Audit a Decentralized Lending Protocol for Smart Contract Vulnerabilities
Overview
What this challenge is about.
Audit a DeFi lending pool for reentrancy, oracle flaws, and arithmetic bugs. Document each finding with a fix to earn your verifiable certificate.
The scenario
LendFlow is a roughly 15-person, venture-backed financial-technology startup operating a permissionless lending market on the Ethereum public blockchain, serving retail crypto users globally. Having watched a comparable protocol lose funds to a flash loan exploit, its leadership now treats a pre-launch security review of the contracts that custody user deposits as the gating step before scaling total value locked.
The Brief
What you'll do, and what you'll demonstrate.
Identify, prioritize, and propose verified fixes for the security vulnerabilities in LendFlow's lending pool and oracle smart contracts before the protocol handles significant user funds.
Earning criteria — what you'll demonstrate
- Systematically audit Solidity smart contracts for the most common decentralized finance attack patterns
- Assess and communicate vulnerability severity in terms of concrete impact on user funds
- Write and run a proof-of-concept exploit to prove a vulnerability is real and not theoretical
- Produce practical, correct remediation guidance that developers can apply directly to the code
Program Fit
Where this fits in your program.
Sharpens the same skills your degree expects you to demonstrate.
Aligned coursework coming soon.
Skills
Skills you'll demonstrate.
Each one shows up on your verified credential.
- Solidity
Apply solidity to solve real industry problems and demonstrate production-level capability.
- Smart Contract Auditing
Apply smart contract auditing to solve real industry problems and demonstrate production-level capability.
- Decentralized Finance
Apply decentralized finance to solve real industry problems and demonstrate production-level capability.
- Security
Apply security to solve real industry problems and demonstrate production-level capability.
- Ethereum
Apply ethereum to solve real industry problems and demonstrate production-level capability.
Careers
Career paths this challenge builds toward
Completing this challenge demonstrates skills that transfer directly to these roles:
Smart Contract Auditor
This challenge mirrors a real audit engagement end to end: reading unfamiliar Solidity, hunting for exploitable flaws, and writing client-ready findings. It builds the exact judgment auditing firms hire for when reviewing protocols before launch.
This challenge sharpens
- smart-contract-auditing
- solidity
- security
Blockchain Security Engineer
Defending production protocols requires understanding how attackers think and how Ethereum contracts fail under adversarial conditions. Proving exploits and shipping correct fixes here maps directly to securing live on-chain systems.
This challenge sharpens
- security
- ethereum
- solidity
DeFi Protocol Engineer
Building lending and trading protocols demands fluency in both the financial logic and its security pitfalls. Auditing a lending pool teaches the design patterns and oracle considerations that protocol engineers must get right.
This challenge sharpens
- decentralized-finance
- solidity
- smart-contract-auditing