Sep 21, 2018
Checkout Smart Contracts Security Audit Scope.
Our security audit process consist of following stages:-
Stage -1- Specification gathering:-
This is most crucial stage because detail is key for a successful smart contract audit. Here we will gather the specifications from you to know the intended behaviour of smart contract. In this stage, we need a summary of intended behaviour of smart contract from your side. We would also gather specification through forms.
You can provide specification summary in the form of example image attached below:-
Stage 2:- Manual Review
Manual Review is king in smart contract auditing
Goals of manual review:-
a.) Verify that every detail in specification is implemented in smart contract.
b.) Verify that contract does not have any behaviour that is not specified in specifications.
c.) Verify that contract does not violate original intended behaviour of specifications.
Here we would look for undefined ,unexpected behaviour and common security vulnerabilities like:-
=> Re-entrance
=> Overflows
=> Uncheck return values for low level calls.
=> Denial of service
=> Bad randomness
=> Front running
=> Time manipulation
=> Short address attack
=> Unknown vulnerabilities
In manual review more that one auditor will review the code.The goal is get to as many skilled eyes on contract code as possible.
=> We will apply all security attacks known till date on your contract manually to find security vulnerabilities
=> We will also ensure that your contract has some mechanism to defend against unknown vulnerabilities.Because state of ethereum is constantly changing and we cannot say which vulnerabilities will arise in future so we must have a mechanism beforehand.
=> We would ensure that smart contract code must respond to bugs and vulnerabilities well.
=> Manual testing will be done on test nets like rinkeby and ropsten.
=> We would also ensure that there is no unnecessary code in contract .
=> Best code practices will also be considered in this phase.
Stage 3:- Unit testing:-
Goal:-Writing and running comprehensive test suite.
=> In this stage smart contract functions will be unit tested on multiple parameters and under multiple conditions to ensure that all paths of functions are functioning as intended.
=> In this phase intended behaviour of smart contract is verified.
=> In this phase , we would also ensure that smart contract functions are not consuming unnecessary gas .
=> Gas limits of functions will be verified in this stage.
Stage 4: (Testing with automated tools)
=> Testing with automated tools is important to catch that bugs that humans miss.
Some of the tools we would use are:-
Mythril
Oyente
Manticore
Solgraph
Solidity-coverage
At the end we would provide you a comprehensive report along with details of audit and steps to cover up with the vulnerabilities if we found any in your contracts.
Thanks for reading. Also do check out our earlier audit reports.
QuillAudits is a secure smart contract audits platform designed by QuillHash Technologies. It is a fully automated platform to verify smart contracts to check for security vulnerabilities through it’s superior manual review and automated tools. We conduct both smart contract audits and penetration tests to find potential security vulnerabilities which might harm the platform’s integrity.
