A comprehensive guide to security best practices and known vulnerabilities for EOS smart contract developers.
EOS Smart Contract Security Best Practices is a community-driven guide that documents security guidelines and analyzes known vulnerabilities for developers building on the EOS blockchain. It helps developers avoid common pitfalls, understand attack vectors like integer overflow and reentrancy, and write more secure smart contracts by learning from real-world exploits.
EOS smart contract developers, blockchain security researchers, and DApp teams who need to audit or harden their contracts against known vulnerabilities.
It provides a centralized, practical resource focused specifically on EOS security, combining theoretical guidelines with concrete code examples and references to actual hacks, which is often scattered across blogs and incident reports.
A guide to EOS smart contract security best practices
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Targets EOS-unique issues like apply校验 and transfer假通知 with detailed code examples, such as the batchtransfer overflow and fake notification defenses from real contracts.
Links each vulnerability to actual exploits, like the EOSBet hack and EOSDice attacks, providing concrete context and lessons from past incidents.
Maintained by the community with contributions in English, Chinese, and Korean, ensuring it evolves with new threats and global accessibility.
Offers corrected code snippets for each vulnerability, such as using asset structures for overflow prevention and defer actions for rollback attacks, aiding practical implementation.
Lacks integration with automated security tools or testing frameworks, requiring developers to manually review and apply guidelines, which can be time-intensive.
Focuses on known issues like integer overflow and reentrancy; may not cover novel or emerging attack vectors without community updates, leaving gaps for new threats.
Targets experienced EOS developers, with minimal guidance on basic setup or EOSIO concepts, making it less accessible for newcomers to the ecosystem.