Can anyone tell me the steps or points required to audit the smart contract? I want to audit a smart contact and i need checklist for that.
CEO of Solidified here.
Most audit companies will require the following:
1) Spec of Intended Behavior
This is a written technical specification of how your contracts should work. For tokensales:
- list of contracts to be audited
- type of sale/auction
- hard cap/soft cap
- exchange rate
- min/max contribution
- length of each stage of the sale (time limits for presale, sale, etc.)
- which functions are intended to be controlled by the owner and other privileged roles (i.e. manual progressing through stages of tokensale, enabling refunds, pausing the tokensale, burning of tokens)
- is the token intended to be compatible with any standard, like ERC20
- any vesting logic
- bonus structure
- whitelist functionality if exists
- specify edge cases - i.e. refunds: supposed to give change back when send too much money? What happens when: 1) doesn’t reach soft cap, 2) overreach the limit
- token minting mechanics. when is it supposed to stop minting?
- token burning mechanics
- Re-use of other contacts and their versions.
- A contract-by-contract description writeup
- Known weaknesses
- What's out of scope
For more complex contracts, we also ask for a function-by-function overview and a state flow diagram.
2) Finalized code with access to github repository
You need to have your smart contract code frozen before you begin the audit. No changes are allowed to be made during the audit or they null out the audit work. We often note the commit hash auditors are reviewing in the audit report to avoid misunderstanding.
Additionally, it is very useful to have access to the github repository of the client, not just the code of the contracts, because often questions come up during the audit regarding the deployment, compiler version used and other things.
3) Be at least 2-3 weeks away from your project launch
The process is broken into 3 stages:
Initial Audit Report
Client fixes discovered issues and performs a re-audit.
Contract is posted on Bug bounty.
You need to allow time for all 3 stages to complete before your project goes live.
You will need to have your devs on standby during the audit process, better yet provide a common communication channel such as Slack, where auditors can easily reach out to devs for clarifications during the audit process.
You will likely need ETH to pay for the audit. Many audit firms do not take other tokens or fiat for compensation.
Excellent article about preparing for a smart contract audit here, too.
Basicly go over the possible exploits like re-entrancy, overflow/Underflow attacks, ...
For this refer to security considerations in the docs: http://solidity.readthedocs.io/en/v0.4.21/security-considerations.html
And Common patterns: http://solidity.readthedocs.io/en/v0.4.21/common-patterns.html
If you want to learn more about smart contract security and possible expoits make sure to check out the interactive smart contract 'hacking' game from the guys at Zeppelin. They have recently added new ones in: https://ethernaut.zeppelin.solutions/
You can read this article from HashExs' medium blog. They are making audit reports for ICO projects. Also you will find there some examples of audits in their blog.