The Ultimate Web3 Security Toolkit: 100+ Tools Curated
One repository to rule them all: secret scanning, smart contract auditing, runtime protection, key management, compliance, fuzzing, formal verification, and more.
The Problem: Fragmented Knowledge
You're a security engineer / DevOps lead / founder building on Web3. You need to:
- Scan for leaked private keys in your repos
- Audit smart contracts before deployment
- Monitor runtime for attacks
- Manage keys securely (hardware, MPC, rotation)
- Secure your supply chain (SBOM, signing, provenance)
- Meet compliance (CCSS, SOC2, ISO27001)
- Fuzz test your contracts
- Formally verify critical logic
Where do you start? Google gives you 50 tabs. GitHub search gives you 500 repos. Most are abandoned, incomplete, or generic tools that don't understand Web3.
The Solution: awesome-web3-security
I curated 100+ tools across 15 categories in one place:
👉 github.com/ezequiellich44-cmd/awesome-web3-security
Categories Covered
| Category | Tools | Highlights |
|---|---|---|
| Secret Scanning | 12 | drainscan (web3-native), gitleaks, trufflehog, GitHub Secret Scanning |
| Smart Contract Auditing | 15 | Slither, Mythril, Echidna, Foundry, Halmos, SolSniper (Token-2022) |
| Runtime Protection | 12 | Forta, OpenZeppelin Defender, Tenderly, Phalcon, Flashbots |
| Key Management | 12 | Ledger, Trezor, Fireblocks, Qredo, HashiCorp Vault, AWS Secrets Manager |
| Supply Chain Security | 9 | Sigstore, SLSA, Syft, Grype, Dependabot, Renovate, OSSF Scorecard |
| Compliance & Standards | 7 | CCSS, NIST, ISO27001, SOC2, OWASP Top 10, SCSVS |
| Fuzzing & Testing | 8 | Foundry, Echidna, Halmos, Medusa, Proptest, Hypothesis |
| Formal Verification | 7 | Certora, K Framework, Coq, Isabelle, Dafny, Move Prover |
| Incident Response | 9 | Chainalysis, Elliptic, TRM Labs, BlockSci, Etherscan, Dune |
| Blockchain-Specific | 20+ | Ethereum, Solana, Cosmos, L2s (Arbitrum, Optimism, zkSync, Starknet) |
| Learning Resources | 15+ | RareSkills, Cyfrin Updraft, Secureum, Damn Vulnerable DeFi, Ethernaut |
| Communities | 7 | EthSecurity, Solana Security, Immunefi, Code4rena, Sherlock |
| Audit Firms | 15 | Trail of Bits, OpenZeppelin, ConsenSys Diligence, Sigma Prime, OtterSec |
| Checklists | 8 | Solidity, Anchor, Token-2022, Pre-Audit, Trail of Bits, Secureum |
Why This List Is Different
1. Comparison Tables (Not Just Links)
Every category has structured tables with the columns that matter:
Secret Scanning Example:
| Tool | Language | Key Features | Web3-Native | SARIF | Git History |
|---|---|---|---|---|---|
| drainscan | Python | EVM, Solana, BIP-39, Phantom, entropy, offline derivation, live balances | ✅ | ✅ 2.1.0 | ✅ Pro |
| gitleaks | Go | Generic patterns, high speed | ❌ | ✅ | ✅ |
| trufflehog | Go | Entropy + regex, 800+ detectors | ❌ | ✅ | ✅ |
You can compare at a glance.
2. Open Source vs Commercial Separated
No hidden sales pitches. Each category has:
- Open Source table (free tools)
- Commercial / Pro table (with pricing models)
3. CI/CD Integration Matrix
| Platform | drainscan | gitleaks | trufflehog |
|---|---|---|---|
| GitHub Actions | ✅ | ✅ | ✅ |
| GitLab CI | ✅ | ✅ | ✅ |
| Bitbucket | ✅ | ✅ | ✅ |
| Azure Pipelines | ✅ | ✅ | ✅ |
| Pre-commit | ✅ | ✅ | ✅ |
4. Blockchain-Specific Depth
Solana Token-2022 Extensions (the new attack surface):
-
permanentDelegate→ authority can seize tokens anytime -
transferFee→ configurable transfer fees (up to 100%) -
defaultFrozen→ tokens born frozen, can't sell until thawed -
mintCloseAuthority→ mint can be destroyed -
transferHook→ arbitrary logic on every transfer
Tools that detect these: SolSniper, drainscan (entropy detection)
5. Learning Pathways
Not just tools — how to learn:
- Beginner: Ethernaut, Capture The Ether, Cyfrin Updraft
- Advanced: RareSkills, Secureum, Damn Vulnerable DeFi
- Specialized: Solana Security, ZK Proofs, MEV
6. Audit Firms Ranked by Specialty
| Firm | Specialty | Notable Tools |
|---|---|---|
| Trail of Bits | EVM, Rust, ZK, formal | Slither, Echidna, Manticore |
| OtterSec / Neodyme | Solana, Anchor | Solana focus |
| Sec3 | Solana, Move, Sui, Aptos | Multi-VM |
| Veridise | Formal, Move, Rust | Move Prover |
How to Use It
For Security Engineers
# Quick scan your repo
pip install drainscan --extra-index-url https://ezequiellich44-cmd.github.io/pypi-simple/
drainscan scan . --live --min-confidence high
For DevOps / Platform Teams
Copy-paste CI/CD configs from the repo:
- GitHub Actions (SARIF → Code Scanning)
- GitLab CI (SAST dashboard)
- Bitbucket Pipelines
- Azure Pipelines
For Founders / CISOs
Use Checklists section for pre-deployment, audit prep, post-deploy monitoring.
For Auditors
Reference Methodologies (Trail of Bits, ConsenSys, OpenZeppelin, Secureum) + Formal Verification tools.
Contributing
We accept PRs! CONTRIBUTING.md has the format.
Quick rules:
- One tool per PR
- Follow table format exactly
- Active maintenance required (commit within 6 months)
- Alphabetical within categories
- Factual descriptions only
Star History
Built By Practitioners
This list is maintained by engineers building drainscan — the only web3-native secret scanner with:
- BIP-39 checksum validation (kills false positives)
- Offline address derivation (see exact wallet)
- Live balance checks (read-only RPC)
- Entropy detection (catches foreign-chain keys)
- Watch mode (real-time monitoring)
- SARIF 2.1.0 (GitHub Code Scanning / GitLab SAST)
- Git-history deep scan (Pro)
Get Started
# Star the repo ⭐
https://github.com/ezequiellich44-cmd/awesome-web3-security
# Try the scanner
pip install drainscan --extra-index-url https://ezequiellich44-cmd.github.io/pypi-simple/
drainscan scan . --live
# Need git-history + SARIF + HTML reports?
# $99 one-time: https://github.com/ezequiellich44-cmd/drainscan/issues/1
Stop searching. Start securing. ⭐ awesome-web3-security
