Back to Security

Smart Contract Auditing Guide

Learn the methodology, tools, and best practices for auditing smart contracts. Whether you're a developer reviewing your own code or an aspiring auditor.

The Audit Process

1

Scoping

1-2 days

Define audit scope, review documentation, understand business logic

Review specs and docs
Identify critical functions
Set up development environment
Define testing scope
2

Manual Review

3-7 days

Line-by-line code review looking for vulnerabilities and logic errors

Review access controls
Check state management
Analyze external calls
Verify math operations
3

Automated Analysis

1-2 days

Run static analysis tools and fuzzers to find common issues

Run Slither/Mythril
Execute fuzz tests
Check gas optimization
Verify test coverage
4

Reporting

2-3 days

Document findings, assign severity, provide recommendations

Write detailed findings
Create PoC exploits
Suggest remediations
Executive summary

Severity Classification

Critical

Direct loss of funds or complete contract compromise

Examples:
Reentrancy allowing fund drain
Unprotected admin functions
Oracle manipulation

High

Significant impact on contract functionality or user funds

Examples:
Integer overflow
Incorrect access control
Front-running vulnerabilities

Medium

Limited impact, requires specific conditions to exploit

Examples:
DoS conditions
Griefing attacks
Suboptimal implementations

Low

Minor issues, best practices, or informational findings

Examples:
Gas optimizations
Code clarity
Missing events

Security Checklist

Access Control

  • All admin functions have proper access modifiers
  • Role-based access control is properly implemented
  • Ownership transfer is two-step
  • Critical functions have timelock or multisig

State Management

  • State changes follow Checks-Effects-Interactions
  • ReentrancyGuard on external call functions
  • No unexpected state mutations
  • Proper initialization of storage variables

External Calls

  • Return values are checked
  • Low-level calls handle failures
  • No unbounded loops with external calls
  • Delegate calls are safe

Math & Logic

  • SafeMath or Solidity 0.8+ for arithmetic
  • Division before multiplication avoided
  • Proper decimal handling
  • Edge cases handled (zero values, max values)

Manual Review Techniques

Line-by-Line Review

Read every line of code, understanding what it does and why.

  • • Start with entry points
  • • Follow data flow
  • • Question every assumption

Threat Modeling

Think like an attacker. What would you try to exploit?

  • • Identify trust boundaries
  • • Map attack surfaces
  • • Consider edge cases

Pattern Matching

Look for known vulnerable patterns in the code.

  • • External calls before state changes
  • • Unchecked return values
  • • Missing access controls

Audit Report Structure

Report Template

1. Executive Summary

High-level overview of the audit, key findings, and overall security assessment.

2. Scope & Methodology

What was audited, commit hash, tools used, and testing approach.

3. Findings

Detailed vulnerabilities with severity, description, impact, and remediation.

[CRITICAL] Reentrancy in withdraw()
Description: The withdraw function updates state after external call...
Impact: Attacker can drain all funds from the contract.
Recommendation: Use Checks-Effects-Interactions pattern...

4. Recommendations

General security improvements and best practices suggestions.

5. Appendix

Tool outputs, test results, and additional technical details.

Common Audit Mistakes

Don't

  • • Rely solely on automated tools
  • • Skip reading documentation and specs
  • • Ignore "low severity" findings
  • • Audit without understanding the business logic
  • • Rush through the review to meet deadlines
  • • Assume tested code is secure

Do

  • • Combine manual review with automated tools
  • • Understand the full context and use cases
  • • Test your findings with PoC exploits
  • • Review dependencies and external contracts
  • • Consider economic/game theory attacks
  • • Provide clear, actionable recommendations

Essential Tools

Ready to Audit Your Contract?

Use ChainLens to automatically scan for vulnerabilities before a manual audit.