Like any totally normal person, I enjoy spending my Friday nights going deep into recently deployed Ethereum contracts, hunting for cool bugs and sneaky vulnerabilities.
This repository is a curated collection of the vulnerable contracts, "big brain" logic fails, and interesting exploits I stumble upon during this sessions.
Each case study is designed to be a practical deep dive into both common and obscure smart contract vulnerabilities. We’ll look at how a bad actor would exploit these flaws and, more importantly, discuss the best practices to prevent them. The goal is simple: learn from others' mistakes and make Web3 a little more secure for everyone.
The vulnerabilities shared here pose zero real-world risk.
If a contract address is published here, it is because the contract is already "wrecked", it holds no assets or the attack would require special conditions impossible to meet in reality. In cases where I discover an active, high-risk vulnerability (still does not happen LoL), I follow responsible disclosure. To prevent actual exploits, I anonymize all identifying data, including addresses and contract names. I also avoid posting full source code and will rename functions to obscure the original target.
My goal is strictly to document and publish the hacking mechanism for educational purposes, not to provide a blueprint for real-world attacks.