Auditing Smart Contracts

Analogy categoryAnalogies

What a Smart Contract Audit Is

A smart contract audit is a systematic, independent review of a contract's code and design intended to find vulnerabilities, logic errors, and economic flaws before deployment, when fixing them is still cheap. Because deployed code is immutable and directly custodies value, the cost of a missed bug is uniquely high, and reentrancy and access-control failures have drained hundreds of millions of dollars from live protocols. An audit combines automated analysis, manual expert review, and threat modeling, but it is important to understand what an audit is not: it reduces risk and raises the bar for attackers, but it can never prove a contract is bug-free.

🏏

Cricket analogy: It's like a pre-match pitch and equipment inspection by neutral officials: it catches obvious dangers and reduces risk, but cannot guarantee no freak injury once play begins.

Common Vulnerability Classes

Auditors work through well-known vulnerability classes. Reentrancy occurs when a contract makes an external call before updating its own state, letting the callee re-enter and withdraw repeatedly, which the Checks-Effects-Interactions pattern and reentrancy guards defend against. Access-control flaws leave privileged functions (minting, upgrading, withdrawing) unprotected or protected by the wrong modifier. Other classes include unchecked external call return values, oracle and price manipulation via flash loans, integer issues, denial-of-service via unbounded loops or failing transfers, and front-running where a validator or bot reorders transactions to profit. Recognizing these patterns is the core of an auditor's pattern library.

🏏

Cricket analogy: It's like a bowler's dossier of each batter's known weaknesses, short ball, outside off, the googly, a catalogue of recurring vulnerabilities to probe systematically.

Automated Tools: Static and Dynamic Analysis

Tooling amplifies human review. Static analyzers like Slither parse the code without running it to flag suspicious patterns such as reentrancy, uninitialized storage, and incorrect modifiers in seconds. Symbolic-execution tools like Mythril explore many execution paths to find inputs that reach a bug. Fuzzers such as Echidna or Foundry's built-in fuzzing throw thousands of randomized inputs at the contract, checking that stated invariants (for example, total supply always equals the sum of balances) never break. These tools produce false positives and miss logic bugs specific to your protocol's economics, so they augment rather than replace an expert reviewer.

🏏

Cricket analogy: It's like ball-tracking and edge-detection tech flagging most decisions instantly, while a human umpire still judges intent and context the machine cannot, so tools augment judgment.

solidity

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.24;

// VULNERABLE: state updated AFTER the external call -> reentrancy
contract BadBank {
    mapping(address => uint256) public balances;

    function withdraw() external {
        uint256 amount = balances[msg.sender];
        (bool ok, ) = msg.sender.call{value: amount}(""); // callee can re-enter here
        require(ok, "send failed");
        balances[msg.sender] = 0;                          // too late
    }
}

// FIXED: Checks-Effects-Interactions - update state BEFORE the external call
contract GoodBank {
    mapping(address => uint256) public balances;

    function withdraw() external {
        uint256 amount = balances[msg.sender];
        require(amount > 0, "nothing to withdraw");        // checks
        balances[msg.sender] = 0;                          // effects
        (bool ok, ) = msg.sender.call{value: amount}("");  // interactions
        require(ok, "send failed");
    }
}

A passing audit is not a safety guarantee. Audits are point-in-time reviews of a specific code commit, and any change afterward, even a one-line 'fix', is unaudited and has caused catastrophic losses. Treat an audit as one layer among several: combine it with thorough tests, fuzzing, timelocks on upgrades, runtime monitoring, and a bug bounty.

The Manual Audit Process and Its Limits

A manual audit is where deep logic and economic flaws are actually caught. The auditor builds a threat model of who the actors are, what they control, and what they gain by cheating, then reads every line against it, tracing how funds and privileges flow and asking what happens if a call reverts, is re-entered, or is front-run. They work through checklists such as the SWC registry and Solidity best practices and probe protocol-specific invariants that no generic tool understands. Crucially, an audit is a point-in-time snapshot of a specific commit: any code change afterward is unaudited, and even a clean report is a reduction of risk, never a guarantee of safety, which is why serious projects also run bug bounties and monitor deployed contracts.

🏏

Cricket analogy: It's like a coach studying full match footage to find a batter's decision-making flaws no stat sheet shows, a deep review of one specific series, not a permanent verdict on all future form.

Run Slither early and often during development, not just at the end: catching an obvious reentrancy or unchecked-return issue yourself is far cheaper than paying an auditor to flag it. Reserve the paid audit for deep, protocol-specific logic that automated tools cannot reason about.

An audit is a systematic, independent, point-in-time review to find flaws before immutable code deploys; it reduces risk but never guarantees safety.
Auditors scan for known classes: reentrancy, access-control flaws, unchecked calls, oracle manipulation, integer/DoS issues, and front-running.
The Checks-Effects-Interactions pattern and reentrancy guards defend against reentrancy.
Static analyzers (Slither), symbolic execution (Mythril), and fuzzers (Echidna/Foundry) automate detection but produce false positives and miss protocol-specific logic.
Manual review with threat modeling and invariant checking is where deep economic and logic bugs are caught.
Any code change after an audit is unaudited, so freeze and re-audit before deploying changes.
Combine audits with tests, fuzzing, timelocks, monitoring, and bug bounties for layered defense.