Making Smart Contract More Secure Through Security Auditing

The decentralized finance (DeFi) landscape has become somewhat of a neo surrealist portrait in recent years. Cluttered with duplicitous actors, vibrant utility, and, frankly, unusual interpretations - DeFi is an industry still in its infancy, trialing phases and fads until it settles upon a happy medium.

Borrowing from the dark existentialism of the aforementioned, DeFi has been thwarted by money-hungry actors poised to coerce and swindle investors out of their funds through too–good-to-be-true-type projects. Recent news has presented a barrage of bad news, whether it be nefarious actors and their bridge exploits or mysterious rug pulls for millions upon millions of dollars - the current landscape of DeFi is a minefield of uncertainty and trepidation for investors.

Of course, few intend to venture into the darker depths of DeFi. Yet, it can be an unintentional endeavor, particularly when ‘x1000’ is promised or the hottest meme is encapsulated in a utility-less token. It would be cynical to assume that each of these projects is rooted in craftiness, but as with anything, there is a reason very few have smart contract security audits.

‍

What is a Smart Contract Security Audit?

Whilst you may not be familiar with the task of auditing smart contracts, it's inevitable you have heard of smart contracts in some form. To briefly reiterate what they are, smart contracts are self-executing pre-defined agreements between a buyer and seller, with this agreement consolidated in code that is visibly signposted on the blockchain in which the smart contract is executed. This code determines the execution, ultimately permitting decentralized agreements between two disparate and anonymous parties.

Smart contracting technology is only applicable to networks such as Ethereum and Solana that facilitate their use for agreement execution. Take Bitcoin as an example, having been built upon an infrastructure that predates smart contracting solutions by several years, it is unable to process or facilitate smart contracts - whereas Ethereum and Solana (amongst many others) are built around this concept.

Now, let’s pivot back towards auditing. Whilst the above was a skin-deep perusal through smart contracts, it is important to note that a majority of projects built upon the plethora of Layer-1s and 2s are established through smart contracts, or more specifically known on Solana as “programs.”. These smart contracts dictate the way in which the project will operate, from tokenomics to utility, smart contracts define a project from its conception.

Smart contract security auditing is the process whereby a detailed analysis is conducted by a series of professional auditors. In doing so, each line of code is thoroughly analyzed, scrutinized, and picked apart to deduce whether it was built with nefarious intentions or actually seeks to operate in the best interests of its investors. Considering these lines of code are integral to the safeguarding of funds and the integrity of the project, security audits are critical for projects looking to host millions of dollars in funds and to establish a solid basis from which they can operate.

For those who turn their noses up at the idea of auditing decentralized technology, you’re likely missing the point.

Sure, audits are mostly commonplace in centralized settings - yet they provide investors and users with peace of mind. Think of Microsoft, considering its immense global presence and utility, it is absolutely concrete that rigorous auditing processes have been undertaken over the years to ensure that the technology behind our most used devices and applications are not vicious malware that is poised to exploit. Undeniably, we are grateful as a result, because no one appreciates having their data and funds swept away in some opportunistic caper. 

Still not convinced? Maybe we can turn your attention to why security audits are integral for your favorite projects.

‍

How Do Security Audits Work?

The idea of security audits typically evokes an image of an intimidating, stern figure dressed to the nines stalking through a business whilst ominously checking off a list shielded by a haggard clipboard. Whilst this isn’t miles off from the digital cousin of audits, there fortunately isn’t some inspector wandering about - in person at least.

‍

Smart contract security audits typically involve an individual or team of blockchain veterans with a specialism in coding and/or auditing. Following comparable processes to the audits we think of on a day-to-day basis, there is little variance, with the exception that the process is conducted virtually and with code in mind.

In terms of linear processes, smart contract security audits tend to follow this protocol:

• Ascertaining the scope of the audit.

• This essentially denotes the process by which the project outlines their intentions and the specifications involved.
• From this specification, an auditing team is able to keep the project’s targets in mind when auditing the project to ultimately see if they are doing as they say.

• Providing an initial quote.

• Running tests.

• Testing processes will differ between the auditing team, their resources, and methods. 
• Typically however, both manual and automated tests will be conducted to ensure a thorough analysis is conducted.

• Creating an initial report draft.

• This first draft involves the errors identified and is then forwarded to the project for feedback and remediation.

• Publishing the final report.

• The final report will delve into any discrepancies between the project’s intentions and their infrastructure and transparently identify whether or not the project is deemed as ‘safe’ or not.
• Even if a project passes an audit, any issues that have since been remediated are also accessible in the report - ultimately offering an increased level of transparency.

‍

Whilst this process remains relatively standardized across the board, there are some differentiations based on the type of audit that is carried out. 

‍

The Types Of Security Audits

As you may have gathered, there is great variance between the different types of smart contract security audits and the way in which they operate. This is ultimately so that different areas of the protocol can be scoured in a way that a single audit would be unable to accomplish.

‍Contract Vulnerabilities

Whilst some smart contracts are devised to deliberately exploit, many have tears at the seams of their infrastructure unintentionally. Vulnerabilities within smart contracts can cause a great ripple effect throughout the project itself and its community. With major weaknesses, many protocols can become susceptible to advanced exploits from third parties which seek to drain funds. 

To locate these issues, auditors conduct a break testing process to simulate malicious attacks to ascertain the impact it would have on the smart contract. Whilst there is a plethora of potential vulnerabilities, these are the most common:

• Reentrancy issues 

• This is essentially where a smart contract makes an external call to another external contract prior to the resolution of any effects.
• The smart contract can then recursively interact with the other contract in ways it should not be able to, primarily due to the original contract’s balance not being updated.
• However, this is heavily mitigated by the runtime on Solana: https://docs.solana.com/developing/programming-model/calling-between-programs#reentrancy

• Integer overflows and underflows

• When a smart contract carries out an arithmetic operation but the output exceeds the integer size limits, causing the value to become truncated leading to potentially dangerous state

• Front running opportunities

• Poorly structured code can provide a forewarning of market sales and purchases which can then be repurposed for illicit trading for their own benefit.

• Account Validation

• Accounts are untyped at the runtime level, meaning that programs need to take special care to ensure that the correct accounts are being passed in
• Improper account validation is the root cause of many hacks in the wild, including Crema, Cashio, and Wormhole. 
• https://twitter.com/osec_io/status/1543469811287465984

Gas Efficiency 

Drawing away from the common theme of security, gas efficiency audits are a measure of efficiency and optimization. With many contracts designed for the purpose of processing complicated series of transactions to complete their intended function, it is inevitable that gas fees are involved as a result. Yet, as seen with Ethereum, when gas fees rise too much, smart contracts fail to execute. As a result, auditors seek to identify areas of optimisation inherent to this structure and assess whether they efficiently power the smart contracting technology of a project.

Security Flaws

Security flaw audits involve analyzing the network hosting the contracts and the API interacting with the dApp. If a project is vulnerable, then it is highly likely that its UI may be compromised or that it is susceptible to a DDoS attack which in turn can connect users’ wallets to malicious applications, as opposed to the project.

Why You Should Care

With nonchalance regarding the authenticity of projects is commonplace within the DeFi sector, it is integral to see beyond this ‘crypto-bro-ape’ veneer and delve into projects that present real world utility and uphold the integrity of its community. Reams of projects have yet to be audited, failed audits, or simply refused one - and this should be a blazing red flag for any investor.

Having endured rigorous auditing ourselves, we understand the need for transparency within the decentralized space - so you feel secure using our technology. Based upon the results of our audit, we have taken the initiative to have regular stringent internal auditing of our codebase, integrating a devnet ‘banking’ period, amongst a roster of other features to ensure that we are at all times putting our community above all else.