Security is an Art. Defense is a Science.

Top Security Issues in Solidity Smart Contracts

I. Access Control & Authorization

Missing Access Control: Functions callable by anyone when they should be restricted. (SWC-100)

Incorrect Access Control Logic: Flawed conditions allowing unauthorized access.

Unprotected Initializer: initialize() callable multiple times in upgradeable contracts. (SWC-104)

tx.origin for Authorization: Using tx.origin instead of msg.sender. (SWC-115)

II. Arithmetic Issues

Integer Overflow/Underflow: Unchecked arithmetic resulting in wrapping. (SWC-101)

Loss of Precision: Incorrect handling of fixed-point arithmetic or division.

III. Reentrancy & External Calls

Reentrancy: External call before state update, allowing re-entry. (SWC-107)

Read-Only Reentrancy: External call allows re-entry to read state before it's updated.

Unchecked External Call Return: Not checking boolean success of call(). (SWC-104)

IV. Logic & Design Flaws

Business Logic Errors: Flaws in core rules. (CWE-840)

Flash Loan Attacks: Using uncollateralized loans to manipulate prices or drain pools.

Oracle Manipulation: Feeding false price data to the contract.

V. Front-running & MEV

Timestamp Dependence: Miner manipulation of block.timestamp. (SWC-116)

Order Dependence (Front-running): Transaction order manipulation. (SWC-114)

Mobile Pentesting Checklist

Android Security

Debug Mode: Verify android:debuggable="false" in Manifest.

Exported Components: Audit activities to ensure android:exported="false".

Shared Preferences: Scan for unencrypted sensitive data in local storage.

Root Detection: Test if the app blocks execution on rooted devices.

SSL Pinning: Verify certificate pinning blocks traffic interception via proxy.

iOS Security

App Transport Security: Ensure NSAllowsArbitraryLoads is set to false.

Keychain Accessibility: Ensure keys use kSecAttrAccessibleAfterFirstUnlockThisDeviceOnly.

Jailbreak Detection: Test if the app detects and exits on jailbroken devices.

SSL Pinning: Verify robust certificate pinning prevents MITM attacks.

Background Snapshots: Mask the UI before the app enters the background.

API Testing Checklist

1. Broken Object Level Authorization (BOLA)

ID Infiltration: Swap object IDs in URLs to access resources of other users.

2. Broken User Authentication

Weak Signatures: Change JWT algorithms to 'none'.

3. Excessive Data Exposure

Full Object Returns: Inspect responses to see if hidden user attributes are leaked.

4. Rate Limiting & Resource Consumption

Heavy Payload: Send oversized JSON bodies to measure memory depletion.

5. Mass Assignment

Property Injection: Add privilege attributes (like "isAdmin": true) to payloads.

Cloud Security Checklist

IAM & Access

MFA Enforcement: Enforce MFA for all console and CLI users.

Wildcard Policies: Eliminate overly permissive policies using wildcards (*).

Object Storage

Public Access: Explicitly block public read/write on S3/Blob buckets.

Network & VPC

Open Security Groups: Close rules allowing 0.0.0.0/0.

Public Subnets: Move databases and backend microservices to private subnets.

DevSecOps Pipeline Integration

1. Pre-Commit

Secrets Detection: Block commits locally if raw API keys are found.

2. CI Build Stage

SAST: Run automated code scans during the build.

Dependency Scanning (SCA): Scan libraries for known CVEs.

3. Artifact Security

Base Image Scan: Scan container base images (Dockerfiles) for OS vulnerabilities.

4. IaC Security

Template Scanning: Scan Terraform/CloudFormation files for misconfigurations.