Journey into Solidity Auditing: A Developer's Experience

Auditing requires persistence and continuous learning, as success doesn't come instantly.

### My Journey into Solidity Auditing: From Novice to Aspiring Expert
* 🚀 "Not everyone who starts auditing makes **10 grand, 100 grand** right off the bat and finds all kinds of **crazy bugs**."
* 💰 I discovered cryptocurrency in 2021, making some money, but it was in 2022 that I began to **explore development more seriously**.
* 📚 My coding experience was limited to a **basic Python course** during my mechanical engineering studies in South Africa, so I started learning **Solidity** through Crypto Zombies and web design through sca.com.
* 👨 By the end of 2022, I secured a job as a Solidity developer, primarily conducting **audits for token contracts**, but the company went under within two months due to the **bear market**.
* 🔍 After seeing the progress of renowned Solidity auditor Pas, I decided to focus on the **security aspect of Solidity**, despite initially struggling to **find vulnerabilities** in my early attempts.
* 🎓 I took a course by Johnny Time, which helped me understand how to **properly identify vulnerabilities and write reports**, leading to my participation in several audits.
* 💔 However, my early audit attempts yielded minimal results, with only a few **low-severity findings** being validated, but I continued to **improve my skills**.
* 📅 Looking ahead, I plan to participate in upcoming audits as I find more time, sharing my **progress and experiences** along the way, while also inviting others to share their **journeys in auditing**.

not everyone who starts auditing makes 10 grand, 100 grand right off the bat and finds all kinds of crazy bugs, you know what I mean. So here's my story of how I got into auditing and where I am now. All right, so I found crypto back in like 2021. It was all good, lots of money, made a little bit of money, but 2022, that's when I really started looking into development. Um, the only coding I'd ever done up until that point was um, a python course taught by my school. I'm doing mechanical engineering in the University here in my country, in South Africa. So I did, I done a basic python course, that's all I know, you know what I mean. So I basically had to learn everything from scratch essentially because it had been a whole year. We learned python back in 2021. So what this goal to become a developer started off um, learning solidity on crypto zombies, then proceeded to learn um, basic website design on sca.com. I learned HTML, CSS, JavaScript, you know, went back to finish chapter six of like

crypto zombies because that last part of that zombies game needed a front end. So from then on, I was like, okay, cool, I know some basic development, or what else can we learn? Learn the React course. That was also a front end course. And then later, at the end of 2022, got a job as a developer, right? Solidity developer. Now, most of the time at this job, I was doing audits for token contracts. And like, I was terrible at front end still. I still think I hate front end. Like, it's just terrible, right? But anyway, cool. Yeah, the company, within two months of starting to work there, the company went south. Like, you know, it was during the bear market, so the company legit just went belly up before I even got paid, right? So yeah, that was difficult. But a few months before I got the job, back in August, I started seeing, like, yeah, October, November. I think I started seeing Pas off's tweets. I'll post a picture of his Twitter right here if you don't know who he is.

but one of the most famous Solidity auditors out there right now. And I started seeing his progress, and I thought, well, maybe it's time I dove into the security side of Solidity because that's where I felt I had the most potential. Yeah, the most potential. So, started doing, started competing. Codina was terrible, was terrible. Like, I tried to find low bugs, like low vulnerability, you know, low severity, those kind of bugs, gas optimization bugs. I was just terrible at that. So, okay, I took a break, took a course. Shout out to Johnny Time. I'll post this Twitter here and a link to his course as well 'cause that really helped me out. Took his course. I paid for it using money from an Arbitrum airdrop, so basically free for me. Took his course, learned, relearned the security side of it 'cause I knew some basic vulnerabilities, but I didn't know how to properly look for them and how to properly spot them and how to properly write the report. So, took that course.

around July is when I finished it, and then I participated in some audits in September. I participated in the delegate audit, thought I found the bug, but when the results came out, I came to realize the bug I found was already listed in the, what do you call, the automated findings, so it was invalid anyway. So yeah, uh, that was tough. So Zero from that audit from after I did the course. Then November, uh, they kelp down. I'll post a picture of that as well. Kelp Dow on Code Arena. That audit went really well. I found, found like, I could see, I could see that with my focus, like just spending a few days solely focused on auditing. It was absolutely fantastic. Like I believed I had found, uh, two highs and a medium and a few lows, but only got validated. Only one of my lows were validated, and I realized one of the highs I found, um, I didn't write the report properly. So because it didn't explain it properly, it got invalidated. So from kelp out, I only got about $2, I think. Yeah, that was my

wor only about $2 or so. That was November, right? That was November, December. There were about two audits, but I couldn't really put all my focus into them because I was like, I had family over and that, and I was also babysitting. My mom had went to a different country, so December, like, it was difficult to focus on audits in the beginning. Um, but then January, January and February, after I came back from the holidays, I did the curves audit on COD Arena, the standard on um Cod Hawks, and then also AI Arena on code, on code Arena. Yeah, AI Arena on curves. I think I found one high, but it was duplicated by almost everyone, so only got like 50 cents or something like that, like very low, less than a dollar. But at least I found a high that Al, what was important to me, at least I found a validated high. Um, then moved on to the standard for code, code Hawks. I submitted about four mediums and about two, three lows. Um, at the end, only one of the lows got validated, but I think I did

pretty good in that audit. Um, because it was my first audit from coming back from the holiday, so I was still a bit rusty then. AI Arena, AI Arena, I totally killed it. I submitted um two highs and about four mediums. Um, I got validated for about two mediums, so that one was about 76 cents, as that was highly duplicated as well. I think for that contest, we had about 2,000 submissions, so yeah, there was... I knew I wasn't going to get rich off that audit, right? But since then, I haven't been able to properly participate in any audits, like probably just like a lot of y'all. Y'all probably um, y'all probably don't have a lot of time as well 'cause this is just the side thing you're doing. So like, you know, it's very difficult to make time for audits when you have a job or you're doing school and all of that, so it is what it is. Now I have some time, just finished off with some tests, so I'm going to be looking to

Participate in the current ongoing chakra audit, and then I have some holidays coming up as well, so I plan to participate in about two to three more audits over the next month. They should be good. I'm going to be getting back into auditing a lot more, going to try posting a lot more as well, showing my progress. Um, yeah, let me know, how did you get into auditing, and where are you now?

How I became a smart contract auditor

Tumelo_Crypto

I discovered crypto in 2021 and made some money, but it was in 2022 that I started learning development from scratch.

I learned Solidity, web design, and React, eventually landing a job as a Solidity developer, where I did audits for token contracts.

Unfortunately, the company went under within two months, leaving me without pay.

The speaker was inspired by a famous Solidity auditor and decided to transition into security auditing.

After struggling initially, they took a course that helped them relearn and properly identify vulnerabilities.

Their first audit participation was challenging, but they eventually found success in a later audit, although they faced some setbacks in getting their findings validated.

Challenges and Progress in Audit Participation

The speaker struggled to focus on audits in December due to family commitments and babysitting.

In January and February, they completed several audits on COD Arena and Code Hawks, finding some highs and mediums but not making significant earnings.

They expressed the difficulty of finding time for audits while balancing work and school, but are now looking to participate more actively.

The speaker plans to participate in two to three more chakra audits over the next month.

They are looking to get back into auditing more frequently and aim to share their progress through posts.

The speaker expresses interest in learning about the other person's journey into auditing and their current situation.