Learning Recap

A couple weeks ago, I shared my intention to learn Solidity. In order to give myself a clear path and perhaps help others who have similar goals, I thought it would make sense to document the journey.

I began with The Ultimate Smart Contract Developer Roadmap by Oliver Jumpertz. While some of the individual resources have proven helpful, the roadmap as a whole feels disjointed. It jumps from the overly simplistic to the overly complex, and some of the resources overlap with each other. Thus, while I appreciate Oliver’s efforts to create a cohesive roadmap, I cannot recommend it.

A friend of mine recommended freeCodeCamp’s course to me, and I feel that my time is now being used more wisely. The amount of content Patrick Collins has managed to pack into a single video course amazes me, and he excels at making the material exciting. I trust that completing this course will give me a strong foundation, but building on that foundation requires a less guided approach.

The Crossroads

At this point in learning a language, I typically branch off and create a project from scratch (with a healthy dose of Stack Overflow, of course). In this case, instead of creating my own decentralized application, I’ve decided to start by learning to audit other smart contracts. I have several reasons for this:

• Importance - Web3 makes security—and thus, auditing—more important than ever. If I do end up creating dapps, a background in auditing should serve me well.

• Risk - Creating a dapp means higher risk since real coins and tokens can be lost. I won’t have that risk as an auditor.

• Excitement - Even though I’m not the one who personally bears the risk, the high stakes make things all the more exciting.

• Experience - I already have some experience reading audits from my time with Token Flags.

• Opportunity - Code4rena and Immunefi post contests and bounties regularly. Plus, auditing companies always seem to be hiring.

Once I complete the Patrick Collins course, I can advance to audit-specific learning materials. Three roadmaps stand out:

1. How to become a smart contract auditor, a guide by Christoph Michel. The Beginner Roadmap to Smart Contract Auditing by Andy Li builds on this guide, so I’ve bulleted his recommendations as well.

2. Hacking the Blockchain: Ethereum, a guide by Sleepy.

3. Simplified Roadmap for Blockchain Security, a guide by Devansh Batham, which he elaborates further in Learning Solidity in 30 Days.

Below I’ve summarized each roadmap.

Roadmap: Michel & Li

1. Learn programming

If you have no prior programming experience, be mentally prepared that it’ll take you years before your reviews will be useful.

2. Learn ETH blockchain & Solidity basics

There’s no better way to combine learning Solidity with learning about ETH security than solving CTFs.

• For the CTFs, start with Ethernaut and pair it with D-Squared’s explanation videos. Capture the Ether overlaps with Ethernaut but may still be helpful. Damn Vulnerable DeFi is the most advanced, so it should be completed last.

• Switch back and forth between watching the Patrick Collins course and completing the CTFs. This approach provides a shorter feedback loop between learning something and applying it.

3. Become familiar with the most used smart contracts

There are certain contracts, patterns or even algorithms that you will see over and over again during your auditing career.

• For learning DeFi basics, use Teach Yourself Crypto.

• For MasterChef specifically, watch Synthetix Staking Rewards Contract Explained.

4. Learn the finance basics

There will be a time when you’re auditing a DeFi project that uses a lot of traditional finance terms and you don’t understand anything.

• As with the Patrick Collins course, use the Khan Academy finance course as a reference instead of plowing straight through it.

5. Get real experience

At this point, your training is over and you’ll just keep reading more code and exploit post mortems to get better.

• The Secureum 101 articles, and in particular Audit Findings 101 and Audit Findings 201, help to acclimate you to reading audit reports. D-Squared has a video series for this as well.

• After reading the Secureum articles, start reading Code4rena audit reports. Start with low risk, non-critical issues and gas optimizations. At that point, you’ll be able to start engaging in contests, even if you’re only looking for minor issues. Next, read through the high and medium findings that have duplicate reports. Read different reports for the same finding to get different wardens’ points of view. Finally, read through the high and medium findings that have unique reports.

• For submitting QA and gas optimization reports, don’t run automated tools. It’s more helpful to find issues manually since it trains you to pick up on patterns.

• Understand and categorize all findings, including findings from the Secureum articles.

Roadmap: Sleepy

1. Intro to computer science (optional)

I highly recommend completing an introductory course on computer science, such as Harvard’s CS50, ideally before beginning a course on Solidity.

2. freeCodeCamp course

[This course] shines above most other resources because it covers coding token standards like ERC20, ERC721 (NFTs), and DeFi (decentralized finance), which will give you an incredible understanding of the business logic of DApps and DEXs.

This is the Python-oriented counterpart to Patrick’s JavaScript-oriented course mentioned earlier. It’s half the length and a bit older.

3. Mastering Ethereum book (optional)

The best resource for learning about Ethereum is Mastering Ethereum by Andreas Antonopoulos and Dr. Gavin Woods…You’ll want to read chapters 1, 2, 3, 4, 5, 6, 13, and 14.

Later, Sleepy notes that you could also add chapter 9.

To supplement this reading, he mentions you could take a look at ConsenSys’ Ethereum Smart Contract Best Practices.

4. CryptoZombies

You might not be able to pick up the syntax of Solidity easily from [the freeCodeCamp] course, so I recommend checking out CryptoZombies for additional practice. It’ll take much less time to get acquainted with the syntax.

5. Hack Solidity playlist

Finally, we come to the Smart Contract Programmer who is one of my favourite YouTubers and one of the only ones providing technical explanations of common Solidity smart contract vulnerabilities via video.

6. SWC Registry

The Smart Contract Weakness Classification Registry is an implementation of the weakness classification scheme proposed in EIP-1470. It is loosely aligned to the terminologies and structure used in the Common Weakness Enumeration (CWE) while overlaying a wide range of weakness variants that are specific to smart contracts.

7. Secureum bootcamp

It may be worthwhile to incorporate the Secureum bootcamp videos as part of your learning from the very beginning. I personally skipped the Ethereum and Solidity modules as I had already completed the freeCodeCamp course and read the corresponding chapters in Mastering Ethereum.

Additionally, I recommend reading through audit reports from various well-respected smart contract security firms like Trail of Bits and ConsenSys.

8. Capture the Flags

I recommend doing them in this order: Ethernaut/Capture The Ether -> Damn Vulnerable DeFi -> Paradigm CTF (One of the hardest out there created by Paradigm and notably samczsun, DeFi’s most legendary security researcher. You can read Immunefi’s interview with him here.) Ethernaut/Capture the Ether overlap, so you can do one over the other.

For solutions, see Web3 Blockchain Developer’s series for Ethernaut, Smart Contract Programmer’s series for Damn Vulnerable DeFi, and Christoph Michel’s article for Paradigm CTF 2021.

9. Real life experience

You can and should hunt for bugs on Immunefi, which hosts a multitude of bug bounty programs.

Finally, I encourage you to apply to the various smart contract security firms, as there’s an extremely high demand for people like you.

Batham’s Roadmap

1. Elementary Topics

This section covers introductory computer science topics, such as:

• Linux

• Git

• CI/CD

• Object Oriented Programming

2. Basics of Internet

Next, internet fundamentals are taught:

• Networking

• Browsers

• Protocols: DNS, HTTP, RPC

• Authentication and authorization

3. Web 2.0 Security

This section simply recommends reading through the OWASP Top 10.

4. Basics of Blockchain

Now moving into the crypto space, basics are covered with an emphasis on Bitcoin:

• Cryptography

• Bitcoin

• Consensus

• Mining

5. Basics of Ethereum

After Bitcoin, Ethereum follows naturally:

• Ether

• Gas

• ERC standards

• Ethereum Virtual Machine

6. Understanding Solidity

Knowing the basics of Ethereum provides a foundation for learning Solidity:

• Data types

• ABIs

• JSON RPC

• Libraries

7. Frameworks for Ethereum development

You may not need all of these, but he lists a few frameworks that could be useful:

• Truffle

• Brownie

• Infura

• OpenZeppelin

• Dapptools

8. Smart Contract Security

Once you have the basics of Solidity down, you can dive deeper into security topics:

• Visualization tools

• Linters and formatters

• Common vulnerabilities in smart contracts

• Static and dynamic analysis

9. Blockchain CTFs

Building on the CTFs mentioned in other roadmaps, Batham adds Smart Contract CTF and GOATCasino:

• Ethernaut

• Damn Vulnerable DeFi

• Smart Contract CTF

• Capture the Ether

• GOATCasino

• Paradigm CTF

10. Bug Bounty Platforms

He also adds a couple of bug bounty platforms which aren’t specific to crypto:

• Immunefi

• HackerOne

• Bugcrowd

Instead of sticking to one roadmap over another, I intend to pick and choose from each one. When all is said and done, I may publish a roadmap that combines all of these resources with my own learning experience. Please let me know if that would be helpful or if you have any other feedback!