Solodit

Solodit is a free search engine for smart contract security audit findings. It gathers thousands of real vulnerabilities published in audit reports and security contests in one place, and lets you filter them by severity, bug type, protocol or audit firm. If you work in, or want to get into, Web3 security, Solodit is one of the most valuable study tools out there.

What is Solodit?

Solodit is a database of findings taken from public audit reports and audit contest platforms. It is currently maintained by Cyfrin, a company focused on smart contract security and education. Each entry usually includes the problem description, impact, the affected code snippet and the recommended fix, plus a link to the original report.

Besides the search engine, Solodit offers an audit checklist with concrete questions for reviewing contracts, and sections related to bug bounty programmes and contests.

What Solodit is used for

• Learning from real bugs: instead of textbook vulnerabilities, you see how they appeared in audited protocols.
• Preparing for audit contests: searching findings from similar protocols (lending, DEXs, staking, bridges) before reviewing a new one.
• Reviewing your own code: if you write Solidity, checking whether your design pattern has caused trouble elsewhere.
• Building internal checklists for audit or development teams.

How to get started with Solodit

1. Go to the official website. You can search without signing up, although an account gives extra features such as bookmarks.
2. Start by filtering for high severity and a category you already understand, such as reentrancy or access control.
3. Read the full finding, open the original report and locate the affected code.
4. Try to reproduce the bug locally with Foundry or Hardhat before moving on.

Example study workflow

Say you are about to audit a lending protocol:

1. Filter Solodit by the matching protocol category and high severity.
2. Group findings into recurring themes: oracle manipulation, rounding, incorrect liquidations, issues with non-standard tokens.
3. Turn each theme into concrete review questions: "what if the oracle price is stale?", "what if the token charges a fee on transfer?".
4. Go through the Solodit checklist and add those questions to your notes.

To reproduce a finding locally, a minimal Foundry skeleton is:

forge init audit-lab
cd audit-lab
forge test -vvv

Copy the vulnerable version of the contract, write a test that demonstrates the bug, then apply the recommended fix and confirm the test no longer passes.

Pro tips

• Do not just binge-read findings: pick one theme per week and go deep.
• Look at medium and low severity findings too; they teach a lot about edge cases.
• Compare how different firms describe the same kind of bug: it will improve your own report writing.
• Pair Solodit with cryptography fundamentals (signatures, hashes) from platforms like CryptoHack.

Pros and cons

Pros	Cons
Free, with thousands of real findings	You need to read Solidity to get the most out of it
Very useful filters by severity and topic	Not a course: it does not teach from scratch
Practical audit checklist	English only

Solodit alternatives and complements

• Hack The Box: includes blockchain challenges to practise exploitation.
• CryptoHack: to master the cryptography underneath signatures and wallets.
• CyberChef: handy for decoding data and calldata during analysis.

Frequently asked questions

Is Solodit free?

Yes. You can search and read findings for free. Some extra features require creating an account.

What is a finding on Solodit?

It is a vulnerability or issue documented in an audit: description, impact, affected code and recommended fix.

How do you use Solodit to learn auditing?

Filter by protocol type or vulnerability, read findings with the code in front of you and reproduce the most interesting ones locally with tests.

Is Solodit good for beginners?

It is once you have a grounding in Solidity and how the EVM works. If you are starting from zero, learn to write simple contracts first.

To strengthen the Linux and command-line basics you will use with Foundry and other tools, practise at the Hackers en Acción Academy.