hello guys, it's Johnny time, and welcome to another smart contract auditing tutorial. Today, you're going to learn about one of the most useful tools for smart contract auditors. You can look at it like an all-in-one tool, all in one place for you as an auditor, with so many useful features that will help you to organize, automate, and optimize your auditing process. Features such as integrated AI with GPT and pre-made prompts, features such as writing reports right after you do the audit and assembling a report automatically, automated scanning, graphs, and so much more. Features that will come out in the future. So, I love this tool, and I got in touch with the team behind it, and we decided to make this video to show you what this tool is about and how you can use it to optimize your auditing process. Also, I was able to get for you from the team a special gift for the Johnny time Community, which I will reveal by the end of this video. So, make sure to stick till the end in order to get this gift. So,

let's get [Music] started. So, the tool is Audit Wizard. This is an amazing all-in-one web tree security platform. And if you are not familiar with this tool, rest assured that after this video, you're going to want so much to go and start using it because you will be amazed by the tool, the UX, and the UI, and the easiness of how you can use this tool and how it's going to help you with the auditing process. And we're going to cover all the tricks and tips of how to use this tool so you can go head out to Audit Wizard. You can also use my special link in the description to claim the gift, so make sure to watch till the end and use the link in the description below. But before you do that, I want to walk you through the tool and show you how I use it and what kind of features it has. So, you can click here, Try Audit Wizard, and it will automatically redirect you to the login page. As you can see, we have

different login methods including Google, including with Metamask wallet login with Ethereum or any other wallet that you have, or traditional sign-up with username and password. I'm going to use my Google account to log in, and once you're logged in, you got to your own all-in-one place for smart contract auditing. So, you can use this page in order to import a repository from GitHub. You can also add your private GitHub API access key in order to import a private repository if you have a smart contract solo audit or you work in a team. H or alternatively, you can pick a contest and bu bounties. So, as you can see, they already scraped all the active contests from Codina, Sherlock, and Heads Finance. So, you can just click here, and just by clicking, automatically, it's going to load all the code of the project for you. And you have some kind of online IDE with all the code. The design is amazing, the UX is amazing, it's so smooth, and you can see that automatically without even going to Cod Arena, without even going to the contest.

you have everything here. All the code is already imported for you. You even have the readme, the markdown file formatted for you so you can read the contest. You can go right and check the contracts now. Alternatively, you can also paste a repository URL if you want to go the old-fashioned way, like I like to do. So, this is the Beloved USSD contest that if you follow my channel, you already know. So, I can just click here, and it's going to import from the repository, and it's also going to import and install all the dependencies. So, you don't need to deal with dependency installation and with setups. Everything is already ready for you to start your auditing process. So, this is a very efficient and time-saving feature that is going to reduce so much time for you in the auditing process. And this is just the beginning. So, currently, Solidity and EVM are the only technologies that are supported by the platform. So, if you're going to audit Kyo smart contracts or RAS smart contracts, it's not supported at the moment. But the team told me that they're

going to add this support later on, so if you want to audit Solidity smart contracts and EVM-based projects, this is the right tool for you. Now, another super cool feature that they have that I didn't see anywhere else is that you can import contracts directly from Etherscan, obviously only if the contract is verified. So here you can see an example of the Uniswap Universal Router contract. I can just copy the address, and this is one of the most amazing features. You're going to go back here, and you paste here the contract address, and it's going to import from Etherscan with all the dependencies and everything right into the platform. So if you love bug bounty hunting and you're going to find bugs in Mayet or other blockchain deployed smart contracts, this is an awesome tool for you to import directly the code from the blockchain explorer websites. This is pretty incredible. As you can see, it imported all the contracts, all the dependencies, all the interfaces, all the libraries, everything is imported just by providing the contract address. Now you

can always return to your projects, and let's pick the USSD one, for instance. So, this is what you're going to see when you import and start a new project. Now, I'm going to head over to the contracts folder, and let's just pick the USSD do Soul smart contract so I can start an audit smart, the smart contract, start reading it. But before I do so, I want to utilize all the automation tools that this tool has built in. The first one I want to utilize is the graph tool. So, the graph tool is going to generate for us a graph that will help us get the scope of the contract. So, if you're familiar with Siara Sora or like the V solidity visual developer, this is very similar. We have it built in here in the platform, and you can see that right by looking at the graph. I can have so much more context about the smart contract and get a high-level overview, which will help me audit it and get an idea about the different functions, about external calls, about where it receives and sends, if, and so on.

another cool feature to get a highlight overview about the contract is as okay so you can see here everything about a contract like the tree and all the solidity versions all the directive and it's another cool like line of code and a lot of like tools that will help you to assess the work to get a highlight overview like this a and graph tools now one of the coolest features in my opinion is the AI integration so you can use AI they already built in GPT into the produ products and the first thing that is about AI is that you know many Auditors use it to report vulnerabilities and they try to use GPD to find vulnerabilities and report them directly to contest and stuff and this is very not professional because most of this going to be um false positives but the cool thing about AI here is that it's not going to find vulnerabilities for you but it's going to reduce the time for you understanding the code base so it's going to be much easier and faster for you to understand the code.

basee, so as you can see here, you have the analyze code feature. So, analyze code is going to save you so much time by just giving you some kind of summary about the smart contract that you're going to work on. So, as you can see here, we have a summary about the USSD contract, which very nicely describes what the contract does. The Solidity code defines a contract for a stable coin named USSD. The contract uses Open Zeppelin upgradable contracts for ERC20 tokens and access control. So, you don't even need to read the code; you already know what kind of business and what kind of contract you have to deal with. You have upgradability, you have ERC20 tokens, access control, and it actually goes in-depth to the explanation of what the contract does and even shows you some potential security flaws that the contract might have. Now, I won't say that every security flaw, security fled, it fund is not a false positive. Probably most of them, like GP usually does, they are not legit; it's false positives. But it gives you some kind of idea about

what the contract is about, and you can manually verify and see these security flaws, and it might give you ideas of other ways to exploit and find vulnerabilities in the contract. Now, another cool feature is the chat with AI. Now, it's so much better than using GPT because you have it already inside a tool, and also the AI already sends the prompt, they send the context of the contract to GPT-3, so you don't need to send it yourself. It basically optimizes AI for auditing, so I can just ask him questions about a code, such as which functions change the state of the contract, and then it's going to list all the functions that are going to change the state of the contract because he already has the context of the smart contract, and he knows that we are doing a smart contract audit because the tool already fed GPT with the context. Also, this is super useful because you can just use it to create some kind of summary for your audit report. So here, I asked the

tool based on the smart contract. Create a paragraph about USSD and what it is or what it does. Here I have some kind of paragraph which I can use, including the final report we will get in a second to the reporting features that we have here, which are more than incredible. But I want to show you all the features of the AI first because these are mind-blowing features that are going to save so much time and effort for you. Now you can use the AI to ask questions about a code or just general questions about Solidity, about memory storage, U Chain Link, whatever you want. He has the context, but you can ask him anything. So you can ask something like, What kind of vulnerabilities are added to the code potentially while using Chain Link oracles? For instance, Chain Link oracles. And there you go, you're going to just... You have an assistant right there, and it's going to give you some kind of ideas about Oracle manipulation or some kind of vulnerabilities that are related to Chain Link or whatever the contract is.

about you have your AI assistant here on the tool toolbar on the side, which is incredible. Now, another super useful tool is the scan features. So, currently, they support only slitter, but they're going to add myth and pyrometer later on. Slitter is a static analyzer. If you don't know what it is, please check out the other video where I have a complete tutorial about slitter. So, they integrated slitter into the platform, so in just one click away, you can just click scan here, and like magic, you're going to have so many vulnerabilities that slitter found. Now, we know that slitter has a lot of false positives, but you can filter down and get more context about the contract. Maybe some of them are not false positives and are legit, and you can just add them to your audit report. Now, we know that slitter has a lot of false positives, and here we have some kind of medium vulnerability that def found unused return, and it shows us the line of code here. So, we can jump into the line of codes, and we see that

we use Uniswap, but we call the exact input function, and we actually don't use the return value, so we ignore the return value. Now, this is not really a vulnerability, but it can give us some more context about the contract, about what vulnerabilities might happen, because sometimes when we ignore the return value, it might be catastrophic for the contract, and a lot of unintended behavior can happen. Now, here, for instance, H slitter found something more interesting for us automatically. So, as you can see here, between lines 170 to 173, we have divide before multiply, and we know that Sol rounds down the number, and if we divide before multiply, we might lose some numbers or round down numbers, and it might affect the accounting of the smart contract. So, let's say you found a vulnerability, and you know when we use a Solidity visual developer, we usually add audit comments. Now, here we don't have to do it. We can just right-click on the line and click here, add note, right? We can add notes along our code. For example, here H

division before mully before multiplication whatever and here is the location so we can just highlight the code to popular this field so we just click and as you can see it automatically got the lines of code for us and we can write the description with divide before we multiply and we might round down and mess up with accounting I don't know whatever report it is so you're just going to edit this note and then you can use on this note and convert them into reports now you can see that the note is saved in your notes you can click here the notes to get to your notes and here you also have a bookmark in the line of code and you have the note in much more nice and organized way than using the audit comment so it's really up to your preference but this one is very classic and very pretty and very organized so I really like the way they implemented the noting system so now let's say that you audited the code you wrote your note you wrote your not and it's time to write

your findings and add them and assemble a final report for the client or for the context. So, let's say you find a vulnerability. You can click here, add finding, and automatically it's going to open for you the add finding toolbar. Now, this is a valid finding from the contest. As you can see from the USSD contest, they're using Uniswap without specifying a deadline for the swap, and this is very bad. We're not going to get into in-depth why it's bad. You can check out the other USSD deep dive video that I've had on my channel, but this is a valid finding. So, as you can see, it's automatically going to fill in the line of code, and here you can write the title like in every other platform. So, you can write not using deadline while not specifying deadline while using Uniswap V3 swap. Okay, so this could be like the title, right? The severity in that case is high. I wouldn't say critical, but high. And here you can write the description.

and this is something super cool because I told you that I use AI to write my description, and here you have it built-in, so you can use rewrite with AI if you want to improve, maybe fix your English, or improve it, or write it in a more professional way. This is a very awesome built-in tool that can help you to write your report. For example, I can write here, um, while swapping tokens with Uniswap V3, the deadline parameter is commented out, which basically sends a transaction without the deadline, and it could lead to H losing money. Y y y. Now I don't have time to write the whole description, obviously. If it's a real contest, I will write it in a more uh described way. So I'm going to click here rewrite with AI, and let's see what happens. Let's see how the AI magic helps me to optimize my description. Now you can see that it's already much better. So if you had like typos or stuff, it's probably going to fix it for you, and it already looked much more

professional during the token swapping process with Unisoft V2. We have identified that the deadline parameter is currently commented out. This essentially results in transactions being sent without a specific deadline. This could potentially lead to financial loss. We recommend addressing this issue promptly to ensure security and efficiency of the transactions. So you can see that the prompt is already very well optimized by the team, and it really made a good job describing the vulnerability and the recommendation. Um, remove the comment from the deadline line of code and allow the user to specify his deadline in the function parameters. Okay, you can also use again Rewise with AI to rewrite your recommendation, and again, the prompt is already ready for you to basically create the best report that you can make. Please proceed to eliminate the comment from the deadline line of code. Additionally, modify the function parameters to enable the user to define their own deadline. So you can work with this prompt, you can work with this AI solution, and once you're done, you can click here, add finding, and every finding

that you add will be added automatically to your final report, which is super, super cool. Now, let's add another finding. This is another vulnerability regarding using Unis swap. So, here we use amount out minimum zero. So, I'm going to add here another Finding, and as you can see again, it's automatically added the line of code. Let's click here, add finding. Now, it's going to fill in the previous finding for me, but it already updated the line of code over here. So, not specifying slipage while swapping tokens with Unis Swap. This is another vulnerability using Unis swap router without specifying slip Edge protection, yada, yada, yada. Then, let the user Supply as a function parameter param the mean amount out to have slipage protection. Okay, then you can use the rewrite again, the rewrite with AI to improve the finding, but this is not important for right now. I just want to show you how the report looks like, so I'm just going to add the finding s is now. Let's say you wrote

this finding, and you maybe want to find his finding somewhere else in the code base, so you can use even here command shift F on Mac or in Windows control shift F. And they already have this, like, it really feels like an IDE with on steroids, like IDE for Auditors with all these amazing features. And you can use this search bar to search things through your old code, like deadline right or file names. Let's say you want to go to the tests, right? So you have a USD simulator.test.js. So you can use this command shift F to find things around the whole project. Now let's say you completed the audit, and now you want to assemble a report. So you just go here to the report tab, and you can fill in your names and save them and all the data, and it will save it automatically. So my name is Johnny time, client name USD, the date is automatically being filled today here. You can write an overview about the USD audit, audit that was performed by Johnny Ginger security, yada y y, and here you can add

some metadata about the audit, like the audit type, solidity, EVM, yeah, it's EVM timeline, I don't know, one week, or you can specify the dates, everything about the audit, all the information, the communication quality, let's say medium, test quality, low, commit hash, you can paste the commit hash, right? So, all the relevant information about the report, and it's going to automatically add your findings to the reports. Now, once you have all the information set up, you can click here, generate report, and the magic will start. Now, another cool thing is that you can even add your personal logo. So, if you're an auditing firm, or like you have a solo auditing company, you can add your own logo as a brand to the audit report. And let's click once again, generate report, and let's see what we get. So, this is the report that we see over here. Let's open it and see how it looks like. It's a .doc file with your logo, with your name, with the summary, everything, all the executive summary, description, and your summary finding. So, all your findings are

automatically added to the report with all the categories: critical, high, medium, low, informational, and gas optimization. And if you scroll even more down, you have all your finding details and finding deep dive. So, this is pretty amazing, and this is one of the best all-in-one tools for smart contract auditing. It's like an online IDE on steroids, with AI, with notes, with report generation. This is just crazy. Now, the cool thing about this tool is that it's completely free, guys. It's free. It's in beta, actually, Alpha Testing mode. So, you can check out the link in the description to sign up and basically try it out. It's going to be paid. There is going to be a pro version in the future. They're going to add so many features, as you can see here, like AI report writing, fuzzing, POC, advanced scanning with mreal, and more tools. Right now, these features are work in progress, but once they're out, they're going to be in the pro version. Now, the cool thing is that if you use my link in the

description: This is my gift for the community from the Audit Wizard team. You're going to get a free trial for the pro features, so make sure to use the link to sign up to Audit Wizard using my link in the description below. So, once those features are out, you're going to get first free trial access for them. And also, in addition, they have the Discord community, but we made a deal that everyone that joins the Discord community through this specific link, this specific video, will be added automatically to a VIP channel with the developers of the tool. So, if you are one of my viewers, one of my smart contract auditing students, and you want to explore the tool and you have some feature suggestions, bug reports, you have a direct line to the developers and to the team behind this tool. So, you can request your own features, provide your feedback, and provide feedback about bugs or features. So, definitely check out the link in the description below to get both the potential trial once the pro comes out and the direct channel with the developers. Now, if you are not sure

about some of these features. They also have amazing comprehensive docs, so you can read about every single feature and about upcoming features and FAQ. So definitely check out the doc if you have any open questions before you ask questions in the Discord Community or on Twitter. Now that's it for today. I hope you liked this video, and if you liked it and tried out the tool, please leave a comment in the comment section below. If you enjoyed this video, obviously smash the like button and subscribe to the channel for more awesome smart contract auditing content, and I will see you in the next one. Bye-bye.

The Ultimate Smart Contract Auditor Tool - AuditWizard Complete Tutorial

The Ultimate Smart Contract Auditor Tool - AuditWizard Complete Tutorial

스크립트