Online Channels, Communities, and Forums

Smart contract security moves faster than any book or course can keep up with. The communities below are where the day-to-day conversation happens — new exploits dissected hours after they occur, new tools announced, new techniques shared, and new auditors found and mentored.

Discord Servers

Discord is the dominant real-time channel in the space. The most active and useful servers for an auditor:

  • Secureum — channels for RACE participants, study groups, paper-of-the-week discussions, and active job/contract postings.
  • Code4rena — contest announcements, post-contest discussions, public triage rooms during open contests.
  • Sherlock — contest discussions and judging conversations.
  • Cantina — contest channels and a growing community of solo auditors.
  • CodeHawks (Cyfrin) — First Flights coordination, contest discussion, and learning channels.
  • Immunefi — bug-bounty hunters' channels, programs index, triage discussion.
  • Trail of Bits Empire Hacking — open community around ToB's tooling and research.
  • OpenZeppelin Forum / Discord — discussion around OZ contracts, common patterns, and upgrade questions.

X (formerly Twitter)

X remains the highest-bandwidth public channel for security commentary. A starter list of accounts worth following:

  • Firms: @trailofbits, @OpenZeppelin, @SpearbitDAO, @cantinaxyz, @sherlockdefi, @code4rena, @CyfrinAudits, @zellic_io, @ChainSecurity, @dedaub, @PeckShieldAlert, @SlowMist_Team.
  • Researchers and educators: @PatrickAlphaC, @owenthurm, @0xKaden, @bytes032, @0xRajeev, @tinchoabbate, @0xSorryNotSorry, @samczsun, @transmissions11.
  • Exploit and post-mortem feeds: @RektHQ, @blocksecteam, @phalcon_xyz, @CertiKAlert, @AnciliaInc.
  • Tooling and research: @cryticio, @smtchecker, @CertoraInc, @halmos_xyz.

The signal-to-noise ratio on X varies; curate aggressively.

Warpcast / Farcaster

Farcaster's /security and /defi channels host an increasingly active community of researchers and auditors, with longer, less performative discussion than X.

Newsletters and Periodicals

  • Officer's Notes — weekly security-focused newsletter aggregating exploits, audits, and research.
  • Rekt News — rekt.news — long-form, narrative post-mortems of major exploits.
  • BlockSec Phalcon updates — exploit alerts and reconstructions.
  • Week in Ethereum News — broader ecosystem newsletter with a security section.
  • The Defiant — DeFi-wide coverage that often includes security stories.

Forums and Long-Form Discussion

  • Ethereum Magicians — ethereum-magicians.org — EIP discussion; the place where standards-level security debates happen.
  • Ethereum Research — ethresear.ch — deep technical posts from protocol researchers; useful for understanding the assumptions L1 and L2s actually rely on.
  • r/ethdev — Reddit; lower-density but occasional good Q&A.
  • OpenZeppelin Forum — forum.openzeppelin.com — historical archive of common-pattern discussions; still useful as a reference.

Podcasts and Video Channels

  • Smart Contract Programmer (YouTube) — already mentioned in courses; equally useful as ongoing media.
  • Owen Thurm / Guardian Audits (YouTube) — exploit walkthroughs.
  • Johnny Time (YouTube) — security and DeFi technical breakdowns.
  • The Defiant podcast, Unchained, Bell Curve, Bankless — broader DeFi coverage with periodic security episodes.
  • Trail of Bits' "Empire Hacking" talks — recorded sessions, often deep.

CTFs and Wargames as Communities

Some of the best learning communities form around recurring CTFs:

  • EthernautDAO — Discord and recurring CTFs.
  • Paradigm CTF — annual; the post-event write-ups are essential reading.
  • Capture The Ether, Ethernaut, Damn Vulnerable DeFi — async wargames with active solver communities sharing solutions and variations.

Finding a Mentor

The single highest-leverage move for a new auditor is to find a more senior auditor to co-review with, even informally. The above communities are where that happens. Useful approaches:

  • Pick a public contest report. Read it cover to cover. Replicate the top findings. Post your write-up and tag the auditor whose work you're studying.
  • Contribute to tooling. A PR to Slither, Aderyn, Foundry, or any widely-used contract library gets you in front of senior people in a low-stakes context.
  • Submit thoughtful contest findings. Even unsuccessful submissions, when well-reasoned, get noticed by judges.

Communities reward consistent, public, technically-grounded participation. Show up, do the work in the open, and the mentorship and opportunities tend to follow.