C01Introductory
Unguarded Initializer
Unsafe proxy upgrade
Explain how an outside account can become the owner of the rewards distributor and sweep its tokens, then fix the deployment and the contract.
- Language
- Solidity
- Time
- 20–30 minutes
Security challenges.
6 short training exercises in Solidity and Rust (Anchor). Each one is a small, intentionally vulnerable contract written for this site, with an objective, hints you reveal one at a time, and a worked solution with the fixed code.
Challenges
- C02Intermediate
The First Deposit
First-depositor attack
Show how the first depositor can make a later deposit mint zero shares, quantify the loss, and harden the vault.
- Language
- Solidity
- Time
- 30–45 minutes
- C03Intermediate
Replay Window
Signature replay
Find every way a signed voucher can be used more than its signer intended, and redesign the signed message.
- Language
- Solidity
- Time
- 30–45 minutes
- C04Advanced
Spot Price Oracle
Oracle manipulation
Describe a single-transaction sequence that borrows more than the collateral is worth, estimate what it costs, and replace the price source.
- Language
- Solidity
- Time
- 45–60 minutes
- C05Intermediate
Account Cosplay
Account validation
Show how a caller who is not the vault authority can pass the authorisation check and withdraw from the vault, then make the account constraints do the work.
- Language
- Rust (Anchor)
- Time
- 30–45 minutes
- C06Advanced
The Honest View
Read-only reentrancy
Explain how the lending market can be made to value pool shares at an inflated price even though the pool itself is protected by a reentrancy guard.
- Language
- Solidity
- Time
- 45–60 minutes
How to use them
Read, reason, then check.
The challenges teach analysis, not tooling. Each one can be solved by reading the code; a local Foundry or Anchor test environment helps to confirm your reasoning.
Read the objective
It states what an attacker wants to achieve. Work out which assumption in the code makes it possible.
Take hints sparingly
Hints are revealed one at a time and move from where to look towards what to try.
Write the fix first
Before opening the solution, write the change you would ask the team to make and why.
Compare and read on
The solution explains the root cause and the fix, with references to the standard or documentation.
The code is intentionally vulnerable and exists only on this site. Do not deploy it, and do not apply what you learn to systems you are not authorised to test.
Ready for a real scope?
Research programmes define components, identifiers and rules for each protocol in scope. Validated findings are recognised.