<p>"Mythril" is a tool to analyze the security properties of EVM bytecode. Given that it only expects EVM bytecode as input, Mythril can be used to check the output produced by Solidity, Vyper or any other language targeting the Ethereum Virtual Machine.</p>
<p><strong>Protip 1</strong>: Given that Mythril's only requirement is EVM bytecode you can also use it to check your Smart Contracts for EVM compatible platforms such as the Binance Smart Chain, Avalanche, Hedera or Tron.</p>
<p><strong>Protip 2</strong>: For more advanced security analyses you can use the paid tool <a href="https://mythx.io/">MythX</a>. It includes Mythril, the fuzzer Harvey and the static analysis engine Maru. Work through the <a href="https://mythx.io/mythxperts/apprentice/">MythX Apprentice Tutorial</a> to learn more about MythX and get rewarded with NFTs.</p>


Security analysis tool for Ethereum Virtual Machine (EVM) bytecode.

Mythril

<p>Brownie is a development and testing framework for Smart Contracts targeting the Ethereum Virtual Machine. It has full support for languages like Solidity and Vyper, powerful debugging tools as well as a package manager.</p>
<p><strong>Protip</strong>: Brownie also ships with a built-in console you can use to quickly interact with and iterate on your project.</p>


Development and testing framework for Smart Contracts targeting the Ethereum Virtual Machine (EVM).

Brownie

<p>eth-gas-reporter is a Mocha reporter for Ethereum test suites which provides you insights into your Smart Contract's gas usage. Using it you can see a breakdown of gas usage per unit test, metrics for method calls and deployments as well as costs of deploying and using your Smart Contract system.</p>
<p><strong>Protip</strong>: If you're using Truffle or Hardhat you can find more information about official support and proper setup in the <a href="https://github.com/cgewecke/eth-gas-reporter/blob/master/README.md">README</a>.</p>


Generate gas usage reports for your Smart Contracts.

Eth Gas Reporter

<p>The eth-tester project is a tool suite which provides high-level abstractions to test Ethereum dApps. It's written in Python and can be used programmatically as a project dependency or interactively via the CLI.</p>
<p>Ethereum Tester's implementation focuses on modularity which makes it possible to use different backends for different test scenarios.</p>


Tool suite to test Ethereum Virtual Machine (EVM) based applications.

Ethereum Tester

<p>"Waffle" is the most advanced Smart Contract testing framework. It integrates nicely with development frameworks such as Ganache or Hardhat, is minimalistic with only a few dependencies, has a nice and easy to remember syntax and is fast in both, development- and execution time.</p>
<p><strong>Protip</strong>: You should definitely spend some time to read through their <a href="https://ethereum-waffle.readthedocs.io/en/latest/">documentation</a>. The <a href="https://ethereum-waffle.readthedocs.io/en/latest/matchers.html">Chai matchers docs</a> in particular explain how you can make use of their custom matchers to e.g. check for BigNumbers or events emitted by your contracts.</p>


Testing framework for Smart Contracts targeting the Ethereum Virtual Machine (EVM).

Waffle

<p>The Remix IDE is a fully fledged online development environment which lets you write, test, deploy and invoke Smart Contracts right from the comfort of your browser.</p>
<p>It has support for different Solidity compiler versions, various plugins such as debuggers or linters as well as an in-browser CLI.</p>
<p><strong>Protip 1</strong>: Did you stumble upon an interesting dApp project on GitHub you'd like to play around with? Simply use the "Import from GitHub" functionality and start coding within in seconds.</p>
<p><strong>Protip 2</strong>: The Remix Project offers a <a href="https://github.com/ethereum/remix-desktop">Remix Desktop App</a> which helps you develop your Smart Contracts in an offline-ready IDE. No need to install and configure compilers, editors and plugins.</p>


Browser-based development environment for Ethereum Virtual Machine (EVM) Smart Contract development.

Remix IDE

<p>Tenderly helps you troubleshoot your Smart Contracts through real-time monitoring, analytics and alerting. They offer a "free forever" plan which is suited for experimentation and smaller hobby projects.</p>
<p><strong>Protip</strong>: Their visual debugger and state inspector make it super simple to figure out why and where a transaction was reverted. Simply go to their <a href="https://dashboard.tenderly.co/explorer">Blockchain Explorer</a>, paste your failed transaction into the search box and hit enter. Next up you'll get detailed data as to what happened during the execution and at which point the transaction was reverted (and why).</p>


Developer Platform to build, monitor and debug Ethereum Virtual Machine (EVM) based dApps.

Tenderly

<h2>FAQs</h2>
<h3><strong>How do I get started with Ethereum / Smart Contract development?</strong></h3>
<p>This really depends on your prior experience with Blockchain technologies such as Smart Contracts and programming languages.</p>
<p>If you have little experience with Blockchains and their inner working we'd advise to start by reading through some of the "<a href="https://wiki.cryptodevhub.io/general-resources">General Resources</a>" such as Binance Academy or CoinMarketCap Academy.</p>
<p>If you're already familiar with the Blockchain but lack Smart Contract / dApp development experience you'll find a full curriculum in our "<a href="https://wiki.cryptodevhub.io/ethereum-evm/getting-started">Getting Started</a>" section.</p>
<p>Seasoned dApp developers and folks familiar with other Blockchain ecosystems can start by looking through our "<a href="https://wiki.cryptodevhub.io/ethereum-evm/tutorials">Tutorials</a>" list.</p>
<h3>How do I run a local Ethereum Blockchain Node?</h3>
<p>Generally speaking there are 2 popular solutions for running local Ethereum Blockchain Nodes.</p>
<h4>Ganache CLI</h4>
<p>The Ganache project is part of the Truffle Suite, a popular choice for Smart Contract- and dApp development on the Ethereum Blockchain. While Truffle provides a fully-fledged development environment which makes it simple to compile, test and deploy Smart Contracts and dApp, Ganache can be thought of an extension to Truffle which makes it possible to run your code locally.</p>
<p>Ganache comes in 2 flavors: Ganache (a desktop app) and Ganache CLI. We'd recommend to use the CLI version as it integrates nicely with other tools such as Truffle or Hardhat and can be automated and therefore leveraged in e.g. CI / CD systems or end-to-end tests.</p>
<p>Installing <a href="https://github.com/trufflesuite/ganache-cli">Ganache CLI</a> is as simple as running <code>npm install --save-dev ganache-cli</code>. This will add Ganache as a development dependency to your current project.</p>
<p>Once installed you can start a local Ethereum Node via <code>npx ganache-cli</code>.</p>
<p>Notice that Ganache CLI has a slew of <a href="https://github.com/trufflesuite/ganache-cli#options">options</a> you can pass into the command. What we'd recommend is to e.g. use the <code>-d</code> / <code>--deterministic</code> flag such that deterministic accounts are generated: <code>npx ganache-cli --deterministic</code>.</p>
<h4>Hardhat Network</h4>
<p>If you're using Hardhat as your Ethereum dApp development framework you're already in possession of an Ethereum Node you can run locally.</p>
<p>The Hardhat development environment ships with the <a href="https://hardhat.org/hardhat-network/">Hardhat Network</a>, a local Ethereum network specifically designed for development. In fact, every time you ran a Hardhat test you leveraged such network behind the scenes.</p>
<p>Running a local Ethereum Blockchain Node is as simple as running <code>npx hardhat node</code>.</p>
<p>There's also a lot you can configure when using Hardhat Networks. We'd advise to read through the <a href="https://hardhat.org/hardhat-network/">thorough documentation</a> to learn more about its capabilities.</p>
<h3>How do I get realtime data from the Ethereum Blockchain?</h3>
<p>Almost all Ethereum JSON-RPC API implementations support the <code>eth_subscribe</code> method which makes it possible to create a so called subscription to listen to events emitted on the Blockchain. You can use this method in combination with WebSockets to get notified when something happens on the blockchain.</p>
<p>The following 2 code examples demonstrate how you can listen for new blocks being created. Browsing through your library's documentation you should also find examples on how to listen for e.g. contract events.</p>
<h4>Web3.js</h4>
<pre><code>const Web3 = require('web3')

const URL = 'wss://example.com'
const provider = new Web3.providers.WebsocketProvider(URL)

const web3 = new Web3(provider)

web3.eth.subscribe('newBlockHeaders').on('data', (block) => {
  // A new block was created
  console.log(block)
})
</code></pre>
<h4>Ethers</h4>
<pre><code>const { ethers } = require('ethers')

const provider = new ethers.providers.JsonRpcProvider()

provider.on('block', (blockNumber) => {
  // A new block was created
  console.log(blockNumber)
})
</code></pre>
<p><strong>Note</strong>: While you could achieve the same functionality by continously requesting new data from the Ethereum blockchain every X seconds (called "pull"), using subscriptions (called "push") is way more compute- and bandwidth efficient.</p>
<h3>How do I call a deployed Smart Contract?</h3>
<p>To call an already deployed Smart Contract you need 2 things:</p>
<ol>
<li>The Smart Contract address</li>
<li>The Smart Contract ABI</li>
</ol>
<p>Both information can usually be found in the projects documentation or via block explorers such as Etherscan.</p>
<p><a href="https://etherscan.io/address/0x7a250d5630b4cf539739df2c5dacb4c659f2488d">Here</a> fore example is the "Uniswap Router V2" Smart Contract on Etherscan. If you click on "Contract" and scroll down you'll find a section "Contract ABI" which shows you the Smart Contract's ABI. The address can be found at the top of the page or in the URL in your browser's address bar.</p>
<p>Having both information you can now call the Smart Contract via your client library of choice. The following are examples in both Web3.js and Ethers.</p>
<h4>Web3.js</h4>
<pre><code>const Web3 = require("web3");

const URL = "wss://example.com"
const provider = new Web3.providers.WebsocketProvider(URL)

const web3 = new Web3(provider);

const address = "0x1234567890"; // &#x3C;-- The Smart Contract address
const abi = [{ ... }]; // &#x3C;-- The Smart Contract ABI

// The arguments for your function call
const arg1 = "Foo";
const arg2 = "Bar";

const instance = new web3.eth.Contract(abi, address);

const result = await instance.methods.myFunc(arg1, arg2).call();

console.log(result);
</code></pre>
<h4>Ethers</h4>
<pre><code>const { ethers } = require("ethers");

const provider = new ethers.providers.JsonRpcProvider();

const address = "0x1234567890"; // &#x3C;-- The Smart Contract address
const abi = [{ ... }]; // &#x3C;-- The Smart Contract ABI

// The arguments for your function call
const arg1 = "Foo";
const arg2 = "Bar";

const instance = new ethers.Contract(address, abi, provider);

const result = await instance.myFunc(arg1, arg2);

console.log(result);
</code></pre>
<h3>Where do I get the testnet address of token X?</h3>
<p>The best resource to find the corresponding token addresses is in the projects documentation. Let's take a look at an example.</p>
<p>If you're working on an integration with Kyber which is deployed on the Ropsten testnet and uses DAI behind the scenes you'd find the corresponding address <a href="https://developer.kyber.network/docs/RopstenEnvGuide/#token-addresses">here</a>. In this case the DAI address is <code>0xaD6D458402F60fD3Bd25163575031ACDce07538D</code>.</p>
<p>Now let's say that you're extending your dApp's capabilities via an integration with Aave v1. Looking through their documentation you'll find the Ropsten testnet addresses <a href="https://docs.aave.com/developers/v/1.0/deployed-contracts/deployed-contract-instances">here</a>. DAI has the address <code>0xf80A32A835F79D7787E8a8ee5721D0fEaFd78108</code>.</p>
<p>Now if you pay close attention you'll notice that bot addresses are different and this is important to remember when working with testnets. Given that DAI and other tokens have no value on testnets they're usually deployed multiple times. More often than not you'll encounter project's using different deployment, making it nearly impossible for your to test complex interactions based on tokenized assets.</p>
<p>If you're running into this problem you should skip testnets and switch to a mainnet forking + account impersonating strategy, both of which are discussed in the following two questions.</p>
<h3>Is there a way to simulate real transactions on mainnet?</h3>
<p>If you're using a local Ethereum Blockchain Node for development like Ganache CLI or Hardhat Network you can add an option which enables "mainnet forking".</p>
<p>Forking mainnet means that your local Blockchain Node will take a snapshot of the Ethereum mainnet including account and Smart Contract state and save it offline. Any subsequent interaction with your local Blockchain Node will be based off of this snapshot without affecting the real Ethereum mainnet.</p>
<p>Using "mainnet forking" you can then interact with all the protocols already deployed on Ethereum mainnet via their respective "real" addresses and Smart Contract ABIs. But instead doing "real" transactions you run them locally with fake ETH. This capability is super powerful as it makes it super simple and efficient to test real-world use cases.</p>
<p>The following examples show you how you can do "mainnet forking" with Ganache CLI and Hardhat Network. For more information we'd encourage you to browse through their official docs about "mainnet forking" (<a href="https://github.com/trufflesuite/ganache-cli#readme">Ganache CLI</a>, <a href="https://hardhat.org/guides/mainnet-forking.html">Hardhat Network</a>).</p>
<p><strong>Note</strong>: You can also add another option to start the forking process at block X. This is very useful if you're relying on mainnet forking in your tests as it makes testing via the forking mechanism deterministic.</p>
<h4>Ganache CLI</h4>
<pre><code>npx ganache-cli --fork https://cloudflare-eth.com
</code></pre>
<h4>Hardhat Network</h4>
<pre><code>npx hardhat node --fork https://cloudflare-eth.com
</code></pre>
<h3>How do I mint token X for testing?</h3>
<p>The easiest way to mint a token for testing is to not mint it at all but impersonate someone else's account. While this sounds ethical questionable it's a very powerful strategy with zero harm involved for the impersonated account holder.</p>
<p>What you'd do in this case is you'd run a local Ethereum Blockchain Node via "mainnet forking" (see above) while also passing in a parameter to unlock an account of your choice. This account should hold some amount of the token you're interested in during your testing.</p>
<p>You can then spend any token of the unlocked account in your local Blockchain Node instance without possessing its private key.</p>
<p>The following are examples which show how you'd start a Ganache CLI as well as Hardhat Network instance with account impersonation enabled. Please consult the corresponding tooling documentation for more information (<a href="https://github.com/trufflesuite/ganache-cli#readme">Ganache CLI</a>, <a href="https://hardhat.org/guides/mainnet-forking.html">Hardhat Network</a>).</p>
<h4>Ganache CLI</h4>
<pre><code>npx ganache-cli --fork https://cloudflare-eth.com --unlock 0x1234567890
</code></pre>
<h4>Hardhat Network</h4>
<pre><code>npx hardhat node --fork https://cloudflare-eth.com
</code></pre>
<pre><code>await hre.network.provider.request({
  method: 'hardhat_impersonateAccount',
  params: ['0x1234567890']
})
</code></pre>
<h3>How much does a Smart Contract audit cost?</h3>
<p>As it's usually the case, this really depends on the size and complexity of your project. Most auditing firms charge per time spent inspecting the contract(s).</p>
<p>Larger projects (more lines-of-code) usually take longer to audit. The same applies to complex projects. An ERC-20 contract for example is easier to audit compared to a new, non-standard custom token implementation.</p>
<p>Here are some rough estimates taken from a <a href="https://medium.com/iearn/things-i-wish-i-knew-before-building-ethereum-defi-dapps-cd6bf0f07a16">blog post</a> written by Andre Cronje. The code in question is 359 LOC written in Solidity:</p>
<ul>
<li>trailofbits.com $16.000 1 week, 1 person</li>
<li>cryptomaniacs $10.000 2 weeks, 2 people</li>
<li>sigmaprime.io $27.500 11 days, 2 people</li>
</ul>
<p>Andre concludes that bigger projects usually cost in the range of $50.000 to audit.</p>
<p><strong>Note</strong>: There's projects such as <a href="https://immunefi.com/">Immunefi</a> which will help you set up and coordinate a bug bounty program for your Smart Contract project. It's not the same as an audit but lets you work together with white hat hackers to uncover security vulnerabilities.</p>
<h3>I'm getting an "Internal JSON RPC error" when working with Metamask</h3>
<p>Are you running an Ethereum Node via Ganache CLI or Hardhat Network for local development? If true, you're very likely reusing an old network configuration via Metamask.</p>
<p>Metamask keeps track of nonces which are auto-incrementing numbers assigned to every transaction. And while your new Node starts with nonces at 0, Metamask still stores the nonce state of the old Node configuration.</p>
<p>To solve this problem all you have to do is <a href="https://metamask.zendesk.com/hc/en-us/articles/360015488891-How-to-reset-your-wallet">reset your Metamask account</a>. This has to be done every time you reuse an existing Metamask network configuration with a new Ethereum Node.</p>


Frequently asked questions about Smart Contract development on the Ethereum Virtual Machine (EVM).

Ethereum Virtual Machine (EVM) - Frequently Asked Questions

<p>The "DappUniversity" YouTube Channel is a great place to find useful video tutorials for full-stack dApp development on Ethereum. Simply click on the "Playlists" tab to find curated lists with videos on topics such Solidity, Web3.js, Ethereum + React and more.</p>
<p><strong>Protip</strong>: When sorting the videos by duration you'll find a bunch of long-form videos (some of which are ~8 hours long!) which will walk you through the whole dApp development life cycle end-to-end. Also keep an eye on the video descriptions which usually include links to the project's GitHub repository.</p>


Tutorials, guides and courses to master Blockchain development.

DappUniversity

<p>The "EatTheBlocks" YouTube Channel is another great resource to learn Smart Contract and dApp development on the Ethereum Blockchain. The channel is very developer-focused and covers a wide range of topics such as Solidity, Web3.js, OpenZeppelin, Money Legos (DeFi), UI / UX and more. Clicking on the "Playlists" tab will show you curated lists of videos from such topics.</p>
<p><strong>Protip</strong>: The <a href="https://github.com/jklepatch/eattheblocks">eattheblocks GitHub</a> repository is the central place where all the channels code is published and released. In it you'll find projects for topics such as Flash Loans, ERC-20 Tokens, DEXes and more.</p>


Videos to learn Blockchain- and Smart Contract development.

EatTheBlocks

<p>The "Smart Contract Programmer" YouTube Channel is a hands-on resource that teaches you everything you need to know to become a proficient Smart Contract developer.</p>
<p>Topics covered are Solidity- and Vyper basics, Smart Contract security and hacks, dApp development, engineering best practices and Smart Contract composability (via DeFi protocol integrations).</p>


Hands-on tutorials and explainers to learn Smart Contract development on Ethereum Virtual Machine (EVM) chains.

Smart Contract Programmer

<p>The Week in Ethereum News Newsletter is one of the oldest and most established Ethereum Newsletters out there. Once subscribed, you'll get a weekly digest with curated content about all the important topics and discussions happening in the Ethereum ecosystem.</p>
<p>Blockchain technology enthusiasts will definitely enjoy the summaries of the core dev calls whereas dApp and Smart Contract developers find hidden gems in the "Stuff for developers" section.</p>


Weekly Newsletter covering all the developments in the Ethereum ecosystem.

Week in Ethereum News

<p>The official Ethereum Wiki is one of the best places to learn everything about Ethereum as well as related technologies and protocols such as IPFS, Whisper, Swarm, etc.</p>
<p>Browsing through the wiki you'll find plenty of resources on topics like governance, scaling, sharding, Eth1 vs. Eth2, the official roadmap as well as general research related to Blockchains and Smart Contracts.</p>
<p><strong>Protip</strong>: The wiki is community-driven which means that you can contribute by joining the discussions and proposing changes.</p>


Ethereum Wiki

<p>The EthSpring project is an effort to gather and categorize Ethereum learning resources. Browsing through their material you'll learn about the Crypto Philosophy, Peer Protocols, Protocol Theory, Zero-Knowledge-Proofs and more.</p>
<p><strong>Protip</strong>: You can also subscribe to the EthSpring Newsletter to get notified when new resources are added.</p>


Collection of various Ethereum learning resources.

EthSpring

<p>The book "Mastering Ethereum", written by Andreas Antonopoulos and Gavin Wood does a great job explaining everything you need to know about the Ethereum Blockchain as well as the Ethereum Virtual Machine (EVM) and Smart Contract development via Solidity and Vyper.</p>
<p>While you should definitely grab a copy at your retailer of choice you can also check out the books source code at their <a href="https://github.com/ethereumbook/ethereumbook">GitHub Repository</a> and file Issues / PRs to contribute back.</p>


The Official Book about Ethereum and its Ecosystem.

Mastering Ethereum

<p>The Ethereum foundation has its own curated list of community tutorials.</p>
<p>Use the filters at the top to find the content you're interested in and if you wrote a tutorial yourself be sure to click the "Submit a Tutorial" button at the top to get added to the list as well.</p>


Ethereum Development Tutorials

<p>Learn X in Y minutes also has a dedicated site for development with the Vyper programming language. After a brief introduction to Vyper you'll see a huge annotated Smart Contract written in Vyper which walks you through its various language features. While it might be challenging for Vyper devs who are just starting out you'll definitely want to bookmark this page and visit it when you need a quick Vyper refresher.</p>


A mini-tutorial and reference to learn Vyper