Smart Contract Audit Services

1
A Developers guide to Smart Contract Security
Audits
Cyphershield.tech
2

• Smart contract audits enable developers to
  provide a thorough analysis of smart contract
  sets. The main goal of a smart contract audit is
  to detect and eliminate vulnerabilities.
• A good smart contract audit examines and comments
  on a projects smart contract code, presented to
  the projects developers.
• One key aspect to remember when writing smart
  contracts is to keep it simple, as added
  complexity increases the likelihood of errors
• Simplicity in smart contract design is effective
  in instances where the smart contract system
  performs a limited set of functions for a
  predefined period of time.
• The security audit of a contract has to start
  from the development stage, adding new, thorough
  tests when new attack vectors are discovered
• There are pitfalls that have to be considered
  when programming smart contracts on the Ethereum
  blockchain, such as how timestamps can be
  imprecise, with miners influencing the execution
  time of a transaction.

3

• Getting started
• First, well audit a smart contract for
  bulk-uploading NFTs. A key component of auditing
  smart contracts is the process of investigating
  aspects of the code to find bugs,
  vulnerabilities, and risks before deployment to
  the Ethereum mainnet.
• A smart contract audit is not a 100 percent
  guarantee that the contract wont exhibit bugs or
  vulnerabilities.
• It does, however, guarantee that the smart
  contract is secure and has been reviewed by an
  expert.
• Structure of a smart contract audit
• A smart contract audit report is expected to
  contain a variety of items, listed below,
  including details about identified
  vulnerabilities, a disclaimer, and suggested
  remediations.

4

• Disclaimer This section is important for stating
  that the audit is not a legally binding document
  and provides no guarantee
• Overview of the audit A brief look at the
  contract and the best practices that have been
  observed in its creation
• Attacks carried out on the contract Outlines the
  attacks that have been carried out on the
  contract, ensuring its security
• Critical-level vulnerabilities Outline critical
  vulnerabilities found in the contract, such as a
  bug that allows attackers to steal currency
• Medium-level vulnerabilities Vulnerabilities
  that could damage the contract but with a
  limitation
• Low-level vulnerabilities Issues that dont
  affect the contract
• Inspecting the code line by line Analysis of the
  lines of code with potential improvements

5
Disclaimer Smart contracts are deployed and
executed on the Ethereum blockchain. An audit
cannot explicitly guarantee that the smart
contract will forever be secure, since changes on
the Ethereum platform could create new attack
vectors that affect the smart contract. This
document is not meant to serve as a warranty
about the safety or utility of the code contained
in this smart contract and is designed for
discussion purposes. Overview The project
contains only one file, NftUpload.sol, composed
of 114 lines of code written in
Solidity. Relevant functions and state variables
are commented on based on the natspec
documentation.
6

• What is a sandwich attack?
• A sandwich attack is a front-running technique
  and common attack vector on decentralized
  exchanges running the automated market maker
  mechanism.
• The goal of this attack is to manipulate the
  price of an asset as a result of buying and
  selling.
• Sandwich attacks are possible because all
  blockchain transactions can be openly observed in
  the mempool
• Once the attack bot notices a pending transaction
  of a victim exchanging asset X for asset Y, the
  victim is front-run by buying asset Y.
• Conclusion
• Smart contract audits are especially necessary
  for DApps. A project having a smart contract
  isnt an indication of value, but it is of great
  importance.
• I encourage developers to continue learning and
  improving knowledge of latest updates when it
  comes to contract security and best practices