Methodology
Our team of experienced auditors, researchers, and engineers will thoroughly review your project to identify code vulnerabilities and weaknesses that could compromise its security or functionality.
Before the audit starts, the Chain+ team will request access to the repository and the definition of the commit hash to be used during the audit. The audit begins with a joint meeting, during which the client walks us through the codebase and provides all available documentation, including the test suite. We recommend that tests provide code coverage above 90%. A joint communication channel is established between both teams, and the meeting dates are set.
The Chain+ team will develop a deep understanding of the protocol's intended use cases and internal mechanics. This insight will be leveraged to identify potential issues, exploits, and attack vectors. The code will be matched against the technical specification. The client's team and our auditors will have many meetings to discuss the audit progress.
When the review phase is complete, the client will receive an initial document listing issues and points of attention. The client will evaluate the list of findings while our team works on the audit report, which also evaluates the documentation provided by the client and the quality of the test suite. Once the initial audit report is ready, it is shipped to the client.
The client evaluates the report and performs the fixes in the code, and may request more information and meetings with the Chain+ team. When the client finishes, we recheck the code. This process is repeated until both teams reach a final decision — the client comments on every issue, and those comments become part of the audit report. The final report is then sent to the client for final approval.
Reports
At Chain+, we generate comprehensive reports (audit, security, code reviews). A high-quality audit report provides an independent, third-party review of the contract's code and identifies vulnerabilities, weaknesses, and areas for improvement, helping ensure the contract performs as intended and does not expose users to unnecessary risks.
Smart contracts often handle financial transactions or sensitive data, so any vulnerability could result in significant financial losses or data breaches. An audit report identifies and addresses these issues before they become major problems.
In decentralized applications trust is critical. A comprehensive audit report following best auditing practices increases users' and stakeholders' confidence in the project and its underlying technology.
Our process also identifies areas of improvement in the contract's design and code, helping ensure it is scalable, maintainable, and efficient, and reducing the risk of future vulnerabilities.
Executive Summary
A high-level summary of the audit
Assumptions
The assumptions for the audit (when needed)
Summary of Issues
A table summarizing the identified issues
System Overview
A description of the protocol and its core functionalities
Risk Rating Methodology
The strategy used to rank the issues identified
List of Issues
An in-depth description of the issues found during the audit
Documentation Evaluation
Assessment of the documentation provided for the audit
Client's Test Suite Output
Execution and assessment of the test suite provided by the client
Analysis from Automated Tools
Findings detected by automated testing tools
Tell us about your project and get a scope and quote within 48 hours.