Read as
Why this module exists. Smart contract and Web3 pentest is its own discipline — the rules of “immutable, public, value-at-stake” change the testing approach entirely. This module covers fundamentals for traditional web pentesters extending into the Web3 surface.
What is different about smart contracts
- Immutable once deployed: no patch cycle (mostly). Find the bug, lose the funds.
- Public source code: bytecode is on-chain; usually source code published for verification.
- Direct financial exposure: vulnerabilities translate to ETH / tokens immediately.
- Gas economy: every operation costs; some attacks exploit gas pricing.
- Composability: contract A calls contract B which calls contract C; integration risks compound.
The recurring vulnerability classes
| Class | Example |
|---|---|
| Reentrancy | The DAO 2016 ($60M); recursive callbacks before state update |
| Integer overflow / underflow | Pre-Solidity 0.8 default; arithmetic wraps silently |
| Access control | Missing onlyOwner on privileged functions |
| Oracle manipulation | Flash-loan-driven price manipulation; ~$1B+ lost in 2021-22 |
| Front-running | MEV: see pending transaction, submit yours with higher gas |
| Cross-contract risk | Trusted external contract behaves unexpectedly |
| Upgrade-proxy bugs | Misimplemented proxy patterns; storage collision |
The testing toolchain
- Slither: static analyser; detects 80+ vulnerability patterns.
- Mythril: symbolic execution.
- Echidna: property-based fuzzing.
- Foundry: test framework with fuzzing built-in.
- Tenderly: transaction simulation for testing exploits.
- Etherscan / block explorers: on-chain transaction analysis.
The audit workflow
- Read the spec / whitepaper. Understand the intended behaviour.
- Read the code. Map functions to spec.
- Run Slither / Mythril / Foundry for automated findings.
- Manual review: each function — who can call, what state mutates, what invariants must hold.
- Invariant testing: encode invariants as Echidna properties; fuzz against them.
- Cross-contract analysis: external calls — what happens if the callee misbehaves?
- Economic analysis: incentive design — can a rational actor profit by misbehaving?
The Indian Web3 reality
- India does not have a Web3-specific regulator yet; CERT-In has issued guidance on crypto exchange security.
- Indian-built DeFi protocols have been audited mostly by global firms.
- Indian centralised exchanges follow PCI-DSS-like security; pentests focus on web layer + custodial systems.
- The Government of India’s Digital Rupee (CBDC) pilot has different security architecture; not directly relevant to public-blockchain Web3 testing.
Common entry points for web pentesters
If extending from web pentest into Web3:
- Web frontends to dApps: still XSS, CSRF, etc. — the off-chain web layer.
- Wallet interaction: signing flows, transaction construction. Vulnerable to phishing UIs.
- Bridge contracts: cross-chain bridges are high-value, high-vulnerability targets.
- Centralised exchange APIs: standard API security plus crypto-specific patterns.
Key takeaways
- Smart contract immutability + value-at-stake makes the testing high-stakes.
- Recurring classes: reentrancy, overflow, access control, oracle manipulation, front-running.
- Tools: Slither, Mythril, Echidna, Foundry, Tenderly.
- Workflow: spec → code map → automated → manual → invariant fuzzing → cross-contract → economic.
- Web pentesters’ nearest entry: dApp frontends, wallet interactions, bridge contracts, exchange APIs.
Need a real pentest?
Get a VAPT scoping call
Senior practitioner-led VAPT — not a checklist run by juniors. CVSS-scored findings, free retest, attestation letter. India's SMBs and SaaS teams.
Book VAPT scoping call
Replies in 4 working hrs · India-only · Senior consultants