Resources

Recommended reading, none of it mandatory. Most of the questions you will have during the project are answered somewhere on this page, and reading around the module is what turns a set of notes into a culture: the vocabulary, the history, the way people in the field think about what they build. Come back to it when the notes run out, and when they do not.

Every link here also appears next to the paragraph it belongs to, in a bordered block, on the session and project pages. This page is the union, so that you can find something again without remembering which day it was on.

Start here

The four that come before everything else, whatever you go on to do.

• ethereum.org/developers: the Ethereum Foundation’s introduction, maintained, neutral, and the best single starting point. Its developer docs are the reference to prefer when a search result disagrees with them.
• Learn Solidity in Y minutes: the whole language as one commented file. A cheatsheet rather than a tutorial, and the page to keep open all module.
• Solidity by Example: one short, complete, runnable contract per concept, from Hello World to the attacks.
• evm.codes: every EVM instruction with its gas cost, and a playground that runs it. Where “what does this cost” is answered.

Documentation you will have open

• Solidity: docs.soliditylang.org. The language reference, and “Solidity by Example”, which is where the first afternoon lands. Also its cheatsheet, units and global variables, storage layout and style guide.
• Hardhat: hardhat.org/docs. Project setup, testing, Ignition, the keystore, verification. Check the version on anything you find elsewhere: Hardhat 2 tutorials do not apply.
• viem: viem.sh. Clients, contracts, events, chains. The API reference is good; read the “getting started” once.
• wagmi: wagmi.sh. The React hooks, and the connector setup for wallets. RainbowKit sits on top of it if you would rather not write the connect button.
• OpenZeppelin Contracts, docs.openzeppelin.com/contracts. Read the source of anything you inherit from; it is short and it is the best Solidity you will see. The Wizard is a good way to see how a standard contract is assembled, and a bad way to produce a project.
• Foundry: book.getfoundry.sh. Fuzzing, invariants, forks, cheatcodes; and forge-std, which the Hardhat template already ships.
• Base: docs.base.org. Network details, the bridge, and the faucets that exist this month.
• Basescan: sepolia.basescan.org. Where your contracts live. If its bot check will not let you through, Blockscout shows the same verified source and the same transactions; hardhat verify publishes to both.

References

• EIPs: eips.ethereum.org. Every standard the module mentions has its specification here, and they are shorter than you expect. Read ERC-20 in full once. The ones this module leans on: ERC-721, ERC-1155, EIP-55 for the address checksum, EIP-1193 for the wallet interface, EIP-1559 for the fee market, EIP-712 for signatures, EIP-2612 for permits, ERC-4337 and EIP-7702 for account abstraction, ERC-5192 for soulbound tokens, and EIP-1967 for proxy storage slots.
• The Ethereum whitepaper and yellow paper: the former for the idea, the latter only if you want the formal EVM.
• Bitcoin: A Peer-to-Peer Electronic Cash System: nine pages, 2008, still the clearest statement of the original problem.
• The EVM illustrated, Takenobu Tani: the machine, its stack, memory, storage and gas, drawn. Fifty slides and almost no prose.
• An Incomplete Guide to Rollups, Vitalik Buterin: why Layer 2 exists and what each family trusts. The OP Stack documentation is the specific version, since Base is built on it.
• ethereum.org’s glossary, for the words this site’s own glossary does not carry.

Security

• Smart Contract Best Practices, ConsenSys Diligence: known attacks and development recommendations, one page each, maintained since 2016. The closest thing to a textbook.
• Building Secure Contracts, Trail of Bits: development guidelines, a program-analysis course, and the tooling, from people who audit for a living.
• The Solidity documentation’s security considerations and the OWASP Smart Contract Top 10, the catalogue of failures from Day 3, with references. The SWC registry you will see cited elsewhere has not been maintained since 2020.
• rekt.news: post-mortems of exploits, written for developers, as they happen. The field’s best security education, one incident at a time.
• Code4rena’s reports: hundreds of real audits, each finding with the vulnerable code and the fix. Free, and closer to the work than anything written as teaching material. Immunefi is the bug-bounty side of the same world.
• learn-evm-attacks and DeFiHackLabs: real exploits reproduced as Foundry tests you can run.
• Slither: github.com/crytic/slither, and its detector documentation, which is a catalogue of bugs in its own right. Run it on your project before the defence.
• Damn Vulnerable DeFi and Ethernaut: capture-the-flag challenges in Solidity. If you enjoyed the afternoon of Day 3, this is where to go next.
• The DAO, as it happened: the Ethereum Foundation’s announcement, 17 June 2016, and OpenZeppelin on reentrancy after Istanbul, for why transfer stopped being safe advice.

The ecosystem

• DefiLlama: what protocols exist, on which chains, holding how much. The map, updated live. Its opposite number is Web3 is Going Just Great, a dated catalogue of what has collapsed; read both.
• L2BEAT: every Layer 2, what stage of decentralisation it has actually reached, and what it trusts. Read Base’s page before saying “Base is decentralised”.
• Infrastructure, one reference each. Oracles: Chainlink data feeds, and market manipulation vs. oracle exploits. Storage: IPFS on content addressing. Indexing: Ponder for the light version, The Graph for the decentralised one. Account abstraction: erc4337.io. MEV: ethereum.org then Flashbots.
• Tokens that do not behave: weird-erc20, a catalogue of real tokens that break the standard in real ways. Read it before accepting any token you did not deploy.
• Zero-knowledge: An approximate introduction to how zk-SNARKs are possible, Vitalik Buterin. One evening, and the reference everyone has read.
• One production protocol per subject. The final defence asks “name a protocol that does what you do, in production; how does it handle the problem you struggled with?” These are the answers to start from.
  • Escrow, money and commerce: Uniswap and Aave, for how funds are held and moved by rule, Sablier for payments that stream and escrow over time, and Kleros for dispute resolution by an arbiter who is not simply trusted.
  • Treasury, governance: Sky, formerly MakerDAO and OpenZeppelin’s Governor, which most DAOs on Ethereum run on, timelock included; Tally to watch live proposals and quorums; Safe and Snapshot for what most communities actually use instead; and Vitalik Buterin on moving beyond coin voting governance for why token weight is capturable.
  • Credentials, identity: EAS, the Ethereum Attestation Service, for on-chain and off-chain attestations with a schema registry; Verax for the same idea as a shared registry on an L2; ENS for how a verifier learns which address is really the issuer’s; and the W3C Verifiable Credentials data model, which is the strongest argument that a credential does not need a chain at all, and therefore the most useful thing to have read before defending one that does. All of them have their contracts verified and their design decisions explained; they are their own best teaching material.

Tools for reading a chain

• 4byte.directory and openchain.xyz/signatures: give them the first four bytes of a data field, get the function back. What to do when a contract is not verified.
• Tenderly: simulate a transaction before sending it, and step through one that failed. The debugger the EVM does not otherwise have.
• Alchemy on eth_getLogs, for the block-range limit that will shape any page of yours that reads history.

Going further on your own

• Cyfrin Updraft: free, long-form courses from beginner Solidity through security, made by an audit firm.
• SpeedRunEthereum: a ladder of small build-it-yourself challenges, each a working contract and frontend.
• RareSkills publishes a good free curriculum for the level after this module.

Keeping up

• The Ethereum Foundation blog and the Ethereum roadmap: what changed, and what is coming. ethresear.ch is where the arguments happen before they become proposals, and the EIP repository is where they land.
• The Trail of Bits blog, for security engineering written by practitioners rather than marketers.
• The verified source of any contract you use. More accurate than its documentation, always.