# OWASP Smart Contract Top 10:2026, SCSVS, and SCWE Audit Guide

Locale: `en`

Source: `/en/compliance/owasp-smart-contract/`

Summary: OWASP Smart Contract Top 10:2026, SCSVS (35 controls), and SCWE (156 weaknesses) set beside Thai SEC digital asset audit rules.

On this page

1. [Overview](/en/compliance/owasp-smart-contract/#topic-overview)
2. [OWASP Smart Contract Top 10:2026 (SC01 to SC10)](/en/compliance/owasp-smart-contract/#smart-contract-top-10-2026)
3. [OWASP SCSVS Verification Standard: 35 Controls Across 11 Categories (S1 to S11)](/en/compliance/owasp-smart-contract/#scsvs-verification-standard)
4. [OWASP SCWE (156 Weaknesses) and the Alternate Top 15 of Web3 Attack Vectors](/en/compliance/owasp-smart-contract/#scwe-and-top15-web3-vectors)
5. [Comparing Smart Contract Audits with Thai SEC Digital Asset Rules](/en/compliance/owasp-smart-contract/#thai-sec-smart-contract-audit)
6. [Requirements Matrix](/en/compliance/owasp-smart-contract/#compliance-matrix)
7. [Implementation Checklist](/en/compliance/owasp-smart-contract/#compliance-readiness-checklist)
8. [Frequently Asked Questions](/en/compliance/owasp-smart-contract/#compliance-faq)
9. [Related Frameworks](/en/compliance/owasp-smart-contract/#related-compliance-frameworks)

# OWASP Smart Contract Top 10:2026, SCSVS, and SCWE Audit Guide

A practical guide to the OWASP Smart Contract Top 10:2026 (SC01 to SC10), the OWASP Smart Contract Security Verification Standard (SCSVS) with 35 controls across 11 categories (S1 to S11), and the OWASP Smart Contract Security Weakness Enumeration (SCWE) cataloging 156 weaknesses (SCWE-001 to SCWE-156), set beside Thai SEC digital asset and ICO portal rules. OWASP material is voluntary technical guidance, not a requirement of the SEC.

Overview

Target Audience

Web3 and DeFi protocol teams, ICO portals, and Thai SEC-regulated digital asset operators

Testing and Review Frequency

Prior to mainnet deployment, before digital token offerings, and after any contract upgrade or material change

Assessment Scope

Smart contract source code, upgradeable proxies, oracle feeds, economic invariants, Web3 frontends, and key custody

Relevant Risks

Irreversible capital loss via access control, flash loan, or reentrancy exploits, and regulatory non-compliance

## OWASP Smart Contract Top 10:2026 (SC01 to SC10)

The 2026 edition prioritizes smart contract risks responsible for real-world capital loss across EVM chains and decentralized finance protocols.

[![OWASP Smart Contract Top 10 2026: Access and proxies (SC01, SC10), Logic and input (SC02, SC05), Oracles, flash loans, and calls (SC03, SC04, SC06, SC08), Math and verification (SC07, SC09)](/assets/compliance/guide-owasp-smart-contract-compliance-control-summary-en-v2.webp)](/assets/compliance/guide-owasp-smart-contract-compliance-control-summary-en-v2.webp)

**OWASP Smart Contract Top 10 2026**

SC01 to SC10 with 35 SCSVS controls and 156 SCWE weaknesses

- **Access and proxies (SC01, SC10)**
  - Broken access control and proxy upgradeability flaws
- **Logic and input (SC02, SC05)**
  - Business logic flaws and missing input validation
- **Oracles, flash loans, and calls (SC03, SC04, SC06, SC08)**
  - Price oracle manipulation, flash loan attacks, unchecked external calls, and reentrancy
- **Math and verification (SC07, SC09)**
  - Arithmetic errors and integer overflow, checked with 35 SCSVS controls and 156 SCWE entries

- SC01 Access Control Vulnerabilities and SC10 Proxy and Upgradeability Vulnerabilities cover weak control of privileged functions and flaws in upgradeable proxy contracts, including unprotected initializers.
- SC02 Business Logic Vulnerabilities and SC05 Lack of Input Validation arise from flawed business logic and unvalidated parameters supplied by users.
- SC03 Price Oracle Manipulation and SC04 Flash Loan–Facilitated Attacks exploit manipulated price sources or temporarily borrowed liquidity within a single transaction to extract value from a protocol.
- SC06 Unchecked External Calls, SC08 Reentrancy Attacks, SC07 Arithmetic Errors, and SC09 Integer Overflow and Underflow cover unverified external calls, re-entrant execution, and arithmetic flaws including rounding and precision.

## OWASP SCSVS Verification Standard: 35 Controls Across 11 Categories (S1 to S11)

The OWASP Smart Contract Security Verification Standard (SCSVS) establishes repeatable engineering and audit requirements for smart contract systems. OWASP currently labels it an initial version 0.0.1 (alpha).

- Covers 35 controls across 11 categories: S1 Architecture, Design, and Threat Modeling (3), S2 Policies, Procedures, and Code Management (3), S3 Business Logic and Economic Security (3), S4 Access Control and Authentication (3), S5 Secure Interactions and Communications (4), S6 Cryptographic Practices (3), S7 Arithmetic and Logic Security (2), S8 Denial of Service (2), S9 Blockchain Data and State Management (4), S10 Gas Usage, Efficiency, and Limitations (2), and S11 Component-Specific Security (6).
- Defines three assurance levels: L1 Basic Security for lower-risk contracts, L2 Moderate Security for contracts that handle sensitive data or financial transactions or sit in a DeFi ecosystem, and L3 High Assurance Security for mission-critical contracts with significant assets, governance, or high-value transactions.
- Example controls include S1.2 Proxy Patterns for upgradeable contracts, S4.1 Role-Based Access Control for role separation, and S5.1 Contract Interactions.
- Produces structured verification evidence that engineering teams, independent auditors, and regulators can trace across release cycles.

## OWASP SCWE (156 Weaknesses) and the Alternate Top 15 of Web3 Attack Vectors

The OWASP Smart Contract Security Weakness Enumeration (SCWE) catalogs 156 root-cause weaknesses. The same Top 10 project also publishes an unranked Alternate Top 15 (WA01 to WA15) of Web3 attack vectors beyond smart contracts.

- Catalogs 156 weaknesses (SCWE-001 through SCWE-156) to standardize root-cause classification in smart contract security assessments.
- WA01 Multisig Hijacking, WA02 Supply Chain Attacks, WA03 Private Key Compromise, and WA04 Drainer Malware are examples of vectors testers should consider beyond contract code.
- WA05 to WA15 range from social engineering and UI spoofing to Web2 infrastructure breaches at exchanges, insider threats, and nation-state infiltration through fake hiring.
- STH recommendation: use SCWE IDs to guide stateful fuzzing, invariant testing, and symbolic execution campaigns tailored to protocol-specific mechanics.

## Comparing Smart Contract Audits with Thai SEC Digital Asset Rules

OWASP material is voluntary technical guidance. The Thai SEC notifications reviewed do not reference OWASP, SCSVS, or SCWE, so use them as a technical benchmark alongside the regulatory duties below.

- Notification KorJor. 16/2561 Clause 17(1)(c) requires an ICO portal to be satisfied that the source code of the smart contract, or of any mechanism used in its place, matches the details in the draft prospectus, and Clause 16/1 requires it to follow the SEC notice on information technology systems and its guidelines. The notification itself has no direct penetration-testing clause.
- Notification KorThor. 19/2561 Clause 18 requires digital asset business operators to penetration test critical systems before service starts and at least once a year afterwards, by a party independent of the IT function, and to report results to the SEC Office within 30 days of the formal result and no later than 90 days after testing ends. Clause 17 applies the SEC IT notice and guidelines, such as NorPor. 6/2567, by analogy.
- Referencing SC01 to SC10, SCSVS categories (S1 to S11), and SCWE IDs (SCWE-001 to SCWE-156) provides clear traceability for pre-launch audits and post-remediation retesting.
- Combine on-chain contract reviews with off-chain penetration testing of Web3 frontends, wallet signing flows, RPC nodes, and cryptographic key management.

## References and Assessment Scope

Summary of source references, assessment scope, and review timing in the context of each item.

| Reference | Topic | Assessment Scope | Testing Cycle |
| --- | --- | --- | --- |
| **OWASP Smart Contract Top 10:2026 (SC01 to SC10)** | Smart Contract Risk Assessment Across Ten Categories | Evaluate access control, business logic, price oracles, input validation, external calls, flash loans, reentrancy, arithmetic errors, and proxy upgradeability | Prior to mainnet launch and after contract upgrades |
| **OWASP SCSVS (S1 to S11)** | Verification of 35 Controls Across Assurance Levels L1, L2, and L3 | Verify architecture, policies and code management, business logic, access control, contract interactions, cryptography, arithmetic, DoS, blockchain data, gas usage, and component-specific security | Proportionate to protocol risk tier (L1 basic, L2 moderate, L3 high assurance) |
| **OWASP SCWE (156 Weaknesses)** | Root-Cause Weakness Mapping and the Alternate Top 15 Web3 Attack Vectors | Map findings to SCWE-001 through SCWE-156 and consider WA01 to WA15 vectors such as multisig hijacking, supply chain attacks, and private key compromise | During secure SDLC fuzzing and pre-release security audits |
| **Thai SEC KorJor. 16/2561 and KorThor. 19/2561** | ICO Portal Source-Code Audit and Digital Asset Penetration Testing | Verify smart contract source code against the draft prospectus (KorJor. 16/2561 Clause 17(1)(c)) and conduct penetration testing of critical systems (KorThor. 19/2561 Clause 18) | Before token offering, and for penetration testing before service starts and at least annually under KorThor. 19/2561 Clause 18 |

### Implementation Checklist

Select items your organization has completed. The percentage shows selected items only and does not assess security or compliance.

0%

Verify role-based access control and proxy upgradeability against SCSVS category S4 and control S1.2.
          
          
            
            Define economic invariants and execute stateful fuzzing to uncover Business Logic (SC02) and Arithmetic (SC07, SC09) flaws.
          
          
            
            Review oracle price sources and flash loan scenarios against Price Oracle Manipulation (SC03) and Flash Loan–Facilitated Attacks (SC04).
          
          
            
            Review external calls (SC06), reentrancy (SC08), and input validation (SC05). STH recommends Checks-Effects-Interactions ordering and reentrancy guards.
          
          
            
            Compile audit and retest reports mapped to SC01 to SC10, SCSVS categories, and SCWE as technical evidence for ICO portal or SEC review where relevant. OWASP is not a criterion set by the SEC.

No items selected

Select items above to track your progress.

[Request Pentest Quote](/en/#contact)

## Frequently Asked Questions (FAQ)

Key answers and practical guidance addressing common compliance questions.

### How do the OWASP Smart Contract Top 10:2026, SCSVS, and SCWE fit together?

The Smart Contract Top 10:2026 (SC01 to SC10) highlights ten high-impact risk categories. SCSVS provides 35 verification controls across 11 categories (S1 to S11) and assurance levels L1 to L3, although OWASP still labels it an initial version 0.0.1. SCWE catalogs 156 weakness IDs (SCWE-001 to SCWE-156) for precise root-cause reporting.

### How do these OWASP standards relate to Thai SEC digital asset regulations?

Thai SEC Notification KorJor. 16/2561 Clause 17(1)(c) requires ICO portals to be satisfied that smart contract source code matches the draft prospectus, and KorThor. 19/2561 Clause 18 requires digital asset operators to penetration test critical systems before service starts and at least annually. These notifications do not reference OWASP.

### Is automated static analysis sufficient for smart contract security?

No. Static analyzers catch syntactic patterns, whereas high-impact causes of loss such as Business Logic Vulnerabilities (SC02), Price Oracle Manipulation (SC03), and Flash Loan–Facilitated Attacks (SC04) require manual architectural review, economic invariant testing, and stateful fuzzing.

## Related Compliance Frameworks and Security Standards

- [
                Thai SEC penetration testing requirements
                
              ](/en/compliance/sec/)
- [
                OWASP ASVS 5.0 Application Security Verification Standard
                
              ](/en/compliance/owasp-asvs/)
- [
                OWASP Top 10 guides for Web, Mobile, API, LLM, and Agentic
                
              ](/en/compliance/owasp-top-10/)
- [
                Technology Crime Decree B.E. 2566 and No. 2 B.E. 2568
                
              ](/en/compliance/tech-crime-decree/)

Open full-size image to zoom

## Official source documents

OWASP Smart Contract Top 10:2026, SCSVS, and SCWE

[Go to the official source ](https://owasp.org/www-project-smart-contract-top-10/)

- [OWASP Smart Contract Security Verification Standard (SCSVS)](https://owasp.org/www-project-smart-contract-security-verification-standard/)
- [OWASP Smart Contract Security Weakness Enumeration (SCWE)](https://scs.owasp.org/SCWE/)

## Need a pentest that satisfies these requirements?

Tell us about your systems and the requirements you must meet. The STH team will assess the approach and prepare a quotation.

[Request a Pentest quote](/en/#contact)

Last updated 1 November 2026