Hacker News Reader

Comment by rfd4sgmk8u | Hacker News Reader

"auditing" means paying someone to run various open source solidity and EVM analysis tools and copy-pasting the results into a doc.

Auditing really doesn't mean much. A lot of audited platforms get hacked. A lot of unaudited platforms get hacked. Nobody is ever accountable.

View on HN

As someone paying a six figure invoice to have their project audited right now, it's really not that simple.

Do audited projects get hacked? Yes, absolutely. Is a clean audit report mean a project is bullet proof. Definitely not, especially if it's not from a top-tier firm. But an audit will definitely catch any of the common exploits that are easy to make, like this protocol doesn't check to make sure that the caller is not currently inside another transaction in the contract.

All in all, an unaudited protocol has at least an order of magnitude higher risk than one audited by a reputable firm. Ignoring audits altogether would be like refusing to lock your doors, because you heard about a house that still get robbed when the front door was locked.

There's the Swiss cheese theory of accidents. Each layer may have holes in it, but by having enough layers and aggressively trying to shrink the number and size of holes in each layer, you can get much more secure.

External audits by good teams are a good layer, but neither they, nor any other individual layer is a silver bullet. Good audits do provide a lot of value.

Can you explain how it is not more simple than running open source tooling and copy pasting the results? I am yet to see an 'audit report' that is more than just this. Its checkbox compliance. Are you paying six figures for this?

I agree that unaudited is worse. But what are you actually paying for with these clowns?

There are plenty of audit companies that do a in-depth review of the code, a review of the protocol itself, etc., and come up with questions trying to understand the various execution flows. This goes beyond what current tools can do, it acts as a second pair of eyes to read through and understand all of the smart contracts.

We've also paid for an audit from a leading company recently. You paying for a team of smart people to spend a couple weeks trying to break your system. It's not going to find everything, but everything that is found is a way that can't be attacked anymore.

I am friends with a top auditor. He is a genius. Two seconds of looking at a contract and he's found 10 holes.

Auditing isn't perfect, but it is better than not doing it at all.

There are some brilliant people out there. I have no doubt solidity experts can spot vulns by inspection. My point is that auditing is necessary but not sufficient.

Its a greater issue in security where audits and testing can lead one into a false sense of security, 'because it is audited'. The original post was saying all the hacked contracts were 'unaudited'. While this is true, I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling.

"I am arguing that in nearly every case, the audit would just be a copy paste of the same data the solidity developer would see when they ran the open source tooling."

That's not been my experience with good audits. Automated tooling only gets you so far. We use open source automated security tooling, unit tests, and and some formal proving, and audits have found things these didn't.

Would you be willing to share either reports or the name of the audit vendor that you trust?

Sure. Best auditor is https://openzeppelin.com/security-audits/. Second might be https://www.trailofbits.com.

Here's the audit that just finished:

https://github.com/OriginProtocol/security/blob/master/audit...

Thank you for sharing! I agree that OZ and ToB are the best in this space. They write the open source tooling, and I am sure they have some really good inhouse tools too.

Their findings are very valuable, could potentially have saved million of user AUM/TVL. Sincerely, Best of luck with Origin!

Good luck as well.

Agreed fully. Even with all the unit tests that I write, I still find logic bugs in my code. =) Software is hard!

This would have likely been caught in a standard audit. Flashloan attacks are incredibly well known and any auditor worth their salt will examine those scenarios

You are correct that flash loans are a part of the standard attack toolbox.

This was not a standard attack though. It was a genuinely new attack vector that's not been seen before. Flash loan was just one hammer in the attacks toolbox.

Remember anything a flashloan can do, a whale can do too.

Yeah, just like the thousand other times. These kinds of attacks rely on contract state and unbalance of tokens. They are quite difficult to detect statically.

Reply on news.ycombinator.com