Web3 Security 101
Twelve parts on how smart contracts work, how they get broken and what to watch: from who can call what to the first five minutes of an incident. Each part ends with the rules that would catch it.
How a contract works
- Web3 Security 101Part 1 of 12
What a smart contract actually is: code, state, events and who can call what
A smart contract is code and storage at an address. How calls, events and state work, and what you can see in logs and what only by asking the contract.
SmartAlert - Web3 Security 101Part 2 of 12
Owners, roles and admin keys: where the door is
How OpenZeppelin Ownable and AccessControl decide who can mint, pause or upgrade, why one admin key is a single point of failure, and what to watch.
SmartAlert - Web3 Security 101Part 3 of 12
Upgradeable proxies: why the code behind an address can change
How ERC-1967 proxies, delegatecall and initializers work, why an audited contract can change after the audit, and which upgrade signals you can watch.
SmartAlert - Web3 Security 101Part 4 of 12
Multisigs and Safes: owners, threshold, modules, delegatecall
How a Safe multisig works: owners, threshold, execTransaction, modules, guards and delegatecall. What it protects, what it does not, how to watch it.
SmartAlert
How contracts get broken
- Web3 Security 101Part 5 of 12
Admin key compromise: how IoTeX, PlayDapp and Zoth were taken without a single bug
Most big hacks start with a stolen admin key, not a code bug. Three cases with exact timings, what the chain showed first, and which alerts you can set.
SmartAlert - Web3 Security 101Part 6 of 12
Why bridges are the biggest target: how the Ronin and Orbit bridges lost money
A bridge keeps everyone's tokens in one contract and trusts off-chain signers. Ronin and Orbit step by step: which alerts would fire and which would not.
SmartAlert - Web3 Security 101Part 7 of 12
Oracle and price manipulation, flash loans: what a protocol believes about prices, and the KiloEx case
How an attacker moves the price a protocol trusts, why flash loans make it free, and what the KiloEx hack looked like. Which alerts help, which cannot.
SmartAlert - Web3 Security 101Part 8 of 12
Single-transaction exploits: Radiant, Infini, KiloEx and Bybit, and what monitoring cannot do
Some hacks give no warning: the first sign and the loss are one transaction. Four cases, why an alert on confirmed blocks is late, and what helps.
SmartAlert
How to watch
- Web3 Security 101Part 9 of 12
What to monitor after an audit: a checklist by contract type
An audit checks the code on one day. A checklist of what to watch after it, by contract type: token, proxy, Safe, bridge or vault, keeper wallet.
SmartAlert - Web3 Security 101Part 10 of 12
Events vs state: when no event will come
Events tell you what a contract chose to announce. State is what it holds. Why Ronin's threshold went to 0 silently and how a view-function rule catches it.
SmartAlert - Web3 Security 101Part 11 of 12
Fixed thresholds vs an hourly norm: why one number is always wrong
A fixed alert threshold is noisy by day and blind at night. How comparing each hour with the same hour on earlier days works, and when a fixed number is right.
SmartAlert - Web3 Security 101Part 12 of 12
Incident response: the first five minutes after the alert
An alert is not a response. Who holds the pause key, who gets the alert, what each contract's lever is, how to freeze funds downstream, and a night test.
SmartAlert
Try it free
An address is enough. The first 14 days get Pro limits, and rules are checked on history before they go live.