A self-study security curriculum for smart contract auditors crossing into Canton Network and DAML.
A 6-day bootcamp that takes a working smart contract auditor (EVM, Solana, Move, Cosmos background) from zero on Canton/DAML to capable of conducting a real DAML audit. The curriculum covers the language, the platform, the privacy + authorization model, the auditor toolchain, and the 20 most common DAML vulnerability patterns — with working code examples for each lesson.
By end of Day 6 you should be able to:
- Read any DAML template and immediately identify privacy + authorization concerns
- Recognize the 20 most common DAML vulnerability patterns by sight
- Set up the auditor toolchain (
daml sandbox,daml navigator, OpenZeppelin'sdaml-lint/daml-props/daml-verify) - Write Daml Script PoCs that mechanically demonstrate findings
- Conduct deployment-layer audits of Canton synchronizer configurations
- Walk a real DAML codebase against the 20-pattern catalogue
Experienced smart contract auditors who need to ramp on Canton + DAML quickly. The curriculum assumes:
- Comfortable with smart contract security concepts (privilege escalation, access control, etc.)
- Familiar with statically-typed functional or functional-adjacent languages (Haskell, Rust, OCaml, Scala, Swift, etc.) OR willing to learn fast
- Comfortable in a terminal, can install tooling
Why Canton/DAML matters: Canton Network has production deployments at major financial institutions. DAML is how you write applications on it. The pool of public-chain auditors is in the tens of thousands; the pool of deep-DAML auditors is small. The market window is open.
- Install the Daml SDK:
curl -sSL https://get.daml.com/ | sh - Clone this repo and
cdinto it. - Open
02-curriculum/day1-canton-architecture.mdand start reading. - For each day, run the corresponding code example:
cd 04-code-examples/dayN daml build daml test
| Day | Topic | File | Headline deliverable |
|---|---|---|---|
| 1 | Canton architecture & vision | 02-curriculum/day1-canton-architecture.md |
Mental model: synchronizer / sequencer / mediator / participant / party |
| 2 | DAML language fundamentals | 02-curriculum/day2-daml-language.md |
Read & write DAML templates, signatories, choices, ensure, propose/accept |
| 3 | Advanced DAML | 02-curriculum/day3-daml-advanced.md |
Contract keys, atomic swaps, interfaces, smart contract upgrades |
| 4 | Privacy & authorization (the high-yield day) | 02-curriculum/day4-daml-privacy.md |
Sub-transaction projection, divulgence, choice observer widening, return-type leaks |
| 5 | Canton operational + threat model | 02-curriculum/day5-canton-security.md |
Topology, BFT assumptions, JWT, vetting, the 10 must-not-assumes |
| 6 | The 20-pattern vulnerability catalogue + auditor toolchain | 02-curriculum/day6-vulns-and-tools.md |
Recognize all 20 patterns; write a working PoC exploit |
01-research/ Deep-reference dossiers (~9.5K lines combined) — primary references for each day
02-curriculum/ Day-by-day lessons (Days 1-6)
03-cheatsheets/ Quick-reference cards (DAML types, privacy/authorization)
04-code-examples/ Working DAML code per day, plus tests
05-audit-checklists/ Long-form audit checklists (deployment-layer, more to come)
- Read each lesson end-to-end —
02-curriculum/dayN-*.md. The lessons are written densely; expect 60-90 minutes per day. - Build and test the code for that day:
cd 04-code-examples/dayN daml build && daml test
- Do the exercises at the end of each day. For audit-style exercises (find N bugs in this contract), write up findings using the standard format: Vulnerability / Attack scenario / Impact / Severity / Fix. Then compare your write-up to the canonical findings discussed in the corresponding lesson section.
- Open the deep-reference dossier in
01-research/when you want to go beyond what the lesson covers. The dossiers are reference material, not required reading.
| Day | Lesson | Code examples |
|---|---|---|
| 1 | ✓ Complete | (architecture only — no code) |
| 2 | ✓ Complete | ✓ 04-code-examples/day2/ |
| 3 | ✓ Complete | ✓ 04-code-examples/day3/ |
| 4 | ✓ Complete | ✓ 04-code-examples/day4/ |
| 5 | ✓ Complete | (operational/threat-model — no code) |
| 6 | ✓ Complete | ✓ 04-code-examples/day6/ |
Built referencing:
- The Canton whitepaper (Digital Asset)
- DAML language documentation at docs.daml.com
- Canton open source: github.com/digital-asset/canton
- Splice / Canton Network: docs.dev.sync.global
- OpenZeppelin DAML security tools (released March 2026): daml-lint · daml-props · daml-verify
- DAML security best-practices reference: SupremacyTeam/DAML-Smart-Contract-Security-Best-Practices
- SC Audit Studio's DAML vulnerabilities article: scauditstudio.com
- Foundational papers: PBFT (Castro & Liskov, 1999); Byzantine Generals (Lamport et al., 1982)
MIT — see LICENSE.
Built by BlockApex