THE CYCLE
The thorough and Detailed Process
Specification Gathering
This is the most crucial stage because the detail is key for a successful smart contract Security audit. Here we will gather the specifications from you to know the intended behavior of smart contract. In this stage, we need a summary of the intended behavior of the smart contract from your side. We would also gather specification through forms.
Manual Review
Goals of manual review
Verify that every detail in the specification is implemented in smart contract.
Verify that the contract does not have any behavior that is not specified in specifications.
Verify that contract does not violate original intended behavior of specifications.
Here we would look for undefined, unexpected behavior and common security vulnerabilities like
Re-entrancy
Timestamp Dependence
Gas Limit and Loops
DoS with Block Gas Limit
Transaction-Ordering Dependence
Use of tx.origin
Exception disorder
Gasless send
Balance equality
Byte array
Transfer forwards all gas
ERC's Standard violation
Compiler version not fixed
Redundant fallback function
Send instead of transfer
Style guide violation
Unchecked external call
Unchecked math
Unsafe type inference
Implicit visibility level
The goal is to get to as many skilled eyes on contract code as possible
Manual Testing
Smart contract will be manually deployed on any of the test network using remix IDE. All the transaction hashes will be recorded.
Gas consumptions and behavior of functions also noted.
Functional Testing
The smart contract will be manually deployed in a sandbox environment like testnet/mainnet forks, hardhat, ganache, etc
Smart contract functions will be tested on multiple parameters and under multiple conditions to ensure that all paths of functions are functioning as intended.
In this phase, the intended behavior of the smart contract is verified.
In this phase, we would also ensure that smart contract functions are not consuming unnecessary gas.
Gas limits of functions will be verified in this stage.
Testing with Automated Tools
QuillShield
Slither
Mythril
Oyente
Manticore
Solgraph
Solidity Coverage
Testing with automated tools is important to catch those bugs that humans miss. Some of the tools we would use are
Initial Audit Report
At the end, we would provide you a comprehensive report along with details of audit and steps to cover up with the vulnerabilities if we found any in your contracts.
Final Audit Report
After initial audit fixes, process is repeated again and Final audit report is delivered.
Delivery
After getting a green light from the previous step, we send the report to our designers. With their skills, they make a PDF version of the Audit Report and beautifully showcase everything in it. Sample Audit Report:
The report then gets uploaded onto our official GitHub Repository. We then share with you the link to the Audit Report along with a Certificate of Compliance from QuillAudits.
Enhanced Post-Audit Support
Quill Red Teaming
In-Depth Security Evaluation: Our comprehensive red team and bug bounty services aim to evaluate your project's existing security measures. This includes an extra layer of scrutiny from our internal red team and independent security experts worldwide.
Continuous Monitoring
Proactive Incident Prevention: Our on-chain monitoring system keeps a watchful eye on your project, providing real-time alerts to preempt any potential incidents.
PR, AMAs, Marketing
Strategic Outreach: We go beyond the audit itself to help promote your project:
Social Media Announcements: We leverage our social media channels to announce the successful completion of the audit.
Interactive AMAs: Our expert auditors engage with your audience, explaining the audit report's intricacies and building trust in your project through direct interactions.
Niche PR Services: We offer targeted PR services, including articles and guest posts in well-known publications.
Cross-Platform Promotion: We boost your project's visibility through cross-platform promotions.
In addition to the above services, we provide:
Post-Audit Insurance Coverage: Secure your project further.
Access to QuillAudits Partner Ecosystem: Benefit from our network and receive support for any necessary integrations.
Promotion Through Our Academy Initiative: Tap into our educational initiative to promote your project.
Discounts on Future Audits: Enjoy cost savings on future audits.
Listing Support: Receive assistance with listing your project.
And Much More: Explore the multitude of support options we offer.
Choose QuillAudits for comprehensive post-audit support to strengthen and promote your project effectively.
