Code Hawks Contest: First Flight Security Audit Overview

First flights empower junior security researchers by providing manageable codebases for practice and collaborative learning without financial stakes.

### Introduction to First Flights: A Smart Contract Security Research Initiative
* 👋 Welcome to the Code Haw contest, where we are excited to introduce a new series called **First Flights** aimed at helping junior security researchers navigate the **daunting world of smart contract audits**.
* 🚀 Rockstar Patrick Collins explains that First Flights serve as stepping stones for new researchers, providing **manageable codebases to practice finding bugs** without the pressure of **financial stakes**.
* 📜 The first codebase being reviewed is a simple password store smart contract, consisting of around **20-30 lines of code**, designed to help users **store and retrieve passwords securely**.
* 🔍 Participants are encouraged to gain context by reading the documentation, as **understanding the code's intended functionality** is crucial for **identifying potential bugs**.
* 🔧 The codebase includes a **set password function**, which is only accessible to the contract owner, and a **get password function** that reverts if called by anyone else, highlighting the **importance of business logic in security audits**.
* 🛠 Tools like Solidity Metrics and Slither are introduced to assist in **estimating code complexity** and conducting **static analysis for obvious bugs**, reinforcing the necessity of **thorough testing and review processes**.
* 💬 The session emphasizes that while **100% test coverage is beneficial**, it does not guarantee the **correctness of tests**, encouraging researchers to **critically evaluate the tests** they encounter.
* 🎓 Finally, Patrick reassures participants that understanding specific domains, such as **DeFi**, is essential for auditing related protocols, but not necessarily for all smart contract audits, thus allowing for **specialization in various areas of blockchain development**.

### Insights on Security Reviews and Submissions in Smart Contract Auditing
* 🔍 The discussion revolves around using the Slither tool for security reviews, emphasizing that it helps **identify potential vulnerabilities** like **re-entrancy issues** in a codebase, albeit with **slower performance** due to Python's limitations.
* 💡 Participants are encouraged to engage in the ongoing Viper competitive compiler audit, which is a **great opportunity for Python engineers to contribute insights**.
* ⚙ The importance of running automated tools before manual reviews is highlighted, with Slither providing **useful outputs that can guide the auditing process**.
* 📊 A recent run of Slither revealed a finding regarding the **immutability of the 's owner' variable**, suggesting that it should be **immutable to save gas costs**, although such findings may not be valid for the current contest.
* 📝 The process of submitting findings on Code Hawks is explained, including the need for **clear titles that combine root causes with impacts** to make submissions easier for judges to understand.
* 📈 Submissions require relevant GitHub links to the code, a summary of the issue, and an assessment of **severity based on likelihood and impact**, with guidance provided on how to **categorize findings**.
* 🔗 The community is reminded to focus on **security-related submissions**, avoiding gas optimizations unless explicitly allowed, and to provide **proof of concepts** to substantiate claims.
* 📅 Finally, attendees are encouraged to reach out with questions and continue engaging in discussions to foster a **safer web3 environment**, emphasizing the **importance of security in smart contract development**.

Kick-Off | First Flight #1: PasswordStore | Juliettech with Patrick Collins

Book a smart contract audit here 👇
https://www.cyfrin.io/


Cyfrin Audits

First Flights: A New Initiative for Security Researchers

The First Flights initiative aims to provide a stepping stone for junior security researchers, offering small codebases for practice and collaboration without any financial stakes.

The first codebase being reviewed is extremely small, with only 20-30 lines of code, and is designed to help researchers estimate the time required for audits.

The initiative also offers tools for measuring code complexity and lines of code, facilitating the learning and growth of security researchers in the web3 space.

Gaining context is crucial for smart contract audits, with the codebase's README providing essential information.

The project's goal is to create a secure password storage and retrieval system, with a focus on preventing unauthorized access.

The codebase has known issues from a previous audit, offering a chance for participants to identify and address them.

The speaker discusses the process of auditing a codebase, inspired by the Tincho method used by a smart contract security researcher.

They emphasize the importance of starting with the smallest contracts and gradually working up, while also highlighting the significance of compiling the code and running tests for context.

The speaker shares their experience of finding a $100,000 vulnerability during a real-time audit and encourages taking the code review process in chunks to avoid feeling overwhelmed.

Analyzing a Solidity Password Store Contract

The contract is designed to store a private password, with the owner having the ability to update it.

It has two main functions: setPassword, which allows the owner to set a new password, and getPassword, which retrieves the password for the owner.

The codebase is small and straightforward, making it a great starting point for understanding smart contract functionality.

Tools and Techniques for Smart Contract Auditing

Foundry and Hardhat are popular tools for writing codebases, with Foundry offering faster test runs and a Solidity-only approach.

100% test coverage is a good indicator of a developer's commitment to testing, but it doesn't guarantee the tests are effective.

Understanding the business logic and intent of a protocol is crucial for effective auditing, and tools like Slither can help identify obvious bugs in the codebase.

The speaker discusses running the Slither tool for a security review of a Python codebase, mentioning its slow performance.

They highlight the ongoing Viper competitive compiler audit and the common vulnerabilities Slither detects.

The speaker also addresses questions about the tool's usage, the importance of running automated tools, and the feedback Slither provides on gas improvements and immutable variables.

Patrick shared his process for deploying a project, running commands, and analyzing test coverage and code.

He emphasized the importance of understanding the project's context, roles, and using tools like Slither for analysis.

The speaker then walked through the submission process for a finding in Code Hawks, highlighting the importance of a clear title, severity, and providing detailed finding information.

The severity of vulnerabilities in a codebase is categorized as high, medium, or low, based on a matrix of likelihood and impact.

High impact is associated with direct risk to funds or severe disruption of functionality, while low impact involves minor issues with no risk to funds.

Relevant GitHub links are provided to the specific lines of code causing the vulnerabilities, aiming to make the submission process easier for judges.

The Overlap Between Web3 Development and Security Research

Web3 development and smart contract security research share similar skill sets, with strong developers often excelling as security researchers.

While the two roles have different focuses—defending code for developers and attacking code for researchers—they complement each other.

Submitting findings for security issues involves a structured format, including a summary, vulnerability details, impact, tools used, and recommendations for the protocol to improve security.

Proving the need for a fix is crucial when submitting potential re-entries to a protocol.

Providing clear and concise proof, including code changes and recommendations, increases the chances of the issue being addressed.

The burden of proof lies with the submitter, making it essential to provide strong evidence, such as test cases, to support the claim.