Last updated: December 19, 2024

Foreword

Welcome to the OWASP Smart Contract Security Testing Guide. Feel free to explore the existing content, but do note that it may change at any time.

This guide is a community-driven effort to provide a comprehensive resource for understanding, testing, and improving the security of smart contracts. Like the blockchain space itself, the content in this guide is dynamic and ever-evolving, reflecting the fast-paced advancements in protocols, best practices, and the discovery of new vulnerabilities.

Smart contracts are at the heart of decentralized ecosystems, but their complexity makes them a prime target for attacks. With every protocol upgrade, L2 innovation, or emerging standard, new challenges arise for developers and security professionals alike. This guide aims to bridge the gap, equipping you with practical techniques and insights to navigate the ever-changing landscape of smart contract security.

If you have feedback, suggestions, or would like to contribute, feel free to create an issue on GitHub or join the discussion on OWASP’s Slack. See the README for details:

https://www.github.com/OWASP/owasp-scstg/

smart contract (noun): A self-executing contract with the terms of the agreement directly written into lines of code, enabling secure, automated transactions on a blockchain.

This isn’t a traditional security guide. It doesn’t just explain vulnerabilities or list best practices. It’s a living document shaped by the community for the community. Security testing in Web3 demands a deep understanding of blockchain fundamentals, cryptographic principles, protocol designs, and attack vectors—many of which are only briefly introduced here.

So, don’t stop at this guide. Read the code, explore the EVM, experiment with testnets, audit real-world projects, and stay curious. As you grow in your journey, consider giving back to the SCSTG. After all, the strength of this guide lies in the collective expertise of its contributors. Or, as they say in the open-source world: "Do a pull request."

We hope this guide inspires you to push the boundaries of what’s possible in securing decentralized systems. Welcome aboard!