Why care about smart contract security?
We changed the way we offer our spot-check service in August 2021 -- not out of the blue, but out of duty of care. We currently only offer our spot-check service as a complimentary and complementary service to a full manual security audit. Put succinctly, we want to emphasize that spot checks are only one layer of a comprehensive, multi-layered security strategy. We cannot stress enough the importance of integrating security at every stage of the smart contract development cycle.
Here’s an analogy: physical bugs are the same as software bugs. For example, if you have a pest infestation in your apartment, you would focus on all areas of your apartment, not only under the sink. If you only spray under your sink you run the risk of letting the pests take over your whole apartment. In the end, this will take up more of your time and cause an even bigger issue in the future.
Diligence’s multi-layered approach to security ensures that vulnerabilities are continuously eliminated at each stage of the development cycle. Like dealing with a pest infestation, taking a proactive approach and integrating security at every stage will prevent a bigger issue in the future. You don’t want to become the next protocol on the Rekt.news homepage that has been hacked for millions.
Continuous diligence by Consensys Diligence
In this article, we will outline why each of our five layers, our products and services, are collectively exhaustive, but not mutually exclusive. The timeline below illustrates when you typically want to start using each product and service in your overall smart contract security strategy. You can use each product and service continuously throughout your entire development cycle.
As a smart contract developer, you want to minimize risk and maximize productivity. Using these layers will minimize your risk of being hacked from the beginning of your smart contract development by identifying and solving issues as soon as they are detected. This will, in turn, maximize your productivity and the likelihood of not rewriting your smart contracts.
What:
MythX is an automated security analysis tool that performs static analysis, dynamic analysis, and symbolic execution. It finds known vulnerabilities and generates a detailed report with a summary of all the issues, including the source lines where they can be found.
When:
MythX is the first layer in your security strategy to find vulnerabilities in your smart contracts. It has the lowest barrier to entry as you can simply get started by creating a free account on the MythX website. It can be used continuously through your development cycle.
Why:
Using an automated, easily accessible tool like MythX will eliminate avoidable vulnerabilities, and maximize productivity by preventing smart contract rewrites at a later stage.
What:
A prerequisite for using Fuzzing, Scribble is a specification language for writing properties specific to your smart contract as well as a runtime verification tool to turn Scribble properties into concrete Solidity assertions.
Scribble allows other tools such as your existing test suite, fuzzers, and symbolic executors to automatically test the properties.
When:
Scribble is the second layer of your Diligence security strategy. This product finds vulnerabilities by inserting Solidity assertions to check your specification.
Why:
Scribble can detect bugs that your test suite doesn't have the Solidity assertions to detect. Using Scribble easily documents your code and enhances your test suite with extra checks.
What:
Diligence Fuzzing enables users to find bugs immediately after writing their first Scribble property.
Fuzzing uses the grey box fuzzing technique that automatically tests Scribble properties.
When:
Fuzzing is the third layer and ideally should be used continuously after you’ve written your Scribble properties.
Why:
Fuzzing brings a significant improvement to the security of your smart contracts. The Fuzzer minimizes risk, and checks that your smart contracts are doing what they should be doing through the execution of millions of intelligently selected inputs.
1-Day Spot Check
What:
Spot checks are 8 hours of a high-level review of your codebase. The goal is to find any overarching design inconsistencies. Our team of auditors makes recommendations on how to better integrate security into your overall system design patterns.
Spot checks are a very time-limited review that are intended to be a preliminary check before a full manual security audit.
When:
Spot checks should be the penultimate layer of your security strategy in preparation for a full manual security audit.
Why:
As mentioned earlier, spot checks are no longer offering this as a standalone service. Spot checks help to identify design inconsistencies in preparation for an audit and are complementary to MythX, Scribble, Fuzzing, and a full audit.
What:
An in-depth code review with our veteran smart contract security auditing team who will manually double-check your code to identify vulnerabilities.
When:
A full manual security audit is the final layer of your security strategy. A human auditing your code prevents potentially catastrophic vulnerabilities after launch.
Audits are most valuable when you’ve used other security tools in conjunction like MythX and Fuzzing to prepare for your audit.
Why:
Skipping an audit means you may end up on rekt.news.
More layers, more security
Unlike MythX, Scribble, and Fuzzing, a spot check is also a manual service performed by an auditor. However, we must emphasize that it is not a substitute for a full manual security audit.
Experience has taught us that disclaimers and warnings about insufficiently audited contracts are not enough to incentivize additional security layers. As we have outlined throughout this piece, smart contract security is a multi-layered strategy.
Simply put, the more you do the safer you are. Each service or product adds a layer of protection. The more layers you have in your security strategy the safer your smart contract will be after deployment.
Stay safe out there.
Want to discuss your multi layered security strategy? Consensys Diligence is here to help.