1

I am a student of Information Security and my teacher has given me the task to know about the details of auditing that is being done on Ethereum smart contracts that are written using solidity. Details like what are the parameters that are checked, how is auditing carried out, and what is the role of inline assembly in performing this task. I've searched a lot on internet but did not find anything useful. Can anyone of you please guide me or provide me the track which I can follow to achieve this task?

1

I think there is no 'standard' way of automatically auditing a solidity contract; of course you have the compiler, that checks for syntax errors and overflows etc. For the details how to use it, please check out this documentation.

For a general security auditing of any contract, sanity checks will be performed, just like on normal coding. White hat hackers and auditors will look for any weaknesses in a contract, for example, missing modifiers (like 'internal', the famous parity hack, where 30 million was stolen because of missing this keyword), but also if calls that should only be called by the owner have the code to back that up, that sort of thing. This article on medium is pretty nice and covers some of the basic things to look out here

Good luck with your school assignment!

0

Here is a methodological approach (checklist) to audit smart contracts with a fixed set of rules:

http://ethereum.stackexchange.com/questions/8551/methodological-security-review-of-a-smart-contract

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.