mirror of
https://github.com/lux-apps/papers.git
synced 2026-10-30 18:15:21 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
55 lines
1.7 KiB
TeX
55 lines
1.7 KiB
TeX
\section{The Audit Process}
|
|
|
|
|
|
\subsection{Why Audit}
|
|
|
|
Smart contracts are immutable programs that custody funds. A bug in a smart contract
|
|
cannot be patched after deployment (without proxy patterns, which introduce their own
|
|
risks). The asymmetry is extreme: the attacker needs to find one bug; the defender must
|
|
eliminate all bugs.
|
|
|
|
\subsection{Five-Phase Methodology}
|
|
|
|
Our audit process has five sequential phases. Each phase catches different bug classes.
|
|
Skipping any phase leaves a gap.
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{@{}clll@{}}
|
|
\toprule
|
|
\textbf{Phase} & \textbf{Method} & \textbf{Tool} & \textbf{Catches} \\
|
|
\midrule
|
|
1 & Static analysis & Slither & Known patterns, code quality \\
|
|
2 & Pattern detection & Aderyn & Domain-specific anti-patterns \\
|
|
3 & Fuzz testing & Foundry & Implementation bugs, edge cases \\
|
|
4 & Symbolic execution & Halmos & Logic bugs, invariant violations \\
|
|
5 & Manual review & Human & Business logic, economic attacks \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{The five-phase audit methodology.}
|
|
\end{table}
|
|
|
|
\subsection{Severity Classification}
|
|
|
|
\begin{table}[H]
|
|
\centering
|
|
\small
|
|
\begin{tabular}{@{}llp{8cm}@{}}
|
|
\toprule
|
|
\textbf{Severity} & \textbf{Count} & \textbf{Criteria} \\
|
|
\midrule
|
|
Critical & 3 & Direct fund loss, exploitable without special conditions \\
|
|
High & 18 & Indirect fund loss, requires specific conditions \\
|
|
Medium & 37 & Protocol malfunction, no direct fund loss \\
|
|
Low & 41 & Code quality, gas optimization, best practices \\
|
|
Informational & 23 & Style, documentation, non-functional \\
|
|
\midrule
|
|
\textbf{Total} & \textbf{122} & \\
|
|
\bottomrule
|
|
\end{tabular}
|
|
\caption{Findings by severity across 50 contract domains.}
|
|
\end{table}
|
|
|
|
%% ============================================================
|