8 Field Techniques for Smart Contract Auditing — Forged by Refuting My Own Findings
8 Field Techniques for Smart Contract Auditing — Forged by Refuting My Own Findings I recently spent 24 focused rounds auditing a lending-and-automation codebase for a security competition. I opened 7 attack hypotheses. I closed all 7 — six with proofs, one by refuting my own draft finding at final review, hours before it would have gone to judges as a "Low severity, high confidence" report. That…
In a recent 24-hour audit of a lending and automation codebase, the reporter opened seven attack hypotheses. All seven were closed, with six having solid proofs and one refuted by the reporter at the last minute. This experience proved more valuable than the other findings.
The reporter emphasizes eight techniques for smart contract auditing, each of which can be applied immediately. The first technique involves reconstructing the economic model before reading the functions. This approach helps identify the mechanism of the contract and focus on critical state transitions, saving time.
The second technique is to trace the patch trail from previous audit fixes. Denser numbers indicate areas that have been thoroughly examined, while sparser numbers with heavy external interactions suggest promising areas to investigate.
The third technique involves assessing the specific loss spectrum covered by each check. A require statement, such as (shares == 0 → revert), might provide inflation protection, but it only blocks one point. This technique aims to avoid partial-loss coverage and ensure comprehensive protection.
The fourth technique asks, "Who keeps the dust?" when encountering rounding sites. The outcome of rounding operations determines ownership. If dust returns to the fund's source, it is safe; if it goes to the protocol or an attacker, it is a bug. This analysis helps identify potential vulnerabilities in the contract.
The fifth technique focuses on invariants, which must remain ordered in certain state pairs. The reporter suggests finding the single point where the invariant is established and ensuring that every mutation preserves it. This method can alleviate underflow fears once the pattern is recognized.
The sixth technique involves enumerating callback points as a grid and verifying the "Call Before Interaction" (CEI) principle at each cell. Contracts typically have fewer external callback points than anticipated, usually fewer than five. By enumerating these points and checking effects-before-interactions, the reporter can close reentrancy hypotheses more efficiently.
The seventh technique addresses consume-on-failure designs. The reporter questions whether the opponent can cause the failure. Fail-open flows, where a transaction is consumed, an action fails, and an event is emitted, pose a griefing surface if an adversary can deliberately trigger the failure. If all failure sources are environmental, the design is sound; otherwise, it presents a Denial of Service (DoS) vector.
The final technique emphasizes the importance of verifying exact wei-level numbers through exploit math before accepting findings. The reporter shares an anecdote where a textbook ERC4626 inflation finding did not hold true for the specific deposit profile. By checking numbers on an end-to-end basis, the reporter can avoid falling into the trap of relying on analogies that may mislead triagers and undermine the credibility of their findings.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
