Need Help Managing Your Smart Contract Audit?
Get expert guidance on preparing for and managing a smart contract audit.
Complete Guide
Quick Answer
A smart contract audit follows 6 phases: Specification Review (Days 1-2 — check code against spec), Architecture Review (Days 2-4 — high-level scan, trust boundaries), Line-by-Line Code Review (Days 3-14 — manual audit for reentrancy, access control, oracle manipulation, flash loan attacks), Automated Tool Analysis (Days 3-7 — Slither, Mythril, Echidna catch 40-60% of vulnerabilities), Report Writing (Days 12-16 — severity classification: Critical, High, Medium, Low, Informational), and Remediation and Re-Audit (Weeks 4-6). A well-prepared 2,000-line DeFi protocol typically receives: 0-2 Critical, 2-5 High, 5-10 Medium, 10-20 Low, 20-50 Informational.
Phase 1: Specification Review (Day 1–2)
Before reading code: the auditor reviews the specification document to understand what the contract is supposed to do. This establishes the audit's baseline — the auditor is not just checking 'does this compile' but 'does this do what it claims.'
Auditors actively look for: gaps in the specification (functions without defined behavior), ambiguous invariants, and economic assumptions that are not validated in the spec.
Phase 2: Architecture Review (Day 2–4)
High-level scan of the codebase:
How many contracts?
What are the trust boundaries (which contracts call which)?
What external dependencies exist (oracles, tokens, bridges)?
What access control model is used?
Are there upgradeable proxies? What is the upgrade mechanism?
Common early findings: Missing access control, insufficient separation of concerns, dangerous external call patterns.
Phase 3: Line-by-Line Code Review (Day 3–14)
The manual audit. The auditor reads every line with specific attack classes in mind:
Reentrancy: Every external call — is state updated before or after?
Integer overflow/underflow: Every arithmetic operation — is it bounded?
Access control: Every function — who can call it, and what can they do?
Oracle manipulation: Every price or rate read — can it be manipulated?
Flash loan attacks: Every multi-step operation — can it be exploited atomically?
Logic errors: Every business logic — does it do what the spec requires?
Gas griefing: Every loop or external call — can it be made to run out of gas?
Phase 4: Automated Tool Analysis (Day 3–7, parallel with Phase 3)
# Slither — static analysis
slither . --print function-summary
slither . --detect reentrancy-eth,reentrancy-no-eth,controlled-delegatecall
# Mythril — symbolic execution
myth analyze src/LendingPool.sol --max-depth 10 --execution-timeout 300
# Echidna — fuzz testing
echidna-test . --contract LendingPool --config echidna.config.yamlAutomated tools catch approximately 40–60% of common vulnerability patterns. The remaining 50–60% require manual analysis.
Phase 5: Report Writing (Day 12–16)
Finding severity levels:
Critical: Direct fund loss, complete protocol compromise (fix before any mainnet deployment)
High: Large fund loss under specific conditions (fix before mainnet, re-audit required)
Medium: Limited fund loss or significant functionality break (fix strongly recommended)
Low: Minor issue with minimal impact (fix before launch)
Informational: Best practice, gas optimization, code clarity (optional to fix)
For each finding: Title, severity, description, proof-of-concept (exploit scenario or test), recommended fix.
Phase 6: Remediation and Re-Audit (Week 4–6)
Development team implements fixes for all Critical and High findings. Auditor re-reviews only the fixed findings to confirm:
The fix addresses the reported vulnerability
The fix does not introduce new vulnerabilities
The change is consistent with the original specification