Practical overview
When it fits
Use it when you want a hands-on way to examine how named EVM exploits work, rather than relying only on written vulnerability descriptions.
Who it is for
- Solidity developers
- Smart-contract auditors
- Bug-bounty researchers
- Learners studying EVM security
Documented uses
- Study documented smart-contract vulnerabilities through executable examples.
- Reproduce selected exploits locally with Foundry.
- Inspect attack categories and supporting diagrams or references.
- Build a local environment for vulnerability research using historical EVM state where required.
Requirements & limits
The repository is public and MIT-licensed. The documented workflow requires Foundry; some tests also require archive-node data configured through foundry.toml.
- The material is organized as executable Foundry tests rather than a conventional course.
- Coverage spans multiple vulnerability classes, including access control, business logic, reentrancy, and bridges.
- Diagrams and contextual links accompany attack reproductions.
- Historical-state-dependent tests need an archive-node JSON-RPC endpoint.
- The repository is written primarily in Solidity and targets EVM-chain security study.
Check current requirements in the official documentation. Source-based guidance does not mean OpenViST has run or independently tested this project.
Run a selected exploit reproduction with Foundry
Clone the repository, install its dependencies, and run a documented exploit test with verbose output.
Before you start
- Foundry installed
- A local computer
- An archive-node JSON-RPC URL in foundry.toml for tests that require historical state
Steps
Clone the Learn EVM Attacks repository.
Run forge install to install dependencies.
Choose a vulnerability folder and its documented contract, such as Exploit_MBCToken.
Run forge test --match-contract Exploit_MBCToken -vvv; adjust verbosity as needed, with -vvvv including traces.
If the test depends on old-block state, configure archive-node access in foundry.toml and rerun it.
Expected outcome
The selected Foundry reproduction runs with the requested level of test output when its documented dependencies and historical-state access are available.
Guide limitations
- Only some tests require archive data, but the README warns that missing archive access can cause a test to fail.
- This guide covers the documented local test workflow, not independent validation of each reproduction.
Sources & review
Source record details
- Source availability
- Active
- Sources checked
- 1 October 2026
- Original website title
- coinspect/learn-evm-attacks · Official homepage title · retained in its source language