// web3 --security --bootcamp
Over $2 billion was stolen from crypto in 2024 alone (Chainalysis). Most of it was preventable. This bootcamp teaches you to write, break, and audit smart contracts — hands-on, in Solidity, with the same tools professional auditors use.
// curriculum
No slideware. You'll deploy vulnerable contracts, exploit them, then fix them. That's the only way this sticks.
MODULE 01
Storage vs. memory, visibility modifiers, the EVM gas model, and how state actually lives on-chain. You can't secure what you don't understand at the opcode level.
MODULE 02
Reentrancy (the DAO, still happening), oracle manipulation, front-running / MEV, integer issues, and access-control failures. We reproduce each one against live testnet code.
MODULE 03
Run the industry-standard analyzer, read its output, and separate real findings from noise. Automated tools catch the obvious — you learn where they stop.
MODULE 04
Property-based testing and invariant fuzzing with Foundry's forge. Define what should always be true, then let the fuzzer try to prove you wrong — thousands of times.
MODULE 05
Seed-phrase handling, hardware wallets, multi-sig, signature phishing, and how not to lose everything to a blind approve(). The human layer that most audits ignore.
// example
Reentrancy is the classic, and it still drains wallets in 2024. The pattern: your contract sends ETH before updating its own state, and the receiving contract calls back in to withdraw again. Here's the checks-effects-interactions fix:
// VULNERABLE — state updated after transfer
function withdraw() external {
uint256 bal = balances[msg.sender];
(bool ok, ) = msg.sender.call{value: bal}("");
require(ok);
balances[msg.sender] = 0; // too late
}
// FIXED — effects before interactions
function withdraw() external {
uint256 bal = balances[msg.sender];
balances[msg.sender] = 0; // update first
(bool ok, ) = msg.sender.call{value: bal}("");
require(ok, "transfer failed");
}You'll write the exploit for the top version, watch it drain the contract, then patch it. Then Slither will confirm it. Then Foundry will fuzz it. That loop is the whole course.
// cohort_details
FORMAT
Lifetime access to all five modules, lab repos, and exploit walkthroughs. Move as fast or slow as you need. Everything runs locally with Foundry — no paid tooling required.
OPTIONAL
Small-group live audits and office hours for those who want feedback on their own code. Bring a contract, leave with a findings list you understand.
OUTCOME
By the end you can run a first-pass audit: enumerate the attack surface, run static analysis and fuzzing, and write a severity-ranked report. The foundation for real audit work.