Audit Application Form
Let's talk
Please provide your current email address, to which we can send a notification with the course start dates once it's determined.
MixBytes Farm
Free course "Smart Contract Auditor" for developers
from blockchain researchers and practicing auditors of the MixBytes team.
45 days
24 days
4 days
6 days
Duration:
Lectures and tests:
Capture The Flag:
Final audit:
30 days
21 days
3 days
6 days
Duration:
Lectures and tests:
Capture The Flag:
Final audit:
Why this course
Learn a new high-demand profession and upgrade your current skills in blockchain security.
You will be able to find a job in blockchain security and work with interesting DeFi projects as an auditor.
Become part of the MixBytes Camp professional community.
Stages of training
Joining the closed
Having successfully passed the entrance test, you and other students will be added to a group where you can ask questions to the lecturer, discuss tasks, and share your ideas as you study.
Joining the closed
course group
course group
You are to attend a theoretical course which consists of 12 lectures and 12 tests. Access to each of the following lectures is opened only after passing a test. You are given 24 days to complete the course.
Education
Education
CTF
To consolidate the theoretical knowledge, MixBytes auditors have prepared interesting practical tasks with relevant DeFi cases for you. You can take part in a competition with other students for the title of the Top Bug Hunter.
CTF
(Capture The Flag)
(Capture The Flag)
Final audit
After passing the theoretical part and the CTF, you will be given a real smart contract audit project to find vulnerabilities in it. Your final work will be to prepare an audit report with a list of detected vulnerabilities and recommendations for their elimination.
Final audit
After successfully passing the final audit and receiving feedback from the teacher, you will join the MixBytes Camp community of auditors where you can continue your further professional development in DeFi security and smart contract auditing.
MixBytes Camp
MixBytes Camp
Course program
- Ethereum-based networks
- common architecture of Ethereum
- tx distribution process
- forming and validation of blocks
- distribution of blocks
- consensus and finalization
- transaction processing
- Ethereum protocol implementations
- smart-contracts:
- contracts bytecode
- tx execution, EVM
- stack-machine, EVM instructions
- functions, storage, logs,
- determinism and fundamental restrictions in tx processing
- tx processing
- O(1) complexity in terms of each resource in smart-contracts
- execution difficulty, basic resources: cpu, memory, storage, network
- gas & fees
- opcode pricing, gas, gas price
- typical gas price for operations: arithmetics, branching, load, store
- opcode pricing, gas, gas price
- O(1) complexity in terms of each resource in smart-contracts
- tx ordering
- MEV
- MEV
- events signatures
- Solidity functions
- selectors, calldata, parameters passing
- selectors, calldata, parameters passing
- payable and non-payable addresses
- fallback function
- fallback function
- contracts storage
- slots, variables, dynamic types
- slots, variables, dynamic types
- cross-contract calls
- CALL, DELEGATECALL
- CALL, DELEGATECALL
- contracts upgradeability
- proxy contracts, versioning
- proxy contracts, versioning
- contracts deployment
- CREATE & CREATE2 deployment
- SELFDESTRUCT issues
- deployment addresses, nonces
- CREATE & CREATE2 deployment
- contract fabric pattern
- merkle trees and membership proofs
- sending ETH pattern
- ERC20 token contract
- balances, transfers, allowances
- mint/burn patterns
- decimals, floats, token maths
- balances, snapshots
- calculation errors, unsuccessful transfers, poisoned tokens
- balances, transfers, allowances
- IOU (I Owe yoU) as main DeFi pattern
- wrapped token pattern, wETH example
- wrapped token pattern, wETH example
- handling time
- crowdsale pattern
- staking pattern
- multisig actions
- example: Gnosis multisig wallet
- example: Gnosis multisig wallet
- offchain signatures, erecover
- malleability, replayability, EIP712
- malleability, replayability, EIP712
- oracles
- external data to contracts
- onchain/offchain aggregation
- case: Chainlink oracles
- oracles frontrunning
- external data to contracts
- onchain randomness
- common DeFi projects architecture
- Uniswap V2
- swap pairs, constant product, fabric, liquidity providing
- swap pairs, constant product, fabric, liquidity providing
- Compound
- lending/borrownig mechanics
- CToken, Comptroller contracts
- risk parameters, oracles & liquidations
- lending/borrownig mechanics
- AAve
- lending/borrownig mechanics
- AToken, LendingPool contracts
- risk parameters, oracles & liquidations
- flashloans
- lending/borrownig mechanics
- Yearn
- vaults & yield farrming
- vaults & yield farrming
- practice
- use flashloans to perform liquidations in AAve
- use flashloans to perform liquidations in AAve
- reentrancy
- external CALLs and return values
- ETH/ERC20 balances vulnerabilities
- ERC20 tokens, security flaws
- memory/storage variables misuse
- arithmetics, overflows, rounding errors
- storage slot collisions
- misc vulnerabilities: tx.origin, isContract() checks, etc…
- transaction reordering and MEV
- onchain randomness problems
- gas optimisation issues
- binary packed values collisions
- offchain signatures
- misc human attention errors
- financial & hybrid attacks
- oracle prices manipulations
- review of important hacks in DeFi
- security checklist review with hacks examples
- competition in format "Capture The Flag"
- 5 smart-contracts (levels) are deployed to the testnet, participants' task is to solve as much, as possible and confirm the completion of each level onchain, using information about vulnerabilities from previous lectures
- scoring is based on amount of solved levels and time, spent on the tasks
- full smart-contract audit task
- fixed scope of code, being analyzed
- online audit with MixBytes auditor to observe the vulnerability discovery process
- audit of code by participants, using information about vulnerabilities from previous lectures
- preparation of the audit report with all findings in standardized format by participants
- opening of reports, discussion, review of all found and not found vulnerabilities in given scope
- review of the final audit report involving participants of the course
FAQ
To successfully complete the entire course, you need to:
If you have any questions, do not hesitate to contact our Course Supervisor.
- know well algorithms and data structures
- read, write and understand low-level patterns: working with binary data, mathematical algorithms
- be able to understand the logic of someone else's code in Python, C/C++
- understand basic cryptoprimitives (encryption, hashing, digital signature)
- be able to find logical problems and inconsistencies in someone else's code
- be able to effectively learn new documentation in English
If you have any questions, do not hesitate to contact our Course Supervisor.
Any questions left?
Days
Hours
Minutes
Seconds