Skip to main content

Smart Contract Audits

Learn to audit Smart Contract to prevent hacking vulnerabilities.

tip

Most bugs are the result of poor business logic implementation

Core Checks​

Smart Contracts cannot have vulnerabilities as they will be exploited.

  • Overflow and underflow preventions
  • Function visibility
  • Time manipulation within a few minutes only
  • Utilizing reliable and audited dependencies
  • Fix warnings to avoid tricky features
  • Checking external calls, such as reentrancy or short circuits and others
  • Validate external or public functions
  • Checking rounding errors and unexpected behaviors
  • Unbounded loops preventions
  • Push payments and their correct usage
  • Using the latest solidity versions performing change verification
  • Lowering down pseudo-randomness
  • Old solidity constructs and their frequent updates

Frontrunning​

The best remediation is to remove the benefit of front-running in your application, mainly by removing the importance of transaction ordering or time.

All code has the potential for bugs. Read as much code as you can to learn as much as possible from the mistakes of others.

Read Hacking the Blockchain

As you develop, search related mistakes made by others for the type of contract solition to confirm you are not doing the same.

Access Control​

Open Zeppelin

A contract can also be the owner of another one, enabling composability to add additional layers of access control complexity. For example a 2-of-3 multisig run by your project leads.

Hacking the Blockchain

Check for updates at samczsun.com

Tools​

Auditors​

Audit preparation

Courses