Solidity Audit Process: Common Bugs and Best Practices

Auditors must scrutinize Solidity code to prevent bugs from misrepresented accounting and potential attack vectors.

### Common Pitfalls in Solidity Auditing: Identifying Bugs and Improving Practices
* 🔍 Many bugs in Solidity arise from **incorrect accounting practices**, such as misrepresenting values like `message.value`, which can lead to **discrepancies in ether transfers**.
* ⚠ During audits, it's crucial to verify if calculations, like **multiplying variables to determine total ether locked in a contract**, could yield **incorrect results due to oversight**.
* 📜 For aspiring auditors, a comprehensive resource document is available, detailing everything from **basic Solidity coding** to **auditing firm listings**, priced at just **$100** with a **20% discount** for viewers.
* 🛠 A thorough review of project documentation, such as README files, is essential, especially when they **lack clarity**, to ensure **proper setup and understanding of the project structure**.
* 🧪 Utilizing tools like Slither can uncover potential vulnerabilities, such as **reentrancy issues**, which auditors must address to **secure the contract effectively**.
* 💡 Observations about gas optimizations, like using **`bytes` instead of `string`** for static URIs, although minor, can **enhance contract efficiency** and should be noted during the audit process.
* 🤔 It's important to **question ambiguous variables** and **document uncertainties** during the audit, fostering a culture of **thoroughness and clarity** in the reporting process.
* 💻 The audit process often involves iterative reviews, where auditors **refine their findings** and ensure all **potential vulnerabilities are addressed** before finalizing their reports.

My Smart Contract Audit Process (Part 1)

Jackson Kelley

Auditing a Smart Contract: A Two-Part Video Series

The audit process is divided into two sets of videos: one for high-level code review and another for diving into potential bugs.

The auditor emphasizes the importance of sending `message.

value` when transferring ether and notes potential discrepancies with function call amounts.

The auditor uses Slither for static analysis and aims to compile the code to run the project's test libraries for writing proof of concepts (POCs).

Running Tests and Using Slither for Code Audit

The tests for the project fail due to gas-related issues on Ganache, but the author is not concerned as long as some tests pass.

They run Slither from the command line for a sanity check before using it in VS Code.

While waiting for Slither to finish, the author browses through the contract code and notices linter warnings about variable visibility, prompting them to investigate the function calls and ensure the invariant of ether transfer is maintained.

The total supply variable is shadowing a superclass variable, which was initially marked as a concern but later deemed fine.

Running Slither in VS Code provides useful underlining and highlights potential issues, such as reentrancy in the emergency withdrawal function.

The audit process involves pulling the code down, making high-level comments, and then doing a second pass to dive deeper into those comments and potentially writing a proof of concept.

The code uses string types for URIs, which could be more efficient with a byte array.

There's a potential attack vector in the contract deployment factory, but the underlying mechanics account for address collisions.

Minor gas savings can be achieved by checking for inequality instead of greater than zero.

The code is trying to limit the number of lots a buyer can hold, but this can be easily bypassed by creating multiple addresses on the Ethereum blockchain.

The function for withdrawing money has a potential reentrancy issue, as there is no guard in place.

The auditor is focusing on library functions first for a depth-first search approach, while also checking for signature replayability and malleability in the use of ECDSA.

Common Bugs in Solidity and Audit Insights

Incorrect accounting of variables in Solidity can lead to bugs, such as misrepresenting the amount of ether being transferred.

The speaker emphasizes the importance of thoroughly checking for potential discrepancies in variable calculations.

They offer a document with resources for learning to become an auditor, including coding in Solidity and boot camps, at a discounted price.