Roadmaps Security roadmaps Specialised and emerging
Secure code that holds money in public: smart contract auditing, DeFi protocol risks, wallets and key custody, exchanges, bridges and the consensus layer beneath them.
Estimated time: 15–30 months · At about 10 hours a week.
Click a topic to see what to learn and where. Mark topics as you go; your progress is saved in this browser only.
Blocks, transactions, gas, accounts and finality. Learn the Ethereum model in depth; most smart contract security work is on EVM chains.
Write and read Solidity, and understand storage, calls, events and the EVM's quirks. You cannot audit code you cannot write.
Reentrancy, access control mistakes, integer issues, unchecked calls, front-running and signature replay. Learn each with real exploited examples.
Private keys are the asset. Learn seed phrases, hardware wallets, multisig and how users and companies lose keys to phishing and malware.
Foundry and Hardhat let you write tests, fork mainnet and reproduce exploits locally. Make them part of every review.
Checks-effects-interactions, pull payments, access control libraries and well-audited building blocks such as OpenZeppelin. Do not reinvent them.
Understand the protocol's intent, map its trust assumptions, read every line, test the risky paths and write clear findings. Methodology beats instinct.
Slither and similar tools find many known patterns quickly. Use them to cover the obvious and spend human time on logic.
Define invariants such as 'total supply equals the sum of balances' and fuzz to break them. Invariant testing catches bugs reviews miss.
Lending, automated market makers, stablecoins, liquidations and governance. Economic design flaws are as dangerous as code bugs.
Flash loans give attackers huge temporary capital to manipulate prices and oracles. Learn the patterns and the defences, such as time-weighted prices.
Each finding needs a clear description, impact, proof of concept and fix. Rate severity honestly; teams decide launches on your report.
Bridges hold huge pooled funds and depend on validators, message verification and multisigs. They have suffered the largest hacks; study them closely.
Multisig, MPC, HSMs, signing policies and segregated duties protect organisational funds. Most large losses involve compromised keys or signers.
Hot and cold wallets, withdrawal controls, insider risk, account takeover and proof of reserves. Exchanges combine Web3 and traditional security.
Upgradeable proxies and on-chain governance let protocols fix bugs but add admin-key and governance-attack risk. Review both carefully.
Watch contracts and mempools for attacks in progress, pause where you can, and coordinate with exchanges and security groups. Speed matters in minutes.
Validators, node operations, client diversity and network-level attacks. The chain's security underpins every contract on it.
Combine audits, competitions, bug bounties, monitoring, key custody and incident response into one programme. No single audit makes a protocol safe.
Report flaws privately through bug bounties and coordinate with teams. The line between research and theft is authorisation and intent; stay clearly on the right side.
Crypto-asset rules such as the EU's MiCA, anti-money-laundering and sanctions apply to exchanges and custodians. Build security and compliance together.
Smart contracts are programs that hold and move value on public blockchains. Anyone can read and call them, bugs often cannot be patched, and a single flaw can drain millions in minutes. That makes smart contract security one of the most unforgiving areas of software security.
The field covers auditing contracts for vulnerabilities, understanding the economic attacks unique to DeFi, securing the keys and wallets that control assets, protecting exchanges and cross-chain bridges, and understanding consensus and network-level risks. Most learning happens through public audit reports, competitions and post-mortems.
Billions have been lost to contract bugs, bridge hacks and stolen keys. Projects, exchanges and custodians need people who can find flaws before deployment and design systems that survive the ones that slip through.
Take them in roughly this order. Costs and details for the ones marked with a link are on the Certifications page.
A common progression. Titles vary between companies.
All security roadmaps Back to top
Last reviewed: . Found a mistake, or want a roadmap written sooner? Contact