Smart Contract Auditing in Blockchain Explained

How We Process

quillaudits process quillaudits process
draw

Specification Gathering

This is the most crucial stage because the detail is key for a successful smart contract Security audit. Here we will gather the specifications from you to know the intended behavior of smart contract. In this stage, we need a summary of the intended behavior of the smart contract from your side. We would also gather specification through forms.

notepad

Manual Review

Goals of manual review

  • Verify that every detail in the specification is implemented in smart contract.
  • Verify that the contract does not have any behavior that is not specified in specifications.
  • Verify that contract does not violate original intended behavior of specifications.

Here we would look for undefined, unexpected behavior and common security vulnerabilities like

  • Re-entrance
  • Overflows
  • Uncheck return values for low-level calls.
  • Denial of service
  • Bad randomness
  • Front running
  • Time manipulation
  • Short address attack
  • Unknown vulnerabilities

The goal is to get to as many skilled eyes on contract code as possible.

globe

Manual Testing

  • Smart contract will be manually deployed on any of the test network (Ropste/rinkeby) using remix IDE.
  • All the transaction hashes will be recorded.
  • Gas consumptions and behavior of functions also noted.
user

Unit Testing

  • Smart contract functions will be unit tested on multiple parameters and under multiple conditions to ensure that all paths of functions are functioning as intended.
  • In this phase intended behavior of smart contract is verified.
  • In this phase, we would also ensure that smart contract functions are not consuming unnecessary gas.
  • Gas limits of functions will be verified in this stage.
verify-check

Testing with Automated Tools

Testing with automated tools is important to catch those bugs that humans miss.
Some of the tools we would use are

  • Mythril
  • Oyente
  • Manticore
  • Solgraph
  • Solidity Coverage
copy-pen

Initial Audit Report

At the end, we would provide you a comprehensive report along with details of audit and steps to cover up with the vulnerabilities if we found any in your contracts.

window

Final Stage

After initial audit fixes, process is repeated again and Final audit report is delivered.

What is the need of

Smart Contract Audit ?

Compounder Finance DeFi project allegedly pulls the rug from under investors, $11 million stolen

One investor is offering a $100,000 bounty leading to the unmasking of the thief, or thieves, involved. An exit scam allegedly performed by Compounder Finance DeFi developers has left investors $11 million out of pocket....

Read More

In one day, a total of $1.2 million worth of Ethereum was stolen in three DeFi “rug pulls”

The past few days have marked a renaissance in altcoin trading: previously-unknown projects on Uniswap, the leading Ethereum decentralized exchange, have been rallying by thousands of percent. Even some larger names have gained hundreds of percent, somehow benefiting as Bitcoin and Ethereum have begun to falter....

Read More

PopcornSwap Liquidity Siphon Rugpull

A newly released project, PopcornSwap, has performed a liquidity siphon scam. This was nearly an instant rug-pull upon launch, stealing custody of over 2,000,000 USD in users’ tokens....

Read More

Subscribe to our newsletter

Get the latest QuillAudits smart contract audit guidelines , events, blogs sent straight to your inbox every week.