Solana and Ethereum smart contract audits, explained

Smart contract audits involve scrutinizing the code of crypto projects — highlighting security vulnerabilities.

Smart contracts are a crucial cog of the crypto ecosystem — and they’ve unlocked a plethora of use cases for blockchain technology.

But for developers who are furiously writing code, safety needs to be a number one priority. Smart contract exploits can put user funds at risk, and we’ve all seen headlines of high-profile hacks where eye-watering sums of money were lost.

An audit allows an independent organization to kick the tires of a smart contract, and detect vulnerabilities before they’re spotted by malicious actors. This can help crypto projects to achieve credibility, all while giving users peace of mind. Audits are typically done before smart contracts are deployed, as they can be difficult to fix once uploaded to a network.

Smart contracts are commonly found on blockchains including Ethereum and Solana.

The best security firms will put code through stress tests to see how they perform in a range of scenarios.

Experts say it’s important for a project to provide a complete and clear technical specification — and ideally, offer documentation of the deployment process.

These audits aren’t just about uncovering issues that black hat hackers could take advantage of, but flaws that could stop an Ethereum smart contract from working correctly.

The attack vectors being scrutinized can get rather technical — but they include replay attacks, where valid data transmissions are repeatedly made by malicious actors in order to execute fraudulent activities. Others include reentrancy attacks, reordering attacks and short address attacks.

Once an investigation has been completed, crypto projects receive a detailed report of the vulnerabilities within their code — alongside recommendations on how to mitigate their impact, or eliminate them altogether.

As a result, the resources saved through an effective audit can far outweigh the cost… and it can avoid reputational damage, too.

Smart contract audits will vary slightly depending on the blockchain code is based on.

Common security vulnerabilities on Solana can include missed ownership checks, meaning attackers can use fake configurations to bypass access controls.

And while smart contracts can call functions from external smart contracts, validation failures could mean black hat hackers get an opportunity to supply malicious inputs that affect how the code operates.

Top auditing firms will access a Solana smart contract based on documentation quality, security, architecture quality and code quality. Vulnerabilities are assigned a severity level too, meaning business-critical issues can be tackled first.

Audits are vital for ironing out any kinks in a crypto project, and ensuring code is ready to be used by the masses.

Hackers were responsible for stealing $1.3 billion in 78 incidents across the first quarter of 2022 alone, and two-thirds of these attacks were on the Ethereum and Solana blockchains.

But what causes certain projects to be targeted… and how could a smart contract audit have helped them?

Well, common reasons include crypto projects prioritizing speed — and failing to factor in time for a comprehensive audit from a dependable provider.

They may also rely on their own in-house teams to perform security checks. And although this looks financially sensible, there’s a danger that internal staff may not be up to date on the latest hacking techniques used by malicious actors.

Inevitably, some will also believe that they are too good to fail. But complacency is enemy number one in the crypto space, and even the finest projects can fall victim to a hack.

As you might expect, this depends on how complex a smart contract is.

According to Hacken, this can extend to $500,000 for larger projects where there are more lines of code — not least because of the additional engineering hours it’ll take.

The company argues these costs pale into comparison with the economic damage that a smart contract vulnerability can bring.

Hacken cites data showing that, in 2021, 80% of the incidents affecting decentralized applications related to smart contracts — with losses hitting $6.9 billion.

Breaking this down even further, and we can see that the average cost per project stands at $47 million. Somehow, $500,000 looks a lot less expensive now.

Overall, 60% of its clients have been based on Ethereum so far in 2022.

And here’s the difference it can make — after an audit, at least one critical bug was uncovered in 80% of projects. But Hacken says just 75% have fully acted on an audit report in the past — with the remainder ignoring the conclusions, or only taking a small number of recommendations into account. As a result, they had a lower security score.

It’s a process that takes several weeks — depending on how quickly a crypto project works.

Hacken says initial audits typically take 2 to 14 days depending on a smart contract’s complexity and size… and if it’s urgent, these investigations can be expedited. Again, for larger protocols, it might take longer — 30 days in some cases.

At this point, a project will be given recommendations on what needs to be fixed — and how quickly these changes are made will depend on them. Auditors like Hacken then offer a remediation check to ensure all of the vulnerabilities have been patched over to a high standard.

Blockchain technology is becoming a bigger part of all our lives — and auditors like Hacken are ensuring that crypto projects put their best foot forward.

Improving the quality of smart contracts helps reduce those unpleasant headlines about major hacks in the press, and boosts the reputation of crypto projects in the public’s eyes.

Once an investigation has taken place, Hacken offers labels to ensure verified projects can declare they’re audited by Hacken on an official website.

Reports are also attached to a crypto project’s official presence on major websites such as CoinMarketCap and CoinGecko.

The most common types of contracts that the company interacts with include token, token sale, exchange, ERC-721, swap farming, staking, ERC-20, BEP-20 and reward pool.

Already a member of the Enterprise Ethereum Alliance and Solana Foundation, Hacken has its sights set on winning a 20% share of the Web3 cybersecurity market by 2024.