mirror of
https://github.com/lux-apps/papers.git
synced 2026-11-02 11:39:52 +00:00
zeekay
abf99d05fc
Restructured from flat .tex/.pdf files into per-paper subdirectories. Added Antje Worring as co-author on all papers. Synced PDFs to pdfs/ for download site.
31 lines
1.6 KiB
TeX
31 lines
1.6 KiB
TeX
\section{Phase 5: Manual Review}
|
|
|
|
|
|
Automated tools catch \emph{known} vulnerability patterns. Manual review catches:
|
|
|
|
\begin{itemize}[nosep]
|
|
\item \textbf{Business logic errors}: The code does what it says, but what it says is
|
|
wrong. Example: a fee calculation that charges 0.3\% on the output instead of the
|
|
input, giving arbitrageurs a profitable loop.
|
|
\item \textbf{Economic attacks}: Flash loan attacks, oracle manipulation, sandwich
|
|
attacks. These exploit \emph{interactions between contracts} that automated tools
|
|
analyze in isolation.
|
|
\item \textbf{Governance attacks}: Vote buying, proposal frontrunning, timelock bypass.
|
|
\item \textbf{Upgrade risks}: Proxy storage collisions, initialization order dependencies.
|
|
\end{itemize}
|
|
|
|
\subsection{Manual Review Checklist}
|
|
|
|
\begin{enumerate}[nosep]
|
|
\item Read every line of code. Not skim---read.
|
|
\item For each external call: can the callee re-enter? What state is inconsistent at the call point?
|
|
\item For each \texttt{msg.sender} check: can it be bypassed via delegatecall or proxy?
|
|
\item For each arithmetic operation: what happens at the extremes (0, 1, type(uint256).max)?
|
|
\item For each oracle read: what if the oracle returns stale data? Zero? Negative?
|
|
\item For each token interaction: does it handle fee-on-transfer tokens? Rebasing tokens?
|
|
\item For each access control: is it consistent across all functions? Can admin keys be rotated?
|
|
\item For each storage write: is the order correct? Can it be frontrun?
|
|
\end{enumerate}
|
|
|
|
%% ============================================================
|