Courses
1. Introduction to Blockchain and Ethereum
2. Setting Up Your Development Environment
3. Ethereum Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts
6. Building Your First Smart Contract
7. Deploying Smart Contracts on the Ethereum Network
8. Interacting with Smart Contracts
9. Using Ethereum CLI and SDKs
10. Developing Decentralized Applications (DApps)
11. Smart Contract Security Best Practices
12. Testing and Debugging Smart Contracts
13. Optimizing Performance on Ethereum
14. Exploring Ethereum Ecosystem Tools
1. Introduction to Blockchain and Polygon
2. Setting Up Your Development Environment
3. Polygon Architecture and Key Concepts
4. Creating and Managing Wallets
5. Understanding Smart Contracts on Polygon
6. Building Your First Smart Contract on Polygon
7. Deploying Smart Contracts on the Polygon Network
8. Interacting with Smart Contracts on Polygon
9. Using Polygon CLI and SDKs
10. Developing Decentralized Applications (DApps) on Polygon
11. Smart Contract Security Best Practices for Polygon
12. Testing and Debugging Smart Contracts on Polygon
13. Optimizing Performance on Polygon
14. Exploring Polygon Ecosystem Tools
1. Introduction to Cybersecurity
2. Report Writing for Penetration Testers
3. Information Gathering
4. Vulnerability Scanning
5. Introduction to Web Applications
6. Common Web Application Attacks
7. SQL Injection Attacks
8. Client-Side Attacks
9. Locating Public Exploits
10. Fixing Exploits
11. Antivirus Evasion
12. Password Attacks
13. Windows Privilege Escalation
14. Linux Privilege Escalation
15. Advanced Tunneling
16. The Metasploit Framework
17. Active Directory: Introduction and Enumeration
18. Attacking Active Directory Authentication
19. Lateral Movement in Active Directory
1. JavaScript Prototype Pollution
2. Advanced Server-Side Request Forgery (SSRF)
3. Web Security Tools and Methodologies
4. Source Code Analysis
5. Persistent Cross-Site Scripting
6. Session Hijacking
7. .NET Deserialization
8. Remote Code Execution
9. Blind SQL Injection
10. Data Exfiltration
11. Bypassing File Upload Restrictions and File Extension Filters
12. PHP Type Juggling with Loose Comparisons
13. PostgreSQL Extension and User-Defined Functions
14. Bypassing REGEX Restrictions
15. Magic Hashes
16. Bypassing Character Restrictions
17. UDF Reverse Shells
18. PostgreSQL Large Objects
19. DOM-Based Cross-Site Scripting (Black Box)
20. Server-Side Template Injection
21. Weak Random Token Generation
22. XML External Entity Injection
23. RCE via Database Functions
24. OS Command Injection via WebSockets (Black Box)
Smart Contract Security Best Practices
Solana · Chapter 11
Smart Contract Security Best Practices
Programs must check the accounts and permissions they receive. A polished interface cannot stop someone from calling your program directly with different inputs.
The basics
- Check required signers, account ownership and the relationship between a user and their data.
- For a program-derived address (PDA), validate the expected seeds. A PDA is a reproducible address derived from a program ID and chosen inputs.
- Validate lengths and arithmetic, and use account constraints carefully. Calling another program is a cross-program invocation (CPI); verify its identity and supplied accounts.
Try it yourself
For a journal entry, list tests for the correct author, a different wallet, the wrong data account and an overly long entry. Each invalid request should fail.