견고성 감사로의 여정: 개발자의 경험

### 견실성 감사를 향한 나의 여정: 초보자에서 전문가가 되기까지
* 🚀 "감사를 시작한다고 해서 누구나 바로 **1만 달러, 10만 달러를 벌고** 온갖 종류의 이상한 버그를 발견하는 것은 아닙니다."
* 💰 저는 **2021년에 암호화폐를 알게 되어 돈을 벌기 시작**했지만, 좀 더 진지하게 개발에 대해 알아보기 시작한 것은 **2022년부터**였습니다.
* 📚 남아공에서 기계공학을 공부하는 동안 코딩 경험은 **기초 파이썬 과정**으로 제한되어 있었기 때문에, **크립토 좀비**를 통해 솔리디티를 배우고 **sca.com**을 통해 웹 디자인을 배우기 시작했습니다.
* 👨 2022년 말 솔리디티 개발자로 취직해 주로 **토큰 계약 감사를 담당**했지만, 약세장으로 인해 회사는 **두 달 만에 파산**했습니다.
* 🔍 처음에는 취약점을 찾는 데 어려움을 겪었지만, 저명한 솔리디티 감사관인 **파스의 진행 상황**을 보고 솔리디티의 보안 측면에 집중하기로 결정했습니다.
* 🎓 취약점을 올바르게 식별하고 보고서를 작성하는 방법을 이해하는 데 도움이 된 **Johnny Time의 강의**를 들었고, 그 덕분에 **여러 감사에 참여**하게 되었습니다.
* 💔 하지만 초기 감사 시도에서는 **심각도가 낮은 몇 가지 발견 사항만 검증**되는 등 성과가 미미했지만, 계속해서 기술을 향상시켰습니다.
* 📅 앞으로 시간이 나는 대로 다음 감사에 참여하여 진행 상황과 경험을 공유하고, **다른 분들께도 감사 여정을 공유하도록 초대할 계획**입니다.

감사는 한순간에 성공하는 것이 아니므로 끈기와 지속적인 학습이 필요합니다.

not everyone who starts auditing makes 10 grand, 100 grand right off the bat and finds all kinds of crazy bugs, you know what I mean. So here's my story of how I got into auditing and where I am now. All right, so I found crypto back in like 2021. It was all good, lots of money, made a little bit of money, but 2022, that's when I really started looking into development. Um, the only coding I'd ever done up until that point was um, a python course taught by my school. I'm doing mechanical engineering in the University here in my country, in South Africa. So I did, I done a basic python course, that's all I know, you know what I mean. So I basically had to learn everything from scratch essentially because it had been a whole year. We learned python back in 2021. So what this goal to become a developer started off um, learning solidity on crypto zombies, then proceeded to learn um, basic website design on sca.com. I learned HTML, CSS, JavaScript, you know, went back to finish chapter six of like

crypto zombies because that last part of that zombies game needed a front end. So from then on, I was like, okay, cool, I know some basic development, or what else can we learn? Learn the React course. That was also a front end course. And then later, at the end of 2022, got a job as a developer, right? Solidity developer. Now, most of the time at this job, I was doing audits for token contracts. And like, I was terrible at front end still. I still think I hate front end. Like, it's just terrible, right? But anyway, cool. Yeah, the company, within two months of starting to work there, the company went south. Like, you know, it was during the bear market, so the company legit just went belly up before I even got paid, right? So yeah, that was difficult. But a few months before I got the job, back in August, I started seeing, like, yeah, October, November. I think I started seeing Pas off's tweets. I'll post a picture of his Twitter right here if you don't know who he is.

but one of the most famous Solidity auditors out there right now. And I started seeing his progress, and I thought, well, maybe it's time I dove into the security side of Solidity because that's where I felt I had the most potential. Yeah, the most potential. So, started doing, started competing. Codina was terrible, was terrible. Like, I tried to find low bugs, like low vulnerability, you know, low severity, those kind of bugs, gas optimization bugs. I was just terrible at that. So, okay, I took a break, took a course. Shout out to Johnny Time. I'll post this Twitter here and a link to his course as well 'cause that really helped me out. Took his course. I paid for it using money from an Arbitrum airdrop, so basically free for me. Took his course, learned, relearned the security side of it 'cause I knew some basic vulnerabilities, but I didn't know how to properly look for them and how to properly spot them and how to properly write the report. So, took that course.

around July is when I finished it, and then I participated in some audits in September. I participated in the delegate audit, thought I found the bug, but when the results came out, I came to realize the bug I found was already listed in the, what do you call, the automated findings, so it was invalid anyway. So yeah, uh, that was tough. So Zero from that audit from after I did the course. Then November, uh, they kelp down. I'll post a picture of that as well. Kelp Dow on Code Arena. That audit went really well. I found, found like, I could see, I could see that with my focus, like just spending a few days solely focused on auditing. It was absolutely fantastic. Like I believed I had found, uh, two highs and a medium and a few lows, but only got validated. Only one of my lows were validated, and I realized one of the highs I found, um, I didn't write the report properly. So because it didn't explain it properly, it got invalidated. So from kelp out, I only got about $2, I think. Yeah, that was my

wor only about $2 or so. That was November, right? That was November, December. There were about two audits, but I couldn't really put all my focus into them because I was like, I had family over and that, and I was also babysitting. My mom had went to a different country, so December, like, it was difficult to focus on audits in the beginning. Um, but then January, January and February, after I came back from the holidays, I did the curves audit on COD Arena, the standard on um Cod Hawks, and then also AI Arena on code, on code Arena. Yeah, AI Arena on curves. I think I found one high, but it was duplicated by almost everyone, so only got like 50 cents or something like that, like very low, less than a dollar. But at least I found a high that Al, what was important to me, at least I found a validated high. Um, then moved on to the standard for code, code Hawks. I submitted about four mediums and about two, three lows. Um, at the end, only one of the lows got validated, but I think I did

pretty good in that audit. Um, because it was my first audit from coming back from the holiday, so I was still a bit rusty then. AI Arena, AI Arena, I totally killed it. I submitted um two highs and about four mediums. Um, I got validated for about two mediums, so that one was about 76 cents, as that was highly duplicated as well. I think for that contest, we had about 2,000 submissions, so yeah, there was... I knew I wasn't going to get rich off that audit, right? But since then, I haven't been able to properly participate in any audits, like probably just like a lot of y'all. Y'all probably um, y'all probably don't have a lot of time as well 'cause this is just the side thing you're doing. So like, you know, it's very difficult to make time for audits when you have a job or you're doing school and all of that, so it is what it is. Now I have some time, just finished off with some tests, so I'm going to be looking to

Participate in the current ongoing chakra audit, and then I have some holidays coming up as well, so I plan to participate in about two to three more audits over the next month. They should be good. I'm going to be getting back into auditing a lot more, going to try posting a lot more as well, showing my progress. Um, yeah, let me know, how did you get into auditing, and where are you now?

How I became a smart contract auditor

Tumelo_Crypto

저는 2021년에 암호화폐를 알게 되었고 돈을 벌었지만, 개발을 처음부터 배우기 시작한 것은 2022년부터였습니다.

솔리디티, 웹 디자인, 리액트를 배웠고, 결국 솔리디티 개발자로 취직하여 토큰 계약 감사를 맡게 되었습니다.

하지만 불행히도 회사는 두 달 만에 파산했고 저는 급여를 받지 못했습니다.

이 연사는 유명한 솔리디티 감사관으로부터 영감을 받아 보안 감사로 전환하기로 결심했습니다.

처음에는 어려움을 겪었지만, 취약점을 다시 배우고 제대로 식별하는 데 도움이 되는 과정을 수강했습니다.

첫 번째 감사 참여는 어려웠지만 이후 감사에서 발견한 결과를 검증하는 데 약간의 어려움을 겪었지만 결국 성공을 거두었습니다.

발표자는 12월에는 가족과의 약속과 육아로 인해 감사에 집중하기 어려웠습니다.

1월과 2월에는 COD 아레나 및 코드 호크스 감사를 몇 차례 완료하여 중간 정도의 성과를 거두었지만 큰 수익을 얻지는 못했습니다.

이들은 일과 학업의 균형을 맞추면서 감사에 시간을 내기가 어려웠지만 이제는 더 적극적으로 참여하려고 합니다.

이 발표자는 앞으로 한 달 동안 두세 차례 더 차크라 감사에 참여할 계획입니다.

더 자주 감사에 참여하고 싶고 게시물을 통해 진행 상황을 공유하고자 합니다.

발표자는 상대방의 감사 여정과 현재 상황에 대해 배우고 싶다는 관심을 표명합니다.