1.3 Methodology
To standardize the evaluation, we define the following terminology based on OWASP Risk Rating Methodology []:
Likelihood represents how likely a particular vulnerability is to be uncovered and exploited in the wild;
Impact measures the technical loss and business damage of a successful attack;
Severity demonstrates the overall criticality of the risk.
Likelihood and impact are categorized into three ratings: H, M and L, i.e., high, medium and low respectively. Severity is determined by likelihood and impact and can be classified into four categories accordingly, i.e., Critical, High, Medium, Low shown in Table 1.2.
To evaluate the risk, we go through a list of check items and each would be labeled with a severity category. For one check item, if our tool or analysis does not identify any issue, the contract is considered safe regarding the check item. For any discovered issue, we might further deploy contracts on our private testnet and run tests to confirm the findings. If necessary, we would additionally build a PoC to demonstrate the possibility of exploitation. The concrete list of check items is shown in Table 1.3.
In particular, we perform the audit according to the following procedure:
Basic Coding Bugs: We first statically analyze given smart contracts with our proprietary static code analyzer for known coding bugs, and then manually verify (reject or confirm) all the issues found by our tool.
Semantic Consistency Checks: We then manually check the logic of implemented smart con- tracts and compare with the description in the white paper.
Advanced DeFi Scrutiny: We further review business logics, examine system operations, and place DeFi-related aspects under scrutiny to uncover possible pitfalls and/or bugs.
Additional Recommendations: We also provide additional suggestions regarding the coding and development of smart contracts from the perspective of proven programming practices.
To better describe each issue we identified, we categorize the findings with Common Weakness Enumeration (CWE-699) [], which is a community-developed list of software weakness types to better delineate and organize weaknesses around concepts frequently encountered in software devel- opment. Though some categories used in CWE-699 may not be relevant in smart contracts, we use the CWE categories in Table 1.4 to classify our findings.
Last updated
