Jason Turley's Website

Why Security Researchers Should Consider Smart Contract Auditing

TL;DR

The target audience for this post is security researchers, however the information is general enough that it will benefit anyone looking to get started in smart contract auditing. I’ll break down what smart contracts are, why you should care, and how to start hacking them.

What are smart contracts?

A smart contract is code that runs automatically when certain conditions are met. These programs live on a blockchain like Ethereum or Solana. They are immutable and cannot be easily patched like traditional software. This means vulnerabilities in the code need to be found and fixed before the smart contract is deployed to mainnet (production). Which is why having skilled security researchers audit the code is crucial.

BTW: the term “smart contract” is kind of a misnomer. They are neither smart nor a contract.

Why should security researchers care about smart contracts?

I get it, the crypto space has a bad reputation. There are a lot of scammers, rug pulls, and annoying crypto bros. However, blockchain security is still immature and really needs the help that established security professionals can provide. Cryptocurrency exchanges, DeFi protocols, and user wallets have lost billions of dollars due to preventable hacks.

I encourage traditional security researchers to view smart contracts just like any other research target. You have security researchers who may specialize in browsers, operating system internals, or mobile phones. Similarly, smart contracts are another area to specialize in.

Detach yourself from the crud and get paid for your research - you deserve it.

Some advantages of auditing smart contracts:

Game plan for learning smart contracts

As a security researcher you are already skilled at quickly picking up new technology and learning how to attack it. If you can read code and find bugs then you are gtg.

Currently, Ethereum is the primary blockchain that smart contracts are built on. There are some other popular chains like Solana, but the EVM is still where most developers chose to launch their projects. You should learn Ethereum first, then branch out to alt-chains once you have a solid foundation.

Smart contracts are written in languages like Solidity, a high-level language with syntax similar to JavaScript. It gets compiled into bytecode that runs on Ethereum nodes. Users interact with smart contracts through transactions, kinda like function calls that cost a small fee called “gas”.

Resources for learning

I think the best way to learn a new security topic is via Capture The Flag (CTF) challenges. Try these to get hands-on experience with Solidity, the EVM, and DeFi:

For Ethernaut, I recommend using this GitHub repo. It enables you to run the levels locally instead of on a testnet (which can be difficult to set up). Additionally, it uses Foundry, so you will also be learning a testing framework at the same time!

If you are like me, you will get stuck on the beginner CTF challenges since Solidity can be a very confusing language for the uninitiated. I recommend going through one of the following resources to learn Solidity:

Read about smart contract security and Solidity anti-patterns:

Study famous real-world attacks to see how things go wrong:

Stay up to date on the latest hacks and security news:

Get comfortable with tools used for auditing and testing smart contracts:

Audit competitions - get paid to hack

Audit competitions are timed security assessments where people are paid for submitting valid vulnerabilities. There are a lot of platforms popping up that host audit competitions, but they are not all created equally. Code4rena and Immunifi are some trusted, well-established platforms. Read this post from Zellic on choosing an audit competition platform.

These are perfect for learning how protocols work while earning some side cash.

If audit competitions are too overwhelming, try a First Flight from Cyfrin. These are mock audits on smaller code bases. A great way to build confidence and get used to submitting findings!

What bugs matter in audits?

But I don’t like writing reports

I don’t blame you. Thankfully, a lot of report writing is boilerplate and LLMs are actually helpful here. The Smart Contract Security course from Cyfrin has a section on writing findings and reports.

For inspiration, read reports from top auditing firms like Zellic or Trail of Bits to get an understanding of what high quality reports look like. If you’re stuck on wording a bug, Solodit lets you search similar findings for ideas. Links to finished audit reports can be found in the resources section at the end of this article.

Other areas of web3 security

Smart contract auditing isn’t for everyone. Web3 has other areas where your skills can shine:

Final thoughts

Smart contract auditing offers security researchers a rare opportunity: a fast-growing, high-impact field where your skills can directly prevent multi-million dollar hacks. Yes, the crypto space can be noisy, but underneath the hype lies a real need for rigorous, thoughtful security work. If you can reverse engineer binaries, fuzz kernels, or exploit websites, you can absolutely learn how to break smart contracts — and get paid well doing it.

Treat smart contracts like any other research target: dig into the code, understand the execution environment, and question the assumptions. Whether you’re doing CTFs like Ethernaut, diving into DeFi bugs, or competing in audit contests, this space rewards curiosity and persistence.

You don’t need to be a blockchain expert on day one. Just start experimenting, follow your instincts, and learn as you go. The space is still young, and there’s room for new voices.

#blockchain #career #web3