Real Example: In April 2022, the Rari Capital lending platform was attacked due to an error in the code. The attacker requested a loan of 150,000,000 USDC, then repeated the loan request until they successfully stole $80 million.
Integer Overflow and Underflow
Hackers introduce values outside the integer range defined by the smart contract. When this happens, attackers can increase the number of tokens or accounts and withdraw large amounts of funds.
Real Example: In March 2023, the Poolz Finance smart contract was attacked by hackers who increased the number of tokens beyond the maximum limit, allowing them to withdraw excess tokens to their personal wallets. This attack resulted in a loss of at least $390,000.
Access Control Vulnerabilities
Users can access or modify smart contract data without permission. This can affect the token minting process, withdrawals, or ownership transfer.
Denial of Service
Exploiting various contract functions to exhaust important resources such as gas, storage, or CPU cycles.
External Call Vulnerabilities
Occurs when a contract makes an external call without validation, especially to untrusted random addresses. Attackers can execute code without permission, steal assets, or damage contract functions.
Real Example: In February 2023, the self-swapping function on the Dexible DEX was exploited by hackers who made calls to malicious ERC-20 contracts and stole $2 million worth of tokens.
Oracle Manipulation
Oracle connects smart contracts with off-chain data in the real world. Oracle can be manipulated through spoofing, ramping, wash trading, or other methods.
Real Example: In February 2023, the lending and stablecoin platform BonqDAO experienced an oracle price manipulation attack. BonqDAO’s price updates are instantaneous, allowing hackers to use these high prices to take out loans. Then, they lowered the price again and liquidated other users' collateral. This attack resulted in a loss of $120 million.
Flashloan
This attack takes advantage of uncollateralized loans to manipulate the market or exploit weaknesses in smart contracts within a transaction block.
Real Example: The Beanstalk stablecoin was attacked in April 2022 because hackers managed to control 79% of the votes on the governance protocol after taking out flash loans and donating them to the protocol contract to earn significant voting power. After winning the majority of votes, the hackers were able to approve two malicious proposals that were used to steal $181 million in funds.
Understanding Smart Contract Audits
What is a Smart Contract Audit?
A smart contract audit is the process of thoroughly analyzing a contract's code to identify and repair security vulnerabilities and coding errors or inefficiencies.
Why is a Smart Contract Audit Important?
Smart contract audits are crucial in preventing exploitation by hackers. Without an audit, there may be weaknesses in the smart contract that hackers could exploit to steal funds from an exchange, manipulate token functions in a project, or mint tokens arbitrarily.
The Smart Contract Audit Process
Here is a simplified process of a smart contract audit..
- Documentation: Collect all relevant documentation, such as whitepapers, codebases, and other materials related to the smart contract.
- Testing: Auditors run automated tests with various tools.
- Code review: After automated testing, auditors still analyze the code manually.
- Fixing problems: If any issues are found in the smart contract, auditors work with the project team to repair them.
- Audit report: Auditors compile a report of their findings and the audit process for the project team to use as a reference.
Smart Contract Audit Tools
- Slither: Static Analysis Tool for Solidity & Vyper
- Pros:
- 92 built-in detectors and custom detectors.
- Generates an inheritance graph for all contracts.
- Call graph to visualize interactions and calls between a contract's functions.
- Fast execution.
- Cons:
- Limited to Solidity and Vyper smart contracts.
- Many false positives are identified as issues.
- Mythril: Security Analysis for EVM Bytecode
- Pros:
- Supports various EVM-compatible blockchains.
- Cons:
- Uncustomizable.
- Manticore: Ethereum Smart Contract Analysis and Testing
- Pros:
- Can analyze various types of software..
- Free to use.
- Cons:
- Requires significant memory.
- Performance may be slow.
- SuMo: Mutation Testing Tool for Solidity Smart Contract
- Pros:
- Various mutation operator options.
- Supports all projects using Truffle, Hardhat, Brownie, and Foundry.
- Cons:
- Mutation testing is time-consuming.
- Solidity-Coverage: Code Coverage Tool for Ethereum Smart Contract
- Pros:
- Test coverage tracking is simpler and automatically provides comprehensive reporting.
- Comprehensive configuration options for more customized testing.
- Cons:
- Can only be used for Solidity smart contracts.
Trusted Smart Contract Audit Services
- CertiK: Formal Verification and Real-time Monitoring
- Monitoring dashboard to find runtime issues after deployment.
- Transparent audit reports and severity scores.
- AI-powered analysis tools.
- Hashlock: Integrating Security and Education
- Comprehensive remediation guidance in every report.
- Developer workshops and follow-up sessions.
- Specialization in EVM blockchain.
- Trail of Bits: Contributes to Security Research
- Formal verification with custom tools.
- Static and dynamic analysis supported by the latest research.
- Has published security research that has influenced protocol improvements in various blockchains.
- OpenZeppelin: Solidity Smart Contract Language Developer
- Comprehensive audit reports with clear risk categorization.
- Integration with MythX for in-depth static analysis.
- Formal training and developer support to strengthen future versions.
- QuillAudit: Multi-Layer Audits
- Automated vulnerability detection, manual code review, and external red teaming.
- Provides gas optimization services, business logic reviews, and post-deployment monitoring.
- Actively contributes to Web3 security standards.
Tips to Choose a Trusted Smart Contract Service
How can you tell if a project has been audited by a trusted party? Consider the following factors when choosing an auditing company.
- Experience: Skilled and experienced auditors have detailed and in-depth knowledge of blockchain technology and smart contracts.
- Reputation: Research the audit company's reputation through reviews, client testimonials, and recommendations from project teams.
- Customized Services: Choose an audit company with comprehensive audit services that are customizable to your needs.
- Transparency: The company must provide a clear explanation of the price of its services.
- Proven Track Record: The success of an audit company can be judged by the services it has provided in the past. Choose a company with a comprehensive portfolio.
FAQ
How long does a smart contract audit take?
The time required depends on the size and complexity of the smart contract coding. Generally, a team can complete the audit process in a few days.
How often should a smart contract be audited?
Smart contracts cannot be changed after deployment, so a smart contract audit only needs to be conducted once before launch. However, a project or blockchain must be audited regularly.
Should I avoid unaudited projects?
Yes, it is best to avoid unaudited token or exchange projects to avoid compromising your assets due to smart contract exploitation.
Conclusion
Smart contracts are the foundation of all blockchain activities, so audits are a crucial factor that cannot be ignored. Before investing in a token project or using an exchange, remember to research whether the project has undergone thorough auditing.
Smart contracts are closely linked to blockchain. What is a blockchain? Learn all about blockchain in the article What is Blockchain and How Does It Work? A Complete Guide for Beginners.
