2

A lot of blockchain projects have a smart contract security audit on their website and publish about this on social media.

  • What are these audits?

  • Does my project need one?

0

1 Answer 1

11

In a smart contract security audit, or "smart contract audit" for short, usually a third party reads through the code written by the project smart contract developers and they look out for security vulnerabilities. This is somewhat different from the traditional IT security audits and penetration testing because a good smart contract auditor must possess a great deal of domain-specific knowledge not just about coding, but finance and cryptocurrency ecosystem as well.

enter image description here

  • Because the industry is new, there are not yet best practices for auditors or what the client or the investors should expect. The industry is developing so fast, so setting any technical standards today might be outdated tomorrow.

  • The quality of auditors and audits varies greatly. For the sake of this answer being neutral, I do not want to name any auditors or services. You can find these easily if you want to check if any auditor is legit and worth of their asking price.

  • Usually an audit happens "before deployment" e.g. before smart contracts go live and touch real money.

  • Smart contract auditor is hired by any protocol or other smart contract developer: token issuer, DeFi protocol, NFT project.

  • The project hires the auditor. Depending on the bull/bear market cycle and the brand value of the auditor, the auditing cost can be anything between $500/day to $10,000 day.

  • Note that audits are rarely "independent". There are some exceptions, like audits done by venture capital funds that look to invest in a project. But those are not usually called "smart contract audits". More about this below.

  • In high-quality audits, the person who performs the actual audit is named in the audit report. In low-quality audits this often is not the case, because the person do not want any personal responsibility for the shoddy quality of work.

  • For the audit itself, the auditor checks the smart contracts with free linting and static analysis tools and also reads the code through to find any bugs in the logic.

  • The smart contract audit is not a guarantee of a security. In a proper audit, the purpose of the auditor is to give guidance and verbal feedback to developers how to make it more secure.

  • A smart contract audit should not be used as a marketing material. If any project does this, it is usually a red flag about the motives of the project.

  • Unlike in traditional finance and accounting audits, on public blockchains any investor or a third party can assess the risk themselves. Any smart contract source code is public, so any auditor does not need privileged access to see if there could be vulnerabilities. For a true public protocol, any flow of money is 100% transparent. Thus, any investor is able to assess the risk themselves or ask someone to do it on their behalf.

  • For high-quality projects, so-called bug bounty programs or audit contents are run where white hack hackers are rewarded high sums of money for finding bugs in already deployed smart contracts.

  • Auditors rarely take any liability for the quality of work ("skin in the game"). There are some exceptions like the Sherlock protocol where auditors are only fully paid if there is no exploit over the course of the full life cycle of a project.

  • Centralised exchanges, like Binance, KuCoin, Gate.io and others ask for an audit for any ERC-20 token they list. This is mostly to ensure the free-form ERC-20 contracts do not have functions to remove tokens from exchange reserves (i.e. not backdoored). Some other exchanges like Coinbase perform their own audits.

Note that like in accounting audits, from the investor perspective, there is usually a conflict of interest between the auditor and their client, the project. Auditors do not work for investors. This is especially true when a smart contract audit report is publicly used as marketing material, The auditor is getting paid by the client, not the external users of the protocol or smart contracts. Thus, any audit, especially one from low-quality auditors, can be seen as biased. Audits never directly says if a project is a scam, because the auditor would not be paid in this case.

What do you need to do before you go for an audit

An audit does not fix any bad development process or low-quality software engineers.

How to find an auditor

Disclaimer: I did some of the early audits for Ethereum smart contracts back in 2016-2017.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.