Blockchain Pentesting Checklist

Core Concepts

Blockchain pentesting assesses the security of distributed ledger systems and their surrounding components: smart contracts, nodes, consensus, wallets, key management, and the APIs and dApps that interact with them. The goal is to find flaws that let an attacker steal funds, manipulate state, disrupt consensus, or compromise keys, since on-chain actions are typically irreversible.

Methodology

• Scope and platform identification: determine the chain, consensus mechanism, and components in scope.
• Smart contract review: analyze contract logic for vulnerabilities and unsafe access control.
• Node and infrastructure assessment: review node configuration, RPC/API exposure, and key storage.
• Wallet and key management: test how private keys are generated, stored, and protected.
• Consensus and network analysis: evaluate the consensus algorithm and node behavior for abuse.
• Triage and report: confirm impact (funds, state, availability) and document remediation.

What to look for

• Smart contract bugs: reentrancy, integer overflow, unchecked external calls, and broken access control.
• Exposed or unauthenticated RPC/API endpoints and missing rate limiting.
• Private key exposure or weak key management and wallet storage.
• Insecure or upgradeable contracts that allow unintended state changes.
• Consensus weaknesses, replay issues, and data privacy gaps in stored or transmitted data.

Network Assessment

• Identify the blockchain platform.
• Understand the consensus mechanism.
• Analyze the network topology.
• Verify the security model.
• Enumerate network ports and services.

Smart Contract Assessment

• Review smart contract code for vulnerabilities.
  • Tools: Mythril, Securify, Slither
  • Commands: Mythril command, Securify command, Slither command
• Verify contract access control mechanisms.
• Analyze contract state changes and transactions.
  • Tools: Truffle, Ganache
• Assess contract upgradeability.

Node Security

• Secure access to blockchain nodes.
• Review node configuration files.
• Monitor and protect private keys.
  • Tools: Hardware Security Modules (HSMs)
• Implement firewall rules for node security.

Wallet and Key Management

• Secure wallet storage and access.
• Implement secure key management practices.
• Protect private keys from unauthorized access.
  • Software: Metamask, MyEtherWallet

API and RPC Security

• Secure APIs and RPC endpoints.
• Implement rate limiting and access controls.
  • Tools: Nginx, Nginx Rate Limiting
  • Commands: Nginx configuration commands
• Audit API calls for potential vulnerabilities.
  • Tools: Burp Suite, Postman

Consensus Mechanism

• Understand and analyze the consensus mechanism.
• Evaluate the security of the consensus algorithm.
• Assess node behavior in consensus.
  • Tools: Geth, Parity

Privacy and Data Protection

• Verify data privacy mechanisms.
• Audit data encryption and storage.
  • Software: IPFS, Swarm
• Assess user data protection practices.

DApp Security

• Review decentralized applications (DApps) for security.
• Verify DApp smart contract interactions.
• Test DApp authorization and access controls.
  • Tools: Truffle, Ganache

Vulnerability Scanning

• Conduct vulnerability scans.
• Address identified vulnerabilities promptly.
• Regularly update and patch components.
  • Tools: Nessus, OpenVAS