Best Blockchain CTF Challenges for Aspiring Auditors

By Owen Thurm Published November 6, 2026 5 min read

Quick answer. Start with OpenZeppelin's Ethernaut (41 levels), then Damn Vulnerable DeFi v4 (18 challenges). Next, reproduce real hacks with DeFiHackLabs and play the Paradigm and Remedy CTF archives. Skip Capture the Ether: its Ropsten testnet was deprecated in 2022.

Watch: Best Blockchain CTF Challenges for Aspiring Auditors 1:39

Video transcript

Start with Ethernaut, then Damn Vulnerable DeFi. Then reproduce real hacks and play the competition archives.

CTFs teach how contracts break by making you break them. Many lists are out of date, so we checked every entry in November 2026. Guardian runs none of them.

Here is the ranking, easiest to hardest. Every entry is still playable, on the web or on your own machine.

Begin with OpenZeppelin's Ethernaut. Its 41 levels cover classic bugs like re-entrancy. Play EVM Puzzles alongside it to learn opcodes.

Next, Damn Vulnerable DeFi covers flash loans, oracles and governance. Mr Steal Yo Crypto adds variety. With DeFiHackLabs, write the exploit for a real incident before opening theirs.

For a step up, play the Paradigm CTF archives and the Remedy CTF from Hexens, locally. For live events, watch CTFtime.

Skip Capture the Ether. It tells you to switch to Ropsten, a testnet deprecated in 2022. Ethernaut covers many of the same basics.

The path: Ethernaut with EVM Puzzles, then Damn Vulnerable DeFi. Add real incidents, play the archives under a time limit, then move to real code. Write up every solution.

CTFs build the toolbox. Auditing also takes deep reading of unfamiliar code. Read the full guide, or see Guardian's open roles at guardian.security.

Capture the flag challenges teach how smart contracts break by making you break them. Each one is a vulnerable contract, and you win by exploiting it.

Many lists online are out of date. Some point to games on testnets that were deprecated years ago.

We checked every entry below on its own site or repository on November 6, 2026. Guardian runs none of them.

The Ranking at a Glance

The list runs from easiest to hardest. Each entry is still playable, on the web or on your own machine.

#	Name	Level	Teaches	Status
1	Ethernaut	Beginner	Solidity and EVM bug classes	Maintained; 41 levels
2	EVM Puzzles	Beginner	Opcodes and calldata	10 puzzles; unchanged since 2023
3	Damn Vulnerable DeFi	Intermediate	Flash loans, oracles, governance, wallets	v4.1.0, March 2025; 18 challenges
4	Mr Steal Yo Crypto	Intermediate	Exploits inspired by real hacks	20 challenges; repo last updated 2023
5	DeFiHackLabs	Intermediate to advanced	Reproducing real incidents	Active; 906 incidents
6	Paradigm CTF archives	Advanced	Competition puzzles, 2021 to 2023	Archived on GitHub; run locally
7	Remedy CTF 2025	Advanced	Competition puzzles, January 2025	Archived on GitHub; run locally

Beginner Wargames

1. Ethernaut

OpenZeppelin's Ethernaut is a wargame where each level is a contract to hack. You play through a web app with a testnet wallet, on networks such as Sepolia.

Size: 41 levels, starting with a tutorial, per the game data in its repository.
Covers: classic bugs, in levels such as Re-entrancy, Delegation, Puzzle Wallet and Motorbike.
Status: maintained. The newest level was added in November 2025, and the repository was updated in November 2026.

2. EVM Puzzles

EVM Puzzles, a GitHub collection by fvictorio, gives you contract bytecode. You win by sending a transaction that does not revert.

The 10 puzzles train you to read opcodes. Keep the evm.codes reference open while you play.

Intermediate DeFi Challenges

3. Damn Vulnerable DeFi

Damn Vulnerable DeFi moves from Solidity basics to DeFi. Version 4, maintained by The Red Guild, has 18 challenges.

Covers: flash loans, price oracles, governance, DEXs, lending pools, smart contract wallets, timelocks, vaults and upgradeability.
Format: you code each solution as a Foundry test. Some challenges fork mainnet and need an RPC URL.
Status: the latest release, v4.1.0, came out in March 2025.

4. Mr Steal Yo Crypto

Mr Steal Yo Crypto has 20 standalone challenges, “loosely (or directly) inspired by real world exploits.” The main version uses Hardhat, and a Foundry version exists.

Use it for more variety after Damn Vulnerable DeFi. Its Foundry repository was last updated in December 2023.

5. DeFiHackLabs

DeFiHackLabs is not a game. It reproduces real DeFi hacks as Foundry proofs of concept: 906 incidents, per its README.

Pick an incident, read the root cause, and try to write the exploit before you open theirs. Every one is an attack that happened.

Advanced and Live CTFs

6. Paradigm CTF archives

Paradigm has published its 2021, 2022 and 2023 CTF challenges on GitHub. They were written for timed competitions, so expect a step up.

The events are over, but you can still play locally with Docker. The 2023 set runs on Paradigm's public CTF infrastructure; the 2021 and 2022 repos have their own scripts and need an Ethereum RPC URL.

7. Remedy CTF 2025

Hexens ran Remedy CTF online from January 24 to 26, 2025. Its 14 challenges are on GitHub and run on Paradigm's CTF infrastructure.

The README links ChainLight's write-ups, so you can check your solutions.

Live competitions

Dedicated Web3 CTFs run irregularly. Watch CTFtime, which lists events with their dates and format.

General CTFs also include blockchain challenges. In 2025, DiceCTF, HITCON, SekaiCTF and corCTF all did, per a community index of 200+ blockchain challenges.

Skip: Capture the Ether

Capture the Ether, built by smarx, has 20 challenges. Its first one tells players to “Switch to the Ropsten test network.”

The Ethereum Foundation deprecated Ropsten in 2022, with shutdown set for the fourth quarter. Read the challenges as exercises if you like, but you cannot play them as built.

Non-EVM Options

Fewer options exist outside the EVM, and most are workshops rather than games.

Solana, Neodyme workshop: five levels of vulnerable Rust programs, with hints, bug write-ups and solutions.
Solana, Sealevel Attacks: 11 short examples of Solana-specific bugs, each with the recommended Anchor idiom.
Cosmos, Oak Security CosmWasm CTF: 10 challenges from a 2023 live event, with official write-ups.
Move and Cairo: the same community index lists past challenges by chain, including Sui Move.

Paradigm CTF 2022 also included Solana challenges.

A Suggested Order

Ethernaut, start to finish.
EVM Puzzles, alongside Ethernaut.
Damn Vulnerable DeFi v4, all 18 challenges.
Mr Steal Yo Crypto, for more DeFi variety.
DeFiHackLabs, one real incident at a time.
Paradigm and Remedy archives, under a time limit.
Then real code: audit contests and reviews.

Write up every solution in your own words. It is the habit audit reports demand.

Learning With Guardian

CTFs teach bug classes. Auditing also takes design sense and fast, deep reading of unfamiliar code.

Our guide on how to become a smart contract auditor lays out that roadmap. It puts the target at about 1,000 hours of auditing.

The free Advanced Web3 Security Course runs about 23 hours on YouTube. It covers attack classes, DeFi protocols, live audits, the EVM, fuzzing and formal verification.

Guardian hires full-time security researchers at levels GSR-1 to GSR-4, and fuzzing engineers. See the open roles on the careers page.

Frequently Asked Questions

Which CTF should a beginner start with?

Ethernaut. Its 41 levels start with a tutorial, and each one is a contract to hack. Move on to Damn Vulnerable DeFi once you can read Solidity comfortably and write Foundry tests.

Is Capture the Ether still worth doing?

Not as built. Its setup tells players to switch to Ropsten, a testnet the Ethereum Foundation deprecated in 2022. You can still read the 20 challenges as exercises, but Ethernaut is maintained and covers many of the same basics.

Are there live smart contract CTF competitions?

They run irregularly. Paradigm's latest published challenges are from 2023, and Hexens ran Remedy CTF in January 2025. General CTFs such as DiceCTF, HITCON and SekaiCTF included blockchain challenges in 2025.

Do CTFs make you a smart contract auditor?

They build the toolbox: bug classes and how to exploit them. Audits also need fast, deep reading of unfamiliar codebases, which comes from reading many real ones. Our guide puts the target at about 1,000 hours of auditing.

Sources

Put your practice to work at Guardian

Guardian hires full-time security researchers, from GSR-1 to lead researcher, and fuzzing engineers.

Work with Guardian See open roles