Cyfrin's auditor course repo is the written course, and the findings template is the useful part

One README as the whole syllabus

The repository is unusually shaped for a course: there is no build step, no package manifest and no tool to run. The content is the written material, organised inside a single README that opens with a collapsible table of contents built from HTML details and summary blocks.

The structure tells you what the course thinks the learning order is. Section 0 is a welcome that covers why web3 security matters, the best practices for the course, and introduces a "final boss" codebase that the reader is expected to be able to audit by the end. Section 1 is a review stage with an explicit instruction not to skip it. Section 2 defines what a smart contract audit or security review is, then walks the development life cycle, names a subjective shortlist of top auditors, covers tooling, audit readiness, the attacker versus defender mindset, and top attack vectors.

Section 3 is the first hands-on audit, and its subheadings are the ones that matter to an auditor in training: scoping a codebase called PasswordStore, an entity referred to as "the Tincho", vulnerability identification, then two separate exploit categories, access controls and private data. It ends with writing your first finding and producing your first report.

Section 4, truncated in the README, is titled around manual and static analysis.

The rename note explains one piece of vocabulary drift: lessons were renamed to sections, so anyone following an older reference to "Lesson 3" should look for Section 3.

Each section ships an NFT, which tells you how to navigate

Nearly every section in the table of contents ends with a link labelled as that section's NFT. A welcome section, a review section, a section defining audits, the PasswordStore section: each one has an NFT entry.

This is an onboarding mechanic rather than content. A repository of lessons with no progress marker is hard to resume, so the course uses a claimable token per section as a checkpoint for people working through the community Discord, which the README describes as a community of 3000+ developers and auditors. If you are following the written material without joining, the NFT lines are simply noise in the table of contents.

Two bonus items sit before the curriculum, under the introduction. One covers important notes for zkSync and how to bridge to zkSync. The other is bonus NFTs. That pairing suggests the exercises touch more than a single EVM chain, which matters if your own audit practice spans L2 deployments and you want to know whether the course does anything with them.

finding_layout.md is the file to copy first

The repository root is where the practical value is. Alongside the README sit several files that describe how to do the job rather than what to learn.

`finding_layout.md` defines the shape of a finding, which is the document auditors write over and over and which most people learn badly by copying whatever format their last job used. `how-to-ask-a-question.md` and `how-to-answer-a-question.md` come as a pair and address the two directions of asking for help, which matters in a field where half of the skill is knowing how to phrase an ambiguous question about a contract without leaking the answer.

There are two onboarding question lists as well, `extensive-onboarding-questions.md` and `minimal-onboarding-questions.md`. Having both in one repository implies a view that the same candidate can be evaluated either quickly or thoroughly, which is how audit firms actually staff competitions.

`eip712hashing.sol` is a Solidity file at the root, and its presence in a course about signing and authorisation bugs is the reason the primary language of the repository is listed as Solidity. EIP-712 typed structured data hashing is where signature replay and domain separator mistakes live, so shipping a reference implementation to read is more useful than describing it.

`improvement_points.md` reads like a scoring rubric, and `chronological-updates.md` is a dated log of what changed in the course over time.

The course is the front end, the repository is the corpus

The README points at a course page and marks it important, and the surrounding links make the division of labour clear. Cyfrin Updraft is described as offering 50+ hours of smart contract development courses generally, the course page itself is at updraft.cyfrin.io/courses/security, and there are links to a newsletter with weekly security research tips, a Twitter account for new course releases, and Codehawks, described as smart contracts auditing competitions.

So the repository is the written text and the site is the course proper. That distinction matters when you are deciding what to read: if you want the narrative and the web3 security motivation, the README points to the external course page. If you want the reference documents, the conventions and the code, it is here, under a GPL-3.0 licence with a code of conduct and a contributing guide.

The project credits The Red Guild alongside Cyfrin Updraft as the organisation behind the course.

There is also a TODO.md and a cookbook-listings.md at the root, which suggests the repository also indexes planned work and where the material appears in cookbooks.

What is missing, and who this is not for

Two limits are visible from the file listing.

First, the repository contains no auditing tooling. There is no static analysis configuration, no test harness, no deployment scripts. A reader looking for a Slither config or a Foundry setup will not find one here; the tooling lesson inside Section 2 is prose about what exists in the ecosystem, not a pinned, runnable version of it.

Second, and more consequential, there are no GitHub releases. The repository is not archived and the last push was on 2026-07-08, so the content is being worked on, but there is no tagged version of the curriculum. If you are incorporating these conventions into a team process, you are depending on whatever the README said on the day you copied it, and nothing in the repository pins that.

The prerequisites and resources sections come before the curriculum in the table of contents, which tells you the course expects you to arrive already able to read Solidity. That is the honest boundary: this is a course for people moving from writing contracts to reviewing them, not an introduction to either.

Editorial conclusion

This repository suits a developer who already writes Solidity and wants a structured path from reading a codebase to writing a finding report, and who will read the material rather than skim it. It does not suit someone looking for a toolchain, since there is no auditing software here, only lessons and documentation conventions. Before starting, read finding_layout.md and how-to-ask-a-question.md because those files document the course's reporting and questioning conventions.

Frequently asked questions

Official sources

1. Cyfrin/security-and-auditing-full-course-s23 on GitHub
2. Issues
3. License: GPL-3.0
4. README