Security Reference
SECURITY GLOSSARY
Plain-language definitions of the smart contract security terms that show up in audits, tooling, and DeFi risk reviews.
15
Defined Terms
4
Categories
Analysis Techniques
Formal Verification
Formal verification mathematically proves that a smart contract satisfies a specification for all possible inputs, not just tested cases.
Fuzzing
Fuzzing runs a contract with large volumes of generated inputs to break stated properties or invariants, surfacing edge-case bugs.
Invariant Testing
Invariant testing defines properties that must always hold across any sequence of actions, then uses fuzzing to try to violate them.
Static Analysis
Static analysis inspects smart contract source or bytecode without executing it, flagging known-risky patterns quickly and deterministically.
Symbolic Execution
Symbolic execution explores a contract's paths using symbolic inputs and a constraint solver to find inputs that reach dangerous states.
DeFi Concepts
Flash Loan
A flash loan is an uncollateralized loan borrowed and repaid within one transaction, often used to amplify DeFi attacks like oracle manipulation.
MEV (Maximal Extractable Value)
MEV is value extracted by reordering, inserting, or censoring transactions in a block, enabling sandwich attacks and front-running in DeFi.
TWAP (Time-Weighted Average Price)
A TWAP is a price averaged over a time window, used as a manipulation-resistant oracle because a brief price spike barely moves the average.
Security Patterns
Checks-Effects-Interactions
Checks-Effects-Interactions is a Solidity ordering pattern: validate inputs, update state, then make external calls, preventing reentrancy.
Commit-Reveal Scheme
A commit-reveal scheme hides a value behind a hash commitment, then reveals it later, used to prevent front-running and manipulate-able randomness.
EIP-1967 Proxy Storage Slots
EIP-1967 defines fixed pseudo-random storage slots for a proxy's implementation and admin addresses to prevent storage collisions in upgradeable contracts.
Reentrancy Guard
A reentrancy guard is a mutex that blocks a function from being re-entered before it finishes, the standard defense against reentrancy attacks.
Security Tools
Echidna
Echidna is an open-source property-based fuzzer for Ethereum smart contracts that searches for inputs violating user-defined invariants.
Mythril
Mythril is an open-source security analysis tool for EVM bytecode that uses symbolic execution to detect vulnerabilities in smart contracts.
Slither
Slither is an open-source static analysis framework for Solidity that detects common vulnerability patterns and prints code insights quickly.
Put It Into Practice
Run a Free Security Scan
These definitions map to the checks Firepan runs on your repository. See where your contracts stand.
START FREE SCAN →