The "crytic/not-so-smart-contracts" repository is a collection of common Ethereum smart contract vulnerabilities. It serves as an educational resource for developers and security researchers, showcasing various security issues in Solidity contracts along with explanations and potential fixes.

Pros

• Provides real-world examples of smart contract vulnerabilities
• Includes detailed explanations and potential fixes for each vulnerability
• Serves as a valuable learning resource for Ethereum developers
• Regularly updated with new vulnerabilities and best practices

Cons

• May not cover all possible vulnerabilities in smart contracts
• Some examples might become outdated as Solidity and Ethereum evolve
• Requires a basic understanding of Solidity and smart contract development
• Not a comprehensive security solution on its own

Code Examples

1. Reentrancy vulnerability:

contract Vulnerable {
    mapping(address => uint) public balances;

    function withdraw() public {
        uint bal = balances[msg.sender];
        require(bal > 0);
        (bool sent, ) = msg.sender.call{value: bal}("");
        require(sent, "Failed to send Ether");
        balances[msg.sender] = 0;
    }
}

This code demonstrates a reentrancy vulnerability where an attacker can repeatedly call the withdraw function before the balance is updated.

2. Integer overflow:

contract Overflow {
    mapping(address => uint8) public balances;

    function transfer(address _to, uint8 _amount) public {
        balances[msg.sender] -= _amount;
        balances[_to] += _amount;
    }
}

This example shows an integer overflow vulnerability where the balance can wrap around due to the use of uint8.

3. Unprotected self-destruct:

contract Destroyable {
    function destroy() public {
        selfdestruct(payable(msg.sender));
    }
}

This code demonstrates an unprotected selfdestruct function that allows anyone to destroy the contract and send its balance to themselves.

Getting Started

To explore the vulnerabilities:

1. Clone the repository:

   git clone https://github.com/crytic/not-so-smart-contracts.git
   

2. Navigate to the desired vulnerability folder.
3. Read the README.md file for an explanation of the vulnerability.
4. Review the vulnerable and fixed contract examples in the Solidity files.
5. Use a development environment like Remix or Truffle to deploy and test the contracts.