articles, text, images, etc.) is provided for educational purposes only! All information is also based on data from public sources. You are solely responsible for your actions, not the author ❗️

Translations:

• French
• Korean
• Japanese
• Italiano
• Telugu
• Gujarati
• Spanish
• Chinese
• Yoruba

Roadmap

Navigation

• French
• Korean
• Japanese
• Italiano
• Telugu
• Gujarati
• Spanish
• Chinese
• Yoruba

Topic	Instant Link
Basics	Explore
dApps	Explore
Frameworks	Explore
zk-snarks	Explore
Further Readings	Explore
Security	Explore
DeFi	Explore
ENS	Explore
NFT	Explore
Stable Coins	Explore
General Info	Explore
Side Chains	Explore
MEV	Explore
Tools Collection	Explore
ETH 2.0	Explore
Front End	Explore
Project Manag.	Explore

| Special Notes:

• My Blog on Medium
• My X account
• All known smart contract-side and user-side attacks & attack vectors
• An awesome cheatsheet from the Pessimistic.io Team
• All-about-NFT security
• Solidity language cheatsheets, tools and references collection
• Solidity Tutorials

Basics:

• Learn the basics of Distributed Ledger Technology (DLT)
• Bitcoin protocol Explained
• Elliptic Curve Cryptography
• Read Blockchain Explained
• Watch Blockchain - A visual demo
• Watch But how does bitcoin actually work? - 3b1b
• Learn the basics of Computer Science
• Learn DeFi In-Depth - just watch this YouTube playlist
• Teach yourself crypto - visit teachyourselfcrypto.com
• Try Capture The Ether Game

Ethereum

• Learn the basics of Ethereum
• Ethereum Virtual Machine (EVM): turing complete
• Learn about Wallets, Accounts (EOA), Private/Public Keys
• Learn about transactions, Gas, Metamask
• Ethereum clients/Nodes, Geth
• Infura infrastructure

EVM

• NOXX
• Digging deep into the EVM mechanics during contract function calls - Part 1
• Let's take a trip down memory lane - Part 2
• Demystifying Storage Slot Packing - Key Knowledge for the EVM Hackers - Part 3
• Under The Hood - Storage Opcodes In the Go Ethereum (Geth) Client - Part 4
• Another Weapon in the EVM Hackers Arsenal - The Power of Delegate Call - Part 5
• A Treasure Trove of Data - Transaction Receipts & Event Logs - Part 6
• Understanding Trie Databases in Ethereum
• EVM Chad
• Mudit.Blog
• Academic_Smart_Contract_Papers
• cmichel.io
• serial-coder.com
• notonlyowner.com
• Decentralised
• Awesome Blogs
• What happens when you send 1 DAI
• The Complete Guide to Full Stack Ethereum Development
• Ultimate roadmap for web3 developers "from zero to master"
• Solidity Cheatsheets Pack + Bonus
• L2s Explained
• EVM article series - Decipher with Zaryab
• Decipher EVM Puzzles Game(For better understanding of Opcodes in a fun way)

Check out

• A bunch of learning resources to choose from here: pentacle.xyz
• EVM In-Depth
• LearnEVM
• Useful Solidity Patterns
• CryptoBook
• Smart Contract Auditing Checklist
• Hardhat
• Remix
• Foundry
• EIPs
• Wagmi Toolset
• WalletConnect Library

Useful Information

• Solidity Docs
• What is a Smart Contract
• EVM Opcodes
• Beginner's Guide to Yul
• Yul for Gas Optimisation
• Decompiler
• WTF Gas Optimisation
• Solidity by Example
• OpenZeppelin
• EVM Explained
• Useful Solidity Patterns

Directions

• Awesome roadmap.sh RoadMaps Collection
• Vikvikvikkk Repo
• Awesome Ethereum Staking
• The Daily Ape
• Sov's Compendium
• Diamond Crab
• Immersion Den
• Egor Gavrilov
• Curious Daddy
• Patrick Collins
• Solidity Tutorials
• Solana Dev & Degen Tools Packk
• Genesis 0x01: Simplified Roadmap for Blockchain Security
• Blockchain security guide
• DevPill
• EatTheBlocks YouTube Channel
• Moralis Web3
• Solidity Security Explained
• Retrospective: Hacks in Web3
• Medium : severity vulns
• High : severity vulns

Smart Contract

• Basics of Smart Contract: Top 10 free Web3 courses
• Life Cycle of Smart Contract
• Ethereum Higher Level languages (Solidity, Vyper, LLL, Serpent)
• Compiling, testing, Deploying smart Contracts
• Interacting with smart contracts using web3.js or web3.py
• Read How does Ethereum work, anyway?
• Read this article
• Read the Truffle Documentation / Hardhat Documentation
• Read the Web3 Documentation / Ethers Documentation
• Read Book Mastering Ethereum and watch this channel
• Read Solidity Smart Contract Library and Solidity Base with Tutorial from Zombies
• Read Flash Crash for Cash Cyber Threats in Decentralized Finance

Resources to learn Solidity

• cryptozombies.io
• smartcontract.engineer
• solidity-by-example.org
• useweb3.xyz
• Solidity Tutorials
• Books & Researches
• Navigation: officercia.eth
• Solidity Cheatsheets Pack + Bonus
• Solidity Treasures
• Solidity Learning Chat
• Dev Solidity Chat
• Crypto Telegram & Discord Channels & Chats
• Slitherin: Slither Detectors by Pessimistic.io
• WTF Solidity

Smart Contract Standards

• ERCs - Ethereum Improvement Proposals

Tokens

• ERC-20 - Token contract for fungible assets.
• ERC-721 - Token standard for non-fungible assets.
• ERC-1155 - Token standard for semi-fungible tokens
• ERC-918 - Mineable Token Standard.
• ERC-1363 - Payable Token Standard.
• ERC-4626 - Tokenized Vault Standard.
• Token Interaction Checklist

Others

• ERC-165 - Creates a standard method to publish and detect what interfaces a smart contract implements.
• ERC-725 - A standard interface for a simple proxy account.
• ERC-173 - A standard interface for ownership of contracts.

General Development Skills

• Learn GIT
• Create a few repositories on GitHub / GitLab
• Share your code with other people!
• know HTTP(S) protocol, request methods (GET, POST, PUT, PATCH, DELETE, OPTIONS)
• Don't be afraid of using Google, Power Searching with Google
• Get familiar with terminal (Linux/Docker), configure your shell (bash, zsh, fish)
• Read a few books about algorithms and data structures, blockchain, Ethereum, solidity
• Do this course Ethereum and Solidity: The Complete Developer's Guide
• Free tutorial Learning Solidity
• Introduction to Smart Contract Development with Solidity and ERC20 Programming
• Tudelft Repo
• Ethers.org Library
• Web3js.org Library
• TypeChain Library
• Viem Library
• web3.py - for Python
• The Framework to help you securing your protocol

Try this tools:

• eth-cli - CLI tools.
• REPL - Solidity REPL.
• Remix - Online realtime compiler and runtime.
• gencall-cli - An interactive smart contract encoder and sender from your ABI file
• Web3modal
• Optimize Solidity Function Name - Optimize function names to reduce costs
• solc-typed-ast compiler - TypeScript package providing a normalized typed Solidity AST along with the utilities necessary to generate the AST (from Solc) and traverse/manipulate it.
• Slither Explained - for audit
• explorer.swiss-knife.xyz

dApps

• Get familiar with tools that you will be using:

Package Managers

• npm
• yarn
• pnpm

IDE's

• Remix IDE
• Remix IDE Desktop Release
• Ethfiddle
• labs.superblock
• Truffle
• Solidity v0.8.17
• Vyper
• Atom
• Etheratom
• Autocomplete Solidity
• Language Solidity
• Vim solidity
• Vim vyper
• YAKINDU Solidity Tools
• VSCode with Solidity Visual Developer
• Solana VS Code Extension - First VS Code extension for Solana with real-time security analysis (9 detectors) and Trident fuzz coverage visualization
• vscode-solidity-lang Solidity Semantic Highlighting for VSode. available at vscode marketplace
• MetaMask OpenRCP API Playground - View and Interact with MetaMasks RPC API
• Dive Deep into Wagmi & How to Create a Web3 App
• Extrapolating concepts to Web3 — Coding (and understanding) a Decentralized Bank using Solidity

Practice

• Learn Ethereum development by making a Zombie Game
• Yul and Some Solidity Optimizations and Tricks
• Read and make and example: Pet shop tutorial
• Learn Abstract Algebra!
• Learn how to build smart contracts with Python and Vyper: Ape Academy
• Time-locked Wallets: An Introduction to Ethereum Smart Contracts
• The Ultimate ENS and ĐApp Tutorial
• Ultimate Introduction to Ethereum Ðapp Development
• Ethernaut is a Web3/Solidity based wargame for those interested in learning ethereum
• Ethereum and Solidity: The Complete Developer's Guide
• Consensys best practices - This document provides a baseline knowledge of security considerations for intermediate Solidity programmers. It is maintained by ConsenSys Diligence, and the broader Ethereum community.
• Solidity Patterns - A compilation of patterns and best practices.
• Smart Contracts Threats DB - A compilation of the worst patterns.
• ETH.build An Educational Sandbox For Web3
• Node Guardians Story-rich Quests with practical coding challenges

ZK-SNARKs

General info

• ZK-SNARKs-VS-ZK-STARKs
• Why and How zk-SNARK Works: Definitive Explanation
• learn.0xparc.org
• ProofsArgsAndZK.pdf
• zk-learning.org
• zero-knowledge-canon
• Introduction to Zero-Knowledge Proofs
• Zero-knowledge proof learning journey
• zkp.science - All you should know about ZK-SNARKs
• ZoKrates - A toolbox for zkSNARKS on Ethereum
• The AZTEC Protocol - Confidential transactions on the Ethereum network, implementation is live on the Ethereum main-net
• Nightfall - Make any ERC-20 / ERC-721 token private - open source tools & microservices
• Proxy Re-encryption (PRE)
• NuCypher Network - A proxy re-encryption network to empower data privacy in decentralized systems
• pyUmbral - Threshold proxy re-encryption cryptographic library
• Fully Homomorphic Encryption (FHE)
• NuFHE - GPU accelerated FHE library
• Zero knowledge proofs starter pack
• ZK-Research DB
• An awesome post from Vitalik.eth
• Zk snarks under the hood
• Awesome zero knowledge proofs
• Awesome zk
• The missing explanation of ZK-SNARKs
• Why and How zk-SNARK Works
• The Zero-Knowledge Landscape
• Your Guide to Write zkSNARKs in Go
• Building your first zk dapp using snarks & circom
• ZK Tools Directory & Boilerplate
• A beginner's intro to coding zero-knowledge proofs

ZK-STARKs

• StarkWare and StarkWare Resources - StarkEx scalability engine storing state transitions on-chain
• zkSNARKs vs zkSTARKs: a primer
• Breaking Down Recursive ZK-STARKs

Frameworks

Truffle Suite

• Truffle
• Ganache
• Drizzle

Akula

• Akula - an implementation of Ethereum protocol ("client") written in Rust, based on Erigon architecture.

ZeppelinOS

• Getting Started

Labs.Superblock

Note: Superblocks is depreciated

• Labs.superblocks
• dapp Tutorial

Infura (A Gateway to Ethereum)

• Mainnet End Point
• Rops TestNet End Point
• Kovan TestNet End Point
• Rinkby TestNet End Point
• IPFS

NodeReal(A high-performance node service)

• Meganode
• DirectRoute

Other Frameworks

• Frameworks List - Ethereum Frameworks Listing.
• Hardhat - Flexible, extensible and fast Ethereum development environment.
• Ape - The smart contract development tool for Pythonistas, Data Scientists, and Security Professionals.
• Brownie - Brownie is a Python framework for deploying, testing and interacting with Ethereum smart contracts.
• Embark - Framework for DApp development
• Waffle - Framework for advanced smart contract development and testing, small, flexible, fast (based on ethers.js)
• Etherlime - ethers.js based framework for Dapp deployment
• Parasol - [Depreciated] Agile smart contract development environment with testing, INFURA deployment, automatic contract documentation and more. It features a flexible and unopinionated design with unlimited customizability
• 0xcert - JavaScript framework for building decentralized applications
• OpenZeppelin SDK - OpenZeppelin SDK: A suite of tools to help you develop, compile, upgrade, deploy and interact with smart contracts.
• sbt-ethereum - A tab-completey, text-based console for smart-contract interaction and development, including wallet and ABI management, ENS support, and advanced Scala integration.
• Cobra - A fast, flexible and simple development environment framework for Ethereum smart contract, testing and deployment on Ethereum virtual machine(EVM).
• Ether Jar Java integration library for Ethereum blockchain
• Starport - A CLI tool for building sovereign IBC-enabled blockchains.
• Sign in with Ethereum | SIWE- Workflow to authenticate Ethereum accounts using message signing in order to establish a cookie-based web session that manages user metadata.
• Foundry - A smart contract development toolchain for project compilation, dependency management, testing, deployments, on-chain interactions...
• Solmate - These contracts have been audited but they were not developed with users in mind. They mainly seek to optimize gas and optimizations for smart contract development
• OpenZeppelin Relayer - Open-source, self-hosted transaction relayer for EVM chains, Solana and Stellar: submits transactions through an HTTP API, manages nonces, signs with keys held in a keystore, a cloud KMS, HashiCorp Vault or Turnkey, and takes TypeScript plugins.

Interacting with Smart Contract

• Web3.js
• Web3.py
• Web3j
• ethers.js
• Web3 by Example : Web3 by Example is a hands-on introduction to web3 development using annotated example programs.

Python Ethereum Eco System

• Ethereum.org
• Article

Distributed Storage Systems

• Arweave
• INFO
• IPFS
• MESON
• SWARM
• Storej
• Sia

Test Blockchain Networks

• Paradigm Faucet - claim testnet ETH here
• Ethnode - Run an Ethereum node (Geth or Parity) for development, as easy as npm i -g ethnode && ethnode.
• Ganache - App for test Ethereum blockchain with visual UI and logs
• Kaleido - Use Kaleido for spinning up a consortium blockchain network. Great for PoCs and testing
• Besu Private Network - Run a private network of Besu nodes in a Docker container
• Orion - Component for performing private transactions by PegaSys
• Artemis - Java implementation of the Ethereum 2.0 Beacon Chain by PegaSys
• Cliquebait - Simplifies integration and accepting testing of smart contract applications with docker instances that closely resemble a real blockchain network
• Local Raiden - Run a local Raiden network in docker containers for demo and testing purposes
• Private networks deployment scripts - Out-of-the-box deployment scripts for private PoA networks
• Local Ethereum Network - Out-of-the-box deployment scripts for private PoW networks
• Ethereum on Azure - Deployment and governance of consortium Ethereum PoA networks
• Ethereum on Google Cloud - Build Ethereum network based on Proof of Work
• Infura - Ethereum API access to Ethereum networks (Mainnet, Ropsten, Rinkeby, Goerli, Kovan)
• CloudFlare Distributed Web Gateway - Provides access to the Ethereum network through the Cloudflare instead of running your own node
• NOWNodes - NOWNodes provide a full access to Ethereum testnets and access to more than 110 blockchain RPC nodes via API
• Chainstack - Shared and dedicated Ethereum nodes as a service (Mainnet, Ropsten, Rinkeby)
• Alchemy - Blockchain Developer Platform, Ethereum API, and Node Service (Mainnet, Ropsten, Rinkeby, Goerli, Kovan)
• ZMOK - JSON-RPC Ethereum API (Mainnet, Rinkeby, Front-running Mainnet)
• Watchdata - Provide simple and reliable API access to Ethereum blockchain
• GetBlock - Blockchain RPC access to Ethereum blockchain and 50 + others
• Azul - Free, no-signup public RPC for Base mainnet (chainId 8453). No API key required.

Test Ether Faucets

• Sepolia Faucet
• Mumbai Faucet
• Goerli faucet
• Universal faucet
• Nethereum.Faucet - A C#/.NET faucet
• List of Faucets for Public Testnets

Front End

UI Components

• Learn React on official website or complete some courses
• React Roadmap
• aragonUI - A React library including Dapp components
• components.bounties.network - A React library including Dapp components
• ui.decentraland.org - A React library including Dapp components
• dapparatus - Reusable React Dapp components
• Metamask ui - Metamask React Components
• DappHybrid - A cross-platform hybrid hosting mechanism for web based decentralised applications
• Nethereum.UI.Desktop - Cross-platform desktop wallet sample
• eth-button - Minimalist donation button
• Rimble Design System - Adaptable components and design standards for decentralized applications.
• brave-ui - List of reusable React components to empower your brave UI
• DApp frontend security - In this article, Author will take a look at security for DApps.

Project management

• Dework | Web3 Trello with token payments, credentials, bounties...
• Wonderverse | Jira alternative with an intuitive task management system that allows DAOs to pay contributors and collaborate in their projects.

Important (security)

• Building Secure Smart Contracts
• SCSVS
• Solidity audits and secure development material
• SCSVSv2
• Valuable Resources for Web3 Security
• Pashov Audit Group Skills

Further Readings

Inspired by:

• ETH Dapp Developer Roadmap
• DeFi Defence DAO Tools
• Blockchain Learning Path
• 链新社 (ChainNewsClub) - Chinese blockchain & Web3 structured learning platform — Chinese-language platform covering DeFi, smart contracts, and Web3 development paths
• ADF
• DeFi Toolkit
• BlockTools
• SAW List
• Public APIs
• BTC List
• ConsenSys
• EVM Tools
• Solidity Pro
• Zhihu Research Base
• OpenZeppelin - Contracts / Test Helpers + More
• Awesome Ethereum Resource Lists
• Comprehensive Ethereum Developer Resource List
• Smart Contract Learning
• Awesome Cryptoeconomics
• Tudelft Repo
• The Reading List and This repo with Engineering Data List
• Eth Reentrancy Attack Patterns
• Plugin for testing smart contracts
• Solidity function profiler
• Smart Contract Attack Vectors
• DeFi security list
• DeFi Threats Base
• Hacking
• Secureum Bootcamp
• SCSVS
• Smart Contract Inspector
• Blocksec ctfs
• Builder List
• From 0 to Web3.0

Security & Safety:

• Understanding SIM Swap Attacks and How to Safeguard Yourself
• Discord Security A-Z
• All known smart contract side and user side attacks
• Visit my Blog
• Visit blog.pessimistic.io
• All resources to become a smart contract auditor!
• How to become a smart contract auditor
• Blockchain Security Genesis
• Intro security hacking smart contracts on Ethereum
• Books & Researches
• Per Aspera ad Astra

• Blockchain Security Roadmap - This article will be laying down a path/roadmap, following which users will easily enter into the field of Blockchain Security together.
• The Eye of Horus: Spotting and Analyzing Attacks on Ethereum Smart Contracts -Investigation shows that the number of attacks did not necessarily decrease over the past few years, but for some vulnerabilities remained constant.
• Analysis of Bitcoin Vulnerability to Bribery Attacks Launched Through Large Transactions - In this paper, authors design a novel bribery attack and show that this guarantee can be hugely undermined.
• Vulnerability of Blockchain Technologies to Quantum Attacks - Here authors analyze the major blockchain-based cryptocurrencies deployed today -- including Bitcoin, Ethereum, Litecoin and ZCash, and determine risk exposure to quantum attacks.
• BLOCKEYE - Hunting For DeFi Attacks on Blockchain. In this paper, authors proposed BLOCKEYE, a real-time attack detection system for DeFi projects on the Ethereum blockchain.
• Topological Anomaly Detection in Dynamic Multilayer Blockchain Networks - Authors introduce a new topological perspective to structural anomaly detection in dynamic multilayer networks.
• Verification of the Incremental Merkle Tree Algorithm with Dafny - Authors present our new and original correctness proof of the algorithm along with the Dafny machine-checkable version.
• GoHammer Blockchain Performance Test Tool - This tool will help in developing more efficient decentralized systems and will affect decreasing the costs of developing decentralized application projects.
• EtherClue: Digital investigation of attacks on Ethereum smart contracts - In this work, authors study the problem of post-factum investigation of Ethereum attacks using Indicators of Compromise specially crafted for use in the blockchain.
• Requirement Analyses and Evaluations of Blockchain Platforms per Possible Use Cases - This document provides a generic model of understanding blockchain and its applications.
• A Note on Privacy in Constant Function Market Makers - In this note, authors show that privacy is impossible with the usual implementations of CFMMs under most reasonable models of an adversary and provide some mitigating strategies.
• A Survey of Security Vulnerabilities in Ethereum Smart Contracts - This paper explains eight vulnerabilities that are specific to the application level of BT by analyzing the exploitation case scenarios of these vulnerabilities.
• An approach to detect Denial of Service Vulnerability in Ethereum Smart Contracts - In this paper, authors propose a framework that combines static and dynamic analysis to detect DoS due to an unexpected revert in ETH Smart Contracts.
• AGSolT: a Tool for Automated Test-Case Generation for Solidity Smart Contracts - Authors found that AGSolT is capable of achieving high branch overage with both approaches and even discovered some errors in some of the most popular Solidity smart contracts on Github.
• Temporal-Amount Snapshot MultiGraph for Ethereum Transaction Tracking - Authors propose TASMG to model Ethereum transaction records as a temporal-amount network and then present TAW to effectively embed accounts via their transaction records, which integrates temporal and amount information of the proposed network.
• Demystifying Cryptocurrency Mining Attacks: A Semi-supervised Learning Approach Based on Digital Forensics and Dynamic Network Characteristics - This paper addresses the detection of crypto mining attacks in a generic network environment using dynamic network characteristics.
• FASTEN: Fair and Secure Distributed Voting Using Smart Contracts - Authors prove that the probability of privacy breaches is negligibly small. Further, cost analysis of executing FASTEN over Ethereum is comparable to most of the existing cost of elections.
• Interdependencies between Mining Costs, Mining Rewards and Blockchain Security - This paper studies to what extent the cost of operating a proof-of-work blockchain is intrinsically linked to the cost of preventing attacks, and to what extent the underlying digital ledger security budgets are correlated with the cryptocurrency market outcomes
• HyperSec: Visual Analytics for blockchain security monitoring - HyperSec, a visual analytics monitoring tool that provides relevant information at a glance to detect ongoing attacks on Hyperledger Fabric.
• Reentrancy Vulnerability Identification in Ethereum Smart Contracts - In this paper, authors present a framework that combines static and dynamic analysis to detect Reentrancy vulnerabilities in Ethereum smart contracts.
• A General Framework for the Security Analysis of Blockchain Protocols - This paper presents a parsimonious abstraction sufficient for capturing and comparing properties of many well-known permissionless blockchain protocols.
• Coinbugs: Enumerating Common Blockchain Implementation-Level Vulnerabilities - The paper is aimed at security testers aiming to start out in blockchain security reviews and blockchain developers as a reference on common pitfalls.
• Vulnerabilities and Open Issues of Smart Contracts: A Systematic Mapping - This paper conducted a systematic literature mapping identifying initiatives and tools to analyze SCs and how to deal with the identified vulnerabilities.
• SuMo: A Mutation Testing Strategy for Solidity Smart Contracts - Authors report a first evaluation of SuMo on open-source projects for which test suites were available. The results authors got are encouraging, and they suggest that SuMo can effectively help developers to deliver more reliable smart contracts.
• (In)Stability for the Blockchain: Deleveraging Spirals and Stablecoin Attacks - The possibility of deleveraging spirals was first predicted in the initial release of this paper in 2019 and later observed in the Black Thursday crisis in Dai in 2020.
• An Anonymous Trust-Marking Scheme on Blockchain Systems - In this paper, authors propose an anonymous trust-marking scheme on blockchain systems that is universally applicable to any cryptocurrency.
• A Framework and DataSet for Bugs in Ethereum Smart Contracts - In this paper, to fill the gap, authors first collect as many smart contract bugs as possible from multiple sources and divide these bugs into 9 categories by extending the IEEE Standard Classification for Software Anomalies.
• Bitwise Operations and Bit Manipulation in Solidity, Ethereum
• BitMaps
• Reentrancy Guard 2.0
• A Secure Multi-chains Consensus Scheme Against Diverse Miners Behaviors Attacks in Blockchain Networks. - Experimental results show that PoDT is secure against DMB attacks and more effective than traditional consensus schemes in multi-chains environments.
• A Survey on Consortium Blockchain Consensus Mechanisms - This paper highilights several state-of-the art solutions in consensus algorithms for enterprise blockchain.
• Web3 Evasion Techniques
• Extracting Smart Contracts Tested and Verified in Coq - Authors implement extraction of Coq programs to functional languages based on MetaCoq's certified erasure.
• Trustless, privacy-preserving blockchain bridges - In this paper, authors present a protocol for facilitating trust-less cross-chain cryptocurrency transfers that preserve privacy of bridge withdrawals.
• Security checklists for Ethereum smart contract development: patterns and best practices - Authors cover the phases of design, coding, and testing and deployment of the software lifecycle.
• Dynamic Vulnerability Detection on Smart Contracts Using Machine Learning - In this work authors propose Dynamit, a monitoring framework to detect reentrancy vulnerabilities in Ethereum smart contracts.
• Targeting the Weakest Link: Social Engineering Attacks in Ethereum Smart Contracts - In this work, authors explore the possibility and existence of new social engineering attacks beyond smart contract honeypots.
• OptSmart: A Space Efficient Optimistic Concurrent Execution of Smart Contracts - In this paper, authors develop a concurrent miner that proposes a block by executing the AUs concurrently using optimistic Software Transactional Memory systems (STMs).
• DEFECTCHECKER: Automated Smart Contract Defect Detection by Analyzing EVM Bytecode - Experimental results show that DefectChecker performs much better than these tools in terms of both speed and accuracy.
• SmartBugs: A Framework to Analyze Solidity Smart Contracts - Authors show how it enables easy integration and comparison of analysis tools by presenting a new extension to the tool SmartCheck that improves substantially the detection of vulnerabilities related to the DASP10 categories Bad Randomness, Time Manipulation, and Access Control (identified vulnerabilities increased from 11% to 24%).
• Profiling Gas Leaks in Solidity Smart Contracts - In this paper, authors identify a set of 19 Solidity code smells affecting the deployment and transaction costs of a smart contract, and assess the relevance of such smells through a survey involving 34 participants.
• Securing Parallel-chain Protocols under Variable Mining Power - In this paper, authors consider the design of provably secure parallel-chain protocols which can adapt to such mining power variations.
• Ethereum SmartContract Vulnerability Detection using Deep Neural Network and Transfer Learning - ESCORT framework enables transfer learning on new vulnerability types with minimal modification of the DNN model architecture and re-training overhead.
• SCSGuard: Deep Scam Detection for Ethereum Smart Contracts - Experimental results manifest that SCSGuard achieves high accuracy (0.94), precision (0.96%) and recall (0.98) for both Ponzi and Honeypot scams, and new Phishing smart contracts.
• Securing Cyber-Physical Systems Through Blockchain-Based Digital Twins and Threat Intelligence - This article focuses on securing CPSs by integrating Artificial Intelligence (AI) and blockchain for intelligent and trusted DTs.
• A Survey on Blockchain Interoperability: Past, Present, and Future Trends - In this post, authors study blockchain interoperability techniques and solutions, providing a holistic overview of blockchain interoperability, paving the way for systematic research in this domain.
• SoK: Transparent Dishonesty: front-running attacks on Blockchain - A paper on secure smart contract designs decisions and front-running possibilities on DApps.
• SoK: Oracles from the Ground Truth to Market Manipulation - A paper that systemizes the design alternatives for oracles, showcases attacks, and discusses attack mitigation strategies.

Web2 cybersecurity

• TryHackMe: Complete rooms with challenges and puzzles to break, all from the browser - Hands on cybersecurity training with real-world tasks
• Disclose: Cross-industry and vendor-agnostic standards for best practives in cybersecurity research - Open source maintainers and industry experts providing a central source for assistance, information, and help via templates, tools, data sets...
• Hack The Box - A Hacker's playground to dynamically and compete against other users in a collaborative ecosystem that promotes hands-on training experience
• OverTheWire - Set of wargames and challenges offered by a community to learn and practice security concepts in fun wargames.
• Pentesterlab - Hands-on labs covering different bu classes from basic to advanced.
• Portswigger labs - Set of web application secrity labs with attached community solutions
• Vulnhub - Users upload "challenge boxes" that often attempt to gain root access by exploiting known vulnerabilities.

Web3 cybersecurity

• Ethernaut by OpenZeppelin - A collection of Web3 wargamees inspired by OverTheWire in the context of the Ethereum Virtual Machine (EVM). Each level is a smart contract that needs to be hacked.
• Damn Vulnerable Defi - An offensive security playground to learn red team cybersecurity in the context of DeFi and smart contracts. Examples include tasks where the users needs to stop the system from working, take out funds from a contract...
• Damn Vulnerable DeFi | Foundry - Same as Damn Vulnerable DeFi but in the context of the foundry development framework.

Web3 CTF (Capture The Flag)

• Capture the Ether - Traditional game consisting of a series of categorized challenges where the user earns points after every successful challenge. The goal is to make the isComplete() function return true.
• Paradigm CTF

DeFI

• Finematics - Educational videos on DeFi
• Formal Analysis of Composable DeFi Protocols - In this paper, authors propose a formal process-algebraic technique that models DeFi protocols in a compositional manner to allow for efficient property verification.
• Transaction Fee Mechanism Design - Authors explain the behavior of fees in blockchains.
• DeFi-ning DeFi: Challenges & Pathway - Good Retrospective into the beginning of decentralized finance.
• A theory of Automated Market Makers in DeFi - Authors exploit our theory to formally prove a set of fundamental properties of AMMs, characterizing both structural and economic aspects.
• From banks to DeFi: the evolution of the lending market - Authors discuss the persisting reliance of DeFi lending on the traditional financial system, and conclude with the outlook of the lending market in the IOV era.
• On the Just-In-Time Discovery of Profit-Generating Transactions in DeFi Protocols -In this paper, authors investigate two methods that allow them to automatically create profitable DeFi trades.
• Maximizing Extractable Value from Automated Market Makers - In this paper authors formally characterize rational miners as players which follow an optimal strategy in the mining game.
• The Decentralized Financial Crisis - In this paper authors explore how design weaknesses and price fluctuations in DeFi protocols could lead to a DeFi crisis.
• Liquidations: DeFi on a Knife-edge- In order to protect protocols from suffering losses, undercollateralized positions can be liquidated. In this paper, authors present empirical analysis of liquidations on protocols for loanable funds (PLFs).
• Measuring Asset Composability as a Proxy for DeFi Integration - Authors seek to understand the degree to which this practice may contribute to financial integration on Ethereum by examining transactions in 'composed' derivatives for the assets DAI, USDC, USDT, ETH and tokenized BTC for the full set of 344.8 million Ethereum transactions computed in 2020.
• Dynamic Curves for Decentralized Autonomous Cryptocurrency Exchanges - Authors propose in this work a new approach to constructing the AMM by proposing the idea of dynamic curves.
• High-Frequency Trading on Decentralized On-Chain Exchanges - In this work authors formalize, analytically exposit and empirically evaluate an augmented variant of front-running: sandwich attacks, which involve front- and back-running victim TXs.
• Flashot - A Snapshot of Flash Loan Attack on DeFi Ecosystem.
• DeFiRanger - Detecting Price Manipulation Attacks on DeFi Applications.
• Attacking the DeFi Ecosystem with Flash Loans for Fun and Profit - Flash Loans. DeFi. Classic.
• SoK: Decentralized Finance (DeFi) - In this Systematization of Knowl