Common vulnerabilities of smart contracts
Over the years, the most damaging cyber-attacks in blockchain all targeted the security holes of smart contracts, leading to $6.45 billion losses. And funny enough, there are website that constantly updated this so you can learn about these hacks, how they did it and how much money is gone, such as DefiLlama or Rekt Leaderboard
After all, smart contracts are programmed by humans. And after all the hours of work, mistakes are inevitable. When they run daily, certain loopholes might appear that developers and security experts might not even have thought of before.
Here are some of the common threats that smart contracts are exposed to:
Reentrancy
For this type of attack, the hacker exploits the fallback function to input harmful code into your smart contracts. Once they notice a vulnerable contract account, the malicious code is triggered, and they gain repetitive access to the contracts and steal assets.
The DAO hack is the most well-known case of this attack. Therefore, when auditing smart contracts, you should focus on the fallback, withdrawal, and other functions like sending calls and transferring money.
Timestamp dependence
Watch out for this exposure if you use a block timestamp to execute your smart contracts. An experienced hacker can alter the block timestamp to impede the smooth operations of your smart contracts, disrupt its automation, slow down transaction time and obtain a favorable outcome.
Cross-function race conditions
This typical issue will happen if multiple functions have the same state and solution. For example, when the balance has not yet been set to 0, someone can make an external transfer call and steal the tokens.
Overflow and underflow
Smart contract programming languages are also vulnerable to underflow attacks, which occur when the value of a unit-type variable exceeds its maximum by one. In some cases, it returns to zero, and vice versa. Attackers who take advantage of this bug make transfers until the balance is down to 0, resulting in many credits. But don’t worry; it can be detected early in users’ funds through smart contract audits.
Gas limit and loops
Each block limits the amount of gas used for a transaction. If the gas amount exceeds that limit, the transaction fails. On Ethereum, this tendency happens frequently, over 90%, and causes significant financial losses.
Unchecked external calls
This error occurs when the smart contract’s external calls to other contracts fail or do not receive a response. If not addressed promptly, this issue can cause future disruptions in the logic and performance of smart contracts.
The problem can be solved by carefully considering potential failure scenarios during the audit and cautiously using the “call” function in contract design. It is also critical to avoid relying on potentially fraudulent external contracts.
Front-running
This attack requires an exploit in the transaction sequence on a blockchain, which hackers use to modify the record. The problem is particularly common in DeFi applications and can be avoided by implementing transaction ordering algorithms, commit-reveal systems, and other tools for detecting and blocking front-running attempts.
Denial of service (DoS)
Smart contracts, like other types of software, may be vulnerable to DoS attacks, which subject them to an overload of inquiries and require resource-intensive processing activities.
Fallback function
Fallback functions are a set of nameless external functions that lack input and output parameters. They are utilized when no other function fits the function call, making fallback functions without validation a common target for exploits. To address this vulnerability, equip the smart contract with adequate validation logic and restrict access to unneeded functionalities.
What is a smart contracts audit
Smart contracts audit is a thorough examination of the protocol and code to uncover security vulnerabilities, low-quality code, and impose solutions that prevent hostile actors from exploiting a smart contract.
Smart contract codes will be implemented on a blockchain platform such as BNB, Ethereum or Avalanche. Once the contracts are live, making new adjustments is challenging or even impossible. And since anyone can access the code and protocol, imagine what they would do when they spot an error or backdoor on your smart contracts.
Because of this, smart contract audit is vital. Any vulnerabilities must be addressed before launching or upgrading a decentralized program. You need to review the code, logic, architecture, and security measures both manually and automatically.
The best time for smart contracts audit is before launching. But even during execution, you should regularly check for it upon malicious activities and after major updates.
Benefits of smart contracts audit
Apart from getting rid of security’s vulnerable, there are numerous beneficial facts that you don’t have to worry about.
- By increasing the security and integrity of the smart contract, the risk of hostile attacks is decreased, and users’ assets and information are secured. Avoiding security breaches and platform failures is critical for maintaining user trust and ensuring the project’s long-term survival.
- Committing to security and transparency can help build trust between investors and customers, which can, in turn, lead to increased project adoption and engagement and a stronger market reputation.
- Smart contracts auditing can help you stay away from economic crisis and ruining reputation. It will all that out by proving a discovery and remediation of flaws and vulnerabilities.
- It can ensure compliance with legal and regulatory norms where they are applied since, in some fields, the regulations are the top focus of the market.
- Smart contract audits can reveal areas for contract efficiency and functionality improvement, not just discovering vulnerabilities and faults. Developers can use these findings to optimize the smart contract, providing a better user experience and increasing value for all parties involved.
How to audit smart contracts
A step-by-step description and checklist of what to do before, during and after smart contract audit process.
Step 1: Gather documentations
The audited project must initiate a code freeze and give auditors technical documents, such as the codebase, whitepaper, architecture, and other relevant materials. The documentation should give auditors a high-level overview of the code’s goals, scope, and implementation details.
Here’s what to prepare:
- Detailed functional requirements with a road map help auditors understand your specific objectives. They must be articulate, concise, and devoid of ambiguity.
- Clear technical description for your project covering your tech stack, what you have used, instructions for deployment and test-running.
- A breakdown of your development environment
- Security measurement that you use for your smart contracts, standard regulatory from blockchain and your industry.
Step 2: Automation testing
Automated testing, also known as a formal verification engine, examines every potential state of a smart contract and warns of problems that could jeopardize its functioning and security. Auditors may also perform integration tests, unit tests on specific functions, and penetration tests to look for security flaws.
Step 3: Manual review
While automation helps you test in large batches in a shorter time, manual testing involves:
- A deep dive into a specific case.
- Finding underlying vulnerabilities.
- Double-checking the automated tests.
Human engineers are better at detecting issues with contract logic or architecture, poor coding practices that are technically correct but fail automated tests, gas optimization opportunities, and weak points for common attacks such as frontrunning.
Step 4: Classification of contract errors
There are 2 criteria to identify the severity and risk of your code quality and security measures. By doing this, you will know which error to fix first, prioritize, and keep an eye on for the future.
1. Code Vulnerabilities
- Informational: are a notable subset of code defect categories that, while not posing immediate dangers, should be considered for better contract security standards.
- Low: Low-severity code bugs can cause small difficulties or non-essential hazards to the security of smart contracts.
- Medium: Medium code defects can have a financial impact on a business, and individual user data is also a worry. It may also lead to legal action against the developers who are accountable for them.
- High: High-security weaknesses might put many users at risk, resulting in major legal and financial consequences.
2. Code Exploitation for Security Measure
- Low level: Vulnerabilities that can be easily exploited using public tools or automated methods, caused mainly by weak coding. This makes it easier for hackers to access and manipulate systems without being detected.
- Medium level: A thorough understanding of complex systems and blockchain security is required to find these vulnerabilities.
- High level: For this level, you will need inside access to the system, diving deep into the core code. If the hacker can get through your protected gate and gain this access, your system will be jeopardized.
A little bonus!
To accurately classify your smart contract weaknesses and examine if they pass all the security check, here are some guides that is used by experts:
– EEA EthTrust Security Levels (updated Dec 2023): Created by Ethereum, this guide is made for Solidity and EVM-based smart contracts.
– Smart Contract Security Verification Standard (updated 2024): A free checklist for all types of smart contracts in development, deployment, auditing and execution.
– Smart Contract Security Field Guide: A personal project from an industry expert that gives you a deep look into security and hacking.
Step 5: The initial report
Summarizing all the possible flaws and bugs in one place will give you comprehensive feedback on your firm’s codes and the quickest way to solve them. It’s up to you to work with a freelance auditor or an expert team in this step. You can deploy the smart contracts right after decoding all the defections found in the project.
Step 6: Audit report
The auditor compiles all findings into a detailed final report, with all issues indicated as fixed or outstanding. This report is distributed to the project team and is frequently made public to ensure complete transparency for protocol users and other stakeholders.
All detected vulnerabilities are grouped by severity, from Critical to Informational. They should be supported by remedial recommendations from smart contract security specialists.
Vulnerabilities addressed before deployment are marked as resolved. Issues acknowledged but not resolved are accompanied by a discussion of their potential consequences and the project team’s explanation.
Method used for smart contracts audit
For security checking and smart contracts audit, there are 2 ways you can do it: use automated tools or check by hand. Let’s compare them:
| Automated audit | Manual audit | |
|---|---|---|
| What you do | With bug detection programs, you can scan large amounts of data swiftly, accurately and identify key weaknesses faster while saving you time and money on hours of searching manually. | You go through all the steps and check for common vulnerabilities traditionally. This method can see through the complex architecture and contract logics that automated methods usually ignore. |
| Pros | Automated testing is faster and less expensive than manual testing. A variety of analytical instruments from free, paid to open-source. | Human expertise is more nuanced, they can predict probable code vulnerabilities in niche use case better than a machine. Humans can provide a more informed judgment of the code’s quality based on its goals rather than artificial manmade. |
| Cons | Automated smart contract audit can only scan common errors. Most of them are narrowly scoped to detect specific vulnerabilities, requiring testers to use several tools. | It entirely depends on the auditor’s experience. This method also takes more time. |
Each method has its pros and cons. The best way to ensure a comprehensive and accurate smart contracts audit is to leverage both.
At auditing companies like Synodus, we usually begin with using automated analysis to get a full view of your contract state. This overview will help us plan the next steps and know which part to prioritize. Afterward follows a phase of manual auditing to deep dive into each function, code and contract logic.
Besides, smart contracts audit isn’t all about fixing vulnerability errors. The process often has additional gas optimization to make smart contracts less expensive to execute. Especially when your contracts scale, it can be pricier. By reducing the gas consumption and code size, your smart contracts have longer life cycle and high performance.
Tools used for smart contracts audit
Here’re some of our top selected tools for automating smart contract audit:
- Slither: Python-based static and dynamic analysis software for examining Solidity and Vyper code.
- Echidna: A Haskell application used for fuzzing and property-based testing of Ethereum smart contracts. Echidna was created with modularity in mind, allowing it to be quickly expanded to accommodate new mutations or test certain contracts in specific scenarios. Top 15 Smart Contract Platforms: Layer-1, Layer-2, Open-source
- Securify: Ethereum and ChainSecurity developed this tool in 2017. It detects many smart contract vulnerabilities at varying risk levels, examines the EVM bytecode, and identifies semantic facts about the smart contract to combine patterns and uncover faults.
- Dilligence: A graybox fuzzer for smart contracts. It addresses the concerns of random program mutation and other greybox fuzzing issues by introducing an innovative mechanism for anticipating new outputs indicative of smart contract vulnerabilities.
- Mutation testing tools such as SuMo or Certora.
How much does a smart contract audit cost?
Normally, you will have to pay between $5,000 and $15,000 for smart contract auditing services, which surely depends on the complexity of the code.
Why is the smart contract audit cost so high?
- There will be a detailed report about the probable vulnerability.
- They are not just looking at the current codes but also examining the security trends so they can predict ways to prevent them in the future.
- You will get a recommendation report for remedies to adopt.
- If you opt for service from an audit company, they will also offer to fix those vulnerabilities, adding more cost to the initial price.
One way to cut auditing costs is to outsource to low-cost regions. A well-known cybersecurity company can indicate a high hourly rate for its services, but the quality is unsure.
Most of the time, another partner from India, Vietnam, China, or Mexico can offer a much reasonable price with the same or better quality. For example, we have worked with many clients in building and auditing smart contracts for around $20 per hour.
Types of smart contracts auditor and how to find them
Smart contracts audit companies
You can choose between:
- A company specializing in cybersecurity or blockchain security: While they excel in checking and fixing vulnerabilities, they might fall short in optimizing and upgrading your smart contracts. They are best if you are looking for a detailed report and recommendations on auditing.
- A company with blockchain expertise: Much like Synodus, these vendors offer various services related to blockchain products and smart contracts. Because of that, we are competent in security checks, bug fixing, development and optimization. We are best suited if you are looking for A to Z services.
Where to find: Through Google Search or trusted listing sites such as Clutch, G2 and more.
Your auditing team shouldn’t have only security and blockchain experts but also a legal consultant to check the enforcement and execution.
And Synodus has all of them! Our smart contracts auditing services cover all aspects, from checking vulnerabilities using automated and manual methods to finalizing the report and fixing them if you need a helping hand.
Freelancing auditors
Working with freelancer requires less budget than having an in-house team or an entire vendor. However, they are best if your audit is straightforward without complex requirements, scope and codebase or you only need a helping hand on a specialized part.
Freelancer might not be a good choice for lengthy projects. In such cases, a full-functioning team can shorten your project and save resources.
Where to find: Fiverr, Upwork or LinkedIn.
Competitive audits
This is a fun way to audit your smart contracts. By having a competition, you can get more auditors to view the codes and find more bugs in a quicker time. However, make sure you have an in-house executive to manage the game and the audit is not too urgent.
Fews facts and myths of smart contracts audit
Truth: Audits are necessary for both users and project owners
Conducting a project audit always benefits more than one party. For a project owner, it’s a clear indication that their venture takes user security seriously and has no aim of defrauding individuals. On the other hand, users can learn about the project and the potential hazards before investing in or using the dApp.
Myth: Audits ensure safety
Unfortunately, even the most advanced security audits and testing cannot always guarantee a solid defense against attacks since some of them rely on third-party protocols.
Similarly, developers must always decide whether to accept or reject auditor recommendations. If the company does not update the code, it will be vulnerable to an attack. Keep in mind that there is usually no way to defend yourself from a rug pull.
Truth: Conducting an audit is crucial
Any project that has not been audited, regardless of user testimonies, cannot be trusted. Developers must take their tasks seriously and strive to provide the finest service possible.
Myth: A single audit is adequate
Every change to the code may have an impact on all processes within the protocol. This is why even minor adjustments necessitate a new audit. Just because a project was inspected at launch does not guarantee that it will remain secure following an update.
Wrapping up
Smart contract security audits have established industry standards, and they play a significant role in the realm of blockchain and smart contracts. Audits are a vital component of development for any business, whether it’s a DeFi software or a cryptocurrency game. Ignoring them can be a huge mistake.
