## Overview This was my bachelor's thesis, and honestly it started with a pretty simple frustration: smart contracts are a likely target for attacks, and most of the time it comes down to developers leaving attack vectors open. For example the DAO hack lost ~$50M and the Parity wallet exploit drained 150,000 ETH. Both were caused by code mistakes that developers could have avoided. The thing that makes smart contract bugs so brutal is that once code is deployed to a blockchain, it's essentially immutable. In most cases it is impossible to fix these bugs after that. Additionally, the code for these applications is public on a blockchain or other DLTs, so anyone can read your code and anyone can exploit it. So I wanted to understand: what would a developer actually need to learn to *not* make these mistakes? That's the question I spent my thesis answering. ## What I Did I gathered 187 DApp educational resources which are courses on EdX, YouTube tutorials, dev.to guides, interactive learning sites and I ran a thematic analysis to map out what topics they actually teach. Then I identified 30 common flaws and 43 skills needed to prevent them, drawing from the existing challenge and solution literature in [Kannengießer et al. (2021)](https://ieeexplore.ieee.org/document/9555611). Finally, I mapped everything together: which skills prevent which flaws, and which educational themes cover which skills. The result is essentially a knowledge graph connecting "if you want to avoid *this* flaw, you need *these* skills, and you can learn them from *these* topics." The graph below shows you exactly that. If you want to read further on specific flaws or skills, they are detailed later in this article. ## My Findings The most interesting finding wasn't about any specific vulnerability. It was about what's *missing* from almost all DApp education. There's a theme I ended up labeling **"CAN NOT BE MATCHED"**, which represents general software engineering fundamentals like naming conventions, code documentation, version control, and programming paradigms. It showed up as a requirement in **29 out of 30 common flaws**. Almost universally needed, almost universally absent from DApp-specific courses. Educators just assume you already know these topics if you get into Dapp Development. The other surprising result: the most dangerous flaws aren't the most *complicated* ones. **Inefficient Code** and **Unpredictable Execution Behavior** required up to 28 distinct skills and 12 educational themes to fully address. Meanwhile something like **Reduced Code Readability** only needed 3-4 skills. The simple-sounding problems aren't always the ones that'll hurt you most. Here you can see the topics that are connected to the most Flaws which means that these Skills are the most important to learn when developing Dapps. ## The 30 Common Flaws The flaws are grouped into 7 categories. Some are classic security exploits, others are more subtle architectural mistakes that quietly make your contract unreliable or unmaintainable. **Defective Contract Design:** A condition where smart contracts are not executing. Coding errors, insufficient gas, or incompatible EVM operations can prevent a contract from executing, causing a DApp to malfunction, lead to data corruption, or result in a loss of funds. **Ineffective Contracts:** Smart contracts that are performing inefficient operations. Poorly optimized code increases the cost of transactions, leading to higher operational costs and reduced contract execution speed. **Non-Updatable Contracts:** The inability to modify or update a smart contract. Developers need to be aware of the immutable nature of blockchains and by extension smart contracts; failure to recognize this can result in long-term bugs, easily exploitable vulnerabilities, and an inability to meet new DApp requirements. **Predictable Contracts:** Smart contracts that have easily predictable outcomes, making them susceptible to attacks. Flawed random number generation or other discernible patterns can expose contracts to risks such as front-running and arbitrage exploitation, thereby compromising contract integrity. **Poor Cross-Contract Interoperability:** Inability of different contracts to communicate with each other effectively. Designing contracts without considering interactions with other contracts can reduce functionality and even lead to potential contract failures. **Unavailable Contracts:** Instances where smart contracts become inaccessible or unusable. Contracts may become unavailable due to coding errors, self-destruction mechanisms, deprecation, or changes in the blockchain protocol, resulting in service disruptions and, in extreme cases, a loss of funds and data. **Unhandled Exceptions:** A situation where code does not adequately catch or manage errors. The failure to catch errors is often a consequence of insufficient testing, and a lack of error handling can result in unpredictable behavior, system crashes, and security vulnerabilities. **Unpredictable Execution Behavior:** Inconsistent or erratic application outcomes. Unpredictability can originate from poor code design, unhandled exceptions, or external dependencies, leading to potential exploits and eroding user trust. This is the most complex flaw in the study, requiring up to 28 skills to fully address. **Improper Memory Management:** Incorrect or inefficient use of storage or memory. Inadequate understanding of the intricacies of memory and storage in decentralized applications can lead to reduced performance, higher operational costs, and even application failure. **Inefficient Code:** The application's inefficient use of computational resources. Poor code optimization results in slower execution, higher resource consumption, and therefore higher computational cost. **Inefficient Code Reuse:** Reusing code without adequate modification or review. When developers reuse code without a proper review, they may overlook the requirements of their DApp, resulting in inefficiencies, increased complexity, or in the worst case, newly introduced vulnerabilities. **Reduced Code Readability:** Code that is poorly documented or convoluted, making it difficult to update, debug, or audit. Subpar coding and documentation practices result in code that is challenging to read, complicating maintenance and auditing while increasing the likelihood of undetected vulnerabilities. **Suboptimal Resource Allocation:** Inefficient utilization of computational resources in a system or application. Inefficient and unoptimized code consumes more resources than necessary, making the system less scalable and incapable of handling higher demand, leading to lower performance, higher cost, and potential service disruptions. **Inadequate Data Security Measures:** Insufficient protective mechanisms that fail to safeguard data against unauthorized access or theft. Inadequate access controls, absent auditing, and a lack of encryption can result in data breaches, compromising user data privacy and application integrity, and potentially leading to financial losses. **Insufficient Privacy Guards:** Inadequate protective mechanisms to safeguard user information from unauthorized access, dissemination, or misuse. Improper data management, such as storing sensitive information on-chain, or other vulnerabilities can lead to unauthorized access to individuals' data, with potential legal repercussions for the responsible entities. **Suboptimal Integration of External Data:** Incorrect use or lack of data from external sources. Many smart contracts rely on external data to facilitate various functionalities. Inadequate data validation, mismatched data formats, or reliance on unreliable sources can cause inconsistencies and limit the dynamic functionality of DApps. **Flawed Transaction Handling Mechanism:** Inadequate processes implemented to manage, validate, or execute transactions. The most common causes include insufficient gas, incorrect parameters, network issues, or contract issues, leading to incorrect transaction execution, loss of data integrity, or service disruption. **Insecure Interactions:** Vulnerabilities that arise from unsafe communication. Insecure interactions stem from an absence of robust encryption or inadequate validation, reducing the security of interactions between contracts or with external systems. This is the exact mechanism behind the DAO hack, where reentrancy allowed an external contract to repeatedly call back in before state was updated. **Arithmetic Overflow/Underflow:** A condition where the result of a calculation exceeds the minimum or maximum value a data type can store. These arise from inadequate checks in arithmetic operations and can violate data integrity, creating incorrect results and potential vulnerabilities. **Inadequate Access Controls:** Absence of implemented measures to secure sensitive information or functions against unauthorized access. Inherent logical flaws or high code complexity can compromise access control measures, leading to exploits, data manipulation, and a loss of funds; for example, leaving a `withdraw()` function callable by anyone. **Insufficient Code Protection Mechanisms:** Unauthorized copying or stealing of code. Due to the transparency of blockchain systems, anyone can inspect the bytecode of a contract and potentially decompile it. Such accessibility might allow third parties to replicate the code, reducing competitive advantage or exposing vulnerabilities that could be exploited. **Vulnerability to Denial of Service:** Susceptibility of an application to being overloaded by an excessive volume of requests. Improper management of resource consumption and a lack of rate limiting renders a smart contract susceptible to DoS attacks, which can degrade performance or make the contract completely unavailable. **Vulnerability to Front-Running:** A situation where attackers can view pending transactions and execute their own transaction first. Predictable contract behavior combined with a public mempool, where all pending transactions are visible, enables malicious actors to exploit this transparency for their own profit, leading to financial losses for users and a distrust in the system. **Vulnerability to Replay Attacks:** A situation where an attacker can capture and retransmit a valid data transmission to perform unauthorized actions. Insufficient nonce management or inadequate transaction handling can make an application susceptible to replay attacks, enabling unauthorized transactions and leading to financial losses. **Failure to Utilize Optimal Smart Contracts:** Use of suboptimal smart contracts although better solutions exist. Insufficient research can result in developers implementing inferior contracts, increasing operational cost and compromising performance, when audited, battle-tested libraries like OpenZeppelin already solve the problem. **Inability to Locate Specific Functions:** Poor design or a lack of documentation that makes it difficult to identify certain functions. Poor documentation and code design hinder developers from comprehending and interacting with other smart contracts effectively, increasing the likelihood of errors and vulnerabilities due to misuse of functions. **Inconsistent Implementations:** Varying methods in the same application. Differing implementations of methods within the same application can lead to unpredictable behavior, complicate the maintenance process, and introduce vulnerabilities; for example, deviating from established standards like ERC-20 in ways that break compatibility. **Misconceptions about the Code:** Misunderstanding about how the code functions. Lack of documentation can lead to misunderstanding about code operations, resulting in misuse, undiscovered vulnerabilities, and unpredictable behavior. **Inadequate Trust Assurance Measures:** Insufficient mechanisms that ensure the authenticity, integrity, and reliability of a contract's operation. Trust is the foundation for the adoption and continued use of decentralized applications, and a loss of trust could lead to a reduced user base and the potential failure of the application. **Weak Accountability Mechanisms:** Insufficient systems or procedures to attribute actions to specific entities. The blockchain's anonymity features and insufficient logging can hinder accountability in decentralized applications. Without accountability, disputes cannot be resolved, leading to an erosion of trust. ## The 43 Skills These are the skills a developer needs to prevent the flaws above. General Software Engineering Practices and Testing appeared across nearly every single flaw mapping, yet they are the topics most commonly absent from DApp-specific education. **Contract Interaction Management:** A set of skills to facilitate, monitor, and optimize interactions between different smart contracts. Contract interaction enables DApps to leverage the functionality of other contracts, and effectively managing these interactions is crucial for efficiency, security, and interoperability. Developers must be familiar with various external function calls, including those for pure and view functions and the `delegatecall`. **Control Flow Management:** The regulation of execution paths within a smart contract. Control flow ensures that logic executes in the correct sequence and under the right conditions, using constructs like `if/else` conditionals, loops, and modifiers. **Data Location Management:** Understanding and optimizing where data is stored and accessed within a smart contract. The choice of data location directly affects operational costs, data retrieval times, and security. Solidity offers four locations: `storage` (permanent, high gas cost), `memory` (temporary, function-scoped), `stack` (small amount of data like function parameters), and `calldata` (immutable, holds function parameters). **Data Type Management:** Effective utilization of various data types within a smart contract. Selecting the wrong data type can lead to increased resource consumption, higher gas costs, errors, or security issues. Developers need to choose the correct data type, perform type conversions, and execute operations on those types correctly. **Error Handling:** The process of implementing mechanisms to identify, report, and address unexpected conditions or code failures. Given the immutability of transactions, errors must be caught preemptively to prevent permanent mistakes or financial losses. Developers should master error handling statements like `assert` and `require` to revert transactions when an error is encountered. **Event Handling:** The practice of using loggable events in smart contracts to track state changes. Events provide a way to log execution details and notify external applications of state changes. Developers must define and emit events from the contract, set up event listeners on the receiving end, filter through events, and manage event data appropriately. **Function Management:** The design, organization, and optimization of functions in smart contracts. Functions are the primary means of interaction with a contract, so proficient management is essential for accurate, efficient, and secure operation. This includes function declaration, use of modifiers, and understanding constructor and fallback functions. **Inheritance Management:** The strategic use of contract inheritance to build on existing functionality. Inheritance allows a contract to inherit methods and properties from other contracts, conserving development resources through reusability and modularity. It encompasses designing abstract base contracts and derived contracts, overriding functions, and implementing interfaces. **Smart Contract Lifecycle Management:** Oversight of smart contract phases from initialization to termination. Once deployed on Ethereum, smart contracts are immutable, making a thorough understanding of their lifecycle critical. Key stages include initialization, compilation, deployment, migration, upgrading (often requiring a new contract and data migration), and decommissioning. **Solidity Proficiency:** In-depth understanding in using Solidity, the primary language for smart contract development. This involves mastering Solidity syntax, the `Pragma Directive` for compiler version control, and the `SPDX License Identifier` that specifies the license under which the contract code is released. **Access Management:** Strategies and mechanisms employed to control who can interact with a smart contract and its functions. Ensuring appropriate access control is essential to the security, operational integrity, and trustworthiness of smart contracts. Developers must implement modifiers that verify user permissions, and understand techniques such as time-based access control and multi-signature operations. **Data Confidentiality:** Methods and practices used to protect sensitive data within transactions and smart contracts. Every transaction on a public blockchain is visible to all participants, presenting a distinct challenge. Developers should utilize techniques including data encryption, zero-knowledge proofs, off-chain storage, and commit-reveal schemes, and must possess expertise in cryptography and hash functions. **Data Integrity:** Ensuring the accuracy, consistency, and reliability of data within a smart contract to guarantee it remains unaltered. Developers must engage in cryptography, manage immutable storage, understand consensus mechanisms, and implement redundancy checks. Proficiency in cryptography, consensus protocols, and smart contract design patterns is vital. **Data Privacy:** Protection of personal and sensitive data. Given the transparency of public blockchains, data privacy is a special challenge. Developers must encrypt data, store sensitive data off-chain, implement data access controls and anonymization techniques, and understand zero-knowledge proofs and pseudonymity on the blockchain. **Data Validation:** Processes and techniques employed to ensure that used data meets specific formats or standards. Since confirmed transactions cannot be altered, proper validation is crucial for avoiding errors, enhancing security, and upholding data integrity. It encompasses input, type, boundary, and dependency checks using Solidity's modifiers, `revert`, and `assert` operations. **Vulnerability Management:** Identifying, assessing, and addressing potential weaknesses in smart contracts. Given that smart contracts frequently manage substantial value and are immutable post-deployment, addressing vulnerabilities is paramount. Developers must be aware of common attack vectors specific to smart contracts and employ techniques to mitigate them through audits, testing, and design patterns. **Hashing:** The process of converting data into a fixed-length string of bytes using a deterministic one-way function. Hashing ensures data integrity, security, and privacy without revealing actual content. Developers need to be familiar with standard hash functions like Keccak-256, their properties, and hash pointers. **Nonce Management:** Generating, handling, and overseeing nonces. In smart contract development, nonce management is used for transaction ordering and safeguarding against replay attacks. Developers must be proficient in tracking nonces to prevent replay attacks and in generating random nonces for cryptographic operations. **Public Key Cryptography:** Secure authentication and communication using a pair of public and private keys. Public key cryptography is used in smart contracts to authorize actions and secure data integrity. Developers must understand key generation, creation and verification of digital signatures, and encryption. **Random Number Generation:** Generating unpredictable numbers in a deterministic environment. Random numbers are used for token distribution, cryptographic operations, and dynamic contract behavior. Developers need to implement methods to generate and verify random numbers, understand commit-reveal schemes and oracles, and recognize potential vulnerabilities in random number generation. **Data Serialization:** The process of converting complex data structures or objects into a linear format. Serialization is essential for data storage, transmission, and ensuring interoperability between blockchains or blockchain tools. Developers need to encode and decode data, optimize data structures, and be familiar with serialization protocols such as Recursive-Length Prefix (RLP). **Data Transformation:** The process of converting data from one format, structure, or type to another. Data transformation ensures interoperability between different systems and optimizes smart contract storage, performance, and operational costs. Developers must know how to format, convert, aggregate, encode, decode, encrypt, and decrypt data, requiring in-depth knowledge of data types, formats, and gas costs. **State Management:** Techniques and strategies to handle and store the on-chain and off-chain states of the application. State management is crucial for ensuring efficiency, security, and data consistency in the DApp frontend. Developers must synchronize off-chain and on-chain data, cache data, and handle events using libraries such as Web3.js or Ethers.js. **Storage Management:** Management of how data is stored and accessed within the network. Storage management is vital for cost efficiency, swift data retrieval, privacy, and scalability of smart contracts. Developers must structure data, optimize storage layout, select the appropriate data location, and understand the gas costs associated with each storage solution. **Transaction Management:** Creating, signing, broadcasting, and monitoring transactions. Proper transaction management is essential for optimizing costs and ensuring the safety of funds and data. Developers need to understand how transactions are added to a block, the mechanics of transaction queues and the mempool, and the role of nonces in ensuring correct transaction ordering. **Consensus Mechanism Proficiency:** Deep understanding of the consensus protocols used by the network. Understanding consensus algorithms is crucial for managing costs and optimizing smart contract performance. Developers need to be familiar with the properties and mechanics of algorithms like Proof-of-Work and Proof-of-Stake. **Ethereum Governance Handling:** Understanding of the decision-making process in Ethereum. The Ethereum network undergoes changes, including hard forks, that can directly influence how smart contracts operate. Developers must understand how governance changes are implemented and their impact on contract operation. **Libraries Proficiency:** Expertise in using Ethereum-specific software libraries to interact with the network. Libraries such as Ethers.js, Node.js, and Web3.js enhance efficiency and security while reducing contract cost. Familiarity with these is often required for smart contract development. **EVM Proficiency:** Expertise in working with the Ethereum Virtual Machine, understanding its architecture and operation. The EVM executes smart contracts, so understanding its architecture, EVM Opcodes, gas mechanics, and how it handles events is vital for development and optimization. **Gas Management:** Optimizing the gas usage of contracts. Proper gas management ensures cost efficiency and transaction reliability. Developers must estimate required gas, set gas prices, and optimize code for gas usage, and understanding the difference between a transaction gas limit and a block gas limit is essential. **Oracle Integration:** The ability to connect and synchronize oracle data sources with smart contracts. Oracles are pivotal for integrating external data into contracts. Developers must select the appropriate oracle, validate sourced data, and integrate fallback mechanisms while being aware of oracle-specific vulnerabilities that can be introduced into the contract. **Resource Management:** Effective allocation and utilization of computational resources. Resource management enhances the cost efficiency, performance, and scalability of smart contracts. It involves optimizing contracts, evaluating storage solutions, managing memory, and implementing scaling strategies using knowledge of gas optimization, data structures, state channels, and Layer 2 solutions. **Network Analytics:** Analyzing and interpreting network data. Network analytics plays a significant role in DApp development, providing performance insights and helping detect suspicious activities that could indicate potential attacks. Developers need to know how to gather and visualize data using blockchain explorers and on-chain metrics. **API Proficiency:** Utilization and integration of APIs to communicate with external services or nodes. APIs such as JSON-RPC are used to interact with Ethereum nodes, making API proficiency essential for contract interoperability. Developers must integrate APIs, handle authentication, and manage errors, requiring knowledge of REST paradigms and common data formats like JSON and XML. **Auditing:** Systematic examination and evaluation of a smart contract. Given the financial implications of smart contracts, code auditing is a crucial development step. An auditor must perform code review, static analysis, dynamic analysis, and documentation review, and must be familiar with common vulnerabilities and Solidity best practices. **Design Pattern Implementation:** Applying established design patterns to smart contract development. Design patterns enhance the security, efficiency, maintainability, scalability, and reusability of contracts. Developers must be knowledgeable about common patterns such as the Proxy Pattern and the Façade Pattern and know when to apply them. **Frontend Management:** Designing, developing, and optimizing the user interface. Frontend management involves building user interfaces that facilitate interactions between users and smart contracts. It encompasses UI design, wallet integration, and data retrieval from the contract for display. Developers need to be proficient in web frameworks like React and Ethereum libraries for frontend-network interaction. **General Software Engineering Practices:** The ability to apply fundamental principles and methodologies of software development. These practices are foundational to creating reliable and maintainable DApps. Developers must apply coding standards and best practices, including naming conventions and programming paradigms like modularization and encapsulation, and know how to refactor existing code. **General Software Engineering Collaboration and Documentation Skills:** The ability to understand and create comprehensive documentation and effectively work with a team. Most DApp projects rely heavily on teamwork, making collaboration and documentation essential. Developers must be proficient in collaboration tools like Git, adhere to documentation standards, and use code collaboration platforms to ensure quality and consistency. **Testing:** Evaluating and validating software to ensure it meets specified requirements. Testing is a pivotal phase in DApp development, and given that errors can be immutable and lead to financial losses, thorough testing is imperative. Developers need proficiency in unit, integration, and edge case testing, as well as benchmarking to verify the application meets performance standards. **Time Handling:** Managing and processing time-related data. Given the decentralized nature of smart contracts, handling time correctly is crucial for time-dependent functions. Developers must manage block timestamps, set time-based constraints, and calculate computing times while accounting for time drift caused by decentralized transaction execution. **Decentralized Identity Standards:** Application of protocols and practices that allow users to create, control, and verify their digital identities. Decentralized identity shifts control over identity data from centralized authorities to users, enhancing privacy and security. Developers must be able to create, verify, and manage decentralized identities as well as issue and verify credentials. **Incentive Design:** Creating mechanisms to motivate desired behaviors from participants. Proper incentive mechanisms are essential to ensuring that decentralized systems remain secure and efficient, contributing significantly to network security and user engagement. Developers must create a mechanism and formulate its rules to yield desired outcomes through rewards and penalties, requiring knowledge of game theory and behavioral economics. ## Key Takeaways This research produced a few findings that I think genuinely matter for anyone building in the DApp space, or teaching others to do so. **DApp courses have a blind spot for fundamentals.** Nearly every educational resource reviewed jumps straight into Solidity and Ethereum-specific concepts. But the skills that cut across the most flaws, like documentation, naming conventions, code structure, and version control, are almost never taught. They're treated as something developers should already have. **The hardest flaws require breadth, not just depth.** Flaws like Unpredictable Execution Behavior and Inefficient Code are hard not because they require highly specialized knowledge, but because they sit at the intersection of many skill areas at once. Developers who go deep on Solidity alone will still be vulnerable if they lack testing discipline, security awareness, or an understanding of how the EVM actually processes transactions. **Security is not a layer you add later.** Every flaw in the Security Vulnerabilities category stems from decisions made early in design and implementation. Access controls, randomness sources, and protection against reentrancy all need to be considered from the first line of code. Retrofitting security onto a deployed, immutable contract can be difficult or not even an option at all. **The framework is a practical curriculum guide.** The mapping between flaws, skills, and themes isn't just an academic exercise. It gives curriculum designers a concrete answer to the question: "if I want to teach developers to avoid *this* flaw, here's exactly what needs to be in the course." That kind of structured guidance is almost entirely absent from current DApp education.