Hi, I’m Blockchain Developer & Auditor in Solidity currently working as a freelancer on Upwork. I will review smart contracts, blockchain infrastructure code, and decentralized applications for security vulnerabilities using a combination of manual code review and analysis with our tool suite. I work directly with the leading blockchain industry teams to review their code and help secure their products. I will Design and implement solutions to difficult engineering and research problems of your contracts. I will also Collaborate with my teammates to maintain and continually improve your existing blockchain smart contract.
Our Methodology: We like to work with a transparent process and make our reviews a collaborative effort. The goals of our security audits are to improve the quality of systems we review and aim for sufficient remediation to help protect users. The following is the methodology we use in our security audit process.
- Manual Code Review: In manually reviewing all of the code, we look for any potential issues with code logic, error handling, protocol and header parsing, cryptographic errors, and random number generators. We also watch for areas where more defensive programming could reduce the risk of future mistakes and speed up future audits. Although our primary focus is on the in-scope code, we examine dependency code and behavior when it is relevant to a particular line of investigation.
- Vulnerability Analysis: Our audit techniques included manual code analysis, user interface interaction, and whitebox penetration testing. We look at the project's web site to get a high-level understanding of what functionality the software under review provides. We then meet with the developers to gain an appreciation of their vision of the software. We install and use the relevant software, exploring the user interactions and roles. While we do this, we brainstorm threat models and attack surfaces. We read design documentation, review other audit results, search for similar projects, examine source code dependencies, skim open issue tickets, and generally investigate details other than the implementation.
- Documenting Results: We follow a conservative, transparent process for analyzing potential security vulnerabilities and seeing them through successful remediation. Whenever a potential issue is discovered, we immediately create an Issue entry for it in this document, even though we have not yet verified the feasibility and impact of the issue.
- Suggested Solutions: We search for immediate mitigations that live deployments can take, and finally we suggest the requirements for remediation engineering for future releases.