Web3 & Smart Contract Security

Because a deployed contract usually cannot be patched and confirmed transactions are effectively permanent. In a web app a bug can be fixed tonight and the damage contained; in a contract the logic is the vault, so a flaw stays live until it is exploited or the contract is abandoned, with no undo for lost funds.

The EVM, the Ethereum Virtual Machine, is the runtime that executes contract bytecode deterministically on every node so all honest nodes agree. Gas is a unit that meters each operation's computation and storage, paid by the user, so the network cannot be spammed with infinite loops or endless work.

Reentrancy happens when a contract makes an external call before updating its own state. The called address can call back into the original function while the accounting is still stale and withdraw more than it should. The fix is the Checks-Effects-Interactions order: update state before making external calls.

Only on a local development chain or a public testnet, using your own contracts and throwaway test keys where coins have no real value. Never deploy an exploit against a live contract or someone else's deployment, which can be theft and a serious crime regardless of the bug.

Yes. Auditing is mostly reading. You must know what a contract is supposed to do and what state it controls before you can judge whether it is safe. Write down the invariants in plain language; most bugs are simply a place where one of those rules can be broken.

No. The private keyword only stops other contracts from reading the variable through the language. All contract storage is public, and anyone running a node can read any 32-byte storage slot directly, for example with cast storage. Passwords, seeds or answers stored on-chain are never hidden.