mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-02 11:39:52 +00:00
zeekay
4a753bb639
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
27 lines
1.4 KiB
TeX
27 lines
1.4 KiB
TeX
\section{Conclusion}
|
|
|
|
|
|
Smart contract auditing is not a single technique---it is a pipeline. Static analysis
|
|
catches known patterns. Fuzzing catches implementation edge cases. Symbolic execution
|
|
proves invariants. Manual review catches business logic errors. Each phase catches bugs
|
|
that the others miss.
|
|
|
|
Our methodology, applied to 50 contract domains with 832 tests, found 122 issues
|
|
including 3 critical vulnerabilities that would have resulted in direct fund loss.
|
|
All findings were fixed before deployment. The entire pipeline runs automatically on
|
|
every pull request, ensuring that new code does not introduce regressions.
|
|
|
|
The most important lesson: no tool replaces reading the code. Tools find \emph{known}
|
|
bug patterns efficiently. Humans find \emph{unknown} bug patterns---the ones that matter
|
|
most.
|
|
|
|
\begin{thebibliography}{99}
|
|
\bibitem{slither} Feist, J. et al. ``Slither: A Static Analysis Framework For Smart Contracts.'' WOOT, 2019.
|
|
\bibitem{foundry} Paradigm. ``Foundry: A Blazing Fast, Portable and Modular Toolkit for Ethereum Application Development.'' 2022.
|
|
\bibitem{halmos} Park, D. et al. ``Halmos: Symbolic Testing for EVM Smart Contracts.'' a16z Crypto, 2023.
|
|
\bibitem{aderyn} Cyfrin. ``Aderyn: Rust-Based Solidity AST Analyzer.'' 2024.
|
|
\bibitem{dasp} NCC Group. ``Decentralized Application Security Project (DASP) Top 10.'' 2018.
|
|
\bibitem{swc} SmartContractSecurity. ``SWC Registry: Smart Contract Weakness Classification.'' 2020.
|
|
\end{thebibliography}
|
|
|