mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
f4ee7a0525
Bylines, paper authorship, correspondence addresses and the founder blurb under each post named an individual. They name the organisation that published the work instead: the brand on posts and pages, the research byline on papers, and research@ in place of a personal address. Both are what these repositories already used elsewhere — nothing new was coined. Co-authors are untouched. Where a paper named someone else alongside, they stay named; only the one byline changed. Bibliography entries, running heads, PDF metadata and affiliations move with it, so a citation still resolves to whoever the cited paper names. Sample and fixture data uses the placeholder name these tests already use elsewhere, so no assertion changed meaning.
81 lines
2.5 KiB
TeX
81 lines
2.5 KiB
TeX
\documentclass[11pt,a4paper]{article}
|
|
\usepackage{../shared/luxcover}
|
|
\usepackage[utf8]{inputenc}
|
|
\usepackage[T1]{fontenc}
|
|
\usepackage{amsmath,amssymb,amsfonts,amsthm}
|
|
\usepackage{graphicx}
|
|
\usepackage{hyperref}
|
|
\usepackage{booktabs}
|
|
\usepackage{listings}
|
|
\input{../shared/lstlang}
|
|
\usepackage{xcolor}
|
|
\usepackage{enumitem}
|
|
\usepackage{float}
|
|
\usepackage{multirow}
|
|
|
|
\newtheorem{theorem}{Theorem}
|
|
\newtheorem{definition}{Definition}
|
|
\newtheorem{remark}{Remark}
|
|
|
|
\lstset{
|
|
basicstyle=\small\ttfamily,
|
|
keywordstyle=\color{blue}\bfseries,
|
|
commentstyle=\color{gray},
|
|
stringstyle=\color{red},
|
|
breaklines=true,
|
|
frame=single,
|
|
numbers=left,
|
|
numberstyle=\tiny\color{gray}
|
|
}
|
|
|
|
\hypersetup{
|
|
colorlinks=true,
|
|
linkcolor=blue,
|
|
citecolor=blue,
|
|
urlcolor=blue
|
|
}
|
|
|
|
\title{Systematic Smart Contract Auditing:\\Methods and Tools}
|
|
\author{
|
|
Lux Research \\
|
|
Lux Industries, Inc.\thanks{Corresponding author: [email protected]}\\
|
|
\texttt{[email protected]}
|
|
}
|
|
\date{2025}
|
|
|
|
\begin{document}
|
|
|
|
\luxcoverpage
|
|
|
|
\begin{abstract}
|
|
A smart contract audit is a systematic search for vulnerabilities in code that controls
|
|
money. This paper presents a complete audit methodology: static analysis with Slither,
|
|
fuzz testing with Foundry, pattern detection with Aderyn, symbolic execution with Halmos,
|
|
and manual review. We describe the methodology applied to Lux Network's 50 contract
|
|
domains (AMM, bridge, vault, staking, governance, oracle, token, NFT, lending, and 41
|
|
more), comprising 832 tests and 122 findings across five severity levels. For each
|
|
vulnerability class---reentrancy, flash loan attacks, oracle manipulation, access control
|
|
bypass, integer overflow, frontrunning, and others---we provide the detection method,
|
|
a Solidity example, the fix, and the tool that catches it. This is a practitioner's manual:
|
|
every technique described here is used in production on every Lux Network smart contract
|
|
deployment.
|
|
\end{abstract}
|
|
|
|
\tableofcontents
|
|
\newpage
|
|
|
|
%% ============================================================
|
|
|
|
\input{sections/01-the-audit-process}
|
|
\input{sections/02-phase-1-static-analysis-with-slither}
|
|
\input{sections/03-phase-2-pattern-detection-with-aderyn}
|
|
\input{sections/04-phase-3-fuzz-testing-with-foundry}
|
|
\input{sections/05-phase-4-symbolic-execution-with-halmos}
|
|
\input{sections/06-phase-5-manual-review}
|
|
\input{sections/07-vulnerability-taxonomy}
|
|
\input{sections/08-test-coverage}
|
|
\input{sections/09-ci-integration}
|
|
\input{sections/99-conclusion}
|
|
|
|
\end{document}
|