Does hidding smart contract ABI ( some functions ... ex: hidding admin functions only ) make it safier ? can someone find callable functions if i do not provide ABI or contract source ? what are main tips to check the smart contract for vulnerabilities ?
1 Answer
If by hiding you mean not verifying smart contracts on Etherscan then yes.
When the contract is deployed to the blockchain, the contract is still accessible to anyone. The only difference is, it will be more difficult for an attacker to find out what the goal of a certain function will be. In the bytecode, you can only see the function signatures (0x...) and not the actual name and the same applies to the variables.
Even though this does to some extent help, it should not be something you should rely on. If you want to deploy commercially used contracts they should be audited by at least 2 different auditors/firms since it can be very difficult to find vulnerabilities.
To understand how to secure a contract, you should first get familiar with the known attacks: https://blog.sigmaprime.io/solidity-security.html#contract-reference
-
-
Well that depends on your budget. Bigger firms usually do audits at platforms like code4rena, but usually they cost from 30-200k depending on code size. I can also make you an offer if you wish, since I work for an auditing firm. Commented Jan 21, 2023 at 16:42