blockchain-security

Working through smart contract security from first principles — starting with the Bitcoin whitepaper and building up through Ethereum, Solidity, and DeFi security.

Progress

✅ Phase 1 — Why blockchains exist

• Bitcoin whitepaper (Satoshi Nakamoto, 2008)
• Mastering Bitcoin ch. 1–2 (Andreas Antonopoulos)

✅ Phase 2 — Cryptographic foundations

• SHA-256 and hash functions (conceptual)
• Merkle tree — implemented from scratch in Python (foundations/merkle.py)

🔄 Phase 3 — Blockchain core mechanics & Ethereum

• Mastering Ethereum ch. 1–2
• Mastering Ethereum ch. 3–6 (EVM, transactions, gas, smart contracts)
• ethereum.org developer docs

⬜ Phase 4 — Smart contracts (Solidity)

• CryptoZombies
• Solidity by Example
• OpenZeppelin Contracts — read production-grade Solidity

⬜ Phase 5 — DeFi concepts

• Mastering Ethereum DeFi sections
• Uniswap V2 whitepaper

⬜ Phase 6 — Security fundamentals

• SWC Registry (Smart Contract Weakness Classification)
• rekt.news — 10–20 hack post-mortems
• Immunefi bug bounty writeups
• Solodit Checklist + Cyfrin's "Solodit Checklist Explained"

⬜ Phase 7 — Hands-on CTF practice

• Ethernaut — all challenges
• Damn Vulnerable DeFi — all challenges
• Capture the Ether — all challenges

⬜ Phase 8 — Tools

• Foundry
• Slither (+ read detector source)
• Echidna
• Mythril

⬜ Phase 9 — Structured courses

• Cyfrin Updraft
• Secureum 101/201 series
• Solodit — live audit findings

---

Repository structure

blockchain-security/
├── foundations/
│   └── merkle.py          # Merkle tree from scratch — build_tree, get_branch, verify_proof
├── ctf-solutions/
│   ├── ethernaut/
│   └── damn-vulnerable-defi/
├── audit-notes/            # rekt.news post-mortems, vulnerability patterns
└── notes/
    └── ethereum.md         # running notes while reading Mastering Ethereum

Implementations

foundations/merkle.py

Merkle tree built from scratch using only Python's hashlib.sha256 as a black box. Implements:

• hash_leaf / hash_pair — the two primitive operations the whole tree is built from
• build_tree — constructs all layers bottom-up, handles odd-length layers via Bitcoin's duplication convention
• get_root — returns the single root hash
• get_branch — returns the minimal set of sibling hashes needed to prove one transaction's inclusion (what a full node sends an SPV client)
• verify_proof — recomputes the root from a transaction + branch without access to the full tree (what an SPV client runs locally)

Self-tests cover tamper detection and the odd-transaction edge case.

---

github.com/moeen-shahid